Merge pull request #189 from blacklanternsecurity/dev

Dev->Main

Author: liquidsec

README.md

@@ -36,6 +36,7 @@ Inspired by [Blacklist3r](https://github.com/NotSoSecure/Blacklist3r), with a de
 | Laravel_SignedCookies | Checks 'laravel_session' cookies for known laravel 'APP_KEY' |
 | ASPNET_Vstate      | Checks for a once popular custom compressed Viewstate [code snippet](https://blog.sorcery.ie/posts/higherlogic_rce/) vulnerable to RCE|
 | Rack2_SignedCookies | Checks Rack 2.x signed cookies for known secret keys |
+| Yii2_SignedCookies | Checks Yii2 framework's cookie validation keys for known secrets |
 
 ## Installation
 
@@ -282,6 +283,7 @@ Express_SignedCookies_CS = modules_loaded["express_signedcookies_cs"]
 Laravel_SignedCookies = modules_loaded["laravel_signedcookies"]
 ASPNET_Vstate = modules_loaded["aspnet_vstate"]
 Rack2_SignedCookies = modules_loaded["rack2_signedcookies"]
+Yii2_SignedCookies = modules_loaded["yii2_signedcookies"]
 
 
 x = ASPNET_Viewstate()
@@ -409,6 +411,14 @@ if r:
 else:
     print("KEY NOT FOUND :(")
 
+x = Yii2_SignedCookies()
+print(f"###{str(x.__class__.__name__)}###")
+r = x.check_secret("0bb72f36d041a3a022f231eebe114889ee442092ee350242ffb2d4bb53887a81a%3A2%3A%7Bi%3A0%3Bs%3A4%3A%22lang%22%3Bi%3A1%3Bs%3A7%3A%22English%22%3B%7D")
+if r:
+    print(r)
+else:
+    print("KEY NOT FOUND :(")
+
 ```
 
 #### Carve

badsecrets/base.py

@@ -112,6 +112,7 @@ def carve(self, body=None, cookies=None, headers=None, requests_response=None, *
 
         if headers:
             for header_value in headers.values():
+
                 # Check if we have a match outright
                 r = self.check_secret(header_value)
                 if r:

badsecrets/modules/yii2_signedcookies.py

@@ -0,0 +1,48 @@
+# flask_secret_keys wordlist shamelessly copied from https://github.com/Paradoxis/Flask-Unsign <3 <3 <3
+
+import re
+from badsecrets.base import BadsecretsBase
+import hmac
+from hashlib import sha256
+from urllib.parse import unquote
+
+
+class Yii2_SignedCookies(BadsecretsBase):
+    # Match 64 hex chars (SHA256) followed by PHP serialized data
+    identify_regex = re.compile(r"^[a-fA-F0-9]{64}a%3A[a-zA-Z0-9%]+$")
+    description = {"product": "Yii2 Signed Cookie", "secret": "Yii2 cookieValidationKey", "severity": "HIGH"}
