From 89ded5b79bb86ae39cf1e9ee7e3ea07ede541ea2 Mon Sep 17 00:00:00 2001 From: 5225225 <5225225@mailbox.org> Date: Thu, 26 Aug 2021 22:14:20 +0100 Subject: [PATCH] 2021: corctf: draft work on readme --- 2021/corctf/readme/README.md | 69 ++++++++++++++++++++++++++++++++++ 2021/corctf/readme/readme.tar | Bin 0 -> 71680 bytes 2 files changed, 69 insertions(+) create mode 100644 2021/corctf/readme/README.md create mode 100644 2021/corctf/readme/readme.tar diff --git a/2021/corctf/readme/README.md b/2021/corctf/readme/README.md new file mode 100644 index 0000000..bc264c0 --- /dev/null +++ b/2021/corctf/readme/README.md @@ -0,0 +1,69 @@ +# DRAFT : NOT FINISHED + +# readme + +by [5225225](https://www.5snb.club) + +web / 478 pts / 46 solves + +> My new site readme is the ultimate tool for readers everywhere. Remove +clutter from any site and also fetch the next chapters with the click of +a button. + +provided files: [readme.tar](readme.tar) (Original extension was incorrectly `.tar.xz`) + +## solution + +Here, you were given a website with some server-side code to process a URL +given to convert it to reader mode, using [mozilla's readability +library](https://github.com/mozilla/readability). I wasn't expecting +a vulnerability in there, but `readme` also had the feature that it would try +and go to things that looked like they were the next page. I won't paste the +full `index.js` from the tar file, but the relevant section is + +```js +/** + * Helper function to try and retrieve the next section of a site if it exists. + */ +const loadNextPage = async (dom, socket) => { + let targets = [ + ...Array.from(dom.window.document.querySelectorAll("a")), + ...Array.from(dom.window.document.querySelectorAll("button")) + ]; + targets = targets.filter(e => (e.textContent + e.className).toLowerCase().includes("next")); + + if(targets.length == 0) return; + let target = targets[targets.length - 1]; + + if(target.tagName === "A") { + let newDom = await refetch(socket, target.href); + return newDom; + } + else if(target.tagName === "BUTTON") { + dom.window.eval(target.getAttribute("onclick")); + return dom; + } + + return; +}; +``` + +This will look for `a` tags as well as `button`s. The ability to load a new +page is not all that interesting here, so I skipped looking at the handling for +`a` tags. The evaluation of `button`s is interesting, as it uses +[jsdom](https://github.com/jsdom/jsdom) to interpret the `onclick` of the given +page. + +You can't *directly* access properties exposed, but you can do a sandbox escape +using the global constructor given. + + + +```html +

Hello, World!

+ +``` diff --git a/2021/corctf/readme/readme.tar b/2021/corctf/readme/readme.tar new file mode 100644 index 0000000000000000000000000000000000000000..3a91f5288309ac0a93b6effb44144c4c651375d9 GIT binary patch literal 71680 zcmeFacfaaJvM4%#?@z(3H^1xcgINlI1RmS(5JV0lhkNdvQ9=?ZAqfeX>-p@jT0$TZ z7Od^@c{h0Zw+$#%cU4#F>gwuu>`%Y@9}a&so&OX1gum<0__fn_3eV;Kl*<3^J%a{z zj?3Ap)PF@&|0}lfjtL5EMph5lI_|pVQ|1tjm75oy7|GQ`k8_8B>!?dM;al>f* zDJpj@_t9@0&z*Gxdh|~?K~OmPrxgA#?#Eql|Ch_ZVT#g!>ZZ8UBh>O!)cak zNMF7TC%u%u5mh^tu~HakSzo@)`ong$IXwNU^w~wq;)D$+OYdvPG*a*3TZW~lR0CWp zP5bgCcUW8=yzQ|Hmnu`osSJ9%FG0Q!v3=r~Z)|N}R~?s;0V!)UT?ca6t zsA?LA*_S8YzW?i&@Wqwn3QGKOWY{yo)yqTD-m)dfi9dF_bb00)J3*G97EFu93Bok4Gs-lICbIc85hNM z(e()P@6hk>&UYQj_9Pqbqs#9CP{Wl*!L_dd@BEl*#z8n}Lgl`z=6BzJ4FRAo!}ISu zNBVl|!8^E1t}1-}&f4*sDtz}nJahdB^0B_68(%cZO|48@=Uiy$DzJ@be}g(*KutQp%b9t{D@)Dim#F0n5GT-$_hxoXfR$U4^F{ z=exh2;jdJK(*XA0f8tH?@XJpMu*NSxX{xaS>S;fJ=eP%$PAZb*ewR{gY4!7WfBDC` zjbFd}0Bs@JU>8cxh z+UHa^bua;N3MH< zZk@=UAWa<4kR`u@L+^2#DyCd%@BaA>aV&Z}`ipfCT|!;rY~X!Of^MC`eMNmpzKD8u zdh)mQ&MoDRY(LQXu`R zGJsOS#RR1gY0#Z&Fk)Q5e45FLJ-EgK1Vp1BPCRl;tJ9nJNEHDt z-JyH*T9Wn%EucTTd3xy{T=Y~#r8H6vik-rK`FkoIpmBQfOtl2A=+$2nSFZTvMdmv- zA7{D?Sb+me^;NR%>(0Ylj;TrSnkfgjlgPi=^c!cS0JdqTOhMS$wj`#0{F-3@uqQ}e z1S$h5cv*74zG05JvjsF6KItQ{KR*C>f<8Fwbolk|NNyw0D__5>gshhtA1nz}%y$3_ z>;~8n)4{wIp`8JsR5iUqyG{_Wqs zr2Z|{kTeTy-D+n93KfY9(kGlD0yGyG*^^Rd)^$Rydt!6d1;$^cKvhb6)p4D7fQOyz zZk&ISB!&7n&d3*(5u3uo43G#J{r`UEj`#QXl5KN`_myqxNC@72a9vFw#VdC@n8Nq% zPO=XpNrP^gc1hE|zHu-RKcs#W2!7|frU7sQDE}j*?4^IFZ|^`*SF*o?Hv1*@ReDEC z@HAK;2hw|B<$8$V@2=S~eaWtH;0JvFt{Q^26D8;C8>|)GQnCxK*3T*Y zdo&7X#ebm`5bE^wf4_PwlOj%iPJ(@RIT`f_!2XHF5D*!V?Jd_ z{?m2DrvaNsUgF1`=SYAFXP6)`HsU^HFu>&rCO@IC1z}!0&WI;Xf-ngm`vEaq!sG>R zKI#YynqCC~INL`s*B%U~Eg=bvy@Q56;h+X1gq-mEzI*KXvzLuH<-$lOXrN@Iq+1`- zYA64_YvRNw`GEQeFVcMS}sWPC*vRhYWO5Q@7de-GB_Q{l6S z>mcZkzX$*Q_?Lg6cYpmmQW5a)dXE3m?dp-z9>l zPeBt09uIUaf*?v3=mp6TVB!PUQA=?3ZagWvn`{?