+
+    def verify_yii2_cookie(self, cookie_value, validation_key):
+
+        # URL decode the whole value first
+        decoded_cookie = unquote(cookie_value)
+
+        # Split decoded value into signature and data
+        signature = decoded_cookie[:64]
+        data = decoded_cookie[64:].encode("utf-8")
+
+        # Calculate HMAC-SHA256 using raw key
+        mac = hmac.new(validation_key.encode("utf-8"), data, sha256)
+        expected_signature = mac.hexdigest()
+        return signature.lower() == expected_signature.lower()
+
+    def check_secret(self, yii2_cookie):
+        if not self.identify(yii2_cookie):
+            return None
+
+        for password in set(self.load_resources(["yii2_cookieValidationKeys.txt", "top_100000_passwords.txt"])):
+            password = password.rstrip()
+            if self.verify_yii2_cookie(yii2_cookie, password):
+                return {"secret": password, "details": "Valid cookieValidationKey found"}
+
+    def get_hashcat_commands(self, yii2_cookie, *args):
+        return [
+            {
+                "command": f"hashcat -m 19700 -a 0 {yii2_cookie} <dictionary_file>",
+                "description": "Yii2 Cookie Validation Key",
+                "severity": "HIGH",
+            }
+        ]
+
+    def carve_regex(self):
+        return re.compile(r"[^=]+=([a-fA-F0-9]{64}a%3A[^;]+)")

badsecrets/resources/laravel_app_keys.txt

@@ -1,4 +1,13 @@
-base64:INVALID
+base64:/9QshpxORp0Mt68zOLiDNqdwRjxQFbThs0y1bsJ9+L4=
+base64:/e/SRpeUq1QRFRVvpqQzuidKc5rA0VgvxnlI94sm/NU=
+base64:/huj8pIAzAQO4MIFwrPDdh5xA8LP9YdGwkhsExLs3JE=
+base64:/IvXHEB/EVa+ZsEeolHvq0HtFMLrC8iWlKi1TadvefA=
+base64:/l71HcP1CJX0uUUbu5chm7EBNx0za3boPuRypq46MSs=
+base64:/lcdR9cfwQMItnAUH7+zYc2gUsqxeErCyvowfaliMyQ=
+base64:/LSpuNJfJsGEdF1WyNAfXdZr2rpaacMoq9i8Vo31plo=
+base64:/mA6zcfJpsysJ1Ubrkz7YqkS8vBs4TpwDCpVm6BnvQw=
+base64:/Qsc0nZlYC6l2AwBNPfNuVa6Fj9ct4lDLU7KPGgZ/dY=
+base64:/SoV+BrjW7YPOWXleZMqwu0qTHKlhqPIHX6m9W15mug=
 base64:+0WM4iV1pkMedDbbLsA6SpO+aLaXrsfMy4NkDupjwQ8=
 base64:+1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a=
 base64:+4ai/RJ6Xl2RP6WxOp1svwylcQJB5yFS8C56b1z9w8M=
@@ -16,27 +25,20 @@ base64:+SlcmMXT7PlVUyb51HZ4oqMZrDpWrvJsZIsDKoJCAOM=
 base64:+u5YjMwsJrBitDF3uVARLOlO3iwe0m64k03k4BCBFoo=
 base64:+urN9gwinpcMgKT0CpDRdB+OpiAsl48dfbwOIP5Mx7c=
 base64:+YMHeDN6re2ecTfhNUXdzk4hO9ajH5cqM8ENf8dlnQE=
-base64:/9QshpxORp0Mt68zOLiDNqdwRjxQFbThs0y1bsJ9+L4=
-base64:/e/SRpeUq1QRFRVvpqQzuidKc5rA0VgvxnlI94sm/NU=
-base64:/huj8pIAzAQO4MIFwrPDdh5xA8LP9YdGwkhsExLs3JE=
-base64:/IvXHEB/EVa+ZsEeolHvq0HtFMLrC8iWlKi1TadvefA=
-base64:/l71HcP1CJX0uUUbu5chm7EBNx0za3boPuRypq46MSs=
-base64:/lcdR9cfwQMItnAUH7+zYc2gUsqxeErCyvowfaliMyQ=
-base64:/LSpuNJfJsGEdF1WyNAfXdZr2rpaacMoq9i8Vo31plo=
-base64:/mA6zcfJpsysJ1Ubrkz7YqkS8vBs4TpwDCpVm6BnvQw=
-base64:/Qsc0nZlYC6l2AwBNPfNuVa6Fj9ct4lDLU7KPGgZ/dY=
-base64:/SoV+BrjW7YPOWXleZMqwu0qTHKlhqPIHX6m9W15mug=
 base64:027oA4CMT9z2GAdDj1OkGAbqjJ38qHTX1lf0Zm2NIqA=
 base64:05aGX08JrSEXNBarsG/0pqBTZxGjHPR/WgFS6SnRLSc=
 base64:0dLDhNon3ilgxe1wzTKttICV5yfWcjVVbwytHN9Dtps=
 base64:0JpSMQ/V8KcRO1F1IcsQaVBxdF35ISL6uqLKUKuwX1A=
+base64:0l/IxrMOxcym1ruRNh+9MJmQtcevJGzpxkHDXAAMpgg=
 base64:0ntdidtF9oEmNAsXFjr2RrdEac1q4wz7S9PKU5E2LnY=
+base64:0SfZIs9xW2Sf7O4f7KLkGE1lyUtTbxMS0qSTmbOjeCg=
 base64:0WKY8nVgsmp+NNOAaJBJ7FR64pwib8J/cL1Bob6PI6o=
 base64:1+jNMZs+hsN7bMSHnYdnBPRD8UTrbSB/Zad/GkxjvRU=
 base64:1A/PQiiIkwNm04ftgLPzG20N//X6XUgoZI25wWYe/bU=
 base64:1bcYafP1Yn1HTtvKQ6fHnNAPbJSE8l1G7dBp8FhPiao=
 base64:1BSk6zzoX6a0u3+cB3DV/egoB+Gw90ssPilyNa+ZbU0=
 base64:1ezeTL65y7OzLZehrazIWWfIM61mKDjmfOSvIjBrcfY=
+base64:1fHdW86pSowSnqXr6Rw/DHgjMH7aahtqvW8NnfYCLv8=
 base64:1HPidpybaLPZnlnoylB4LiDnf1iSMR8lNUEqAUDSNCk=
 base64:1UhNx2BvXB/v3XoxclINNK2S/BriFCVD5yBFv+J3sUI=
 base64:1uoci6jiUHN4hsJK1FycdhLRF4NS59vt40zi6GNAqbA=
@@ -51,6 +53,7 @@ base64:2EjGMkLNFX3wl4YbKvfTvIcXt7uroeeN/eVzgo/ulzI=
 base64:2ew0gnfULJPlKpjCeSqr5IgqthFVKPlpW0MdoTGUUsM=
 base64:2fl+Ktvkfl+Fuz4Qp/A75G2RTiWVA/ZoKZvp6fiiM10=
 base64:2haEyzFO5qNXDIXFiCRpIWPcmdoorjnXH2rcUaolBmI=
+base64:2kUnZwV0mkuw1bT/H2CutiuorYiInXgyRolcAf+iDko=
 base64:2lY+ePqCW7DKC4g16Wv22YBQ/GwV95al0L7yy6Dfu5o=
 base64:2P5vn6m7ZImfkPhzjcFsIybivBPf1Qu4tT6MJ6nOFyU=
 base64:2rmIsvJq32TFy6Mfa1vRwXs6RoGdYgTX1XCn4KcGuj8=
@@ -77,6 +80,7 @@ base64:40Hxff7sdxEVjzDIXViOKdonGNigp3y5eFpKnIl2neo=
 base64:41DuhNKjcFKtUDMCjsat9uyIzkLc6CFsu0lqLQ9OAXQ=
 base64:43fq3YvfIYSdy8AhVKCYgtUrSNU7ACxVLGMN0a+Nnlg=
 base64:44964KZpnM5M+pOjc6ZOK4xxuaEOp2MV8c3OvDv/uLc=
+base64:44qFOYQmLnxQ4/QI1J32AIxfRRs+3rIE9i9bXY6yMhA=