<&%F~tyTO|$*%DEg0uuy54O@~y zchcyrV*b5+e&F=N}zacx)J+L|~M)Nw};t#z4PQeAag zBgad!oqIc}Ez`^R}*g-dxN2TGPtQ-8#{bH>%I> zonGF;X?#_#w#U5@E1T;nzgrOL#;nWN6!{^6%#DiJG-RYCRnUn32BILy0VU9vfIaZ% z*dJ)UscQme_cmT-sLKVplEt)jfgaJ;c+zZ9gZkQU42!ctOQ<>NWp~`?OxE6rwGy@v z`Q3KP=nT*2hoUmwcQ++L?iZZc1_q$$kMl@z6W?kPFHkRP)y)M;iZLA8u_c*>wm*?X;=~uS}W|z&X zjUqQ_b9B?|3?7VouvC11)CtfJx%X`LBF3-kh)^03Xuv&)Sx2y*V{f*$!q}GCNsTO; z6Sh!tCR=`9Z}oQU&V^|@#}zl@L1`dJ`OZEsju*2jPL71KI>t6cd5$e=H%w~XnKiAwHKeQ# z?r_KPd`hK91CPuv%jp_jUKjONkLwFLqcY@pU(9#0mak8^f+`*8Z4Z(g zGnJ7hgR8o#OPPQxkpcQA==gUscYX;TFeKS@RSser=mGqldM86W63v_iK=hyf|#GZVmgPDn3ZRi!r8Xl+`3t5#;l)s||)qLM3Q+11{eb-8_0Z2G&k zTcc~t6zi4_)j>zoDeTC4Hr-YCIIVXSN)V=g(*eIjGDYoHN>JA_vS#uS9e;o{b#`Aq zV=x0UMv%|QpIXWUFrO1)Ind}%f5z4F61&|B^PJMzc^KcBF9y9;Z|0K%jveOM*kOll zPCqt;aeZKDm33pB9XtA_KbbP@C@a{Ny~?h{BZG}?EijNzxGCa+x4+TANEaUp_$b87 z=d=ytqtpGs69Gm#gT3p!1>}oBN9+|`j5&*R!fE?7#m|%u;3Oy1>Q1-Grc1{(H(QlTea0oRv^uS}8QMHhS_>~0I8(|O&63`xsqK`i`xHLnmxXm> z2iCcP=L_{(&g#_o1*b3U>6sd5+}GYiaU;lg>a4mz-vv|RXKp*U_7J*j4`d4gc#h~g zyP9@nZ*1mCnllcIL#tmOFIs#(?HR^k;W4`P1)?qIiz9EQgB~YuQ~PwK%H?~AV%41F$*3-tF{?fcZK*N ze4r2-ED8qCBLjTl3=qrkQ9+S(E(0sKNT7l#+24|rAb4_Ts~Jd`L&BQ_{(58uP>?(W zE8{Sgcw`MgGsJYm%L5gMjD{@!8_X>F@58ATk~obRQ|uknvR10& z#GytEjG4?Ub-&Tfm#EsX$tmimzkQ@TzKLOeCBW~ z$OLIoZ<*f(5kmkPbUlO*gAS0M^?RSEm#b_6KjaFw z$sgvM&at}Oh@DY(bKP&>$vCiUf_&I^*s6xT?bgty6)DgR%JZ0X2XKp zA=7mt%~=JWO^aLkw(GeEy#^VE@r^6O*L1k=lhYsAY2sRa1#- zg`CaWtNmm=-430eVN)HaeI(P$%CGJRt(k7`3u%EqXxz5k6&fpzm=HE8I_j$LwddK+ zVAts_)ANycW3G5uXQLp&8R@FCMBOvlIB2iWYn5B@K!)3kFoFR6W14_=EUz1eJmVQ+ zo?poW(=4x={r;x2EnjQLumu&F)_b@ljm)dO7XdwEpo+nK@rAL}>QXjmQcPoAJY?Ih zQyk`&3kR#)X{tweD_mD=)=JqLF(mtWOsCs8RobscQa_*1;w-}q848;n7&)ssyMv#r zH#BzHFmHT*Ua$`q=sJEQt{z~HIFI}^`^Ety>|^Z&>W+Lia#pn@_FL|Dfa&B4W7`bJ zl8bDPtXjFJUWMyJx|G2Qp+5nP0)dVDx*laiWr8(9WESoXJjh=08^kvT7@>b@1_?6& z{1|;C%%Z}u4oyy2zG{>Pt>UuX?TuN=a$6k4k`*>Dl=*y)Fy^c_qwtnwnZ@B0<8rHc zZa$k8E4x~+O_Cd1vDZY}mXGSHS8@F3E*XD-Wk?{#8}h?0dJDXz)9PU`wMGy86S2lc zz~Ko|;&(E-g`CdfnQ4MMR^YY5J1`rM-$CK$Ot1yaNONh)ysuK_75r|!rJ6|1 z+#^R)^Sn$Bq_`0F=ra?*NXW+B8UB&mb=LN(Qcv$a^T2I8=Cr_frt^8PUdgq#+P+rV zxufc=L_x@PY?8~J*IA6WOPXtxJIhfQW?KBw_X?}DzZ9m&)pXn>t2bs=0GA1}c;j*r zAAYb{a?^eVy;RKPjwC4*=0>1mOa6%G5KJDjJ^N?MqlXFNh}d z%B)h9H0}_mO=uDy%qwr!1|JeLZopn2 zx?%c!v&2k`o2r?|%`{z{Rwg1-rVL6uw&l9NvxKQM)WG%1ZtJC$zb(|MUAeX1Y&*6x z#<$F(Cd>@Ea3qfSi_wc%@FE|$P@jl1qv*%w{Yc{mMla@-gkU50<}-#h1|J9<`;`e` zCJ1}i)FL6Si{xZkZdEsPZ9&)h)_&zM1e+%oIBJg?uoPEh$HlJRC>QF6 zbF&VkI zyTIKBGgoq+xg1svvuQ8ct!8GctlG>SikdHD>+L>G^z~v6n^8-St@bCpvF^KAvFKCO zag)}F`I!eI*DUN@5NhHeGw!2N|9tHI8u*0aC5orOeJ%wQ$A~$@jH^zRap#=im$A0FTSh0EefOcy~oin(|ilYFk3u zy8A&_D~Xdy)#rp8KjXukjL$F8!(wJ47vqH``gXIycUs#WogLO~Ofh)7U)+@?b>FM+ zywPC2)3CKz^F~;^HflBqWi}NFL#B`Y#y-8UnN`#1)ah-`pz4i5QK-6m4`Znp)O(nk znt^>wz#*W5U@_wCOTlc&;8W@x&60rv8^BZz3g(I*&3fbm>c zSy{`Q&^FOM9Jc&;lb-RtR#R@R>*Q1)H@Px_+s$IObDXlaUTw8E$M&M@?)Qh1H<%Bx z-iR{Y-O-bpbeb-gx7pFUJRFPqp=gfZ zOpeW+Cp5MjTEL5fbhPR{VL#bVa!pgk@ch29$yEo^cmwHOi7n_dnG#6*RkD84F4arHm$To zM}Yc>EnB_)EsQBdUSdLHpmg>OJ9}W;yx*Knh_UGB%R_Fx*N$CP^pv#hZ_Hw8H7FjN z>pW>4Yeiy^U4UYF9_>7(hQ0j_;e455fZFvH&h_OCN+vqFhUlUA)a>#Q&@#~5D4*xS z?C&}z7`M(4p8kf#<76x_fblVZAv(j%))zfJ$5y0vuALnYdgQV~mKT#UxA!}xVP(72 zyO2jzfUMmXIpp!ZHPy`8(5UpQ{&sEoM#<#NoF!?!f|eb&L@z53U!Zdo|3ksw`#dQL zs?KSse$6F#7$*{emY6T;H!pML87^YW^N&mj?m5BQT!&6mHJ?)RC2~G89A42es+{ia zm=Zl+=Dh9R5cBT*SakTdYxjyHdtKo8oY$U;?ZTq8UG|GCv5|B61-0lvaWHn3-rShA zAO#|bH%D4IjyhWEy71=fm_u5HikzSm^kB*C$uyV9IHWO46J&u&)9hrE9y*O`nihKV z<8g51v)zP0?)5!XLua$}q9sX!4p4}PS_1F$NgRX7WRJF@a|bt_C78e3#iraq4GAO-vl;vEBwx*z))n4Tvl7pcU+s3-TSruE^Hg%Ns z%3f|2b32j|y=s4o7aQp;*>Q)C&j=GopUiqRX-zwQ#u$%=Tyr`-P6zS`eVvaby3!)#56!hZWG~k2S1Z`XO4njX%*NH1-lMH z=PP3PxZOmy=krmIGgQ>`sD(fwJ{?MXjNykmUBN4xLx(UcKBenrN8`Z(xaqnK%PLUK z=7Anh%IV8I2w9N<)S&C9?{_5ft_xl+jhkY1nr#pxn<-*DvRpD<&(YT{8FvXbm-gzC z*wjZ3p>1jew9)Zq*@@kqy^wHl*|UI_PqMLi z1+a0HL4(}u1I-*Nlh7t9@MTV0DnUIGt-zO75PSEJCSU8OpGw>)w zcU$(B8n<`NV;-_l+YM|x65DyIftAuUr0DD>?96nG=CU**dySsJcJ#yAU1Wv&2=vQ`vVN0ZTev_$&w^YaMl0vD0- z@+;7ZPv;XQZN1I+*a7&qy_`_9>P^}&4{@;$L`XV`029?NQnDq~60FF9y2 zAoL~?%`V~tFPni69_@XClz7)ERjpgIV(MAc*YDL9>#NQG?iNAY8R6$Znre-<3eXQCL03N zHpZ-{tfv%Lm$r7Lj5&PIwD7ib)bX{$%_h0C7K>Jn5|qD(b#g3T$2uC&0P*Mt7;ZFt zAI=;R?&Uq-tJixvpgUZ66R}}6eXrP@9i?t@UeWme-Zx9*T}|vW^pc_cMkn1E*|@dMk}M`JP+ZY(=ZM*1yyvtYAr19Xep#GM zu+F?#rE9a1J}r()i+!+ElbE%_{!^6Acn@D9AvZ4%Gyp`%!Urf%ki3rvm&gpb+>RpW zo~5=-+s3vswJ%B|ov$>n7to?AkoUU_&JpZhJIndY{SB*4qArKuKpYXEkGqWqNN==? zeY!Z@YCB6A+JaBcvHDoaZi?>ID=Y-_u*kJHN^Vx|P8RLqajw(Wg++oh+b zG?