 base64:47qXQqQhQabxJ9HYbh5bNBUc0tv7AS1CBxeUg6+9Bmo=
 base64:496RTpf4K7tRWPEk/QspS50xB6pKRlWqZTB1pv4748s=
 base64:4a+OUff6lLTn0SAkhmQOOvTAzY53ppLva2blqWjvH4c=
@@ -89,6 +93,7 @@ base64:4OdmB2m2dgewlczC+YqifPLDk0RtHCzf8C3UPf5IPXw=
 base64:4R9W47bT7VnNGF7fnG6W9gQqE7958DmxU2t29Tmc+IE=
 base64:4rIqxGmv/9+pXJ83UvZ56PBR36u1N7WpPtBIwfjjHJg=
 base64:4VY6jyiRg1mo4O9sPWFCabDkDqtUegrRX6A/M07Ebw8=
+base64:4YN7psd03OusVfzvJfGHWj1ajm3Muz9x8p7Jp00hoMU=
 base64:4yut09GQ2+r4XXEpTSsXR9nhw6W9mT+bTrvkoo5k3pc=
 base64:4yuvgSTJQO/bWaj7SsydG8mKzIcj5BjGQKVAQG/+GGQ=
 base64:5/vciR3UF9RgO2OKOHSR9Hs3V9kBLjtjzMo9dYYSXhc=
@@ -108,8 +113,9 @@ base64:5uLmjtlC2vp+MgH87G49R7mQ5KvooTQr+s7GdprWAkA=
 base64:5uMTdhlfg3IGY4I0uuCResaLGUEzea9bESkDkXj6tS8=
 base64:5VIvMYEXaRUdR1vHyDTAh28n4uqngzD6KN4eoEgtBUw=
 base64:5XNvZCMI6HPIy4yixRb9VYKFSwhudt2J78ck1oZIluM=
-base64:6++9XvT2dbO35wt0AJYGN52u854Q8Fj+s3Oshrtdf+4=
+base64:5YrPcBu4obulBkCzE3hUsNmzmYYZbgq32IHrIMMJAkM=
 base64:6/ml6L4UUsbHLER7RJsxUFV1l45s7OzCKHsmv1TuX5s=
+base64:6++9XvT2dbO35wt0AJYGN52u854Q8Fj+s3Oshrtdf+4=
 base64:60+6dygEqCWnHdYOfgTvmxDBab2dv2hd
 base64:60LJIcA08R89JLRe1byHzzWmCOgtYpn25lmChZcTX4U=
 base64:67F6U1jFu29lU5gaNO4XWYwsYRQECzKIlw8Xhn2G9f4=
@@ -135,11 +141,13 @@ base64:7F6zU1l4SVZVL6VmpUu46b4zCqyMkZFIGnNx6XDrpwo=
 base64:7Fjg4VnBR7Bl0iyLHz+1I7y9lr20GWJ0iqfjdHxe+mA=
 base64:7Lg2UB1oA1mmvYOyQYsLhF94QWvieMjt4QlNqmiI
 base64:7llC+cQGJ7fS58iPY+BRGC2NCGcCmZaqOIcGAfgp1kI=
+base64:7m+G7vyCnj1nx8emioA0yW2wpqm/F9aZpvAWEdHl5Kw=
 base64:7mbiJ7+YWK7SgZ9d1H9OgkfHEnnowGErn+IJQEO7ocU=
 base64:7n2cYSYBxJo0ovtr6AIyk5eytwlewTsruznMdu4IJaI=
 base64:7n4MG+3TgK4yipA6Vvu+aRU/2PQ5hggPWNseGnIXhYQ=
 base64:7QKM93laOIbjURJMsuqx4uW0CS5H6zzkyQJsss3nySQ=
 base64:7UBgNk65N9N5XKu8Jx7QZTxCdjdTIUhAzJvADSNSZ7Y=
+base64:7vl1ACgZxfy7zWbcLtjZ2TVIRsA4+zFUBts3xxR6a2s=
 base64:7YrxFkYUtnIZlusCVmLC8Oh+oLR8g6XKlYLC66p67ZI=
 base64:7zPNEjM9ClSiAlNh1aRFN2KD83Awn1rfMSJRaB+dTRA=
 base64:87Ijv8QF7DS5tfaZZtXl19lZYc/OE6+FJVMglKfhpcM=
@@ -156,7 +164,9 @@ base64:8uR9b5TW253zHOSXjUPQAfQvQp5ACKhwBH6M5Q1Go3g=
 base64:8uUUY6cysvZ/r+faYcCyhGjbFHy1/aJscQcBVLYQZk4=
 base64:8z0XXZqoBBb9GRcDbIPlZ/YcW29RHLEBv6T46/S/bWY=
 base64:91teBwphQMScpGl9n1EJ3i9/AsgqregHdAfjZRQTfzg=
+base64:98i1FzSlwI3Y5qQ3wafoyEJWKKktrjshOr+wnvGOd4c=
 base64:9cogxokq2Bj1qCRLG8AEkGjjbJXU9BI2uA/vtTUMFGQ=