{K?o}~90)18lvh5O2eqHAaJvfUMQUt)U=Qg6wb4LlJ`)IHsgC;!3&QMN!Vdjvh0 zOi+nE7ln?&vjv~*JOIHHr&V`&8INu zrZ{!<(+&B0ALi}m=KI6;EsJ|sumO*&D?tMM3!d~UyB!o^w|;R=mXxxDH6WL@NcbJS zU9MCnm|X1}?Oth7&nu4Kr^}u88rDFBd}Gl&76q6Rr}vswtu*B-lysgtc(ybi7IHU} zhYz=K-=j(xt&a47J->0Y z791dzT=wYj|(8lm6VxxS+b_C!Z7H5&H?Ej2x|}Bg&O#!Yohk_S2p{SZ-_cb#rXZ zvQBd{&>Qu7c01yWPWCkm z*$e4gk$-c$QSP_8=)chu{@5Md8I~GkNr#h%%W~3LQ2%i0;-i1^t?sPc1$UyPm{`(K z-1h&UwF;{_V0Ip|Hx*N=T?x{1BCU%)$zO2q7sA2cR7C;#TtdF~nOcSAX z+GVo4%W`#=7+|DS>F@DXj~{j=dM^4K*fn79l+|`CLK<#s=J#?{CCy|Nn;mJ@%G?+Y z>501}df9?Ko$F~T-DQ;43wd2pSqL=$gJAMaAme)XSeTc1v0LErC(CsO>(s<$vX}_S z0pWel7K5F>_Xv+xM?UWYpP`0?4_kO`?OyLTi`#vTSk8Cd@|-n~&T(1yvHiMvoh%iF zKkj!MBE9En_sjf(0xGD>=o7k&qQxH?JR-v`4lX$$=gXNv$pmbj=#LJ4r93O& zCz4_n&dxYN(Vz!NBZun}9C;P#3s}JW@*{Avp17PuW;^lK7S!YL8L49SHr45^w*nhD%8C_0sK4E0n*=pKm?m`l|1 zWfI?O0g?LN^?-Ap7&BxMs`(b*@0OcGY&>0Vc6?);?jOb^jpqlRDNkm(X4#;OhDhhB zzOPE7T9Kiy;C6exptJoQuRVtGI;TvLTI)2_Nw!#F+~ zxlg(Iu}(&V8Th)f97H4}@xDW|FM4?qa2V0(Yak9u2PtUpI@N{9ERMb-r&(^Wom7e= zSOru^rDCO0S%^?k<|O%#0&f8~oj343Fc4_Q`3(jF)jv6dj(GKa0oWDM>qB;hI!C+X zvNfzV1dmpAi8b`zs; zdT;JWW3xfm*FB=P8u1--f~R?RtO{#qFq#cC1yh!XO|Q_l^zMq@Eqr#C9j3X>k{V(@ zQCMp8QKP(=tBVQS&)!6URVQPaXurP7L8>$yFb^9Np_B$XohWlEwSSMHLbVm~>C61| zq%lOMCyxO2Kw*ANJt9-Bb+l38u-@>FGnzOGRd2b%k+0|S*TFMr53Rw8!P50Zz4I-O zX##SH*`=k|(8xE8W~H`XRm;vWD_Yio)nsOMm4;IRp^;i#~$BJ`pq`V@b=2zniI9 zdwwX1nnTkEvs$7L#bNh~#^DK{_ahPng^c}Kala}M0mz`cu(2W&0{NJ?ky;(>mkr#| zt7Bt4o;LACRnHA48aH9JyeJ$Dimd0y-D+>u)yK1Ri`WrfQLYRNvtfF+q$aXb;%KAY zT37ouu8HGPw>$G%wHG|k#9qG3L$pxALcFu`(_f2I0v0KHK+hAh3{s8yotec&7G{k{+lQdC&;u+(9h2bP`E2| zs@xUEt`hDKdSI`^S!_1gC-oTm%n-u58tL0@G6Cu+D4A?8+;e(o?i86apzF79OpOBx z5ue_i*Wg3m!fCeT3VU!XTp zQ1ppM>^7^-&2GkZ{MmHe7YuJ)*p5xvGn8Asc>x`zUOvPmzRTbnFge$wzCtN#H*j5_ z*aW0v_dH)|mGgpM&sWt#Jv&UgPT9~sAL3b2>IfcDmrIuHiFA3LM=b`G&jdloo z_3oIq%RkzVoJ&+)eVGXYd{2v)@9hCDFwzj8XTqE0+yI%Y7K7>H6UKzf0;TPCI?FCxW@^?3bPMOTaRJ+OVRQ8jN>Q%w zeMI7N`YKbM@`r=&2hgF@D7N;*kC=}14Ph)N3{DIC(Ndq9J-(Woa2V1ri8(G>$9!l~ zzy*#g^w;Xu0zlMV_<+75C;G#_27UoPH42W^O#8bQ(WgeVZ1CJbF0gwg*XuQ4Pv5B7 z)0tUYWtrTt-M2JPT^s4%MqlXqP-dxuF3|XzWO!*@8#=b*a|7u{@`E0UkB-y=%lEC= zW<+$X)(Jc^p)Vorcyo>|Oa{YczD=8Uda18^icIe3*+Uz)7aX^6?ABQE3en4CsxHDPZ`R@M21-9o=R*ZmHt5MruP=v`Xoq ztmyS>x>&c%dPkiX`m!