+base64:9D74AySW2RLJ89uOze2ofGRyPD/lNlF8uM7fDJQCEHs=
 base64:9EB8D3F7ygNyZbTVIDcBIf34CoUfNslFwAylbas/g8w=
 base64:9fSl5OzNLcxZG2kjtrC8H9StlvuOuzklXYjl2DjbFc4=
 base64:9GBceVvJawucMcgm9USZTnbidF/mhyNKzwy1/mHu3RQ=
@@ -196,6 +206,7 @@ base64:AncvxPyxqpJlD87XriL0FsqzHisEXOsB03mvuE67IQs=
 base64:AnWeHWfGLkitEYnHTw43xuZ4qd/pSvKP0RV9dlFXyXg=
 base64:ao/1Djd0dv72O1kVrjX4ucVH4DimwqJfnMyzlALdLTI=
 base64:aQH6a/dWOf67PeU3MW1K/ynoLdxJkOov5WY6LrAsHlo=
+base64:aQRqql6aWPXNnPl5UdczcRGTTDrubfifa6mqLXpAfgw=
 base64:ATM10q5JXcL37xckWACJ7xEIImqAeIRaJR0nRR6RT2A=
 base64:Aup6zYzXyt2K8D7zDXqS4ltLqw1DnIH1Lw8AeEkhWfY=
 base64:aVD9kJ+dZvCiF2uiMMTLl/3aiOqdyObsquvUvfshhFA=
@@ -248,8 +259,10 @@ base64:Ctm7ecWQR5tquhaoNy0aZ1z9fRXRsCWXeRwGfDA3li0=
 base64:CUwcJ8WPal9M3lgUjqV6WZG44UZhK04eJItYdBPVsho=
 base64:CWOF9XCcUkm9/xzhHa3w+FToqje/FVfbJdhdxs1SF/Q=
 base64:CX9KtRoaCEMWeKkSk6IhH14HKDT6yo8EuA8SekrI/U4=
+base64:cyRuHSQ4PEjwiS63ozVqdoj7uQmlbPTcgskUxvKrgqE=
 base64:cZapUtHxWz8kJI0cYkhMI9o8XJSFFGuX9ZtSRffGyR4=
 base64:d1OqYSX7xBMd/thqoLFK4/wQ2iRC0UWXWshrJSbWI7k=
+base64:d96Q67bcisr2+mow9I0WTHrLDcTRoAjszN7Z5YKEE/8=
 base64:dadz+aCeCiPvmzghdds+ob40lmHHqXV8g446QhSLu7k=
 base64:DC7wRRcmBY6OYx30+gylX/+jG6o/VTDMvWfKvbHrP0s=
 base64:del2di75oTOJ50raX00YTJ5UBCzZBWtmnXednDnzdqQ=
@@ -274,6 +287,7 @@ base64:E7cSacuN9DWWUc+zI7Og7YrvD2XwAt9WSw4YMQzah1c=
 base64:E8bcBtXb4bvGFcbOrle2O7nt+d5ETRs67n7mhaLTNPg=
 base64:e9YMLuQLZAZ1S73KnliPMmwcR9uos0KOwG4c9lZTwZM=
 base64:ec2Cw6WQfuaut4IxUrWL0JYGNxqnD5zAsXYKHbCLPnM=
+base64:ecTVlYPtHv05xacO1GZhcqmXVsnO2XRwIjp9l8MnCwI=
 base64:eeD988Sm1GSinj5zkHiqUXsXcMD2eo4Noqowfr9p3DE=
 base64:eftWZbNMrXoZe0vz1Wibap32jW3qDpUSsycgspS2EnU=
 base64:EglxUtygy2OhkAX1YsS8MsMEDzNQsJa5cJ9mjtiSiwk=
@@ -286,6 +300,7 @@ base64:ePteyZr1Cf2eSsIyXhvImo62ir5GtWKSIOxVQoNgjpE=
 base64:erCz9UkoU7rFGTNReb+GkWCGmhyn2Dlbg8rZLnbLfCA=
 base64:eY8+oYc5zrlEyU/3KsSWeJk0mf7Z4oNEm1fxNQjTSbY=
 base64:eZMEwmBRSOY5gUkDeARf3EvkeHu2oJKJu1R2UcYQ/go=
+base64:f/YSunQ1hRBmFNTYOCVFg0VCKW2pZvNBPirqQ3x1xNc=
 base64:F0KzKT+u97hkQ8S1BENcREmHjJ71wjrZUOkiW6SB0Gk=
 base64:F0Ww+bxXeWvG4ErWbpqSM40are1mBjRaB/H8G6dA8KA=
 base64:f5LrwnPzdEXl2mJYzEsp2nHSYUU7krkfINKzO5ZuIBc=
@@ -363,6 +378,7 @@ base64:h7hzIY1l7zQ38eOSKa3XxNp9PIvzrwwlMzn7jnCAqEw=
 base64:Hc0VUHCGKq3B7poHbkD/c658q3jR0CQjtS3q/eosvDM=
 base64:hcd7LG5XWs+r30DggGLIesbPjaqGHq9ng7mGN557T2U=