~XX6elytz2U|waRjt8|CI(sotMgJgVT1 z(`!EKZLr~iYtLAm9k&lNSMQ9vIG^Uk$(ZqYhhQ15LEdESCC(GOhbziIxy&11<%|nh z;Ec-;upa>Jxh_zabAfJ?Qks>eCLvWJxs$+4wwRMP{K~es^#UBZR%q#~T&r0n`JPPo zyb9Z2_R^bGEl=mH+Mr46JDn^|wpCR$+i+B0{}y-HP?-r12Y#UYP>TKM%}#KRU;q~3 zer^M#;%O!i8uw|ATgZjtnlY!t{g5YDEwLmQY7MVR3(R35PD@HL*J$9AX1id*-sjb3 ztyKrT;*js|(>$|g>9j0&)!NXqN3M!z$-Zg@`!*9A{~Z0eH|DTV@(nsa1c`7CA}fF| z3MM?&`wCg&T+v@N(yfNNv^?5!F?lp6=H{@@(;e8V+?00P5*$snFl$Ah@K{3dbL6;> zb4}9f9UNuY&KHVVr8m;j1crHyHm%&KK$F|SKABUM!h1MFaON9uzJLY1FF%0KUpgpZ zCGC|-t;UY))53u-xua&CpHgyvGx7=(cgR=EM(NNQ__+a;FPD3o(;&+Sw(fQ(TXD8A z9clq5j+VAl)t8rcOThGD^%yL4C&v1^NaH>9(Twl&te$|3D8Qq$xKHIEk<$4u8-&Sf}Y)3^-0Td^YdZ-xbF_(5QY+Xb919v>v=0> zy>9Lno2qwk40b?okK5_7ySfsX2EfZaKd z1w3_{`-k)53&+5nZ<<#}qYUr+rY&ZC`?Lie8TtpyqUR9vz41i8OfO3a9Lx5Ec(|_nO#g_$M^%k#SBV3ZL1v82#z64~+_y(Tq z&#BFrF7K^w!(J~tqoY_bjO!q3Ldx$ANie@YYmAriI0xkr3g;iM&DNXC?snQLN)r!T zZYwK7=$AWrbvq}u>wMhAe%^b%PwKnZdmn8R4tgK`0NNw3{X<4VYD82Zo!6_Br%-08 z3JFV;Q6#CgSEO^YC@Py8yHa}vh3%_Ze8%m`{9t)lGIbBam=#%5%f?pUb<>j;9F1u6 zrAe)6R{3?{vq#z$@VFODKBqt%B|pVnnt;K2eos=8M{B)0wp%ol-#TDmpN4aT z8C^vz4|}!ooLC(gy2n$sg*h3T*oc)Va!}z)hhxi|tbHiL=m_ba#FiODZD`)Urt9-O zm2NC8rCE2U_*|-}cGl@AyyPZ4?W6%G(X7V7gD6 z_SQVehOX53HrIeU;$)F(r5oeYU~cZ28YTC3*08VZ_14fl99Q+MAe205TPfSVjgg1_ zAYYz}P>Ms#b8_Fmjq1maMZ1SRETMmc97jL{%)?{XfVTnCbF6dyW1%`}LeXNA%Wu0a zN!zQ|QN`3&Q_bQ1yilJKes5vr6>rHFmOUKeIBIXx!3UBxchZbAD9&32)nclq+Mw~n zXwqV{XxyJ@#OQpg+hg!znZ=PgLLz74 zRgpUZMWYZVV89?CK+i{^>v(S8Ue$|B!S4H|S$d$RYgB`;;+5H)QHth{rgwdwu64;7 ztN3Hu(Yu9gmOXNY(&{+!eBCP)n>IBiS>ZVE8C}b7E3f45M+dedQi5GVDW=iD0V&}; zS9I(uO3a9x7q}B0h;@1o9f}oy@#>(d;3+g3i3!emxBc5c(G)ge5y4<4cCw+)#p7Ji z1?1^PyTs7+2`wJR`hLA*+c9V4+mJdl_l1Sq_<8k%KIr;96ZNI-Sx3PBKO-Oftg~D6ld71uhH8 z$||^*Ncm5W#p@J^Hvoz&{u8tpV$!(b4BEX;{YO+Ww2m`@a?ZqN)tQgxtKqUM5baKB zCyO~{+iFzDo8_VKkJr3d}(RcuE_a-{$L=99|5tTA4 z-k-@_qkPUmj5s{LeF0gHizfV5s)kM6p=)>pD2oE(ac;l69_S0RG}JFpXGUA@EpTyL zvHHu+gs)-E^nz8>E4>LNsuJ!2O|`5E+8Mx8GAWC9QTe1aa9xcI`6ougXpgE(lEQS5Pzag~^m{Wk)7X zw*^tx+kD-Vx!!&-YS}bjpN^)R{HVxmiCWsS_@PPT>4n5q_ZvT76$?GKm#$YSer+st zatcL`Ds$c1Ej+z4znM;=j@h>-FUIlzwq@`*;1dC&c7mY63oiX)X=b5<^QcM>)q{#N z1T$dGb>~QLEXguPgJ!XLVEINvCg!ji%H#85t4X`op+}ag`?@gTA!O|dhhbxb3%tLD z147k_dy^^>+K^NPrfJyi-jb{@E0x{uKx*F17Pb6Z;Vo$^h^?H8{N1Ax&?sK_?