 base64:HDFXsjF5AVPOwuSNIva5kg8llvsevzd9PYOpG6Yfhpo=
+base64:HdS3j1UJe2BQde1DxUbFPTVF5SGMm9FSjHhpDt6ujTo=
 base64:HG4+m9jTf6xlVLhTpi2UhTNKCowdahrt8rfccihv
 base64:hgMrLmXy4kpV4wUnAkkbs1w7caiPipKs3EG+2jTDh2s=
 base64:HGT19Mfm6j77W2N6K3GXqJqqNgUromHg41lRFHesEJc=
@@ -391,6 +407,7 @@ base64:iA9/zEmqK2ySEibgGJFc1xoKoQPGWpU8j3GdDIYIqlI=
 base64:IAxP4IGbQOYZiOOK6PI8naPtb41KEZijUywWZIIMqjc=
 base64:IB8eJbI9VUxmpEWRe3UWDBgxqkTWagkRQh6ReMwnmSM=
 base64:iClDY+duwZa72aoE/ObAYFqGwRbV4cAyKvsffTOWb8c=
+base64:icTi/sxVmvHJkPflNyyKoLkQWAbmlZQDNidjffjGmlI=
 base64:IdDlpLmYyWA9z4Ruj5st1FSYrhCR7lPOscLGCz2Jf4I=
 base64:IdGwtYxQExgt+TaXvitCNAmNeVoowt0Bsd0y1Ru5m50=
 base64:IfMsCgGwgCUDsxLQvFihcYVB7Uel3YWe5J0EEdqkf8g=
@@ -407,6 +424,7 @@ base64:iMO0ExvW1uuTJgnAkownIko9OaTbwGWl5nnPTOhcxec=
 base64:In8bso+Tfs+gUUSaCtZpSJs4o2fQPSw2Q7OLx9Rc3n0=
 base64:iN9gNbccVffo9TjSA0YuuyeWKVH+FeNTmPPqeA/8PWk=
 base64:iNEI8FiHSP/zm5ISVlml8Nf+E924Zp2no5lzP/DWFqo=
+base64:INVALID
 base64:IPL8y+brq2psDGAd7znr8rU6NmLAtCpnkT5Kh0DR82g=
 base64:ipvsN3GKn1Se+QWfbA86ZrVBAvRvRSQgq5vlVqWSDMI=
 base64:IrvaDrgBHezmt/JfxeZZIf7+HvJTl40lCXZXwfCi0N4=
@@ -517,6 +535,7 @@ base64:lVrRVLVTfFO8CHvZvedVHnZ21sGUhqO5jnCj0TtMRtc=
 base64:lZJyDj1tQ0fcYCheHwBm7UqXl4oNJrJyHgpm5dGKuPA=
 base64:M+fgn8t/WZf2nx1pRoAI6Il6F/s1zJDTg2Siq/P6yI0=
 base64:m01VwGwCcwKocDsWyJ2PpEy1lBnKq1hvNuZNtmpoeAY=
+base64:m0fxndX379uMv61oM5kyePZqaBMFe7JvCTywnkwbe+A=
 base64:M0r3Ha/4VkLvQztXmWsvk9FINXBr8kVeVq17lx0SXVc=
 base64:m50/rvsDU4f+E0PEcPcm69t+0CCEkNPCYPblrf/dP4k=
 base64:M5rIAOPDDprYiZ59yms8zW9qeYyL9+N8RwMRTHobwz8=
@@ -539,6 +558,7 @@ base64:MknQCbr1YwZRWyI5dbe6r48gTkrxQE/bwqEzgVkO5s8=
 base64:MKUlaO9Ki+k13O+Rj2qHZhbRMJBT8JrWuSrSyijH6m4=
 base64:Mm3+1mbz89XLkMZQu595B7VHXvTJA5dkkp3ZaTToc58=
 base64:mneztAePqDIxZRR6phyEmX8QcZI3FNk5Kip9+u4ePLI=
+base64:MpcvOjqGOqF2EQWynK1VSDOAJM7AtGFhu62TSAGpcSw=
 base64:mrbYgRdSzkUlGSb/kadVM4kgmtCw4f0bhAvjHDedEy0=
 base64:mrgPzJEAoEPNaM2J6j4h5D8XCbSo7YpfifRwhDOXnBE=
 base64:mskdvikF91Lz7F1xp2MItkxLAuj7Y2zdYfOBj1Uel+o=
@@ -608,6 +628,7 @@ base64:pbcRYqzZvrh5ibJO4vWu8TWZ1PuBdJb5ZN5Dyuyd4Bg=
 base64:pdFRDSmSuigoy3BiyCCp6rj3RUVxE9bXfTKeO3WM7O8=
 base64:PGRap+Cn11couIxZAF03fMaGxSmOMWyi6HLLL+K7neI=
 base64:PgRq6c7nezHMR5K9PB3hR8ceTDzkxD19733fbzD7uKk=
+base64:pGwNRHBYg+/GuUZ6N9GSfb+cFrCED+0t0yjl+E7OI0g=