`1N9ql&16YI=nro|}%cGi^I6jBU5(j|-Fi z!7}+t`{2>4UFpF<6Jxwi6>x7;C>&N)r(8bNg=MQhZdL3tOF|7D>d;Kj*KA9G({ZxX z+-h8ON{A)S+WNjxeq0R)wEKfnmZu|2f|&-gj0qDHB+#D@1_(>lB<2#orOqWPwtyN9 z>MfiR1A}!H7J!wM#B?j{nV&=vHT zBx`c_$mxj}N&9h$#-Oe1`O&Kf-J_Q;bCLM>_>Axdza(x+CV!n}E_fkVG42K5#R(~W zSGLliwT1eIEbQFH#w|N`ZCj!nZP`|2){&_t#;lZCGbd}Xi+5WnV|9Ij;pTiv8MT5^ zol4FKt69c^t74n}Oj!)P!`Z^csgazIUDaic#3xP%zyYQoXW4mGZsL#w<$fsuizZ$u zS0qlEyYquq*Y+kplg~+dWiivn&9qXt>t4QD5E)+=Obo{vZ*y!mogv-b+6~j-t3|6% zcKfTEVbu&*qb0#wI_a!FOV9bia#tKwUQqJCRVPQw)F+J}U+D%ex~h^JX}K#SdsQOg z!N`2mz{EiZLleIc%!*$b8&8DOHu$;JtaHnv(Ck>*Lc?&EquR&>azpj+y3lGlVp_~` z!)|}e?KqjJP+76Hs`_-F>n?nTZ*=>6W=Uw<>2Sf4{nAYqfny3A$$fnG42sKt18+u9 z5%$q{NM8b2&zVv#NXv2&lG|6gc}_OOI=-P7%hJK`%fxiQkSi0%f~~q~r@D3ICMH6q zLA*38HS`2GomvEs0j;M$RdsefSL~!~ zJ~w6jT}hP6!)>nEEz*l-meHmh-(rtmV_Y0j99fwu)wZ!7!R9N^FZrVdJ5&b8m67YY z)h1uz;Ixu{r9Z)J?Q8&|BDHr2c#j^4q?d93JUznENsuGF6v)^MAvZV8J1^j~`}o zZ%~qpHm?uL&V~#gI3pz(j_3!>vtCM0o~&ig+UYZm?<$+Jd>qq@jgVi=C*vGd!`1e# zFsjeDI4}5YUOZw7&T4B)GFsd9ky!FuQp?Y{?ZU99yg%zhU8Y*LmZK8`amqtP$r!G^ zlalg#s@QUm9N*HOAfjwpl2b3T(HS*AI5{aA^CYafB1u*BzCi+GTd?!hz$@XPca3 z5P`-|qg ztOGofmtOJkh)j=%YE%3e8?9PfF`FOg$I8GwwCuv>I=L=cyx<-x$#MoSqjD*VfUvmy zf_mX7Bjc$}Ee?8{eA}suSan*$+$vJa zraGHs({n@YI}_MxG$;;~)p1oBll^q1Hyh{2H!kW`8M1r$Cx!D>{NsRu0P&wNgvfDw zN`V8{Z(!^On=(*2b2iqLW_ml{S8H=kT2~=>rdnO?uotd@Y=vkQTr-l0IEIK@2*Adljr2wtba1#m!t%g?}*c!2_LLv$Hy zQ0dwNvFO-cZabd~YpS$Y7Am%vRhQD2J0i`%up8;EGFcV;?!c@y55?Ymw`8Bjk2${uLy3T;#lmFt6@+^(IY z;F){$PO898q7R`J3eRL0wWy}iv( z@+_0(agM7qjHePy zOH9F+8ONT;WcGO>j7yF<8a9|Ipv0iN(}AE@!D&YK&_;22;*y&2DZEv*B6R`}b_4T5WY2!bUKs@6pL|(hxlA8I-yrk&|!kVTjf}WL&Eh;;q<^p$YG-~9E6#16A z&&`k4q=pYi*(JZmYxQQoQu4SwoF0hP%l!pcstgD}jdRDz29Y;0ojPZ8-oyRde3TGm zfHgX9;T69GiYwT~K2@u=ZM~+s&04N4Hu;V>T9zUG|EkBf3a6hxuyIfhDmEv1d9(tM zsK>z<@FQLdMbmbB0#${x1L7bQ3)X8)KDc! z!5fVgD|N_Kcix8cHk^Vaw4LJ0uIxH3&k)Nm2*8cE@L)2OJm2im0AHqXFOv%$&zcD; zYap6keg#AQBwR{ljQn(8B`WGNKcqWde>B7!a8&oe$nURrd!F(c@AVwc+5QIS5dlP9 zh7Xu9AP4kA#g4?Vu^v^2J|!=ie5)(Vg4-wy>nXRv3+Xm9RYpy=;_AIwm-0T)yPcir&)8FuI9y{kFMnSmKQFHe&4Gluf_`kG7i2wqo z=mSROsltIhxR&8}>RGo7Tc|a~=@{AJXr!#k9(yf-=h8|KdiyP2eFzhEIH=o%y8Lu9 zLu8=#zhKVGW1E=Iaz?eBuBdf+SMOP+(o=WoX|Mz(fMpPKXTk#nkutm(09vV1q->)P^@Oz|R7z!w+6u&$%&!hbuOZ^C{!H>W&DwF^WK=mj7TaUGHOQ}CShwJ9 z(}%@CR3cH390!UNCTbLZK*sB8h4+YwrYWDFSl-k^JdrffVlV}IL2Kk7_>Akdf;v*W zYR}2yWwq1KGS;dN)9EqU9l>$3X_HNd)0 zvb@SujIFkI!x#2Nf4=_V-P(@#sEUH3-#}G~S4Aj&43(~73agq1@-%PTgl$wvzMg91 zZMo^yI(4;db=E6iUzE58J9mtZHUvAgyHp>ig zb5oYORgN=qdata>I;d6e0?