 base64:pHA74AODncjDvqAUeQNhMqh5rEyYivTZP2i0VY4EW5I=
 base64:PHBfgngQoOlPv203o1AZqyeqNYL4EXhxKZqNgEVLA54=
 base64:PJGLH/WytRcP+hSQJgSKCv/rFNS3HVheUU5aTm/hoWQ=
@@ -636,6 +657,7 @@ base64:qCdRwQ4lM0ajvQWUv6qNarGcyUiw8zxmHPMLpv8GU2Y=
 base64:qEVMM82S+VkvIjvIxO/fFECHxyZOjchvQqrT/zA8/po=
 base64:QFIlbXa1UjSO9oR0jUXeVPrLJsB4PYkab1mmi+SJOLA=
 base64:qfTHCI2GJpPQc06Cve+ytXSCRMXu6Wj/ZXm21Wc61EA=
+base64:qHr09R0bEm/pFwlRvFMfvka+jWXwmGN693ueNMoFgzc=
 base64:Qkl8TUh4zhf9ZF110E3EcMg5LhJKWqp6W4/7e/AA03Y=
 base64:qLwyFbsu0eMKV7u+NofhfgOhslVlrWDfgMCi4TNyp5Q=
 base64:QOz1K6l4udI9PKPZIEFYyRv7mIS9XadFH0omcptXW8E=
@@ -670,12 +692,14 @@ base64:RJXd3aXvduowbZg98AcfnHmd0CTrCRf869edwFyBZZM=
 base64:RK7W5ernW3hypjD1qKcgaUG29NkreHy7WagdONpxvUM=
 base64:Rot1GA0vPhQglKPoiHa+z6QFv6OMo25sN/UIULJZKSs=
 base64:rqmUBaPQcU328ZN96BrrGwXvSPjNyr8LxQRapSRRKy0=
+base64:RR++yx2rJ9kdxbdh3+AmbHLDQu+Q76i++co9Y8ybbno=
 base64:RS5qESNbvwpYJO9akWf1APqjJv43EpeuY+PBjxkGZLU=
 base64:rSgGSW9WFVlgaV8U6gGz2PQed3e2EfjQRLgHzP78sVA=
 base64:rStQqLzIFBjKtsxn526tDLQqNZCpELAgjz8U0NnPFkc=
 base64:rvFZAdijuOB3q6BmVmZ5XoJSlX57UmmpcvmuIoOf/oA=
 base64:RVQgNW0UecWpfrzuX0KKMjIgxYjONf0X2qdD6sr++KI=
 base64:S24F5flCaVF7VAzfamro3Kqm9mb9boeU4H9aXl22KHI=
+base64:S2NVQv9IxQvBqtHoTaYtdPb7EGt+4DN20oVp9vwd9kQ=
 base64:S2Y1bDZHaEZBdmNOV1VlandUbjNJOVJsaDBQNDV6emU=
 base64:s3F01KNrdYp7CVFeqhGVPJzoY9K1516eHb1y6nBjV8k=
 base64:s3LcgGeF/Gd49vO5Jq8TbOuBrUtBbAl+ulc3gbeB5mc=
@@ -686,6 +710,7 @@ base64:s9OoQAgjmQ6YmhOCYeBG50VfHe0a89nBvPHJd4qgnD0=
 base64:SCdhAqTtqYsiKvHSHD80zfit1nYn7U84+rfL9MDc8To=
 base64:sci4EjvwaZroPEsHbxmI6EqQ7sHODjSy5TRlfXj4Gx8=
 base64:SewjCpfUYYstuwKs09prsZXaGrvcPVQnn5QQpSCkqY4=
+base64:SFTS6WWGj1iqMfkYK9LaMwTsG0rfqVlwzH5wNp1s+/o=
 base64:SGJITnJXZ1NNSXlEVWRwU29BVHRodGhwOXhxREV3OEk=
 base64:SHy+rpI6zLpOq+GofMpKYHx8L9Gd3FW5A+7WpwF5MoM=
 base64:siU5u+dQQzNZSjg8E+FQzQuxb9PunU8l7HAB96HVhio=
@@ -732,11 +757,13 @@ base64:tvpEqAYAyWqTG/kh4vdkUeY8+JVLPGvZqTx3eNmU45U=
 base64:TVX4Zm4Ccx5Qxzcc+SPX0NtmMONaHTCHOXAvQ4SVk7E=
 base64:TWrybYY8BDKuRFnC85czc0dBSrUc/K+vmZV75pZwHSw=
 base64:tzIJe+FKENnMsPmSp+Iuf4ktwueeBCGDJoXHVwG75XY=
+base64:u//vIpsiKxrbkYoGY7ZVV+n7VjObO/QeofukQLD4OJI=
 base64:U+v0+vHAwrchxrhk
 base64:u07w3fIEiBnOwMIPV+q9Z7KlQusI4B3dqE0XcNCmdEE=
 base64:u4CzZUFTwd/U2FLsf5KE55tlsSIcOla2+H5m/wlaXvM=