-;xsWls0+RZ) za04P^H+SgzHl>%0!I7rMd`mA9xwOn$Wz4Af-jZ)k$btY{5X2#l=SHP{wbSp9CR~|l zRfpS-%k`(2r{c{@USmr2nryG@-t9?{CsI7#`(F4af93-ALIAY?J%ILHnmm6zsjaAK z?x+atW@cfz%7C?r@vPX@s8KDaO%GhNTNYb>UZu8^NsAcFy16B_SWGvo4Ttw9&Epg@ zF1VgspF)~So@%ydFR;*c={=Opezi5~6vsl_3F4L!%HKneaGazoBUn>(KIPpH}_?X1KsUp zg14XJIM555g1PPun%zA;N-wR#4%;>QdwRefz3jrvZK*<6oy}(bmZCxl(OGs+t6P2O zw#>qQZwu;jvdDSE{R9#;+q(gvTmU$@|4xNk4QY~rcEinL8B zUzu3$zUp}Uc8i&04}Ge-o0UhcBeqqK+heQU?>1MHR)ZPyWgl~Dkhd+1)M~F2l0V_P z_N&E!*kVuH~m4x^pZT8>dN+n!8DMGKUl)ZQ?49ng-HL7JZ+s`7?S(v%}7C zHECP>wY#oWE?9%m|N7AB49fLvDG^iXSY~X}LIIY7peiOhuFXQk>QMo^% zPx!n3#PbvpT?_9MM2?{Ul)~@8`j=mV<2g7xmHL;%{oe#2QWbBfLrK6Sa3bV;BVRC? z_!%it$Y5~@Nl?txf4niMR`ZW3 z!%U$YDaVoobb^!kA8)Du_TN&{UUgH!N=6VZc|%p)!qUzmbWIiDtl=PetvRZM*Y4&p zzx}&z9#u^P4;irIcvVx~XhH1~HiUUSgye&>1EWoL0Zbr7bVLQDM#K-Kc)Jw%3tW+S z$-ql~T5t=6oI+Io*Hc($`QPzCQtWr(S|rpoosVSv`ZJVy^#AbhPdI_+@cf@r`QN2C zS3v(Sm;bBr4@DRq!Er^V-|`a;>j(NjpU0_)C(xrX{$!58|Iq)xh32om`_rGR{mOX3 zGAT6ZzkK;A{6HH8eo{bT{&JdJ!B1C(Q^tM?ZNyJl`0H|4Q;kguDqsB!du0zAY&e4K zt+$k7ORJxQZAQ+I7)qoPHmH2rJ8zmU6nNk)K{VbWdlEZez|gueiNX0bmuv633QvJ{ zPMx=bKr;%LE#xvSq0JYzS#{f@2)Q>cw(ESsRYp#4ZH+p(QD93$quAIj`$lu$!xfWF zPj$Uo@AmR;aniz#B|D|NnQThuGuaaWL`n4blR}(n2Vc*G3-8%i7pz|x1JX@XTxv4xq+Bx< z#?oB$6^#ID2y(Z7{0XzJ-b58VF1^xrx&cJ9c5X(t&7BqYETxJ+2c>*f&S`z4?}$qGQV?O(}>{lu91R&5Dr## zh~B-OnsjzNq}qlJ$mZLbX5q_M$f6^&^{Z=WR8a4H4uJ`n@#i;Db)ch%A7ON*w_jLI z;v6Z3o_K$M{|SRv9su!F$$$Ih>WS;0f6io5uzdif)TT0-3#6Yy7bxY}P!RO8zu@vM z;A`-gpn>qwn|Ci4(Aa2_oBB)Y=ags)J9L`dJDf;lA4YJtoZy=FI}h6XYjp4Xzb04= zy&5Kc!~3fFRWk)Rp~y7ek%Ye6QZS5P14%`r_XC7nki@=ypS%}b3vPyY@3aD3@z*bj zw*T_=?f*do1;8K_9E>k?;;Zz1>gQk1NlOU7@K1UNSIh(Ss?v(vY3^5OBmoaS2CV=L z1Q~JR_wR7J?@mghj2=S|02h7#4h+EYnk2$YD7*Onlfh_z|E@yG6}vI+cHrT+xBHI< z-1Yr?z+MPA;x6a(A|oG9*96hG$TH{d(Gd_X9vc<#`{xiRgryQCBvnOVCWjLhk~o8dqY%qYJ;j zg%7-4^%%X5{=&Pr6bVG`mWc6JI78&kJt7}WMNJ=0P(pJICw2M-y~>38`5s{rAk=-N znt*9g|A9&uwhhe~aP;59Z$F{ED<{MBmw&(r{QCCG-=E-Q3qTWqd}`xEY)nHlImBnd zG4rXfA5a~29nQcVLpiXJ}=>DLprPaUd83LzT0)0n*j*pQVUAc#Pszi99x zMDMYE_+Ed-2 znkG%Yq%V_6)2a?6x@g|2x0I(yi;?7x`s96 z-1-6mj$y>eV0%4#7ySovwH(%&HrulBZmAth!WIknTzLrhEHIM6^LoyX2RNRp)0%g_ z72DLi)jn9-BYxOrWs