 base64:u9+bCGM4fH4nVKTVeSvtg1OvfnvBU1IBbppBTiepnIg=
 base64:U9lXDXOaM6r0jy0cDo/4mZ+VNhm9X2XqMfPv3Rh2yfU=
+base64:UbAcJDlmYHjI3i2Dr+6/ogFa+j/MU5uOCy7b8gpWL70=
 base64:UbsnQQ0KSMOg3CTOBb+Fd/8GNkaaPKaZMFWBzrTK/v4=
 base64:UCfgTCY1PYHCii+kT6F6V088hZCxNnSIa7uGJmS6zHs=
 base64:UdAH2B63rlotjrkSSsj3Hppy4gbfr+OeHvtSdF9r9q8=
@@ -756,6 +783,7 @@ base64:usWIs2TR5YbilKBw3AYHRffsLWhnIMc6zI7ehImi5Oo=
 base64:UYTiyq0ttRIAJhc5MxXif2CyCBO1uBPoZOr9M9Gasqo=
 base64:uz3Q
 base64:V19oaHyTnH+qiak1hsn96VeNqAc2CUYuiW+twZ2D8dc=
+base64:V2r76Ak/Q5Vr9uMwmbKhDmAeiejZuFaQ4w7qkJpYzig=
 base64:V8K2dcGH2cEkeYfmmTNDJJu0z6nAupnbMg93QNyHjTI=
 base64:VA2CKnoO2HiKUAp7Qh3W
 base64:VBLjdBJyRsXzlYpXkaHEPHliE9Ny1iZauzdAv8k2bY8=
@@ -791,6 +819,7 @@ base64:wBUOB+QR0BlmF0+BRAvL3czJFvKThPYEH8v0R1dW2rs=
 base64:wbvPP9pBOwifnwu84BeKAVzmwM4TLvcVFowLcPAi6nA=
 base64:Wea1JQnkL9W25wyk1ne1IDaAxQQg1ykrU5CDa4M7KYI=
 base64:weJMCPc0SVAurD1YEeN7AmGoUuIH2P4qpbgv2zE1sUQ=
+base64:Wg214XomSL4anMxQUS8tj00IvDsouRT2K4Qh46s+J2Y=
 base64:WgjYR4JhhJyZXccYSL3a3MQbnFhw4D5qYD5cVmxISeI=
 base64:WIreMr8bdQG20oCGRCtE8RiCPzxCybh59TfM9miuONw=
 base64:wj6alGJV4kVTflyJDal7bKXV8KP33ujwKIfxgT9wItc=
@@ -800,6 +829,7 @@ base64:wmFPdUEYRor6BOqeOV8St3izpT1q45XEo4nca10owfY=
 base64:WMZF
 base64:WOMdUgrl1tQbkvVpzPb1Q0ljL80RmIqaEYYKvMFBbUE=
 base64:wPxUu+0xqLKVgHGIOTH3QFszbVoIOEk56AyYqMkojyE=
+base64:WrvqXJ+ilWOLItqI7C2N2R2dQkqFAHFYzTrQBBJqtso=
 base64:wSTPSBb4zJrTELf1ePIEbE8Rfqv4XavL3mwmRbHu1S4=
 base64:wuBmi0uX5zPeIkMwyoUn7QBORKeX3gwQ9RbBxfxR2OM=
 base64:wUwZG4vZdCjvB761
@@ -841,6 +871,7 @@ base64:Y/pIYdHIMEtHhHnpqxYFRwZfeQ+B3Hhqq3o8FtcOBcQ=
 base64:Y04cTMFcJyNbvgXuNtCXub7Z8ecnaiRv1NQbyBm89TM=
 base64:Y25hYjBwdUQyMmZiWUpjNmdobnppZ2RqVE1FS3Fzb0E=
 base64:y3ygdJrY4D37
+base64:y85WANvG07lPo7qd8iPCy9JZ3lJVmiIBRe8nOJPYwMA=
 base64:Y9Cjj6pXzmc0t1GZVs6r1VTgmmj33zbXRwOGjaC6mIE=
 base64:yajb5FrXIQdZ3EEd97Dl+tkq+8pZvicl1O5n1fZfBfY=
 base64:YAPyaz0pI4oEqkKJ2OLF1hgjnHOHdtL6UPvTOqY98EQ=
@@ -895,4 +926,4 @@ base64:ZWfU+Gk9o4rPtR+Rt5mj9w+ofNw2mph2m7cXJYX66hE=
 base64:zyEIj1bVmUA8C4I6vD9ONNMip1agnM44Wj1tvIU2TAs=
 base64:ZyEuU+2o2A06YbOyXKMZ0kTQdQULRA+aulH4Eauk46Y=
 base64:ZZpswQHzzpNo6VMWgp+H+dZ7U2hwgVfO9mxaxbAWB3Y=
-base64:Zzq7/JJ57XhzyQ04OPhdBwLD+POCDcLgQinjUtmY9VQ=
+base64:Zzq7/JJ57XhzyQ04OPhdBwLD+POCDcLgQinjUtmY9VQ=